@decentnetwork/beagle 0.1.124 → 0.1.126

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.124";
+window.__DK_UI_VERSION="0.1.126";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js

package/dist/global-prefix.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The npm global prefix a file inside a globally installed package lives
+ * under — the value `npm i -g --prefix` needs to replace THAT copy.
+ *
+ *   /Users/x/.nvm/versions/node/v24.2.0/lib/node_modules/@decentnetwork/beagle → /Users/x/.nvm/versions/node/v24.2.0
+ *   /usr/local/lib/node_modules/@decentnetwork/lan/dist/cli/index.js            → /usr/local
+ *   C:\Users\x\AppData\Roaming\npm\node_modules\@decentnetwork\beagle           → C:\Users\x\AppData\Roaming\npm
+ *
+ * Empty when the path is not inside a global node_modules (dev checkout, npx).
+ * The FIRST match is the global root; a nested dependency's node_modules
+ * sits below it.
+ */
+export declare function globalPrefixOf(path: string, s?: string): string;

package/dist/global-prefix.js

@@ -0,0 +1,25 @@
+import { sep } from "node:path";
+/**
+ * The npm global prefix a file inside a globally installed package lives
+ * under — the value `npm i -g --prefix` needs to replace THAT copy.
+ *
+ *   /Users/x/.nvm/versions/node/v24.2.0/lib/node_modules/@decentnetwork/beagle → /Users/x/.nvm/versions/node/v24.2.0
+ *   /usr/local/lib/node_modules/@decentnetwork/lan/dist/cli/index.js            → /usr/local
+ *   C:\Users\x\AppData\Roaming\npm\node_modules\@decentnetwork\beagle           → C:\Users\x\AppData\Roaming\npm
+ *
+ * Empty when the path is not inside a global node_modules (dev checkout, npx).
+ * The FIRST match is the global root; a nested dependency's node_modules
+ * sits below it.
+ */
+export function globalPrefixOf(path, s = sep) {
+    const posix = `${s}lib${s}node_modules${s}`;
+    const i = path.indexOf(posix);
+    if (i > 0)
+        return path.slice(0, i);
+    if (s === "\\") {
+        const w = path.indexOf(`${s}node_modules${s}`);
+        if (w > 0)
+            return path.slice(0, w);
+    }
+    return "";
+}

