@decentnetwork/beagle 0.1.121 → 0.1.123

package/dist/carrier-node.d.ts

@@ -97,6 +97,15 @@ export declare class CarrierNode extends EventEmitter {
         force?: boolean;
     }): Promise<void>;
     acceptFriendRequest(pubkey: string): Promise<void>;
+    /** The SDK's pending inbound requests (empty before create or on an SDK
+     *  without the call). Re-read when answering friends-pending: a late
+     *  profile patches the SDK's entry without firing a new event. */
+    pendingFriendRequests(): Array<{
+        pubkey: string;
+        userid?: string;
+        punkId?: number;
+        avatarUrl?: string;
+    }>;
     removeFriend(userid: string): boolean;
     /** Decline an inbound request and clear what it created in the SDK. */
     rejectFriendRequest(pubkey: string): void;

package/dist/carrier-node.js

@@ -186,6 +186,13 @@ export class CarrierNode extends EventEmitter {
     acceptFriendRequest(pubkey) {
         return this.#require().acceptFriendRequest(pubkey);
     }
+    /** The SDK's pending inbound requests (empty before create or on an SDK
+     *  without the call). Re-read when answering friends-pending: a late
+     *  profile patches the SDK's entry without firing a new event. */
+    pendingFriendRequests() {
+        const list = this.#peer?.pendingFriendRequests?.();
+        return Array.isArray(list) ? list : [];
+    }
     removeFriend(userid) {
         return this.#require().removeFriend(userid);
     }

package/dist/chat-components.d.ts

@@ -0,0 +1,67 @@
+/** Custom packet id for the components channel.
+ *
+ *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
+ *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
+ *  first free slot. Clients that don't implement this id never see the packet,
+ *  which is exactly the backward-compatibility story we want. */
+export declare const PACKET_ID_CHAT_COMPONENTS = 165;
+/** Payload version. Receivers ignore payloads they don't know how to read
+ *  rather than best-effort parsing a future shape. */
+export declare const COMPONENTS_WIRE_VERSION = 1;
+export declare const MAX_COMPONENTS = 12;
+export declare const MAX_OPTIONS = 40;
+export declare const MAX_LABEL_LEN = 120;
+export declare const MAX_ID_LEN = 64;
+export declare const MAX_VALUE_LEN = 512;
+export declare const MAX_CUSTOM_ID_LEN = 128;
+/** Hard ceiling on a decoded payload before we even try to parse it. */
+export declare const MAX_PAYLOAD_BYTES: number;
+export type ComponentType = "select" | "submit" | "text" | "button" | "attachment";
+export interface SelectOption {
+    label: string;
+    value: string;
+}
+export interface ChatComponent {
+    type: ComponentType;
+    id: string;
+    label?: string;
+    required?: boolean;
+    default?: string;
+    placeholder?: string;
+    options?: SelectOption[];
+}
+export interface ComponentsMessage {
+    v: number;
+    type: "components";
+    /** Chosen by the agent; echoed back so it can route the reply. */
+    custom_id: string;
+    components: ChatComponent[];
+}
+export interface InteractionMessage {
+    v: number;
+    type: "interaction";
+    custom_id: string;
+    /** id of the submit/button that fired. */
+    component: string;
+    values: Record<string, string | {
+        fileId: string;
+        name: string;
+        size: number;
+    }>;
+}
+/**
+ * Validate a remote components payload. Returns null when nothing renderable
+ * survives — the caller then shows only the text message, which is the correct
+ * degraded state, never an error.
+ */
+export declare function parseComponentsMessage(raw: unknown): ComponentsMessage | null;
+/** Build the interaction reply. Values are the user's own input, but they are
+ *  bounded here too so a pathological local state can't emit an oversized
+ *  packet at the peer. */
+export declare function buildInteraction(customId: string, component: string, values: Record<string, string>): InteractionMessage;
+/** Decode a received packet. Returns null for anything malformed or oversized —
+ *  a peer must not be able to make us throw on the receive path. */
+export declare function decodePacket(data: Uint8Array): ComponentsMessage | InteractionMessage | null;
+/** Validate an inbound interaction (the agent side of the channel). */
+export declare function parseInteractionMessage(raw: unknown): InteractionMessage | null;
+export declare function encodePacket(msg: ComponentsMessage | InteractionMessage): Uint8Array;

