@decentnetwork/beagle 0.1.4 → 0.1.6

package/README.md

@@ -28,6 +28,12 @@ Then open <http://localhost:8766>.
 Port 8766 rather than decentlan's 8765, so during the transition the old
 `agentnet ui` and Beagle can run side by side on one machine.
 
+## Calls (web ↔ Android)
+
+Online WebRTC with the Android app uses **Carrier bootstrap TURN**, not the
+tokyo messaging relay. See [docs/webrtc-android-interop.md](docs/webrtc-android-interop.md)
+for the failure modes and how the first-call cold-start was fixed.
+
 ## Status: Phase 1
 
 Beagle picks a **backend** for its Carrier identity. Exactly one is ever live,

package/dist/call-ice.d.ts

@@ -0,0 +1,14 @@
+import type { BootstrapNode } from "./node-config.js";
+export interface RtcIceServer {
+    urls: string | string[];
+    username?: string;
+    credential?: string;
+}
+/**
+ * Build RTCIceServer entries matching Android WebrtcClient.getIceServers().
+ */
+export declare function buildCarrierCallIceServers(opts: {
+    keyFile: string;
+    bootstrapNodes: BootstrapNode[];
+    limit?: number;
+}): Promise<RtcIceServer[]>;

package/dist/call-ice.js

@@ -0,0 +1,66 @@
+// Carrier bootstrap TURN credentials for browser WebRTC.
+//
+// Android online calls use CarrierExtension.getTurnServerInfo() →
+// carrier_get_turn_server(). Prefer @decentnetwork/peer getIceServers() when
+// the installed peer version exports it; otherwise fall back to
+// deriveCarrierTurnCreds via the package dist path (older peer builds).
+import { readFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { base58ToBytes, carrierIdFromPublicKey } from "@decentnetwork/peer";
+function hexToBytes(hex) {
+    const clean = hex.trim().replace(/^0x/i, "");
+    if (clean.length % 2 !== 0)
+        throw new Error("odd hex length");
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function loadKeyPair(keyFile) {
+    if (!existsSync(keyFile))
+        throw new Error(`key file missing: ${keyFile}`);
+    const parsed = JSON.parse(readFileSync(keyFile, "utf-8"));
+    if (parsed.format !== "decent-peer-tox-keypair-v1" || !parsed.publicKey || !parsed.secretKey) {
+        throw new Error(`unsupported key file: ${keyFile}`);
+    }
+    return {
+        publicKey: hexToBytes(parsed.publicKey),
+        secretKey: hexToBytes(parsed.secretKey),
+    };
+}
+/**
+ * Build RTCIceServer entries matching Android WebrtcClient.getIceServers().
+ */
+export async function buildCarrierCallIceServers(opts) {
+    const nodes = opts.bootstrapNodes.filter((n) => n?.host && n?.pk).slice(0, opts.limit ?? 3);
+    if (!nodes.length)
+        throw new Error("no bootstrap nodes for TURN");
+    const { publicKey, secretKey } = loadKeyPair(opts.keyFile);
+    const userid = carrierIdFromPublicKey(publicKey);
+    const peerRoot = dirname(fileURLToPath(import.meta.resolve("@decentnetwork/peer")));
+    const peerMod = (await import(pathToFileURL(join(peerRoot, "index.js")).href));
+    if (typeof peerMod.getIceServers === "function") {
+        return peerMod.getIceServers({
+            bootstrapNodes: nodes,
+            ourUserid: userid,
+            ourSecretKey: secretKey,
+            limit: opts.limit ?? 3,
+            includeTcpTurn: true,
+        });
+    }
+    const { deriveCarrierTurnCreds } = (await import(pathToFileURL(join(peerRoot, "turn-creds.js")).href));
+    const iceServers = [];
+    for (const n of nodes) {
+        const creds = deriveCarrierTurnCreds({
+            bootnodeHost: n.host,
+            bootnodePublicKey: base58ToBytes(n.pk),
+            ourUserid: userid,
+            ourSecretKey: secretKey,
+        });
+        const base = `${creds.host}:${creds.port}`;
+        iceServers.push({ urls: `stun:${base}`, username: creds.username, credential: creds.password }, { urls: `turn:${base}`, username: creds.username, credential: creds.password }, { urls: `turn:${base}?transport=tcp`, username: creds.username, credential: creds.password });
+    }
+    return iceServers;
+}