package/dist/server.js

@@ -14,7 +14,7 @@
 //
 import http from "node:http";
 import net from "node:net";
-import { existsSync, readFileSync, writeFileSync, statSync, createReadStream } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, statSync, createReadStream, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { INSTALL_COMMAND as LAN_INSTALL_COMMAND } from "./lan-handoff.js";
@@ -29,6 +29,8 @@ import { readFriendStore, pickPunk } from "./friend-store.js";
 import { desktopRequestRow } from "./pending-requests.js";
 import { createDiscoverFetch } from "./discover-cache.js";
 import { applyWalletBind } from "@decentnetwork/beagle-ui/wallet-proof";
+import { settleUpload } from "./upload-settle.js";
+import { globalPrefixOf } from "./global-prefix.js";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
 // scripts/build-ui.mjs emits it next to this compiled module at dist/ui/desktop/.
 const DESKTOP_DIR = join(dirname(fileURLToPath(import.meta.url)), "desktop");
@@ -344,9 +346,15 @@ function verLt(a, b) {
  *  different node than this app (nvm: launchd starts v24.2.0 while the shell's
  *  npm is v24.3.0), and a global install lands in the prefix of whichever npm
  *  ran it — the wrong one leaves the daemon on the old code with no error. */
-async function npmGlobalInstall(pkg, nodePath) {
+/** `targetPrefix` is the global prefix the RUNNING copy lives in. Pinning node
+ *  is not enough: an nvm npm-cli.js runs under whatever node its caller picks,
+ *  and npm on PATH (pm2's PATH on mac-dev: v24.3.0) installs into its own
+ *  prefix — beagle 0.1.124 ran from v24.2.0 while every click of Update put
+ *  the new version into v24.3.0, reported success, and restarted onto the old
+ *  code. An explicit --prefix puts the files where the restart will load them. */
+async function npmGlobalInstall(pkg, nodePath, targetPrefix) {
     const { spawn } = await import("node:child_process");
-    const args = ["i", "-g", `${pkg}@latest`];
+    const args = ["i", "-g", `${pkg}@latest`, ...(targetPrefix ? ["--prefix", targetPrefix] : [])];
     const cliFor = (node) => join(dirname(node), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js");
     const npmCli = cliFor(process.execPath);
     const pinned = nodePath && existsSync(nodePath) && existsSync(cliFor(nodePath)) ? cliFor(nodePath) : "";
@@ -356,21 +364,45 @@ async function npmGlobalInstall(pkg, nodePath) {
             { cmd: "npm", args },
             ...(existsSync(npmCli) ? [{ cmd: process.execPath, args: [npmCli, ...args] }] : []),
         ];
+    const runOnce = (cmd, cmdArgs, timeoutMs = 5 * 60_000) => new Promise((resolveRun) => {
+        const ch = spawn(cmd, cmdArgs, { shell: process.platform === "win32" });
+        let out = "";
+        const timer = setTimeout(() => ch.kill("SIGKILL"), timeoutMs);
+        ch.stdout?.on("data", (c) => (out += c));
+        ch.stderr?.on("data", (c) => (out += c));
+        ch.on("error", (e) => { clearTimeout(timer); resolveRun({ code: null, out, spawnErr: e.message }); });
+        ch.on("close", (code) => { clearTimeout(timer); resolveRun({ code, out }); });
+    });
     for (const a of attempts) {
-        const r = await new Promise((resolveRun) => {
-            const ch = spawn(a.cmd, a.args, { shell: process.platform === "win32" });
-            let out = "";
-            const timer = setTimeout(() => ch.kill("SIGKILL"), 5 * 60_000);
-            ch.stdout?.on("data", (c) => (out += c));
-            ch.stderr?.on("data", (c) => (out += c));
-            ch.on("error", (e) => { clearTimeout(timer); resolveRun({ code: null, out, spawnErr: e.message }); });
-            ch.on("close", (code) => { clearTimeout(timer); resolveRun({ code, out }); });
-        });
+        const r = await runOnce(a.cmd, a.args);
         if (r.spawnErr)
             continue; // npm not found this way — try the next resolver
         const tail = r.out.slice(-2000);
         if (r.code === 0)
             return { ok: true, log: tail };
+        // Root-owned prefix, but this account may run root commands without a
+        // password (WSL's default user, cloud images). A privileged install is then
+        // something the person can already do with no prompt, and going through
+        // `sudo -n` EVERY time keeps the layout consistent: the dir stays
+        // root-owned and the next click takes the same path, so no loop. Never
+        // prompts (-n), never changes permissions. -H gives npm root's own cache,
+        // so no root-owned files land in ~/.npm. Absolute node + npm-cli and an
+        // explicit --prefix, because sudo resets PATH and HOME and root's npm
+        // could otherwise resolve a different global prefix than this user's.
+        if (/EACCES|permission denied/i.test(r.out) && (await canSudoNonInteractive())) {
+            const npmCmd = a.cmd === "npm" ? resolveNpmOnPath(npmCli) : [a.cmd, a.args[0]];
+            if (npmCmd.length) {
+                const [exe, ...pre0] = npmCmd;
+                const pre = targetPrefix ? undefined : await runOnce(exe, [...pre0, "prefix", "-g"], 15_000);
+                const prefix = targetPrefix || (pre?.code === 0 ? pre.out.trim().split("\n").pop()?.trim() : "");