package/dist/chat-components.js

@@ -0,0 +1,208 @@
+// Brief 30 — interactive components in chat.
+//
+// An agent declares a form as DATA; this client renders it with its own trusted
+// widgets. No HTML crosses the wire, no URL is fetched, no script runs. The UI's
+// escape-everything policy (dkHtmlEscape) is untouched — components are a
+// separate, whitelisted channel, not an escape hatch from it.
+//
+// Wire shape: a sibling packet, not a field on the chat message. Answering the
+// brief's first open question that way makes "old clients still see the
+// message" a property of the protocol rather than a rule senders must remember:
+// the human-readable text goes out as an ordinary chat message that every
+// existing client already renders, and the component payload rides a custom
+// packet id that any client not built for it never even receives.
+//
+// EVERY value here arrives from a remote peer. The validator is the trust
+// boundary: it whitelists types, caps every count and length, and drops what it
+// does not understand instead of guessing.
+/** Custom packet id for the components channel.
+ *
+ *  160-191 is toxcore's LOSSLESS range — a form must not be silently dropped.
+ *  decentlan owns 161 (session), 162 (dora), 163 (IP), 164 (rate); 165 is the
+ *  first free slot. Clients that don't implement this id never see the packet,
+ *  which is exactly the backward-compatibility story we want. */
+export const PACKET_ID_CHAT_COMPONENTS = 165;
+/** Payload version. Receivers ignore payloads they don't know how to read
+ *  rather than best-effort parsing a future shape. */
+export const COMPONENTS_WIRE_VERSION = 1;
+// --- caps -------------------------------------------------------------------
+// "The client caps sizes/counts itself — a peer must not be able to freeze
+// another peer's UI." (Brief 30, Security). These are deliberately small: a
+// legitimate form is a handful of fields, and anything larger is either a bug
+// or an attempt to hang the renderer.
+export const MAX_COMPONENTS = 12;
+export const MAX_OPTIONS = 40;
+export const MAX_LABEL_LEN = 120;
+export const MAX_ID_LEN = 64;
+export const MAX_VALUE_LEN = 512;
+export const MAX_CUSTOM_ID_LEN = 128;
+/** Hard ceiling on a decoded payload before we even try to parse it. */
+export const MAX_PAYLOAD_BYTES = 64 * 1024;
+/** Types this build actually renders. Anything else is dropped — forward
+ *  compatibility per the brief: an older client must ignore, not break. */
+const RENDERABLE = new Set(["select", "submit", "text"]);
+const str = (v, max) => {
+    if (typeof v !== "string")
+        return undefined;
+    const s = v.trim();
+    if (!s || s.length > max)
+        return undefined;
+    return s;
+};
+/**
+ * Validate a remote components payload. Returns null when nothing renderable
+ * survives — the caller then shows only the text message, which is the correct
+ * degraded state, never an error.
+ */
+export function parseComponentsMessage(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const o = raw;
+    if (o.type !== "components")
+        return null;
+    if (o.v !== COMPONENTS_WIRE_VERSION)
+        return null;
+    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
+    if (!customId)
+        return null;
+    if (!Array.isArray(o.components))
+        return null;
+    const seen = new Set();
+    const out = [];
+    for (const entry of o.components.slice(0, MAX_COMPONENTS)) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const c = entry;
+        const type = typeof c.type === "string" ? c.type : "";
+        if (!RENDERABLE.has(type))
+            continue; // unknown/unsupported: drop, don't guess
+        const id = str(c.id, MAX_ID_LEN);
+        if (!id || seen.has(id))
+            continue; // duplicate ids would alias each other's values
+        seen.add(id);
+        const component = { type: type, id };
+        const label = str(c.label, MAX_LABEL_LEN);
+        if (label)
+            component.label = label;
+        if (c.required === true)
+            component.required = true;
+        const placeholder = str(c.placeholder, MAX_LABEL_LEN);
+        if (placeholder)
+            component.placeholder = placeholder;
+        if (type === "select") {
+            if (!Array.isArray(c.options))
+                continue; // a select with no options is unusable
+            const options = [];
+            const seenValues = new Set();
+            for (const raw of c.options.slice(0, MAX_OPTIONS)) {
+                if (!raw || typeof raw !== "object")
+                    continue;
+                const opt = raw;
+                const value = str(opt.value, MAX_VALUE_LEN);
+                if (!value || seenValues.has(value))
+                    continue;
+                seenValues.add(value);
+                options.push({ label: str(opt.label, MAX_LABEL_LEN) ?? value, value });
+            }
+            if (!options.length)
+                continue;
+            component.options = options;
+            // A default that isn't one of the options would submit a value the agent
+            // never offered; ignore it rather than pass it through.
+            const def = str(c.default, MAX_VALUE_LEN);
+            if (def && options.some((o2) => o2.value === def))
+                component.default = def;
+        }
+        if (type === "text") {
+            const def = str(c.default, MAX_VALUE_LEN);
+            if (def)
+                component.default = def;
+        }
+        out.push(component);
+    }
+    // A form with no way to submit can never be completed — treat it as noise.
+    if (!out.some((c) => c.type === "submit"))
+        return null;
+    // ...and a submit button with nothing to fill in is equally pointless.
+    if (!out.some((c) => c.type === "select" || c.type === "text"))
+        return null;
+    return { v: COMPONENTS_WIRE_VERSION, type: "components", custom_id: customId, components: out };
+}
+/** Build the interaction reply. Values are the user's own input, but they are
+ *  bounded here too so a pathological local state can't emit an oversized
+ *  packet at the peer. */
+export function buildInteraction(customId, component, values) {
+    const clean = {};
+    for (const [k, v] of Object.entries(values)) {
+        const key = str(k, MAX_ID_LEN);
+        if (!key)
+            continue;
+        clean[key] = typeof v === "string" ? v.slice(0, MAX_VALUE_LEN) : "";
+    }
+    return {
+        v: COMPONENTS_WIRE_VERSION,
+        type: "interaction",
+        custom_id: customId.slice(0, MAX_CUSTOM_ID_LEN),
+        component: component.slice(0, MAX_ID_LEN),
+        values: clean,
+    };
+}
+/** Decode a received packet. Returns null for anything malformed or oversized —
+ *  a peer must not be able to make us throw on the receive path. */
+export function decodePacket(data) {
+    if (!data?.length || data.length > MAX_PAYLOAD_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(data).toString("utf-8"));
+    }
+    catch {
+        return null;
+    }
+    const o = parsed;
+    if (!o || typeof o !== "object")
+        return null;
+    if (o.type === "components")
+        return parseComponentsMessage(o);
+    if (o.type === "interaction")
+        return parseInteractionMessage(o);
+    return null;
+}
+/** Validate an inbound interaction (the agent side of the channel). */
+export function parseInteractionMessage(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const o = raw;
+    if (o.type !== "interaction" || o.v !== COMPONENTS_WIRE_VERSION)
+        return null;
+    const customId = str(o.custom_id, MAX_CUSTOM_ID_LEN);
+    const component = str(o.component, MAX_ID_LEN);
+    if (!customId || !component)
+        return null;
+    const values = {};
+    if (o.values && typeof o.values === "object") {
+        for (const [k, v] of Object.entries(o.values).slice(0, MAX_COMPONENTS)) {
+            const key = str(k, MAX_ID_LEN);
+            if (!key)
+                continue;
+            if (typeof v === "string") {
+                values[key] = v.slice(0, MAX_VALUE_LEN);
+                continue;
+            }
+            // File values are {fileId, name, size} — fileId is the content sha256,
+            // which is what makes the reference exact (Brief 30 §3).
+            if (v && typeof v === "object") {
+                const f = v;
+                const fileId = str(f.fileId, 128);
+                const name = str(f.name, MAX_LABEL_LEN);
+                const size = typeof f.size === "number" && Number.isFinite(f.size) ? f.size : undefined;
+                if (fileId && name && size !== undefined)
+                    values[key] = { fileId, name, size };
+            }
+        }
+    }
+    return { v: COMPONENTS_WIRE_VERSION, type: "interaction", custom_id: customId, component, values };
+}
+export function encodePacket(msg) {
+    return new Uint8Array(Buffer.from(JSON.stringify(msg), "utf-8"));
+}

