@decentnetwork/beagle 0.1.59 → 0.1.61

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.59";
+window.__DK_UI_VERSION="0.1.61";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js
@@ -2925,11 +2925,14 @@ ${peer.address}`
     return /* @__PURE__ */ React.createElement(Card, { label: zh ? "\u663E\u793A" : "Display" }, /* @__PURE__ */ React.createElement("div", { style: { ...row, borderBottom: "1px solid var(--line)" } }, /* @__PURE__ */ React.createElement("span", { style: name }, zh ? "\u8BED\u8A00" : "Language"), seg("lang", t.lang, (v) => setTweak("lang", v), [["en", "EN"], ["zh", "\u4E2D\u6587"]])), /* @__PURE__ */ React.createElement("div", { style: row }, /* @__PURE__ */ React.createElement("span", { style: name }, zh ? "\u4E3B\u9898" : "Theme"), seg("theme", t.theme, (v) => setTweak("theme", v), [["dark", zh ? "\u6DF1\u8272" : "Dark"], ["light", zh ? "\u6D45\u8272" : "Light"]])));
   }
   function ProfileTab({ T, me, onEdit, t, setTweak }) {
+    var _a;
     const [qr, setQr] = React.useState(null);
     const [editing, setEditing] = React.useState(false);
     const [ensRec, setEnsRec] = React.useState(null);
-    const punkId = ensRec && ensRec.nft === "CryptoPunks" && ensRec.nftid > 0 ? ensRec.nftid : null;
-    const upAvatar = ensRec && ensRec.texts && ensRec.texts.avatar || null;
+    const pubPunk = ensRec && ensRec.nft === "CryptoPunks" && ensRec.nftid > 0 ? ensRec.nftid : null;
+    const pubAvatar = ensRec && ensRec.texts && ensRec.texts.avatar || null;
+    const punkId = (_a = me.punkId) != null ? _a : pubPunk;
+    const upAvatar = me.avatarUrl || pubAvatar;
     return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, overflow: "auto", background: "var(--bg)" } }, /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto", padding: "24px 28px 60px", display: "flex", flexDirection: "column", gap: 24 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 18, padding: "20px 22px", borderRadius: 14, background: "var(--panel)", border: "1px solid var(--line)" } }, /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, upAvatar ? /* @__PURE__ */ React.createElement("img", { src: upAvatar, alt: "", width: 68, height: 68, style: { width: 68, height: 68, borderRadius: 16, objectFit: "cover", background: "var(--panel-2)" } }) : punkId != null ? /* @__PURE__ */ React.createElement(DkPunkAvatar, { id: punkId, size: 68, radius: 16, fallbackSeed: me.userId }) : /* @__PURE__ */ React.createElement(DkIdenticon, { seed: me.userId, size: 68, radius: 16 }), /* @__PURE__ */ React.createElement("span", { style: { position: "absolute", right: -3, bottom: -3, width: 18, height: 18, borderRadius: 999, background: "var(--online)", border: "3px solid var(--panel)" } })), /* @__PURE__ */ React.createElement("div", { style: { flex: 1, minWidth: 0 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10 } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 22, fontWeight: 700, letterSpacing: -0.5, color: "var(--text)" } }, me.name), /* @__PURE__ */ React.createElement(Tag, { tone: "ok" }, "online"), me.isExit && /* @__PURE__ */ React.createElement(Tag, { tone: "warn" }, "exit", me.exitRegion ? ` \xB7 ${me.exitRegion.toUpperCase()}` : "")), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 13, color: "var(--dim)", marginTop: 4 } }, me.handle), me.description ? /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--ui)", fontSize: 12.5, color: "var(--faint)", marginTop: 3 } }, me.description) : null), /* @__PURE__ */ React.createElement(Btn, { icon: "edit", onClick: () => setEditing(true) }, T.editProfile)), /* @__PURE__ */ React.createElement(Card, { label: T.identity }, /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.userId, value: me.userId, copy: true, qr: true, onQr: (v, l) => setQr({ value: v, label: l }) }), /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.carrierAddr, value: me.carrier, copy: true, qr: true, onQr: (v, l) => setQr({ value: v, label: l }) }), /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.netKey, value: me.netKey, copy: true, last: true })), /* @__PURE__ */ React.createElement(DkEnsCard, { T, me, onRecord: setEnsRec }), typeof me.autoAccept === "boolean" && /* @__PURE__ */ React.createElement(Card, { label: T && T.friendsSettings || "Friends" }, /* @__PURE__ */ React.createElement("label", { style: { display: "flex", alignItems: "center", gap: 13, padding: "14px 16px", cursor: "pointer" } }, /* @__PURE__ */ React.createElement(
       "input",
       {
@@ -4983,7 +4986,8 @@ ${peer.address}`
         onTakeover: () => window.BeagleWeb.takeover().then((st) => {
           data.refresh();
           return st;
-        })
+        }),
+        onLocate: () => window.BeagleWeb.locate()
       }
     ), !data.locked && welcome && /* @__PURE__ */ React.createElement(
       DkWelcome,

package/dist/server.js

@@ -55,7 +55,7 @@ async function fetchDiscoverJson(url) {
 // ── beagles.eth names (ens-gateway worker) ──────────────────────────────────
 // The same registry the mobile apps register into. Web-side registration
 // signs the record with THIS node's Carrier identity (XEdDSA via the backend
-// `sign` op) — the gateway verifies it the same way Sign in with Decent does.
