@decentnetwork/beagle 0.1.123 → 0.1.125

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.123";
+window.__DK_UI_VERSION="0.1.125";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js
@@ -1697,12 +1697,23 @@ ${lines}`, { assistant: { kind: "adopt", rows: fresh } }));
     }, [append, lang, onReloadFriends]);
     return { thread, handle, removeFriends, adoptServicePeers };
   }
+  var REQUEST_AVATAR_HOST = "ens-gateway.beaglechat.workers.dev";
   var MAX_URL = 2048;
   function requestAvatarUrl(r) {
     const u = r && r.avatarUrl;
     if (typeof u !== "string" || !u || u.length > MAX_URL)
       return null;
-    return /^https:\/\/[^\s"'<>]+$/i.test(u) ? u : null;
+    let parsed;
+    try {
+      parsed = new URL(u);
+    } catch {
+      return null;
+    }
+    if (parsed.protocol !== "https:" || parsed.host !== REQUEST_AVATAR_HOST)
+      return null;
+    if (parsed.username || parsed.password)
+      return null;
+    return parsed.href;
   }
   function requestPunkId(r) {
     const p = r && r.punkId;

package/dist/server.js

@@ -14,7 +14,7 @@
 //
 import http from "node:http";
 import net from "node:net";
-import { existsSync, readFileSync, writeFileSync, statSync, createReadStream } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, statSync, createReadStream, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { INSTALL_COMMAND as LAN_INSTALL_COMMAND } from "./lan-handoff.js";
@@ -29,6 +29,7 @@ import { readFriendStore, pickPunk } from "./friend-store.js";
 import { desktopRequestRow } from "./pending-requests.js";
 import { createDiscoverFetch } from "./discover-cache.js";
 import { applyWalletBind } from "@decentnetwork/beagle-ui/wallet-proof";
+import { settleUpload } from "./upload-settle.js";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
 // scripts/build-ui.mjs emits it next to this compiled module at dist/ui/desktop/.
 const DESKTOP_DIR = join(dirname(fileURLToPath(import.meta.url)), "desktop");
@@ -356,21 +357,45 @@ async function npmGlobalInstall(pkg, nodePath) {
             { cmd: "npm", args },
             ...(existsSync(npmCli) ? [{ cmd: process.execPath, args: [npmCli, ...args] }] : []),
         ];
+    const runOnce = (cmd, cmdArgs, timeoutMs = 5 * 60_000) => new Promise((resolveRun) => {
+        const ch = spawn(cmd, cmdArgs, { shell: process.platform === "win32" });
+        let out = "";
+        const timer = setTimeout(() => ch.kill("SIGKILL"), timeoutMs);
+        ch.stdout?.on("data", (c) => (out += c));
+        ch.stderr?.on("data", (c) => (out += c));
+        ch.on("error", (e) => { clearTimeout(timer); resolveRun({ code: null, out, spawnErr: e.message }); });
+        ch.on("close", (code) => { clearTimeout(timer); resolveRun({ code, out }); });
+    });
     for (const a of attempts) {
-        const r = await new Promise((resolveRun) => {
-            const ch = spawn(a.cmd, a.args, { shell: process.platform === "win32" });
-            let out = "";
-            const timer = setTimeout(() => ch.kill("SIGKILL"), 5 * 60_000);
-            ch.stdout?.on("data", (c) => (out += c));
-            ch.stderr?.on("data", (c) => (out += c));
-            ch.on("error", (e) => { clearTimeout(timer); resolveRun({ code: null, out, spawnErr: e.message }); });
-            ch.on("close", (code) => { clearTimeout(timer); resolveRun({ code, out }); });
-        });
+        const r = await runOnce(a.cmd, a.args);
         if (r.spawnErr)
             continue; // npm not found this way — try the next resolver
         const tail = r.out.slice(-2000);
         if (r.code === 0)
             return { ok: true, log: tail };
+        // Root-owned prefix, but this account may run root commands without a
+        // password (WSL's default user, cloud images). A privileged install is then
+        // something the person can already do with no prompt, and going through
+        // `sudo -n` EVERY time keeps the layout consistent: the dir stays
+        // root-owned and the next click takes the same path, so no loop. Never
+        // prompts (-n), never changes permissions. -H gives npm root's own cache,
+        // so no root-owned files land in ~/.npm. Absolute node + npm-cli and an
+        // explicit --prefix, because sudo resets PATH and HOME and root's npm
+        // could otherwise resolve a different global prefix than this user's.
+        if (/EACCES|permission denied/i.test(r.out) && (await canSudoNonInteractive())) {
+            const npmCmd = a.cmd === "npm" ? resolveNpmOnPath(npmCli) : [a.cmd, a.args[0]];
+            if (npmCmd.length) {
+                const [exe, ...pre0] = npmCmd;
+                const pre = await runOnce(exe, [...pre0, "prefix", "-g"], 15_000);
+                const prefix = pre.code === 0 ? pre.out.trim().split("\n").pop()?.trim() : "";
+                if (prefix) {
+                    const s = await runOnce("sudo", ["-n", "-H", ...npmCmd, ...args, "--prefix", prefix]);
+                    if (s.code === 0)
+                        return { ok: true, log: s.out.slice(-2000) };
+                    return { ok: false, error: `sudo -n npm exited ${s.code}`, log: s.out.slice(-2000) };
+                }
+            }
+        }
         // Do NOT tell people to re-run it with sudo. `sudo npm i -g` succeeds and
         // leaves the package directory owned by root, so the NEXT unprivileged
         // update fails exactly the same way — the advice was the thing keeping
@@ -412,9 +437,48 @@ async function globalNpmWritable() {
         return { ok: true };
     }
     catch {
+        // Not writable by us — but npmGlobalInstall falls back to `sudo -n` when
+        // that needs no password, so the button does work there.
+        if (await canSudoNonInteractive())
+            return { ok: true };
         return { ok: false, reason: await globalNpmOwnershipHint(BEAGLE_PKG) };
     }
 }
+/** The `npm` this process would run from PATH, as an absolute command sudo can
+ *  run after it resets PATH: `[node, npm-cli.js]` when npm is a symlink to the