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.121";
+window.__DK_UI_VERSION="0.1.123";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js
@@ -1697,6 +1697,26 @@ ${lines}`, { assistant: { kind: "adopt", rows: fresh } }));
     }, [append, lang, onReloadFriends]);
     return { thread, handle, removeFriends, adoptServicePeers };
   }
+  var MAX_URL = 2048;
+  function requestAvatarUrl(r) {
+    const u = r && r.avatarUrl;
+    if (typeof u !== "string" || !u || u.length > MAX_URL)
+      return null;
+    return /^https:\/\/[^\s"'<>]+$/i.test(u) ? u : null;
+  }
+  function requestPunkId(r) {
+    const p = r && r.punkId;
+    return typeof p === "number" && Number.isInteger(p) && p >= 0 ? p : null;
+  }
+  function requestAvatarSource(r, skipUrl = false) {
+    const url = skipUrl ? null : requestAvatarUrl(r);
+    if (url)
+      return { kind: "url", url };
+    const id = requestPunkId(r);
+    if (id != null)
+      return { kind: "punk", id };
+    return { kind: "ens" };
+  }
   var DK_CMD_HIST_KEY = "beagle.assistant.history";
   var DK_CMD_HIST_MAX = 50;
   function RequestsBlock({ T, requests, onAct }) {
@@ -1740,7 +1760,7 @@ ${lines}`, { assistant: { kind: "adopt", rows: fresh } }));
       display: "flex",
       flexDirection: "column",
       gap: 8
-    } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement(DkEnsAvatar, { userid: r.userid || r.id, name: r.name, fallbackSeed: r.carrier, size: 30, radius: 7 }), /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0, flex: 1 } }, r.name ? /* @__PURE__ */ React.createElement("div", { style: {
+    } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement(DkRequestAvatar, { r, size: 30, radius: 7 }), /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0, flex: 1 } }, r.name ? /* @__PURE__ */ React.createElement("div", { style: {
       fontFamily: "var(--ui)",
       fontSize: 13,
       fontWeight: 600,
@@ -1757,6 +1777,32 @@ ${lines}`, { assistant: { kind: "adopt", rows: fresh } }));
       paddingLeft: 8
     } }, r.descr), failed[r.id] && /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--ui)", fontSize: 11, color: "var(--danger)" } }, failed[r.id]), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", gap: 6 } }, /* @__PURE__ */ React.createElement(Btn, { tone: "ok", icon: "check", size: "sm", onClick: () => act(r, "accept"), style: { flex: 1 } }, T.accept), /* @__PURE__ */ React.createElement(Btn, { tone: "danger", icon: "x", size: "sm", onClick: () => act(r, "reject"), style: { flex: 1 } }, T.reject))))));
   }
+  function DkRequestAvatar({ r, size, radius }) {
+    const [urlBroken, setUrlBroken] = React.useState(false);
+    const url = requestAvatarUrl(r);
+    React.useEffect(() => {
+      setUrlBroken(false);
+    }, [url]);
+    const src = requestAvatarSource(r, urlBroken);
+    const seed = r.carrier || r.userid || r.id;
+    if (src.kind === "url") {
+      return /* @__PURE__ */ React.createElement(
+        "img",
+        {
+          src: src.url,
+          alt: "",
+          width: size,
+          height: size,
+          referrerPolicy: "no-referrer",
+          onError: () => setUrlBroken(true),
+          style: { width: size, height: size, borderRadius: radius, objectFit: "cover", flexShrink: 0, background: "var(--panel-2)" }
+        }
+      );
+    }
+    if (src.kind === "punk")
+      return /* @__PURE__ */ React.createElement(DkPunkAvatar, { id: src.id, size, radius, fallbackSeed: seed });
+    return /* @__PURE__ */ React.createElement(DkEnsAvatar, { userid: r.userid || r.id, name: r.name, fallbackSeed: r.carrier, size, radius });
+  }
   function PeerRow({ peer, T, active, onClick, muted, isProtocol, fix }) {
     const name = peer.alias || peer.userId;
     const row = rosterRow(peer, isProtocol || (() => false), fix);

