@decentnetwork/beagle 0.1.37 → 0.1.39

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.36";
+window.__DK_UI_VERSION="0.1.38";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',
@@ -2056,33 +2056,68 @@ function Msg({ m, peer, T, onTheater, onDelete, onCancel, onRetry, onReveal, onC
         const meta = /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0, flex: 1 } }, /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 12.5, fontWeight: 600, color: mine ? "#fff" : "var(--text)", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" } }, m.file.name), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 11, color: mine ? "rgba(255,255,255,0.7)" : "var(--faint)", marginTop: 1 } }, busy === "cancel" ? `${m.file.size} \xB7 ${T.cancelling || "Cancelling\u2026"}` : busy === "retry" ? `${m.file.size} \xB7 ${T.retrying || "Retrying\u2026"}` : m.file.status === "queued" ? `${m.file.size} \xB7 ${T.queued || "queued"}` : m.file.status === "sending" ? `${m.file.size} \xB7 ${dkPct(m.file.pct)}${m.file.kbps ? " \xB7 " + dkSpeed(m.file.kbps) : ""}` : m.file.status === "failed" ? `${m.file.size} \xB7 failed` : m.file.status === "cancelled" ? `${m.file.size} \xB7 ${T.cancelled || "cancelled"}` : mine ? `${m.file.size} \xB7 sent` : `${m.file.size} \xB7 ${T.open || "open"}`));
         if (mine) {
           const btnBusy = !!busy;
-          return /* @__PURE__ */ React.createElement("div", { style: { ...cardStyle, opacity: btnBusy ? 0.85 : 1 } }, icon, meta, busy === "cancel" || busy === "retry" ? /* @__PURE__ */ React.createElement(Icon, { name: "clock", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }) : m.file.status === "queued" ? /* @__PURE__ */ React.createElement(Icon, { name: "clock", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }) : m.file.status === "sending" ? /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, fontWeight: 700, color: "rgba(255,255,255,0.9)", whiteSpace: "nowrap" } }, dkPct(m.file.pct), m.file.kbps ? " \xB7 " + dkSpeed(m.file.kbps) : "") : m.file.status === "failed" || m.file.status === "cancelled" ? /* @__PURE__ */ React.createElement(Icon, { name: "x", size: 16, stroke: 2.4, color: "rgba(255,200,190,0.95)" }) : /* @__PURE__ */ React.createElement(Icon, { name: "checkCheck", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }), (m.file.status === "sending" || m.file.status === "queued" || busy === "cancel") && m.id && /* @__PURE__ */ React.createElement(
-            "button",
+          return /* @__PURE__ */ React.createElement(
+            "div",
             {
-              title: T.cancel || "cancel",
-              disabled: btnBusy,
-              onClick: (e) => {
-                e.stopPropagation();
-                if (!btnBusy)
-                  onCancel(m.id);
-              },
-              style: { background: "rgba(255,255,255,0.16)", border: "none", borderRadius: 6, cursor: btnBusy ? "wait" : "pointer", padding: 3, marginLeft: 2, display: "inline-flex", flexShrink: 0, opacity: btnBusy ? 0.5 : 1 }
+              style: { ...cardStyle, cursor: "pointer", opacity: btnBusy ? 0.85 : 1 },
+              title: T.open || "open",
+              onClick: () => window.open(dkFileUrl(m.file.name), "_blank", "noopener")
             },
-            /* @__PURE__ */ React.createElement(Icon, { name: "x", size: 13, stroke: 2.4, color: "#fff" })
-          ), m.file.status !== "sent" && m.id && /* @__PURE__ */ React.createElement(
-            "button",
-            {
-              title: T.retry || "retry",
-              disabled: btnBusy,
-              onClick: (e) => {
-                e.stopPropagation();
-                if (!btnBusy)
-                  onRetry(m.id);
+            icon,
+            meta,
+            onReveal && /* @__PURE__ */ React.createElement(
+              "button",
+              {
+                title: T.revealInFinder || "\u5728\u6587\u4EF6\u7BA1\u7406\u5668\u4E2D\u663E\u793A / Show in file manager",
+                onClick: (e) => {
+                  e.stopPropagation();
+                  onReveal(m.file.name);
+                },
+                style: { background: "none", border: "none", cursor: "pointer", padding: 0, display: "inline-flex", flexShrink: 0 }
               },
-              style: { background: "rgba(255,255,255,0.16)", border: "none", borderRadius: 6, cursor: btnBusy ? "wait" : "pointer", padding: 3, marginLeft: 2, display: "inline-flex", flexShrink: 0, opacity: btnBusy ? 0.5 : 1 }
-            },
-            /* @__PURE__ */ React.createElement(Icon, { name: "refresh", size: 13, stroke: 2.2, color: "#fff" })
-          ));
+              /* @__PURE__ */ React.createElement(Icon, { name: "folderOpen", size: 15, stroke: 2, color: "rgba(255,255,255,0.85)" })
+            ),
+            /* @__PURE__ */ React.createElement(
+              "a",
+              {
+                href: dkFileDownloadUrl(m.file.name),
+                download: m.file.name,