package/dist/cli.js

@@ -147,6 +147,10 @@ async function main() {
         routesPath: resolve(args.configDir, "routes.yaml"),
         doraRosterPath,
         downloadsDir: resolve(args.configDir, "downloads"),
+        callIce: {
+            keyFile: resolve(decentlanCarrierDir(args.configDir), "keypair.json"),
+            bootstrapNodes,
+        },
         meExtra: {
             // The panel reads "lan <x> · peer <y>". Report the real decentlan version
             // powering this backend, not beagle's own — conflating them made the

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.3";
+window.__DK_UI_VERSION="0.1.6";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',
@@ -377,6 +377,98 @@ Object.assign(window, {
   DK_ME_FALLBACK,
   dkCopy
 });
+const DK_FALLBACK_ICE_SERVERS = [
+  { urls: "stun:stun.l.google.com:19302" },
+  { urls: "turn:tokyo.fi.chat:3478", username: "allcom", credential: "allcompass" },
+  { urls: "turn:tokyo.fi.chat:3478?transport=tcp", username: "allcom", credential: "allcompass" }
+];
+const DK_LIVE_ICE_SERVERS = [];
+let _dkIcePromise = null;
+let _dkIceWarmPromise = null;
+function dkWarmCallIce(iceServers) {
+  if (_dkIceWarmPromise)
+    return _dkIceWarmPromise;
+  if (!window.RTCPeerConnection || !iceServers || !iceServers.length) {
+    _dkIceWarmPromise = Promise.resolve();
+    return _dkIceWarmPromise;
+  }
+  _dkIceWarmPromise = new Promise((resolve) => {
+    let pc;
+    let finished = false;
+    const done = (why) => {
+      if (finished)
+        return;
+      finished = true;
+      try {
+        if (pc)
+          pc.close();
+      } catch (e) {
+      }
+      console.log("[rtc] ICE warmup done (" + why + ")");
+      resolve();
+    };
+    try {
+      pc = new RTCPeerConnection({ iceServers, iceTransportPolicy: "all" });
+      const timer = setTimeout(() => done("timeout"), 5e3);
+      pc.onicecandidate = (ev) => {
+        const c = ev.candidate && ev.candidate.candidate;
+        if (c && /typ relay/.test(c)) {
+          clearTimeout(timer);
+          done("relay");
+        }
+      };
+      pc.onicegatheringstatechange = () => {
+        if (pc.iceGatheringState === "complete") {
+          clearTimeout(timer);
+          done("gather-complete");
+        }
+      };
+      pc.createDataChannel("ice-warm");
+      pc.createOffer().then((o) => pc.setLocalDescription(o)).catch(() => done("offer-fail"));
+    } catch (e) {
+      done("error");
+    }
+  });
+  return _dkIceWarmPromise;
+}
+function dkLoadCallIceServers() {
+  if (_dkIcePromise)
+    return _dkIcePromise;
+  _dkIcePromise = (async () => {
+    try {
+      const r = await fetch("/api/call-ice-servers", { headers: { "cache-control": "no-cache" } });
+      const d = await r.json();
+      if (d && d.ok && Array.isArray(d.iceServers) && d.iceServers.length) {
+        DK_LIVE_ICE_SERVERS.splice(0, DK_LIVE_ICE_SERVERS.length, ...d.iceServers);
+        console.log("[rtc] Carrier bootstrap ICE servers:", DK_LIVE_ICE_SERVERS.map((s) => s.urls));
+        await dkWarmCallIce(DK_LIVE_ICE_SERVERS);
+        return DK_LIVE_ICE_SERVERS;
+      }
+      console.warn("[rtc] call-ice-servers unavailable:", d && d.error);
+    } catch (e) {
+      console.warn("[rtc] call-ice-servers fetch failed", e);
+    }
+    console.warn("[rtc] falling back to tokyo TURN \u2014 web\u2194Android online ICE may fail");