+// `sign` op) — the gateway verifies it the same way Sign in with Beagle does.
 const ENS_GATEWAY = process.env.BEAGLE_ENS_GATEWAY || "https://ens-gateway.beaglechat.workers.dev";
 async function ensFetchJson(path) {
     const ctl = new AbortController();
@@ -414,7 +414,7 @@ function findSavedFile(downloadsDir, name) {
     return null;
 }
 /** True only when the request came from the local machine. Used to gate the
- *  "Sign in with Decent" routes so binding the UI to a LAN IP can't expose
+ *  "Sign in with Beagle" routes so binding the UI to a LAN IP cannot expose
  *  identity signing to other hosts. The popup always runs in the local user's
  *  browser, so it connects over the loopback interface. */
 function isLocalRequest(req) {
@@ -508,7 +508,7 @@ function validateOrigin(raw) {
         return null;
     }
 }
-// The "Sign in with Decent" consent popup. Self-contained (no external assets),
+// The "Sign in with Beagle" consent popup. Self-contained (no external assets),
 // dark theme matching the desktop UI. Reads origin+nonce from its own query,
 // shows the requesting site and this node's identity, and on Approve calls the
 // local /api/connect-approve to sign, then postMessages the result to the
@@ -517,7 +517,7 @@ function validateOrigin(raw) {
 const CONNECT_PAGE = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Sign in with Decent</title>
+<title>Sign in with Beagle</title>
 <style>
   :root{--bg:#0c0d11;--panel:#14161d;--line:#262a35;--text:#e7e9ef;--faint:#8b91a3;
         --accent:#5b8cff;--good:#46a758;--bad:#e5604d;--mono:ui-monospace,SFMono-Regular,Menlo,monospace}
@@ -534,7 +534,9 @@ const CONNECT_PAGE = `<!doctype html>
   .origin{color:var(--text);font-weight:600;word-break:break-all}
   .id{background:#0e1016;border:1px solid var(--line);border-radius:10px;padding:11px 12px;margin-bottom:14px}
   .lbl{font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:var(--faint);margin-bottom:4px}
+  .who{font-size:13.5px;font-weight:600;margin-bottom:3px}
   .userid{font-family:var(--mono);font-size:12.5px;color:var(--text);word-break:break-all}
+  [hidden]{display:none !important}
   .err{background:rgba(229,96,77,.12);border:1px solid rgba(229,96,77,.4);color:#ffb4a8;
        border-radius:9px;padding:9px 11px;font-size:12.5px;margin-bottom:13px}
   .row{display:flex;gap:10px;margin-top:4px}
@@ -547,44 +549,94 @@ const CONNECT_PAGE = `<!doctype html>
 </style></head>
 <body>
   <div class="card">
-    <div class="brand"><span class="d"></span>Decent</div>
-    <h1>Sign in</h1>
-    <p class="sub"><span id="origin" class="origin">…</span> wants to sign you in with your Decent identity.</p>
-    <div class="id"><div class="lbl">Your identity</div><div id="userid" class="userid">loading…</div></div>
+    <div class="brand"><span class="d"></span>Beagle</div>
+    <h1 id="headline">Sign in</h1>
+    <p class="sub"><span id="origin" class="origin">…</span><span id="leadTail"> wants to sign you in with your Beagle identity.</span></p>
+    <div id="targetRow" class="id" hidden>
+      <div class="lbl">Friend request to</div>
+      <div id="targetName" class="who" hidden></div>
+      <div id="targetAddr" class="userid"></div>
+    </div>
+    <div class="id">
+      <div id="idLabel" class="lbl">Your identity</div>
+      <div id="who" class="who" hidden></div>
+      <div id="userid" class="userid">loading…</div>
+    </div>
     <div id="err" class="err" hidden></div>
     <div class="row">
       <button id="deny" class="btn ghost">Deny</button>
       <button id="approve" class="btn solid" disabled>Approve</button>
     </div>
-    <p class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
+    <p id="note" class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
   </div>
 <script>
 (function(){
   var qs=new URLSearchParams(location.search);
   var origin=qs.get("origin")||"", nonce=qs.get("nonce")||"";
+  // "signin" (default) or "add". One hands the site a signature; the other
+  // asks a stranger to be your friend. Both need consent, and only the second
+  // changes anything — so they are separate actions, never one grant.