package/dist/desktop/vendor/peer-webrtc.js

@@ -57,6 +57,8 @@ var PeerWebRTC = (() => {
     fitSignalForInvite: () => fitSignalForInvite,
     looksLikeSignal: () => looksLikeSignal,
     mediaDirection: () => mediaDirection,
+    orphanPayloadTypeLines: () => orphanPayloadTypeLines,
+    sanitizeSdp: () => sanitizeSdp,
     shrinkSdpForInvite: () => shrinkSdpForInvite,
     videoIsSending: () => videoIsSending
   });
@@ -198,6 +200,29 @@ var PeerWebRTC = (() => {
     }
     return join(lines);
   }
+  function orphanPayloadTypeLines(sdp) {
+    const out = [];
+    let pts;
+    for (const line of sdp.replace(/\r\n/g, "\n").split("\n")) {
+      if (line.startsWith("m=")) {
+        pts = new Set(line.split(" ").slice(3));
+        continue;
+      }
+      const m = pts && /^a=(?:rtpmap|rtcp-fb|fmtp):(\d+)\b/.exec(line);
+      if (m && !pts.has(m[1]))
+        out.push(line);
+    }
+    return out;
+  }
+  function sanitizeSdp(sdp) {
+    const orphans = orphanPayloadTypeLines(sdp);
+    if (orphans.length === 0)
+      return sdp;
+    const drop = new Set(orphans);
+    const crlf = sdp.includes("\r\n");
+    const kept = sdp.replace(/\r\n/g, "\n").split("\n").filter((l) => !drop.has(l));
+    return kept.join(crlf ? "\r\n" : "\n");
+  }
 