+    DK_LIVE_ICE_SERVERS.splice(0, DK_LIVE_ICE_SERVERS.length, ...DK_FALLBACK_ICE_SERVERS.map((s) => ({ ...s })));
+    await dkWarmCallIce(DK_LIVE_ICE_SERVERS);
+    return DK_LIVE_ICE_SERVERS;
+  })();
+  return _dkIcePromise;
+}
+function dkAwaitCallIceServers(ms) {
+  const budget = typeof ms === "number" ? ms : 1e4;
+  return Promise.race([
+    dkLoadCallIceServers(),
+    new Promise((resolve) => setTimeout(() => {
+      if (!DK_LIVE_ICE_SERVERS.length) {
+        DK_LIVE_ICE_SERVERS.splice(0, DK_LIVE_ICE_SERVERS.length, ...DK_FALLBACK_ICE_SERVERS.map((s) => ({ ...s })));
+        console.warn("[rtc] ICE wait timed out \u2014 using fallback");
+      }
+      resolve(DK_LIVE_ICE_SERVERS);
+    }, budget))
+  ]).then(() => DK_LIVE_ICE_SERVERS);
+}
+dkLoadCallIceServers();
 function dkRtcParseEnvelope(data) {
   const text = String(data || "").replace(/\0+$/u, "").trim();
   if (!text)
@@ -394,12 +486,20 @@ function dkRtcSignalBus() {
     return window.__dkRtcSignalBus;
   const PW = window.PeerWebRTC;
   const handlers = /* @__PURE__ */ new Map();
+  const pendingCalls = [];
+  const PENDING_CALL_CAP = 16;
   let started = false;
   let stopped = false;
   function emit(kind, userid, payload) {
     const set = handlers.get(kind);
-    if (!set)
+    if (!set || !set.size) {
+      if (kind === "call") {
+        pendingCalls.push({ userid, payload });
+        if (pendingCalls.length > PENDING_CALL_CAP)
+          pendingCalls.shift();
+      }
       return;
+    }
     for (const h of Array.from(set)) {
       try {
         h(userid, payload);
@@ -447,6 +547,17 @@ function dkRtcSignalBus() {
         handlers.set(kind, /* @__PURE__ */ new Set());
       handlers.get(kind).add(cb);
       this.start();
+      if (kind === "call" && pendingCalls.length) {
+        const queued = pendingCalls.splice(0);
+        console.log("[rtc] flushing " + queued.length + " buffered call signal(s)");
+        for (const q of queued) {
+          try {
+            cb(q.userid, q.payload);
+          } catch (e) {
+            console.warn("[rtc] buffered call handler failed", e);
+          }
+        }
+      }
       return () => {
         var _a;
         return (_a = handlers.get(kind)) == null ? void 0 : _a.delete(cb);
@@ -1313,9 +1424,27 @@ function dkSafeHref(s) {
   }
   return "";
 }
+function dkTrimUrlTail(raw) {
+  let url = raw;
+  const TAIL = `.,;:!?'"\u3002\uFF0C\u3001\uFF1B\uFF1A\uFF01\uFF1F\u2026\u201D\u2019\u300D\u300F`;
+  const PAIRS = [["(", ")"], ["[", "]"], ["{", "}"], ["\uFF08", "\uFF09"], ["\u3010", "\u3011"], ["\u300A", "\u300B"]];
+  const count = (s, ch) => s.split(ch).length - 1;
+  for (; ; ) {
+    const before = url;
+    while (url && TAIL.indexOf(url[url.length - 1]) >= 0)
+      url = url.slice(0, -1);
+    for (let i = 0; i < PAIRS.length; i += 1) {
+      const open = PAIRS[i][0], close = PAIRS[i][1];
+      if (url.slice(-1) === close && count(url, open) < count(url, close))
+        url = url.slice(0, -1);
+    }
+    if (url === before)
+      return url;
+  }
+}
 function dkInlineMarkdown(s) {
   const text = String(s == null ? "" : s);
-  const tokenRe = /(`[^`\n]+`|\[[^\]\n]+\]\([^) \n]+(?: [^)]+)?\)|\*\*[^*\n]+?\*\*|\*[^*\n]+?\*)/g;
+  const tokenRe = /(`[^`\n]+`|\[[^\]\n]+\]\([^) \n]+(?: [^)]+)?\)|https?:\/\/[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=%]+|\*\*[^*\n]+?\*\*|\*[^*\n]+?\*)/g;