+                title: "download",
+                onClick: (e) => e.stopPropagation(),
+                style: { display: "inline-flex", flexShrink: 0 }
+              },
+              /* @__PURE__ */ React.createElement(Icon, { name: "download", size: 15, stroke: 2, color: "rgba(255,255,255,0.85)" })
+            ),
+            busy === "cancel" || busy === "retry" ? /* @__PURE__ */ React.createElement(Icon, { name: "clock", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }) : m.file.status === "queued" ? /* @__PURE__ */ React.createElement(Icon, { name: "clock", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }) : m.file.status === "sending" ? /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, fontWeight: 700, color: "rgba(255,255,255,0.9)", whiteSpace: "nowrap" } }, dkPct(m.file.pct), m.file.kbps ? " \xB7 " + dkSpeed(m.file.kbps) : "") : m.file.status === "failed" || m.file.status === "cancelled" ? /* @__PURE__ */ React.createElement(Icon, { name: "x", size: 16, stroke: 2.4, color: "rgba(255,200,190,0.95)" }) : /* @__PURE__ */ React.createElement(Icon, { name: "checkCheck", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }),
+            (m.file.status === "sending" || m.file.status === "queued" || busy === "cancel") && m.id && /* @__PURE__ */ React.createElement(
+              "button",
+              {
+                title: T.cancel || "cancel",
+                disabled: btnBusy,
+                onClick: (e) => {
+                  e.stopPropagation();
+                  if (!btnBusy)
+                    onCancel(m.id);
+                },
+                style: { background: "rgba(255,255,255,0.16)", border: "none", borderRadius: 6, cursor: btnBusy ? "wait" : "pointer", padding: 3, marginLeft: 2, display: "inline-flex", flexShrink: 0, opacity: btnBusy ? 0.5 : 1 }
+              },
+              /* @__PURE__ */ React.createElement(Icon, { name: "x", size: 13, stroke: 2.4, color: "#fff" })
+            ),
+            m.file.status !== "sent" && m.id && /* @__PURE__ */ React.createElement(
+              "button",
+              {
+                title: T.retry || "retry",
+                disabled: btnBusy,
+                onClick: (e) => {
+                  e.stopPropagation();
+                  if (!btnBusy)
+                    onRetry(m.id);
+                },
+                style: { background: "rgba(255,255,255,0.16)", border: "none", borderRadius: 6, cursor: btnBusy ? "wait" : "pointer", padding: 3, marginLeft: 2, display: "inline-flex", flexShrink: 0, opacity: btnBusy ? 0.5 : 1 }
+              },
+              /* @__PURE__ */ React.createElement(Icon, { name: "refresh", size: 13, stroke: 2.2, color: "#fff" })
+            )
+          );
         }
         return /* @__PURE__ */ React.createElement(
           "div",

package/dist/server.js

@@ -305,6 +305,39 @@ async function agentnetRestart() {
     }
     return { ok: false, error: lastErr };
 }
+// ── saved-files locations ───────────────────────────────────────────────────
+// The daemon (often running as root) owns downloads/ — on such machines this
+// user-level process gets EACCES writing there. Files WE save (sent copies,
+// browser-WebRTC receives) then go to a sibling `sent/` dir we own; readers
+// (open / download / reveal) look in downloads first, then sent.
+function sentDirFor(downloadsDir) {
+    return join(dirname(downloadsDir), "sent");
+}
+async function pickWritableSaveDir(downloadsDir) {
+    const fsp = await import("node:fs/promises");
+    try {
+        await fsp.mkdir(downloadsDir, { recursive: true });
+        await fsp.access(downloadsDir, (await import("node:fs")).constants.W_OK);
+        return downloadsDir;
+    }
+    catch {
+        const alt = sentDirFor(downloadsDir);
+        await fsp.mkdir(alt, { recursive: true });
+        return alt;
+    }
+}
+/** Resolve a saved file by name across downloads/ and sent/, with a
+ *  path-traversal guard. Returns null when absent from both. */
+function findSavedFile(downloadsDir, name) {
+    if (!name)
+        return null;
+    for (const dir of [downloadsDir, sentDirFor(downloadsDir)]) {
+        const f = join(dir, name);
+        if (f.startsWith(dir) && existsSync(f))
+            return f;
+    }
+    return null;
+}
 /** True only when the request came from the local machine. Used to gate the
  *  "Sign in with Decent" routes so binding the UI to a LAN IP can't expose
  *  identity signing to other hosts. The popup always runs in the local user's
@@ -956,8 +989,10 @@ export function startBeagleServer(opts) {
             }
             // ── File transfer ──────────────────────────────────────────────────
             // Upload: the browser POSTs raw file bytes with ?userid=&name= in the
-            // query. We stream them to a temp file (no in-memory buffering of large
-            // files) and hand the daemon that path over the existing file-send IPC.