   // node_modules/@decentnetwork/peer-webrtc/dist/signal.js
   var SDP_TYPES = /* @__PURE__ */ new Set([
@@ -297,7 +322,7 @@ var PeerWebRTC = (() => {
   var ICE_RESTART_MAX = 3;
   var ICE_DISCONNECT_GRACE_MS = 4e3;
   var ICE_FAILED_GRACE_MS = 12e4;
-  var _opts, _iceServers, _sessions, _restartOffersEnabled, _setOutgoingVideoTrack, setOutgoingVideoTrack_fn, _renegotiate, renegotiate_fn, _createOffer, createOffer_fn, _createAnswer, createAnswer_fn, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn, _restartIce, restartIce_fn, _handleSignal, handleSignal_fn, _onOffer, onOffer_fn, _answerRenegotiation, answerRenegotiation_fn, _onAnswer, onAnswer_fn, _onCandidate, onCandidate_fn, _onBye, onBye_fn, _onAuxiliary, onAuxiliary_fn, _createSession, createSession_fn, _wirePeerConnection, wirePeerConnection_fn, _ensureRemoteStream, ensureRemoteStream_fn, _attachLocalMedia, attachLocalMedia_fn, _flushLocalCandidates, flushLocalCandidates_fn, _drainRemoteCandidates, drainRemoteCandidates_fn, _send, send_fn, _sendByeSafe, sendByeSafe_fn, _cleanup, cleanup_fn, _setState, setState_fn, _normId, normId_fn, _toInfo, _newCallId, newCallId_fn, _log, log_fn;
+  var _opts, _iceServers, _sessions, _restartOffersEnabled, _setOutgoingVideoTrack, setOutgoingVideoTrack_fn, _renegotiate, renegotiate_fn, _createOffer, createOffer_fn, _createAnswer, createAnswer_fn, _cleanOutbound, cleanOutbound_fn, _cleanInbound, cleanInbound_fn, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn, _restartIce, restartIce_fn, _handleSignal, handleSignal_fn, _onOffer, onOffer_fn, _answerRenegotiation, answerRenegotiation_fn, _negotiationFailed, negotiationFailed_fn, _onAnswer, onAnswer_fn, _onCandidate, onCandidate_fn, _onBye, onBye_fn, _onAuxiliary, onAuxiliary_fn, _createSession, createSession_fn, _wirePeerConnection, wirePeerConnection_fn, _ensureRemoteStream, ensureRemoteStream_fn, _attachLocalMedia, attachLocalMedia_fn, _flushLocalCandidates, flushLocalCandidates_fn, _drainRemoteCandidates, drainRemoteCandidates_fn, _send, send_fn, _sendByeSafe, sendByeSafe_fn, _cleanup, cleanup_fn, _setState, setState_fn, _normId, normId_fn, _toInfo, _newCallId, newCallId_fn, _log, log_fn;
   var CallEngine = class extends Emitter {
     constructor(opts) {
       var _a, _b;
@@ -309,10 +334,31 @@ var PeerWebRTC = (() => {
       /** Create + send a fresh offer to renegotiate media (e.g. after adding a
        *  screen-share track). The peer applies it via #onOffer's renegotiation path. */
       __privateAdd(this, _renegotiate);
-      /** createOffer with the lean codec set applied (see #preferLeanVideoCodecs). */
+      /** createOffer with the lean codec set applied (see #preferLeanVideoCodecs)
+       *  and the result sanitized (see #cleanOutbound). Every offer — initial,
+       *  screen-share re-offer, ICE restart — goes through here. */
       __privateAdd(this, _createOffer);
-      /** createAnswer with the lean codec set applied. */
+      /** createAnswer with the lean codec set applied and the result sanitized. */
       __privateAdd(this, _createAnswer);
+      /**
+       * Strip orphan codec lines from a description WE produced, before it is
+       * applied locally and before it is sent.
+       *
+       * Firefox's setCodecPreferences drops VP9/AV1 from the m=video line but
+       * leaves their `a=fmtp:` / `a=rtcp-fb:` lines in place; Chrome's parser then
+       * rejects the whole re-offer ("Failed to parse codecs correctly") and the
+       * Firefox peer's screen share never shows up. Measured 2026-10-31 between
+       * the Firefox extension and a Chrome desktop, both on 0.2.16. The sanitizer
+       * is a no-op on a clean description (Chrome, Safari), so the same object
+       * comes back untouched there.
+       */
+      __privateAdd(this, _cleanOutbound);
+      /**
+       * The same cleanup for a description the PEER sent, before setRemoteDescription:
+       * Firefox extensions already in the field (AMO 1.4.14 ships 0.2.16) still
+       * produce the orphan lines, and a receiver on this engine must accept them.
+       */
+      __privateAdd(this, _cleanInbound);
       /**
        * Restrict video to the codecs the peers actually negotiate, so the SDP fits
        * the 8192-byte Carrier invite channel. Chrome otherwise advertises VP9 and
@@ -335,6 +381,7 @@ var PeerWebRTC = (() => {
       __privateAdd(this, _onOffer);
       /** Apply a mid-call re-offer (renegotiation) and send the answer. */
       __privateAdd(this, _answerRenegotiation);
+      __privateAdd(this, _negotiationFailed);
       __privateAdd(this, _onAnswer);
       __privateAdd(this, _onCandidate);
       __privateAdd(this, _onBye);
@@ -450,7 +497,7 @@ var PeerWebRTC = (() => {