   let out = "";
   let last = 0;
   let m;
@@ -1328,6 +1457,11 @@ function dkInlineMarkdown(s) {
       const lm = /^\[([^\]\n]+)\]\(([^) \n]+)(?: [^)]+)?\)$/.exec(tok);
       const href = lm && dkSafeHref(lm[2]);
       out += href ? '<a href="' + dkHtmlEscape(href) + '" target="_blank" rel="noopener">' + dkHtmlEscape(lm[1]) + "</a>" : dkHtmlEscape(tok);
+    } else if (/^https?:\/\//.test(tok)) {
+      const url = dkTrimUrlTail(tok);
+      const href = dkSafeHref(url);
+      const tail = tok.slice(url.length);
+      out += href ? '<a href="' + dkHtmlEscape(href) + '" target="_blank" rel="noopener">' + dkHtmlEscape(url) + "</a>" + dkHtmlEscape(tail) : dkHtmlEscape(tok);
     } else if (tok.startsWith("**")) {
       out += "<strong>" + dkHtmlEscape(tok.slice(2, -2)) + "</strong>";
     } else if (tok.startsWith("*")) {
@@ -2492,6 +2626,12 @@ const DK_FILE_RTC_KIND = "file";
 const DK_FILE_RTC_CHUNK = 16 * 1024;
 const DK_FILE_RTC_OPEN_TIMEOUT_MS = 2e4;
 const DK_FILE_RTC_SIGNAL_TTL_MS = 10 * 60 * 1e3;
+let _dkFileIcePromise = null;
+function dkFileIceServers() {
+  if (!_dkFileIcePromise)
+    _dkFileIcePromise = dkLoadCallIceServers();
+  return _dkFileIcePromise;
+}
 function dkFileRtcId() {
   if (window.crypto && window.crypto.randomUUID)
     return window.crypto.randomUUID();
@@ -2677,7 +2817,7 @@ function useRtcFileController(selfId, onReceivedFile) {
             console.warn("[file-rtc] duplicate offer ignored for " + fileId);
             return;
           }
-          const pc = new RTCPeerConnection({ iceServers: CALL_ICE_SERVERS });
+          const pc = new RTCPeerConnection({ iceServers: await dkFileIceServers() });
           pc.oniceconnectionstatechange = () => console.warn("[file-rtc] receiver ice=" + pc.iceConnectionState + " conn=" + pc.connectionState);
           pc.onconnectionstatechange = () => console.warn("[file-rtc] receiver conn=" + pc.connectionState + " ice=" + pc.iceConnectionState);
           pc.onicecandidate = (ev) => {
@@ -2745,7 +2885,7 @@ function useRtcFileController(selfId, onReceivedFile) {
     }
     const bus = dkRtcSignalBus();
     const fileId = dkFileRtcId();
-    const pc = new RTCPeerConnection({ iceServers: CALL_ICE_SERVERS });
+    const pc = new RTCPeerConnection({ iceServers: await dkFileIceServers() });
     const dc = pc.createDataChannel("agentnet-file", { ordered: true });
     const sess = { pc, dc, peerId, chunks: [], meta: null, pendingCandidates: [] };
     peersRef.current.set(fileId, sess);
@@ -2846,11 +2986,6 @@ function RtcFileInbox({ T, peers, ctl }) {
   }));
 }
 Object.assign(window, { useRtcFileController, RtcFileInbox });
-const CALL_ICE_SERVERS = [
-  { urls: "stun:stun.l.google.com:19302" },
-  { urls: "turn:tokyo.fi.chat:3478", username: "allcom", credential: "allcompass" },
-  { urls: "turn:tokyo.fi.chat:3478?transport=tcp", username: "allcom", credential: "allcompass" }
-];
 const VIDEO_CODEC_KEEP = /^video\/(H264|VP8|rtx|red|ulpfec)$/i;
 const SDP_BUDGET = 8192;
 function trimVideoCodecs(pc) {
@@ -2906,71 +3041,106 @@ function useCallController(selfId, onCallLog) {
       console.warn("[call] WebRTC or peer-webrtc unavailable \u2014 calls disabled");
       return;
     }
-    const { CallEngine } = window.PeerWebRTC;
-    const signaling = makeDaemonSignaling();
-    const engine = new CallEngine({
-      selfId,
-      signaling,