+                if (prefix) {
+                    const s = await runOnce("sudo", ["-n", "-H", ...npmCmd, ...args, ...(targetPrefix ? [] : ["--prefix", prefix])]);
+                    if (s.code === 0)
+                        return { ok: true, log: s.out.slice(-2000) };
+                    return { ok: false, error: `sudo -n npm exited ${s.code}`, log: s.out.slice(-2000) };
+                }
+            }
+        }
         // Do NOT tell people to re-run it with sudo. `sudo npm i -g` succeeds and
         // leaves the package directory owned by root, so the NEXT unprivileged
         // update fails exactly the same way — the advice was the thing keeping
@@ -412,9 +444,48 @@ async function globalNpmWritable() {
         return { ok: true };
     }
     catch {
+        // Not writable by us — but npmGlobalInstall falls back to `sudo -n` when
+        // that needs no password, so the button does work there.
+        if (await canSudoNonInteractive())
+            return { ok: true };
         return { ok: false, reason: await globalNpmOwnershipHint(BEAGLE_PKG) };
     }
 }
+/** The `npm` this process would run from PATH, as an absolute command sudo can
+ *  run after it resets PATH: `[node, npm-cli.js]` when npm is a symlink to the
+ *  JS entry (nvm, nodejs.org, Debian's /usr/bin/npm → /usr/share/nodejs/npm),
+ *  so the same node runs it; else the resolved file itself. Falls back to the
+ *  npm-cli.js beside the running node. Empty when none is found. */
+function resolveNpmOnPath(besideNode) {
+    for (const dir of (process.env.PATH ?? "").split(":")) {
+        if (!dir)
+            continue;
+        const p = join(dir, "npm");
+        if (!existsSync(p))
+            continue;
+        try {
+            const real = realpathSync(p);
+            return real.endsWith(".js") ? [process.execPath, real] : [real];
+        }
+        catch {
+            continue;
+        }
+    }
+    return existsSync(besideNode) ? [process.execPath, besideNode] : [];
+}
+/** True when `sudo -n true` succeeds: this account runs root commands without
+ *  a password prompt. Never prompts. Cached for a minute. */
+let sudoNoPassCache = null;
+async function canSudoNonInteractive() {
+    if (process.platform === "win32" || process.getuid?.() === 0)
+        return false;
+    if (sudoNoPassCache && Date.now() - sudoNoPassCache.at < 60_000)
+        return sudoNoPassCache.ok;
+    const { execFile } = await import("node:child_process");
+    const ok = await new Promise((res) => execFile("sudo", ["-n", "true"], { timeout: 5000 }, (err) => res(!err)));
+    sudoNoPassCache = { at: Date.now(), ok };
+    return ok;
+}
 /**
  * What to tell someone whose global npm directory this process cannot write.
  *
@@ -491,13 +562,31 @@ async function npmQuery(args) {
 /** The node binary the running daemon was started with, from its pid's
  *  command line (`/…/bin/node /…/bin/agentnet up …`). Empty when unknown. */
 async function daemonNodePath(dataDir) {
+    const first = (await daemonCommand(dataDir))[0] ?? "";
+    return /(^|\/)node(\.exe)?$/.test(first) && existsSync(first) ? first : "";
+}
+/** The global prefix the running daemon's lan was loaded from: its script
+ *  (`/…/bin/agentnet`, a symlink into `<prefix>/lib/node_modules/…`) resolved.
+ *  Empty when unknown — the install then falls back to npm's own prefix. */
+async function daemonLanPrefix(dataDir) {
+    const script = (await daemonCommand(dataDir))[1] ?? "";
+    if (!script || !existsSync(script))
+        return "";
+    try {
+        return globalPrefixOf(realpathSync(script));
+    }
+    catch {
+        return "";
+    }
+}
+/** The daemon's command line split on whitespace, from its pidfile's pid. */
+async function daemonCommand(dataDir) {
     const pid = dataDir ? readDaemonPid(dataDir) : "";
     if (!/^\d+$/.test(pid) || process.platform === "win32")
-        return "";
+        return [];
     const { execFile } = await import("node:child_process");
     const cmd = await new Promise((res) => execFile("ps", ["-o", "command=", "-p", pid], { timeout: 5000 }, (err, out) => res(err ? "" : String(out).trim())));
-    const first = cmd.split(/\s+/)[0] ?? "";
-    return /(^|\/)node(\.exe)?$/.test(first) && existsSync(first) ? first : "";
+    return cmd ? cmd.split(/\s+/) : [];
 }
 async function agentnetRestart(dataDir) {
     const pidBefore = dataDir ? readDaemonPid(dataDir) : "";
@@ -1425,42 +1514,33 @@ export function startBeagleServer(opts) {
                 else {
                     destDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
                 }
-                let destName = safe;
-                let destPath = join(destDir, destName);
-                // Re-sending a file the user already has must not duplicate it.
-                // The -N suffix exists so two DIFFERENT files sharing a name both
-                // survive — but an identical re-send hit it too, so every retry of
-                // the same 52 MB video wrote another full copy (observed: four
-                // byte-identical copies of one file, and a 3.9 GB downloads dir).