+ *  JS entry (nvm, nodejs.org, Debian's /usr/bin/npm → /usr/share/nodejs/npm),
+ *  so the same node runs it; else the resolved file itself. Falls back to the
+ *  npm-cli.js beside the running node. Empty when none is found. */
+function resolveNpmOnPath(besideNode) {
+    for (const dir of (process.env.PATH ?? "").split(":")) {
+        if (!dir)
+            continue;
+        const p = join(dir, "npm");
+        if (!existsSync(p))
+            continue;
+        try {
+            const real = realpathSync(p);
+            return real.endsWith(".js") ? [process.execPath, real] : [real];
+        }
+        catch {
+            continue;
+        }
+    }
+    return existsSync(besideNode) ? [process.execPath, besideNode] : [];
+}
+/** True when `sudo -n true` succeeds: this account runs root commands without
+ *  a password prompt. Never prompts. Cached for a minute. */
+let sudoNoPassCache = null;
+async function canSudoNonInteractive() {
+    if (process.platform === "win32" || process.getuid?.() === 0)
+        return false;
+    if (sudoNoPassCache && Date.now() - sudoNoPassCache.at < 60_000)
+        return sudoNoPassCache.ok;
+    const { execFile } = await import("node:child_process");
+    const ok = await new Promise((res) => execFile("sudo", ["-n", "true"], { timeout: 5000 }, (err) => res(!err)));
+    sudoNoPassCache = { at: Date.now(), ok };
+    return ok;
+}
 /**
  * What to tell someone whose global npm directory this process cannot write.
  *
@@ -1425,42 +1489,33 @@ export function startBeagleServer(opts) {
                 else {
                     destDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
                 }
-                let destName = safe;
-                let destPath = join(destDir, destName);
-                // Re-sending a file the user already has must not duplicate it.
-                // The -N suffix exists so two DIFFERENT files sharing a name both
-                // survive — but an identical re-send hit it too, so every retry of
-                // the same 52 MB video wrote another full copy (observed: four
-                // byte-identical copies of one file, and a 3.9 GB downloads dir).
-                // Reuse the existing path when the size already matches, so the
-                // upload overwrites that copy instead of growing a new one. Tradeoff:
-                // a different file with the same name AND the same byte count
-                // replaces the older copy rather than sitting beside it — the same
-                // thing any "save to downloads" does, and far better than unbounded
-                // duplication. Hashing instead would mean buffering the whole upload.
+                // The upload ALWAYS lands in a fresh temp file first, never on an
+                // existing path. It used to open the same-name, same-size file in
+                // downloads/ for writing ("re-send dedupe") — and the most natural
+                // way to forward a received file is to pick exactly that file. The
+                // write truncated the very file the browser was still streaming the
+                // upload from: a 29.7 MB recording was cut to 832 KB on disk and the
+                // 832 KB was sent as "delivered" (mac-dev → nv4090-wsl, 2026-11-02).
                 const uploadSize = Number(req.headers["content-length"] ?? NaN);
-                if (keep) {
-                    const dot = safe.lastIndexOf(".");
-                    const base = dot > 0 ? safe.slice(0, dot) : safe;
-                    const ext = dot > 0 ? safe.slice(dot) : "";
-                    for (let i = 1; existsSync(destPath); i++) {
-                        // Same size is a cheap, reliable proxy here: these are the
-                        // sender's own files, not adversarial input, and the full
-                        // compare would mean buffering the upload to hash it.
-                        if (Number.isFinite(uploadSize) && statSync(destPath).size === uploadSize)
-                            break;
-                        destName = `${base}-${i}${ext}`;
-                        destPath = join(destDir, destName);
-                    }
-                }
+                const tmpPath = join(destDir, `.${safe}.${process.pid}-${Date.now()}.part`);
+                let destPath = tmpPath;
                 try {
                     await new Promise((resolve2, reject) => {
-                        const ws = fs.createWriteStream(destPath);
+                        const ws = fs.createWriteStream(tmpPath);
                         req.pipe(ws);
                         req.on("error", reject);
+                        // A browser that gives up mid-upload closes the socket; without
+                        // this the partial file could still be handed to the daemon.
+                        req.on("close", () => { if (!req.complete)
+                            reject(new Error("upload aborted by the browser")); });
                         ws.on("error", reject);
                         ws.on("finish", () => resolve2());
                     });
+                    const got = statSync(tmpPath).size;
+                    if (Number.isFinite(uploadSize) && got !== uploadSize) {
+                        throw new Error(`upload incomplete (${got} of ${uploadSize} bytes) — nothing was sent`);
+                    }
+                    destPath = keep ? await settleUpload(tmpPath, destDir, safe) : tmpPath;
                     const r = await opts.call({ op: "file-send", userid, path: destPath });
                     if (!r.ok) {
                         sendJson(res, 502, r);
@@ -1474,6 +1529,8 @@ export function startBeagleServer(opts) {
                 finally {
                     if (!keep)
                         await fsp.rm(destDir, { recursive: true, force: true }).catch(() => undefined);
+                    else
+                        await fsp.rm(tmpPath, { force: true }).catch(() => undefined); // no-op once settled
                 }
                 return;
             }