-      createPeerConnection: (c) => createLeanPeerConnection(c),
-      getLocalMedia: (k) => navigator.mediaDevices.getUserMedia({ audio: k.audio, video: k.video }),
-      getDisplayMedia: (c) => navigator.mediaDevices.getDisplayMedia(c || { video: true, audio: false }),
-      iceServers: CALL_ICE_SERVERS,
-      logger: (m) => console.log(m)
-    });
-    engine.on("incomingCall", (info) => {
-      setIncoming(info);
-      if (onCallLogRef.current)
-        onCallLogRef.current(info.peerId, !!info.video, "incoming");
-    });
-    engine.on("stateChanged", (info, state) => setActive((a) => a && a.callId === info.callId ? { ...a, state } : a));
-    engine.on("localStream", (id, s) => {
-      setLocalStream(s);
-      try {
-        setSharing(engine.isSharingScreen(id));
-      } catch (e) {
+    dkRtcSignalBus().start();
+    let cancelled = false;
+    let signaling = null;
+    (async () => {
+      await dkAwaitCallIceServers(1e4);
+      if (cancelled || engineRef.current)
+        return;
+      if (!DK_LIVE_ICE_SERVERS.length) {
+        console.warn("[call] no ICE servers after wait \u2014 calls will likely fail NAT");
       }
-    });
-    engine.on("remoteStream", (id, s) => setRemoteStream(s));
-    engine.on("ended", (id) => {
-      setActive((a) => a && a.callId === id ? null : a);
-      setIncoming((i) => i && i.callId === id ? null : i);
-      setLocalStream(null);
-      setRemoteStream(null);
-    });
-    engineRef.current = engine;
+      const { CallEngine } = window.PeerWebRTC;
+      signaling = makeDaemonSignaling();
+      const engine = new CallEngine({
+        selfId,
+        signaling,
+        createPeerConnection: (c) => createLeanPeerConnection(c),
+        getLocalMedia: (k) => navigator.mediaDevices.getUserMedia({ audio: k.audio, video: k.video }),
+        getDisplayMedia: (c) => navigator.mediaDevices.getDisplayMedia(c || { video: true, audio: false }),
+        iceServers: DK_LIVE_ICE_SERVERS,
+        logger: (m) => console.log(m)
+      });
+      if (cancelled) {
+        try {
+          signaling.stop();
+          engine.dispose();
+        } catch (e) {
+        }
+        return;
+      }
+      engine.on("incomingCall", (info) => {
+        setIncoming(info);
+        if (onCallLogRef.current)
+          onCallLogRef.current(info.peerId, !!info.video, "incoming");
+      });
+      engine.on("stateChanged", (info, state) => setActive((a) => a && a.callId === info.callId ? { ...a, state } : a));
+      engine.on("localStream", (id, s) => {
+        setLocalStream(s);
+        try {
+          setSharing(engine.isSharingScreen(id));
+        } catch (e) {
+        }
+      });
+      engine.on("remoteStream", (id, s) => setRemoteStream(s));
+      engine.on("ended", (id) => {
+        setActive((a) => a && a.callId === id ? null : a);
+        setIncoming((i) => i && i.callId === id ? null : i);
+        setLocalStream(null);
+        setRemoteStream(null);
+      });
+      engineRef.current = engine;
+      console.log("[call] CallEngine ready with ICE:", DK_LIVE_ICE_SERVERS.map((s) => s.urls));
+    })().catch((e) => console.warn("[call] engine init failed", e));
     return () => {
+      cancelled = true;
       try {
-        signaling.stop();
-        engine.dispose();
+        if (signaling)
+          signaling.stop();
+        if (engineRef.current)