         throw new Error(`accept: no pending incoming call ${callId}`);
       }
       await __privateMethod(this, _attachLocalMedia, attachLocalMedia_fn).call(this, session);
-      await session.pc.setRemoteDescription({ type: "offer", sdp: session.pendingOffer });
+      await session.pc.setRemoteDescription({ type: "offer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, session.pendingOffer, "offer") });
       session.hasReceivedSdp = true;
       session.pendingOffer = void 0;
       await __privateMethod(this, _drainRemoteCandidates, drainRemoteCandidates_fn).call(this, session);
@@ -638,12 +685,30 @@ var PeerWebRTC = (() => {
   _createOffer = new WeakSet();
   createOffer_fn = async function(session, opts) {
     __privateMethod(this, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn).call(this, session.pc);
-    return session.pc.createOffer(opts);
+    return __privateMethod(this, _cleanOutbound, cleanOutbound_fn).call(this, await session.pc.createOffer(opts));
   };
   _createAnswer = new WeakSet();
   createAnswer_fn = async function(session) {
     __privateMethod(this, _preferLeanVideoCodecs, preferLeanVideoCodecs_fn).call(this, session.pc);
-    return session.pc.createAnswer();
+    return __privateMethod(this, _cleanOutbound, cleanOutbound_fn).call(this, await session.pc.createAnswer());
+  };
+  _cleanOutbound = new WeakSet();
+  cleanOutbound_fn = function(desc) {
+    var _a, _b;
+    const raw = (_a = desc.sdp) != null ? _a : "";
+    const sdp = sanitizeSdp(raw);
+    if (sdp === raw)
+      return desc;
+    __privateMethod(this, _log, log_fn).call(this, `${(_b = desc.type) != null ? _b : "sdp"}: removed ${orphanPayloadTypeLines(raw).length} orphan codec line(s) from our own description`);
+    return { type: desc.type, sdp };
+  };
+  _cleanInbound = new WeakSet();
+  cleanInbound_fn = function(raw, what) {
+    const sdp = sanitizeSdp(raw);
+    if (sdp !== raw) {
+      __privateMethod(this, _log, log_fn).call(this, `${what}: removed ${orphanPayloadTypeLines(raw).length} orphan codec line(s) from the peer's description`);
+    }
+    return sdp;
   };
   _preferLeanVideoCodecs = new WeakSet();
   preferLeanVideoCodecs_fn = function(pc) {
@@ -733,14 +798,21 @@ var PeerWebRTC = (() => {
   _answerRenegotiation = new WeakSet();
   answerRenegotiation_fn = async function(session, sdp) {
     try {
-      await session.pc.setRemoteDescription({ type: "offer", sdp });
+      await session.pc.setRemoteDescription({ type: "offer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, sdp, "offer") });
       const answer = await __privateMethod(this, _createAnswer, createAnswer_fn).call(this, session);
       await session.pc.setLocalDescription(answer);
       await __privateMethod(this, _send, send_fn).call(this, session.peerId, { type: "answer", sdp: answer.sdp, callId: session.callId });
     } catch (err) {
-      __privateMethod(this, _log, log_fn).call(this, `renegotiation answer failed: ${err.message}`);
+      __privateMethod(this, _negotiationFailed, negotiationFailed_fn).call(this, session, "re-offer", err);
     }
   };
+  _negotiationFailed = new WeakSet();
+  negotiationFailed_fn = function(session, what, err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    __privateMethod(this, _log, log_fn).call(this, `renegotiation failed (${what}) callId=${session.callId}: ${error.message}`);
+    console.warn(`[peer-webrtc] could not apply the peer's ${what} for call ${session.callId}: ${error.message}`);
+    this.emit("negotiationFailed", session.callId, error);
+  };
   _onAnswer = new WeakSet();
   onAnswer_fn = function(peerId, signal) {
     const session = __privateGet(this, _sessions).get(__privateMethod(this, _normId, normId_fn).call(this, signal.callId));
@@ -749,14 +821,14 @@ var PeerWebRTC = (() => {
     session.peerId = peerId;
     void (async () => {
       try {
-        await session.pc.setRemoteDescription({ type: "answer", sdp: signal.sdp });
+        await session.pc.setRemoteDescription({ type: "answer", sdp: __privateMethod(this, _cleanInbound, cleanInbound_fn).call(this, signal.sdp, "answer") });
         session.hasReceivedSdp = true;
         if (session.state !== "connected")
           __privateMethod(this, _setState, setState_fn).call(this, session, "connecting");
         await __privateMethod(this, _drainRemoteCandidates, drainRemoteCandidates_fn).call(this, session);
         await __privateMethod(this, _flushLocalCandidates, flushLocalCandidates_fn).call(this, session);
       } catch (err) {
-        __privateMethod(this, _log, log_fn).call(this, `setRemoteDescription(answer) failed: ${err.message}`);
+        __privateMethod(this, _negotiationFailed, negotiationFailed_fn).call(this, session, "answer", err);
       }
     })();
   };