+  var action=qs.get("action")==="add"?"add":"signin";
+  var target=(qs.get("address")||"").trim(), targetName=(qs.get("name")||"").trim();
   var oEl=document.getElementById("origin"), errEl=document.getElementById("err");
   var approve=document.getElementById("approve"), deny=document.getElementById("deny");
   oEl.textContent=origin||"(unknown site)";
   function fail(m){errEl.textContent=m;errEl.hidden=false;}
-  function reply(data){ if(window.opener&&validOrigin){ window.opener.postMessage(Object.assign({type:"decent-auth",nonce:nonce},data),origin);} }
+  function reply(data){
+    if(!window.opener||!validOrigin) return;
+    // A friend request is NOT an auth assertion and must never be mistaken for
+    // one by a listener written before this existed — hence its own type.
+    var base=action==="add"?{type:"beagle-action",nonce:nonce,action:"add"}:{type:"decent-auth",nonce:nonce};
+    window.opener.postMessage(Object.assign(base,data),origin);
+  }
   var validOrigin=false;
   try{var u=new URL(origin); validOrigin=(u.protocol==="http:"||u.protocol==="https:")&&u.origin===origin;}catch(e){}
   if(!validOrigin) fail("This sign-in request has an invalid origin and was blocked.");
-  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This sign-in request is missing a valid nonce."); }
+  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This request is missing a valid nonce."); }
+  if(action==="add"&&!(target.length>=50&&target.length<=60&&/^[1-9A-HJ-NP-Za-km-z]+$/.test(target))){
+    validOrigin=false; fail("That does not look like a Beagle address, so nothing was sent.");
+  }
+  if(action==="add"){
+    document.title="Add a friend on Beagle";
+    document.getElementById("headline").textContent="Add a friend";
+    // Set the TAIL, not the whole paragraph: rewriting it would remove the
+    // #origin span, and the site name would then render as "null".
+    document.getElementById("leadTail").textContent=" wants to send a friend request from your Beagle identity.";
+    document.getElementById("targetRow").hidden=false;
+    var tn=document.getElementById("targetName");
+    tn.textContent=targetName||""; tn.hidden=!targetName;
+    document.getElementById("targetAddr").textContent=target;
+    document.getElementById("idLabel").textContent="Sent as";
+    approve.textContent="Send request";
+    document.getElementById("note").textContent="The other person sees your name and has to accept. Nothing is shared with the site — it only asked; your Beagle sent it.";
+  }
   fetch("/api/state").then(function(r){return r.json();}).then(function(s){
-    var uid=(s.me&&s.me.userid)||"";
+    var uid=(s.me&&s.me.userid)||"", nm=(s.me&&s.me.name)||"";
     document.getElementById("userid").textContent=uid||"(no identity)";
+    if(nm){var w=document.getElementById("who"); w.textContent=nm; w.hidden=false;}
     if(uid&&validOrigin) approve.disabled=false;
-    else if(!uid) fail("No local Decent identity found — is the daemon running?");
+    else if(!uid) fail("No local Beagle identity found — is the daemon running?");
   }).catch(function(){ fail("Could not reach the local agentnet daemon."); });
   deny.onclick=function(){ reply({error:"denied"}); setTimeout(function(){window.close();},60); };
   approve.onclick=function(){
-    approve.disabled=true; approve.textContent="Signing…";
+    approve.disabled=true;
+    if(action==="add"){
+      approve.textContent="Sending…";
+      fetch("/api/add",{method:"POST",headers:{"content-type":"application/json"},
+        body:JSON.stringify({address:target,hello:targetName?("Hi — we met on "+new URL(origin).host+"."):""})})
+        .then(function(r){return r.json();})
+        .then(function(j){ if(j.ok===false) throw new Error(j.error||"could not send");
+          reply({ok:true,address:target}); setTimeout(function(){window.close();},60); })
+        .catch(function(e){ approve.disabled=false; approve.textContent="Send request";
+          fail("Could not send the request: "+e.message); });
+      return;
+    }
+    approve.textContent="Signing…";
     fetch("/api/connect-approve",{method:"POST",headers:{"content-type":"application/json"},
       body:JSON.stringify({origin:origin,nonce:nonce})})
       .then(function(r){return r.json();})
       .then(function(j){ if(!j.ok) throw new Error(j.error||"sign failed");
-        reply({userid:j.userid,sig:j.sig}); setTimeout(function(){window.close();},60); })
+        reply({userid:j.userid,sig:j.sig,name:j.name,avatar:j.avatar,punkId:j.punkId}); setTimeout(function(){window.close();},60); })
       .catch(function(e){ approve.disabled=false; approve.textContent="Approve"; fail("Signing failed: "+e.message); });