+          engineRef.current.dispose();
       } catch (e) {
       }
       engineRef.current = null;
     };
   }, [selfId]);
-  const start = React.useCallback((peerId, video) => {
-    const eng = engineRef.current;
-    if (!eng) {
-      alert("Calls unavailable (WebRTC not supported here)");
-      return;
+  const waitEngine = React.useCallback(async () => {
+    for (let i = 0; i < 100; i++) {
+      if (engineRef.current)
+        return engineRef.current;
+      await new Promise((r) => setTimeout(r, 100));
     }
+    return null;
+  }, []);
+  const start = React.useCallback((peerId, video) => {
     setActive({ callId: null, peerId, video: !!video, direction: "outgoing", state: "ringing" });
     if (onCallLogRef.current)
       onCallLogRef.current(peerId, !!video, "outgoing");
-    eng.call(peerId, { audio: true, video: !!video }).then((callId) => setActive((a) => a && a.peerId === peerId && a.callId === null ? { ...a, callId } : a)).catch((e) => {
+    waitEngine().then((eng) => {
+      if (!eng)
+        throw new Error("Calls unavailable (engine not ready)");
+      return eng.call(peerId, { audio: true, video: !!video });
+    }).then((callId) => setActive((a) => a && a.peerId === peerId && a.callId === null ? { ...a, callId } : a)).catch((e) => {
       setActive((a) => a && a.peerId === peerId ? null : a);
       alert("Could not start call: " + (e && e.message || e));
     });
-  }, []);
-  const accept = React.useCallback(async () => {
-    const eng = engineRef.current;
+  }, [waitEngine]);
+  const accept = React.useCallback(() => {
+    let pending = null;
     setIncoming((inc) => {
-      if (eng && inc) {
-        setActive({ callId: inc.callId, peerId: inc.peerId, video: inc.video, direction: "incoming", state: "connecting" });
-        eng.accept(inc.callId).catch((e) => alert("Accept failed: " + (e && e.message || e)));
-      }
+      pending = inc;
       return null;
     });
-  }, []);
+    if (!pending)
+      return;
+    setActive({ callId: pending.callId, peerId: pending.peerId, video: pending.video, direction: "incoming", state: "connecting" });
+    waitEngine().then((eng) => {
+      if (!eng)
+        throw new Error("Calls unavailable (engine not ready)");
+      return eng.accept(pending.callId);
+    }).catch((e) => alert("Accept failed: " + (e && e.message || e)));
+  }, [waitEngine]);
   const reject = React.useCallback(() => {
     const eng = engineRef.current;
     setIncoming((inc) => {
@@ -3045,6 +3215,16 @@ function useRingtone(active) {
     }
     let stopped = false;
     const timers = [];
+    const stop = () => {
+      if (stopped)
+        return;
+      stopped = true;
+      timers.forEach(clearTimeout);
+      try {
+        ctx.close();
+      } catch (e) {
+      }
+    };
     const burst = () => {
       if (stopped || ctx.state === "closed")
         return;
@@ -3065,13 +3245,12 @@ function useRingtone(active) {
       timers.push(setTimeout(burst, 3e3));
     };
     burst();
+    window.addEventListener("pagehide", stop);
+    window.addEventListener("beforeunload", stop);
     return () => {
-      stopped = true;
-      timers.forEach(clearTimeout);
-      try {
-        ctx.close();
-      } catch (e) {
-      }
+      window.removeEventListener("pagehide", stop);
+      window.removeEventListener("beforeunload", stop);
+      stop();
     };
   }, [active]);
 }

