@decentnetwork/beagle 0.1.38 → 0.1.40

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.37";
+window.__DK_UI_VERSION="0.1.39";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',
@@ -1882,7 +1882,7 @@ function DkChatForm({ form, submitted, peer, onSubmit }) {
     return null;
   }), err && /* @__PURE__ */ React.createElement("div", { style: { color: "var(--danger, #ff6b6b)", fontSize: 11.5, fontFamily: "var(--mono)" } }, err));
 }
-function Msg({ m, peer, T, onTheater, onDelete, onCancel, onRetry, onReveal, onCall, onFormSubmit, answered, selMode, selected, onToggleSel, busy, isGroup }) {
+function Msg({ m, peer, T, onTheater, onDelete, onCancel, onRetry, onReveal, onOpenFile, onCall, onFormSubmit, answered, selMode, selected, onToggleSel, busy, isGroup }) {
   const mine = m.from === "me";
   const nativeMedia = !m.file ? dkNativeMediaFromText(m.text) : null;
   const grp = isGroup && m.dir !== "out" && !m.file && !nativeMedia ? dkGroupParse(m.text) : null;
@@ -2061,7 +2061,7 @@ function Msg({ m, peer, T, onTheater, onDelete, onCancel, onRetry, onReveal, onC
             {
               style: { ...cardStyle, cursor: "pointer", opacity: btnBusy ? 0.85 : 1 },
               title: T.open || "open",
-              onClick: () => window.open(dkFileUrl(m.file.name), "_blank", "noopener")
+              onClick: () => onOpenFile ? onOpenFile(m.file.name) : window.open(dkFileUrl(m.file.name), "_blank", "noopener")
             },
             icon,
             meta,
@@ -2124,7 +2124,7 @@ function Msg({ m, peer, T, onTheater, onDelete, onCancel, onRetry, onReveal, onC
           {
             style: cardStyle,
             title: "open",
-            onClick: () => window.open(dkFileUrl(m.file.name), "_blank", "noopener")
+            onClick: () => onOpenFile ? onOpenFile(m.file.name) : window.open(dkFileUrl(m.file.name), "_blank", "noopener")
           },
           icon,
           meta,
@@ -2309,10 +2309,21 @@ function Conversation({ T, peer, lang, thread: threadProp, onSend, onSendFile, o
       return;
     dkApi.revealFile(name).then((r) => {
       if (!r || r.ok === false) {
-        showFlash("err", (lang === "zh" ? "\u65E0\u6CD5\u5728\u6587\u4EF6\u7BA1\u7406\u5668\u4E2D\u663E\u793A: " : "Could not reveal file: ") + (r && r.error || ""));
+        const missing = /not found/i.test(r && r.error || "");
+        showFlash("err", missing ? lang === "zh" ? "\u672C\u5730\u6CA1\u6709\u8FD9\u4E2A\u6587\u4EF6\u7684\u526F\u672C(\u5B83\u662F\u65E7\u7248\u672C\u53D1\u9001\u7684,\u5F53\u65F6\u53D1\u5B8C\u5373\u5220;\u65B0\u53D1\u9001\u7684\u6587\u4EF6\u90FD\u4F1A\u4FDD\u7559)" : "No local copy of this file \u2014 it was sent by an older version that did not keep sent copies. Files sent from now on are kept." : (lang === "zh" ? "\u65E0\u6CD5\u5728\u6587\u4EF6\u7BA1\u7406\u5668\u4E2D\u663E\u793A: " : "Could not reveal file: ") + (r && r.error || ""));
       }
     });
   };
+  const doOpenFile = (name) => {
+    if (!name)
+      return;
+    fetch(dkFileDownloadUrl(name), { method: "GET", headers: { range: "bytes=0-0" } }).then((r) => {
+      if (r.ok || r.status === 206)
+        window.open(dkFileUrl(name), "_blank", "noopener");
+      else
+        showFlash("err", lang === "zh" ? "\u672C\u5730\u6CA1\u6709\u8FD9\u4E2A\u6587\u4EF6\u7684\u526F\u672C(\u65E7\u7248\u672C\u53D1\u9001\u7684\u6587\u4EF6\u672A\u4FDD\u7559;\u65B0\u53D1\u9001\u7684\u90FD\u4F1A\u4FDD\u7559)" : "No local copy \u2014 sent before local copies were kept.");
+    }).catch(() => showFlash("err", lang === "zh" ? "\u6253\u5F00\u5931\u8D25" : "Could not open the file"));
+  };
   const doCancel = (id) => {
     if (!id || fileBusy[id])
       return;
@@ -2525,6 +2536,7 @@ ${peer.address}`
         onCancel: doCancel,
         onRetry: doRetry,
         onReveal: doReveal,
+        onOpenFile: doOpenFile,
         onCall,
         onFormSubmit: () => onReloadThread && onReloadThread(),
         answered,