package/dist/upload-settle.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Give a finished upload (already complete in `tmpPath`, inside `dir`) its
+ * final name, without ever writing over an existing file.
+ *
+ * Re-sending a file that is already in downloads/ must not grow another copy
+ * (observed: four byte-identical copies of one 52 MB video). The old dedupe
+ * did that by opening the same-name, same-size file for WRITING before the
+ * upload arrived — which truncated the source when that file was the one
+ * being uploaded (forwarding a received file). Now the comparison happens
+ * after the upload is safely on disk: an existing copy is reused only when
+ * its bytes are identical; a different file with the same name gets `-N`.
+ */
+export declare function settleUpload(tmpPath: string, dir: string, name: string): Promise<string>;

package/dist/upload-settle.js

@@ -0,0 +1,42 @@
+import { createHash } from "node:crypto";
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Give a finished upload (already complete in `tmpPath`, inside `dir`) its
+ * final name, without ever writing over an existing file.
+ *
+ * Re-sending a file that is already in downloads/ must not grow another copy
+ * (observed: four byte-identical copies of one 52 MB video). The old dedupe
+ * did that by opening the same-name, same-size file for WRITING before the
+ * upload arrived — which truncated the source when that file was the one
+ * being uploaded (forwarding a received file). Now the comparison happens
+ * after the upload is safely on disk: an existing copy is reused only when
+ * its bytes are identical; a different file with the same name gets `-N`.
+ */
+export async function settleUpload(tmpPath, dir, name) {
+    const dot = name.lastIndexOf(".");
+    const base = dot > 0 ? name.slice(0, dot) : name;
+    const ext = dot > 0 ? name.slice(dot) : "";
+    const size = statSync(tmpPath).size;
+    for (let i = 0;; i++) {
+        const candidate = join(dir, i === 0 ? name : `${base}-${i}${ext}`);
+        if (!existsSync(candidate)) {
+            await rename(tmpPath, candidate);
+            return candidate;
+        }
+        if (statSync(candidate).size === size && (await sha256File(candidate)) === (await sha256File(tmpPath))) {
+            await rm(tmpPath, { force: true });
+            return candidate;
+        }
+    }
+}
+function sha256File(path) {
+    return new Promise((resolve, reject) => {
+        const h = createHash("sha256");
+        createReadStream(path)
+            .on("data", (c) => h.update(c))
+            .on("error", reject)
+            .on("end", () => resolve(h.digest("hex")));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.123",
+  "version": "0.1.125",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -26,7 +26,7 @@
     "start": "node dist/cli.js"
   },
   "dependencies": {
-    "@decentnetwork/beagle-ui": "^0.2.34",
+    "@decentnetwork/beagle-ui": "^0.2.35",
     "@decentnetwork/chat-components": "^0.1.3",
     "@decentnetwork/lan": "^0.1.313",
     "@decentnetwork/peer": "^0.1.170",