package/dist/embedded-host.js

@@ -18,6 +18,7 @@ import { MessageStore } from "./message-store.js";
 import { FriendMetaStore } from "./friend-meta.js";
 import { Logger } from "./logger.js";
 import { acquireIdentityLock } from "./identity-lock.js";
+import { refreshPendingAvatars, requesterAvatar } from "./pending-requests.js";
 /** Files bigger than this are not queued for an offline friend — the bytes sit
  *  on disk until they reconnect, and an unbounded queue is how you fill a
  *  user's disk by accident. Live transfers have no such limit. */
@@ -228,6 +229,9 @@ export class EmbeddedHost {
                 name: req.name,
                 descr: req.description,
                 hello: req.hello,
+                // The requester's punk / avatar URL (peer >= 0.1.170), so the card can
+                // draw it before accept. A later profile is picked up in friends-pending.
+                ...requesterAvatar(req),
                 arrivedAt: Date.now(),
             });
             this.#events.emit("event", { type: "friend-request", userid });
@@ -493,6 +497,9 @@ export class EmbeddedHost {
                 return {};
             }
             case "friends-pending":
+                // Re-read the SDK's list: a requester's profile that arrived after its
+                // request patches only the SDK's entry, with no new event.
+                refreshPendingAvatars(this.#pending.values(), this.#node.pendingFriendRequests());
                 return { pending: [...this.#pending.values()] };
             case "friends-accept": {
                 const entry = this.#pending.get(uid);

package/dist/pending-requests.d.ts

@@ -0,0 +1,28 @@
+export interface RequesterAvatar {
+    punkId?: number;
+    avatarUrl?: string;
+}
+/** The valid avatar fields of an SDK / backend friend-request record. Keys are
+ *  present only with a value; punk 0 is a real CryptoPunk. */
+export declare function requesterAvatar(src: {
+    punkId?: unknown;
+    avatarUrl?: unknown;
+} | undefined | null): RequesterAvatar;
+/** Fold the SDK's current pending list into the host's own entries, matched by
+ *  pubkey or userid. A value the SDK has wins (a late profile can change it); a
+ *  value only the host has is kept. Mutates `entries`; returns whether anything
+ *  changed. */
+export declare function refreshPendingAvatars<E extends {
+    userid: string;
+    pubkey: string;
+} & RequesterAvatar>(entries: Iterable<E>, live: ReadonlyArray<{
+    pubkey?: string;
+    userid?: string;
+    punkId?: unknown;
+    avatarUrl?: unknown;
+}>): boolean;
+/** One `/api/desktop` `requests[]` row from a friends-pending entry (daemon or
+ *  embedded). `punkId` / `avatarUrl` are null when the requester sent none —
+ *  the same convention as `peers[]` — and the card then falls back to the
+ *  beagles.eth lookup and a generated picture. */
+export declare function desktopRequestRow(p: Record<string, unknown>, i: number, fmtTime: (ts?: number) => string): Record<string, unknown>;