package/dist/server.js

@@ -305,6 +305,39 @@ async function agentnetRestart() {
     }
     return { ok: false, error: lastErr };
 }
+// ── saved-files locations ───────────────────────────────────────────────────
+// The daemon (often running as root) owns downloads/ — on such machines this
+// user-level process gets EACCES writing there. Files WE save (sent copies,
+// browser-WebRTC receives) then go to a sibling `sent/` dir we own; readers
+// (open / download / reveal) look in downloads first, then sent.
+function sentDirFor(downloadsDir) {
+    return join(dirname(downloadsDir), "sent");
+}
+async function pickWritableSaveDir(downloadsDir) {
+    const fsp = await import("node:fs/promises");
+    try {
+        await fsp.mkdir(downloadsDir, { recursive: true });
+        await fsp.access(downloadsDir, (await import("node:fs")).constants.W_OK);
+        return downloadsDir;
+    }
+    catch {
+        const alt = sentDirFor(downloadsDir);
+        await fsp.mkdir(alt, { recursive: true });
+        return alt;
+    }
+}
+/** Resolve a saved file by name across downloads/ and sent/, with a
+ *  path-traversal guard. Returns null when absent from both. */
+function findSavedFile(downloadsDir, name) {
+    if (!name)
+        return null;
+    for (const dir of [downloadsDir, sentDirFor(downloadsDir)]) {
+        const f = join(dir, name);
+        if (f.startsWith(dir) && existsSync(f))
+            return f;
+    }
+    return null;
+}
 /** True only when the request came from the local machine. Used to gate the
  *  "Sign in with Decent" routes so binding the UI to a LAN IP can't expose
  *  identity signing to other hosts. The popup always runs in the local user's
@@ -977,8 +1010,7 @@ export function startBeagleServer(opts) {
                 const keep = !!opts.downloadsDir;
                 let destDir;
                 if (keep) {
-                    destDir = opts.downloadsDir;
-                    await fsp.mkdir(destDir, { recursive: true });
+                    destDir = await pickWritableSaveDir(opts.downloadsDir);
                 }
                 else {
                     destDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
@@ -1036,16 +1068,15 @@ export function startBeagleServer(opts) {
                     return;
                 }
                 const fs = await import("node:fs");
-                const fsp = await import("node:fs/promises");
-                await fsp.mkdir(opts.downloadsDir, { recursive: true });
+                const saveDir = await pickWritableSaveDir(opts.downloadsDir);
                 let finalName = safe;
-                let finalPath = join(opts.downloadsDir, finalName);
+                let finalPath = join(saveDir, finalName);
                 const dot = safe.lastIndexOf(".");
                 const base = dot > 0 ? safe.slice(0, dot) : safe;
                 const ext = dot > 0 ? safe.slice(dot) : "";
                 for (let i = 1; existsSync(finalPath); i++) {
                     finalName = `${base}-${i}${ext}`;
-                    finalPath = join(opts.downloadsDir, finalName);
+                    finalPath = join(saveDir, finalName);
                 }
                 try {
                     await new Promise((resolve2, reject) => {
@@ -1088,8 +1119,8 @@ export function startBeagleServer(opts) {
                 }
                 const body = await readBody(req);
                 const name = (typeof body.name === "string" ? body.name : "").replace(/[/\\]/g, "");
-                const file = join(opts.downloadsDir, name);
-                if (!name || !file.startsWith(opts.downloadsDir) || !existsSync(file)) {
+                const file = findSavedFile(opts.downloadsDir, name);
+                if (!file) {
                     sendJson(res, 404, { ok: false, error: "not found" });
                     return;
                 }
@@ -1105,9 +1136,9 @@ export function startBeagleServer(opts) {
                 }
                 const q = new URL(req.url || "", "http://x").searchParams;
                 const name = (q.get("name") || "").replace(/[/\\]/g, "");
-                const file = join(opts.downloadsDir, name);
-                // Path-traversal guard: the resolved path must stay under downloadsDir.
-                if (!name || !file.startsWith(opts.downloadsDir) || !existsSync(file)) {
+                // Looks in downloads/ then sent/ (traversal-guarded in the helper).
+                const file = findSavedFile(opts.downloadsDir, name);
+                if (!file) {
                     res.writeHead(404);
                     res.end("not found");
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",