+            // query. The upload is saved INTO downloads/ (collision-renamed) and
+            // kept — the sender's own chip can then open / reveal / download the
+            // file just like the receiver's. (It used to stream to a temp file
+            // deleted right after send, which made every sent chip a dead end.)
             if (req.method === "POST" && url === "/api/file-send") {
                 const q = new URL(req.url || "", "http://x").searchParams;
                 const userid = q.get("userid") || "";
@@ -970,17 +1005,36 @@ export function startBeagleServer(opts) {
                 const os = await import("node:os");
                 const fs = await import("node:fs");
                 const fsp = await import("node:fs/promises");
-                const tmpDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
-                const tmpPath = join(tmpDir, safe);
+                // Keep the copy under downloads when available (normal case); fall
+                // back to the old ephemeral temp only when downloads are disabled.
+                const keep = !!opts.downloadsDir;
+                let destDir;
+                if (keep) {
+                    destDir = await pickWritableSaveDir(opts.downloadsDir);
+                }
+                else {
+                    destDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
+                }
+                let destName = safe;
+                let destPath = join(destDir, destName);
+                if (keep) {
+                    const dot = safe.lastIndexOf(".");
+                    const base = dot > 0 ? safe.slice(0, dot) : safe;
+                    const ext = dot > 0 ? safe.slice(dot) : "";
+                    for (let i = 1; existsSync(destPath); i++) {
+                        destName = `${base}-${i}${ext}`;
+                        destPath = join(destDir, destName);
+                    }
+                }
                 try {
                     await new Promise((resolve2, reject) => {
-                        const ws = fs.createWriteStream(tmpPath);
+                        const ws = fs.createWriteStream(destPath);
                         req.pipe(ws);
                         req.on("error", reject);
                         ws.on("error", reject);
                         ws.on("finish", () => resolve2());
                     });
-                    const r = await opts.call({ op: "file-send", userid, path: tmpPath });
+                    const r = await opts.call({ op: "file-send", userid, path: destPath });
                     if (!r.ok) {
                         sendJson(res, 502, r);
                         return;
@@ -991,7 +1045,8 @@ export function startBeagleServer(opts) {
                     sendJson(res, 500, { ok: false, error: e instanceof Error ? e.message : String(e) });
                 }
                 finally {
-                    await fsp.rm(tmpDir, { recursive: true, force: true }).catch(() => undefined);
+                    if (!keep)
+                        await fsp.rm(destDir, { recursive: true, force: true }).catch(() => undefined);
                 }
                 return;
             }
@@ -1013,16 +1068,15 @@ export function startBeagleServer(opts) {
                     return;
                 }
                 const fs = await import("node:fs");
-                const fsp = await import("node:fs/promises");
-                await fsp.mkdir(opts.downloadsDir, { recursive: true });
+                const saveDir = await pickWritableSaveDir(opts.downloadsDir);
                 let finalName = safe;
-                let finalPath = join(opts.downloadsDir, finalName);
+                let finalPath = join(saveDir, finalName);
                 const dot = safe.lastIndexOf(".");
                 const base = dot > 0 ? safe.slice(0, dot) : safe;
                 const ext = dot > 0 ? safe.slice(dot) : "";
                 for (let i = 1; existsSync(finalPath); i++) {
                     finalName = `${base}-${i}${ext}`;
-                    finalPath = join(opts.downloadsDir, finalName);
+                    finalPath = join(saveDir, finalName);
                 }
                 try {
                     await new Promise((resolve2, reject) => {
@@ -1065,8 +1119,8 @@ export function startBeagleServer(opts) {
                 }
                 const body = await readBody(req);
                 const name = (typeof body.name === "string" ? body.name : "").replace(/[/\\]/g, "");
-                const file = join(opts.downloadsDir, name);
-                if (!name || !file.startsWith(opts.downloadsDir) || !existsSync(file)) {
+                const file = findSavedFile(opts.downloadsDir, name);
+                if (!file) {
                     sendJson(res, 404, { ok: false, error: "not found" });
                     return;
                 }
@@ -1082,9 +1136,9 @@ export function startBeagleServer(opts) {
                 }
                 const q = new URL(req.url || "", "http://x").searchParams;
                 const name = (q.get("name") || "").replace(/[/\\]/g, "");
-                const file = join(opts.downloadsDir, name);
-                // Path-traversal guard: the resolved path must stay under downloadsDir.
-                if (!name || !file.startsWith(opts.downloadsDir) || !existsSync(file)) {
+                // Looks in downloads/ then sent/ (traversal-guarded in the helper).
+                const file = findSavedFile(opts.downloadsDir, name);
+                if (!file) {
                     res.writeHead(404);
                     res.end("not found");
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",