   };
 })();
@@ -679,7 +731,7 @@ export function startBeagleServer(opts) {
                 res.end("not found");
                 return;
             }
-            // ── Sign in with Decent ────────────────────────────────────────────
+            // ── Sign in with Beagle ────────────────────────────────────────────
             // A website opens http://localhost:8765/connect?origin=…&nonce=… in a
             // popup; on Approve we sign "decent-auth\n<origin>\n<nonce>" with this
             // node's Carrier identity and postMessage {userid,nonce,sig} back to the
@@ -690,7 +742,7 @@ export function startBeagleServer(opts) {
             if (url === "/connect" || url === "/api/connect-approve") {
                 if (!isLocalRequest(req)) {
                     res.writeHead(403, { "content-type": "text/plain" });
-                    res.end("Sign in with Decent is available only on this machine (localhost).");
+                    res.end("Sign in with Beagle is available only on this machine (localhost).");
                     return;
                 }
             }
@@ -719,11 +771,37 @@ export function startBeagleServer(opts) {
                     sendJson(res, 502, { ok: false, error: r.error || "sign failed" });
                     return;
                 }
-                sendJson(res, 200, {
-                    ok: true,
-                    userid: r.data?.userid ?? "",
-                    sig: r.data?.sig ?? "",
-                });
+                const userid = r.data?.userid ?? "";
+                // Name and avatar ride along so the site can render the person without
+                // a second lookup it has no way to make — nothing public maps a userid
+                // to a display name unless that user registered a beagles.eth name.
+                // Additive: a caller that ignores them behaves exactly as before, and
+                // neither is part of what the signature proves.
+                let name = "";
+                let avatar = null;
+                let punkId = null;
+                const diagId = await opts.call({ op: "diag" });
+                try {
+                    const diag = diagId;
+                    name = ((diag.ok ? diag.data : {})?.node?.name) ?? "";
+                    const pub = (await ensPublicByUserid(1200)).get(userid);
+                    if (pub) {
+                        if (!name)
+                            name = pub.displayName ?? "";
+                        avatar = pub.avatarUrl ?? null;
+                        punkId = pub.punkId;
+                        if (!avatar && pub.punkId != null) {
+                            const punk = await punksFetch(`/api/punks/${pub.punkId}`).catch(() => null);
+                            avatar = punk?.image ?? null;
+                        }
+                    }
+                }
+                catch { /* identity is what matters; the trimmings are best-effort */ }
+                // The address, not just the userid: a friend request needs the full
+                // address (key + nospam + checksum), so without it a site that signed
+                // someone in still cannot offer to introduce them to anyone.
+                const address = ((diagId.ok ? diagId.data : {})?.identity?.address) ?? "";
+                sendJson(res, 200, { ok: true, userid, address, sig: r.data?.sig ?? "", name, avatar, punkId });
                 return;
             }
             // ── beagles.eth name registration ──
@@ -1321,9 +1399,13 @@ export function startBeagleServer(opts) {
                 const d = diag.ok ? (diag.data ?? {}) : {};
                 const identity = d.identity ?? {};
                 const tun = d.tun ?? {};
+                const node = d.node ?? {};
                 const me = {
                     userid: identity.userid,
                     address: identity.address,
+                    // The sign-in popup shows this above the key: a userid alone does not
+                    // tell you which of your identities is about to answer.
+                    name: node.name ?? "",
                     // The configured TUN address is what this host can actually route.
                     // Prefer it over a stale init/default allocation during Dora outage.
                     ip: tun.ip ?? d.allocatedIp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,7 +33,7 @@
     "yargs": "^17.7.2"
   },
   "devDependencies": {
-    "@decentnetwork/beagle-ui": "0.1.0",
+    "@decentnetwork/beagle-ui": "0.1.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.11.0",
     "@types/yargs": "^17.0.32",