-                // Reuse the existing path when the size already matches, so the
-                // upload overwrites that copy instead of growing a new one. Tradeoff:
-                // a different file with the same name AND the same byte count
-                // replaces the older copy rather than sitting beside it — the same
-                // thing any "save to downloads" does, and far better than unbounded
-                // duplication. Hashing instead would mean buffering the whole upload.
+                // The upload ALWAYS lands in a fresh temp file first, never on an
+                // existing path. It used to open the same-name, same-size file in
+                // downloads/ for writing ("re-send dedupe") — and the most natural
+                // way to forward a received file is to pick exactly that file. The
+                // write truncated the very file the browser was still streaming the
+                // upload from: a 29.7 MB recording was cut to 832 KB on disk and the
+                // 832 KB was sent as "delivered" (mac-dev → nv4090-wsl, 2026-11-02).
                 const uploadSize = Number(req.headers["content-length"] ?? NaN);
-                if (keep) {
-                    const dot = safe.lastIndexOf(".");
-                    const base = dot > 0 ? safe.slice(0, dot) : safe;
-                    const ext = dot > 0 ? safe.slice(dot) : "";
-                    for (let i = 1; existsSync(destPath); i++) {
-                        // Same size is a cheap, reliable proxy here: these are the
-                        // sender's own files, not adversarial input, and the full
-                        // compare would mean buffering the upload to hash it.
-                        if (Number.isFinite(uploadSize) && statSync(destPath).size === uploadSize)
-                            break;
-                        destName = `${base}-${i}${ext}`;
-                        destPath = join(destDir, destName);
-                    }
-                }
+                const tmpPath = join(destDir, `.${safe}.${process.pid}-${Date.now()}.part`);
+                let destPath = tmpPath;
                 try {
                     await new Promise((resolve2, reject) => {
-                        const ws = fs.createWriteStream(destPath);
+                        const ws = fs.createWriteStream(tmpPath);
                         req.pipe(ws);
                         req.on("error", reject);
+                        // A browser that gives up mid-upload closes the socket; without
+                        // this the partial file could still be handed to the daemon.
+                        req.on("close", () => { if (!req.complete)
+                            reject(new Error("upload aborted by the browser")); });
                         ws.on("error", reject);
                         ws.on("finish", () => resolve2());
                     });
+                    const got = statSync(tmpPath).size;
+                    if (Number.isFinite(uploadSize) && got !== uploadSize) {
+                        throw new Error(`upload incomplete (${got} of ${uploadSize} bytes) — nothing was sent`);
+                    }
+                    destPath = keep ? await settleUpload(tmpPath, destDir, safe) : tmpPath;
                     const r = await opts.call({ op: "file-send", userid, path: destPath });
                     if (!r.ok) {
                         sendJson(res, 502, r);
@@ -1474,6 +1554,8 @@ export function startBeagleServer(opts) {
                 finally {
                     if (!keep)
                         await fsp.rm(destDir, { recursive: true, force: true }).catch(() => undefined);
+                    else
+                        await fsp.rm(tmpPath, { force: true }).catch(() => undefined); // no-op once settled
                 }
                 return;
             }
@@ -1838,7 +1920,7 @@ export function startBeagleServer(opts) {
                 // lan (the agentnet daemon) updates independently of beagle's own
                 // install mode: global reinstall, then ask the daemon to re-exec.
                 if (body.pkg === "lan") {
-                    const inst = await npmGlobalInstall("@decentnetwork/lan", await daemonNodePath(opts.lanHost?.dataDir));
+                    const inst = await npmGlobalInstall("@decentnetwork/lan", await daemonNodePath(opts.lanHost?.dataDir), await daemonLanPrefix(opts.lanHost?.dataDir));
                     if (!inst.ok) {
                         sendJson(res, 502, inst);
                         return;
@@ -1862,7 +1944,8 @@ export function startBeagleServer(opts) {
                     sendJson(res, 200, { ok: true, npx: true });
                     return;
                 }
-                const r = await npmGlobalInstall(BEAGLE_PKG);
+                // Into the prefix THIS copy runs from, with this node's npm — see npmGlobalInstall.
+                const r = await npmGlobalInstall(BEAGLE_PKG, process.execPath, globalPrefixOf(BEAGLE_ROOT) || undefined);
                 updateCache = null; // next check reflects the new install
                 sendJson(res, r.ok ? 200 : 502, r);
                 return;