package/dist/pending-requests.js

@@ -0,0 +1,69 @@
+// The requester's avatar on a pending friend request, before anyone accepts.
+//
+// peer >= 0.1.170 carries the requester's punk (friendreq field 3, `gender`)
+// and custom avatar URL (field 4) in the request itself, and fills them from a
+// profile the requester pushed before accept. When that profile arrives after
+// the request, the SDK patches only its own pending list — no new event — so
+// a host that copied the event once must re-read peer.pendingFriendRequests()
+// to learn it. lan >= 0.1.313 does that for a daemon backend; the embedded host
+// does it here. See decent-hq docs/tasks/TASK-2026-11-01-avatar-on-friend-request.md.
+import { punkIdOf } from "./friend-store.js";
+/** The valid avatar fields of an SDK / backend friend-request record. Keys are
+ *  present only with a value; punk 0 is a real CryptoPunk. */
+export function requesterAvatar(src) {
+    const out = {};
+    if (!src)
+        return out;
+    const punk = punkIdOf(src.punkId);
+    if (punk !== undefined && Number.isInteger(punk))
+        out.punkId = punk;
+    if (typeof src.avatarUrl === "string" && src.avatarUrl.length > 0)
+        out.avatarUrl = src.avatarUrl;
+    return out;
+}
+/** Fold the SDK's current pending list into the host's own entries, matched by
+ *  pubkey or userid. A value the SDK has wins (a late profile can change it); a
+ *  value only the host has is kept. Mutates `entries`; returns whether anything
+ *  changed. */
+export function refreshPendingAvatars(entries, live) {
+    if (!live.length)
+        return false;
+    let changed = false;
+    for (const e of entries) {
+        const l = live.find((x) => (!!x.pubkey && x.pubkey === e.pubkey) || (!!x.userid && x.userid === e.userid));
+        if (!l)
+            continue;
+        const a = requesterAvatar(l);
+        if (a.punkId !== undefined && a.punkId !== e.punkId) {
+            e.punkId = a.punkId;
+            changed = true;
+        }
+        if (a.avatarUrl !== undefined && a.avatarUrl !== e.avatarUrl) {
+            e.avatarUrl = a.avatarUrl;
+            changed = true;
+        }
+    }
+    return changed;
+}
+/** One `/api/desktop` `requests[]` row from a friends-pending entry (daemon or
+ *  embedded). `punkId` / `avatarUrl` are null when the requester sent none —
+ *  the same convention as `peers[]` — and the card then falls back to the
+ *  beagles.eth lookup and a generated picture. */
+export function desktopRequestRow(p, i, fmtTime) {
+    const a = requesterAvatar(p);
+    return {
+        id: p.userid || p.address || `r${i}`,
+        carrier: p.address || p.userid || "",
+        userid: p.userid || "",
+        // Name and introduction travel in the friend-request packet and were
+        // being dropped here, so every request looked identical and there
+        // was nothing to decide on.
+        name: p.name || "",
+        descr: p.descr || "",
+        via: p.hello || "lan",
+        time: fmtTime(p.arrivedAt),
+        // The requester's avatar, drawn before accept: URL first, then punk.
+        punkId: a.punkId ?? null,
+        avatarUrl: a.avatarUrl ?? null,
+    };
+}

package/dist/server.js

@@ -26,6 +26,7 @@ import { bridgeRoster } from "./bridge-roster.js";
 import { isSupervised } from "./relaunch.js";
 import { historyStats } from "./assistant-stats.js";
 import { readFriendStore, pickPunk } from "./friend-store.js";
+import { desktopRequestRow } from "./pending-requests.js";
 import { createDiscoverFetch } from "./discover-cache.js";
 import { applyWalletBind } from "@decentnetwork/beagle-ui/wallet-proof";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
@@ -2093,18 +2094,9 @@ export function startBeagleServer(opts) {
                     };
                 });
                 const pend = pending.ok ? (pending.data?.pending ?? []) : [];
-                const requests = pend.map((p, i) => ({
-                    id: p.userid || p.address || `r${i}`,
-                    carrier: p.address || p.userid || "",
-                    userid: p.userid || "",
-                    // Name and introduction travel in the friend-request packet and were
-                    // being dropped here, so every request looked identical and there
-                    // was nothing to decide on.
-                    name: p.name || "",
-                    descr: p.descr || "",
-                    via: p.hello || "lan",
-                    time: fmtTime(p.arrivedAt),
-                }));
+                // Same rows for both backends: lan >= 0.1.313 and the embedded host
+                // both answer friends-pending with punkId / avatarUrl when known.
+                const requests = pend.map((p, i) => desktopRequestRow(p, i, fmtTime));
                 // Exit nodes = the AVAILABLE exits this node knows about, grouped by
                 // region. The authoritative list is the shipped DEFAULT_EXITS
                 // (config/default-exits.yaml) — every install has it, so the panel is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.121",
+  "version": "0.1.123",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -26,11 +26,11 @@
     "start": "node dist/cli.js"
   },
   "dependencies": {
-    "@decentnetwork/beagle-ui": "^0.2.33",
+    "@decentnetwork/beagle-ui": "^0.2.34",
     "@decentnetwork/chat-components": "^0.1.3",
-    "@decentnetwork/lan": "^0.1.283",
-    "@decentnetwork/peer": "^0.1.168",
-    "@decentnetwork/peer-webrtc": "^0.2.16",
+    "@decentnetwork/lan": "^0.1.313",
+    "@decentnetwork/peer": "^0.1.170",
+    "@decentnetwork/peer-webrtc": "^0.2.17",
     "js-yaml": "^4.1.0",
     "ws": "^8.21.1",
     "yargs": "^17.7.2"