package/dist/desktop/index.html

@@ -36,7 +36,12 @@
   .dk-md code { font-family: 'JetBrains Mono', ui-monospace, Menlo, monospace; font-size: 0.92em; background: rgba(0,0,0,0.18); border-radius: 4px; padding: 0.08em 0.3em; }
   .dk-md pre { margin: 0.45em 0 0; padding: 8px 10px; overflow: auto; border-radius: 8px; background: rgba(0,0,0,0.22); }
   .dk-md pre code { display: block; background: transparent; padding: 0; white-space: pre; }
-  .dk-md a { color: inherit; text-decoration: underline; text-underline-offset: 2px; }
+  /* color:inherit is deliberate — the same rule has to read well on the dark
+     incoming bubble AND on the accent-coloured outgoing one, where a blue link
+     would clash. The affordance comes from the underline and the cursor. */
+  .dk-md a { color: inherit; text-decoration: underline; text-underline-offset: 2px;
+             cursor: pointer; overflow-wrap: anywhere; }
+  .dk-md a:hover { text-decoration-thickness: 2px; opacity: 0.85; }
   @keyframes dkpulse { 0% { transform: scale(0.9); opacity: 0.7; } 70% { transform: scale(1.5); opacity: 0; } 100% { opacity: 0; } }
 </style>
 </head>

package/dist/embedded-host.js

@@ -207,8 +207,22 @@ export class EmbeddedHost {
         // file chips oldest-first. Reading history() and pattern-matching its shape
         // would couple this to the store's serialization format for no reason.
         for (const msg of this.#messages.queuedOutgoing(pubkey)) {
-            if (!msg.file)
+            // Queued TEXT delivers here too — it used to be skipped, which made
+            // "queued" a terminal state for text: the clock icon never resolved.
+            if (!msg.file) {
+                try {
+                    await this.#node.sendText(pubkey, msg.text);
+                    this.#messages.setStatus(pubkey, msg.id, "sent");
+                    this.#events.emit("event", { type: "chat", userid: pubkey, dir: "out" });
+                }
+                catch (e) {
+                    // Still unreachable — stays queued for the next reconnect. Stop
+                    // flushing so later messages can't overtake this one.
+                    this.#logger.warn(`queued text flush failed: ${e.message}`);
+                    break;
+                }
                 continue;
+            }
             const path = resolve(this.outboxDir, msg.id);
             if (!existsSync(path))
                 continue;
@@ -347,11 +361,34 @@ export class EmbeddedHost {
             }
             case "chat-send": {
                 const text = String(req.text ?? "");
-                await this.#node.sendText(uid, text);
-                this.#messages.append(uid, "out", text, Date.now(), "sent");
+                if (!text)
+                    return {};
+                // Record the user's message BEFORE any network attempt. It used to be
+                // appended only after sendText resolved, so an ACK timeout made the
+                // user's own words vanish from their own thread — they watched the
+                // peer answer a question that wasn't on screen (INBOX 2026-08-02).
+                // A send failure is a delivery state ON the message, never its absence.
+                const msg = this.#messages.append(uid, "out", text, Date.now());
                 this.#meta.ensure(uid);
                 this.#events.emit("event", { type: "chat", userid: uid, dir: "out" });
-                return {};
+                // Anything already queued for this peer goes first — the new message
+                // must not overtake older ones the moment the path recovers.
+                await this.#flushOutbox(uid).catch(() => { });
+                try {
+                    await this.#node.sendText(uid, text);
+                    this.#messages.setStatus(uid, msg.id, "sent");
+                    return {};
+                }
+                catch (e) {
+                    // Offline peer or failed delivery: same recovery either way — keep
+                    // the message "queued" (the UI shows the clock) and deliver it on
+                    // the friend's reconnect via #flushOutbox. This is a success from
+                    // the caller's side: the store owns the message; only its delivery
+                    // is pending.
+                    this.#logger.info(`send to ${uid.slice(0, 8)} queued: ${e.message}`);
+                    this.#messages.setStatus(uid, msg.id, "queued");
+                    return { queued: true };
+                }
             }
             case "chat-log-local":
                 this.#messages.append(uid, req.dir ?? "in", String(req.text ?? ""), Date.now());