package/dist/upload-settle.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Give a finished upload (already complete in `tmpPath`, inside `dir`) its
+ * final name, without ever writing over an existing file.
+ *
+ * Re-sending a file that is already in downloads/ must not grow another copy
+ * (observed: four byte-identical copies of one 52 MB video). The old dedupe
+ * did that by opening the same-name, same-size file for WRITING before the
+ * upload arrived — which truncated the source when that file was the one
+ * being uploaded (forwarding a received file). Now the comparison happens
+ * after the upload is safely on disk: an existing copy is reused only when
+ * its bytes are identical; a different file with the same name gets `-N`.
+ */
+export declare function settleUpload(tmpPath: string, dir: string, name: string): Promise<string>;

package/dist/upload-settle.js

@@ -0,0 +1,42 @@
+import { createHash } from "node:crypto";
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Give a finished upload (already complete in `tmpPath`, inside `dir`) its
+ * final name, without ever writing over an existing file.
+ *
+ * Re-sending a file that is already in downloads/ must not grow another copy
+ * (observed: four byte-identical copies of one 52 MB video). The old dedupe
+ * did that by opening the same-name, same-size file for WRITING before the
+ * upload arrived — which truncated the source when that file was the one
+ * being uploaded (forwarding a received file). Now the comparison happens
+ * after the upload is safely on disk: an existing copy is reused only when
+ * its bytes are identical; a different file with the same name gets `-N`.
+ */
+export async function settleUpload(tmpPath, dir, name) {
+    const dot = name.lastIndexOf(".");
+    const base = dot > 0 ? name.slice(0, dot) : name;
+    const ext = dot > 0 ? name.slice(dot) : "";
+    const size = statSync(tmpPath).size;
+    for (let i = 0;; i++) {
+        const candidate = join(dir, i === 0 ? name : `${base}-${i}${ext}`);
+        if (!existsSync(candidate)) {
+            await rename(tmpPath, candidate);
+            return candidate;
+        }
+        if (statSync(candidate).size === size && (await sha256File(candidate)) === (await sha256File(tmpPath))) {
+            await rm(tmpPath, { force: true });
+            return candidate;
+        }
+    }
+}
+function sha256File(path) {
+    return new Promise((resolve, reject) => {
+        const h = createHash("sha256");
+        createReadStream(path)
+            .on("data", (c) => h.update(c))
+            .on("error", reject)
+            .on("end", () => resolve(h.digest("hex")));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.124",
+  "version": "0.1.126",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",