package/dist/server.d.ts

@@ -37,6 +37,17 @@ export interface BeagleServerOptions {
     listenHost?: string;
     listenPort?: number;
     log?: (msg: string) => void;
+    /** Carrier identity keyfile + bootstrap fleet — used to mint TURN creds for
+     *  browser WebRTC so online calls use the same relays as Android
+     *  CarrierExtension.getTurnServerInfo(). */
+    callIce?: {
+        keyFile: string;
+        bootstrapNodes: Array<{
+            host: string;
+            port: number;
+            pk: string;
+        }>;
+    };
 }
 export declare function startBeagleServer(opts: BeagleServerOptions): {
     stop: () => void;

package/dist/server.js

@@ -645,6 +645,17 @@ export function startBeagleServer(opts) {
                 }
                 // Is THIS node one of the official exit nodes? (so the UI can badge it).
                 const meExit = DEFAULT_EXITS.find((e) => e.userid && e.userid === identity.userid);
+                // "online" must mean "on the Carrier network", and the two backends
+                // know that differently. The daemon has a TUN device, so a TUN IP is
+                // a fine proxy. The embedded backend NEVER creates a TUN — judging it
+                // by tun.ip pinned this light at false forever, and every
+                // beagle-desktop user (embedded-only, no root) saw a dead app while
+                // messages flowed normally (INBOX 2026-08-02). For embedded, ask the
+                // peer itself: a live TCP-relay connection or a joined DHT is being
+                // on the network. TUN keeps its own field (`lan`) — it answers "do I
+                // have a virtual LAN", which is a different question.
+                const dht = d.dht ?? null;
+                const embeddedOnline = !!dht && ((Number(dht.tcpRelayConnected) || 0) > 0 || (Number(dht.knownNodesCount) || 0) > 0);
                 const me = {
                     name: node.name || (identity.userid ?? "").slice(0, 8),
                     // Handle reads as a network address: <name>@decentnetwork.
@@ -654,7 +665,8 @@ export function startBeagleServer(opts) {
                     carrier: identity.address ?? "",
                     netKey: identity.userid ?? "",
                     ip: tun.ip ?? d.allocatedIp ?? "",
-                    online: !!tun.ip,
+                    online: node.backend === "embedded" ? embeddedOnline : !!tun.ip,
+                    lan: !!tun.ip,
                     lanVer: opts.meExtra?.lanVer ?? "",
                     peerVer: opts.meExtra?.peerVer ?? "",
                     channel: opts.meExtra?.channel ?? "@next",
@@ -861,6 +873,23 @@ export function startBeagleServer(opts) {
                 sendJson(res, r.ok ? 200 : 400, r);
                 return;
             }
+            // Carrier bootstrap TURN for browser RTCPeerConnection — same scheme as
+            // Android WebrtcClient.getIceServers() / carrier_get_turn_server().
+            if (req.method === "GET" && url === "/api/call-ice-servers") {
+                if (!opts.callIce) {
+                    sendJson(res, 503, { ok: false, error: "call ICE not configured" });
+                    return;
+                }
+                try {
+                    const { buildCarrierCallIceServers } = await import("./call-ice.js");
+                    const iceServers = await buildCarrierCallIceServers(opts.callIce);
+                    sendJson(res, 200, { ok: true, iceServers });
+                }
+                catch (error) {
+                    sendJson(res, 500, { ok: false, error: error.message });
+                }
+                return;
+            }
             if (req.method === "GET" && url === "/api/call-poll") {
                 // The daemon holds this up to ~20s (long-poll). opts.call's own IPC
                 // timeout is 30s, so it returns before that; on any error, resolve

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.4",
-  "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
+  "version": "0.1.6",
+  "description": "Beagle \u2014 P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
@@ -27,7 +27,7 @@
   "dependencies": {
     "@decentnetwork/chat-components": "^0.1.3",
     "@decentnetwork/lan": "^0.1.256",
-    "@decentnetwork/peer": "^0.1.123",
+    "@decentnetwork/peer": "^0.1.136",
     "@decentnetwork/peer-webrtc": "^0.2.10",
     "js-yaml": "^4.1.0",
     "yargs": "^17.7.2"