@decentnetwork/beagle 0.1.60 → 0.1.61

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.60";
+window.__DK_UI_VERSION="0.1.61";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js
@@ -2925,11 +2925,14 @@ ${peer.address}`
     return /* @__PURE__ */ React.createElement(Card, { label: zh ? "\u663E\u793A" : "Display" }, /* @__PURE__ */ React.createElement("div", { style: { ...row, borderBottom: "1px solid var(--line)" } }, /* @__PURE__ */ React.createElement("span", { style: name }, zh ? "\u8BED\u8A00" : "Language"), seg("lang", t.lang, (v) => setTweak("lang", v), [["en", "EN"], ["zh", "\u4E2D\u6587"]])), /* @__PURE__ */ React.createElement("div", { style: row }, /* @__PURE__ */ React.createElement("span", { style: name }, zh ? "\u4E3B\u9898" : "Theme"), seg("theme", t.theme, (v) => setTweak("theme", v), [["dark", zh ? "\u6DF1\u8272" : "Dark"], ["light", zh ? "\u6D45\u8272" : "Light"]])));
   }
   function ProfileTab({ T, me, onEdit, t, setTweak }) {
+    var _a;
     const [qr, setQr] = React.useState(null);
     const [editing, setEditing] = React.useState(false);
     const [ensRec, setEnsRec] = React.useState(null);
-    const punkId = ensRec && ensRec.nft === "CryptoPunks" && ensRec.nftid > 0 ? ensRec.nftid : null;
-    const upAvatar = ensRec && ensRec.texts && ensRec.texts.avatar || null;
+    const pubPunk = ensRec && ensRec.nft === "CryptoPunks" && ensRec.nftid > 0 ? ensRec.nftid : null;
+    const pubAvatar = ensRec && ensRec.texts && ensRec.texts.avatar || null;
+    const punkId = (_a = me.punkId) != null ? _a : pubPunk;
+    const upAvatar = me.avatarUrl || pubAvatar;
     return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, overflow: "auto", background: "var(--bg)" } }, /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto", padding: "24px 28px 60px", display: "flex", flexDirection: "column", gap: 24 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 18, padding: "20px 22px", borderRadius: 14, background: "var(--panel)", border: "1px solid var(--line)" } }, /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, upAvatar ? /* @__PURE__ */ React.createElement("img", { src: upAvatar, alt: "", width: 68, height: 68, style: { width: 68, height: 68, borderRadius: 16, objectFit: "cover", background: "var(--panel-2)" } }) : punkId != null ? /* @__PURE__ */ React.createElement(DkPunkAvatar, { id: punkId, size: 68, radius: 16, fallbackSeed: me.userId }) : /* @__PURE__ */ React.createElement(DkIdenticon, { seed: me.userId, size: 68, radius: 16 }), /* @__PURE__ */ React.createElement("span", { style: { position: "absolute", right: -3, bottom: -3, width: 18, height: 18, borderRadius: 999, background: "var(--online)", border: "3px solid var(--panel)" } })), /* @__PURE__ */ React.createElement("div", { style: { flex: 1, minWidth: 0 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10 } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 22, fontWeight: 700, letterSpacing: -0.5, color: "var(--text)" } }, me.name), /* @__PURE__ */ React.createElement(Tag, { tone: "ok" }, "online"), me.isExit && /* @__PURE__ */ React.createElement(Tag, { tone: "warn" }, "exit", me.exitRegion ? ` \xB7 ${me.exitRegion.toUpperCase()}` : "")), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 13, color: "var(--dim)", marginTop: 4 } }, me.handle), me.description ? /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--ui)", fontSize: 12.5, color: "var(--faint)", marginTop: 3 } }, me.description) : null), /* @__PURE__ */ React.createElement(Btn, { icon: "edit", onClick: () => setEditing(true) }, T.editProfile)), /* @__PURE__ */ React.createElement(Card, { label: T.identity }, /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.userId, value: me.userId, copy: true, qr: true, onQr: (v, l) => setQr({ value: v, label: l }) }), /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.carrierAddr, value: me.carrier, copy: true, qr: true, onQr: (v, l) => setQr({ value: v, label: l }) }), /* @__PURE__ */ React.createElement(FieldRow, { T, label: T.netKey, value: me.netKey, copy: true, last: true })), /* @__PURE__ */ React.createElement(DkEnsCard, { T, me, onRecord: setEnsRec }), typeof me.autoAccept === "boolean" && /* @__PURE__ */ React.createElement(Card, { label: T && T.friendsSettings || "Friends" }, /* @__PURE__ */ React.createElement("label", { style: { display: "flex", alignItems: "center", gap: 13, padding: "14px 16px", cursor: "pointer" } }, /* @__PURE__ */ React.createElement(
       "input",
       {

package/dist/server.js

@@ -550,10 +550,15 @@ const CONNECT_PAGE = `<!doctype html>
 <body>
   <div class="card">
     <div class="brand"><span class="d"></span>Beagle</div>
-    <h1>Sign in</h1>
-    <p class="sub"><span id="origin" class="origin">…</span> wants to sign you in with your Beagle identity.</p>
+    <h1 id="headline">Sign in</h1>
+    <p class="sub"><span id="origin" class="origin">…</span><span id="leadTail"> wants to sign you in with your Beagle identity.</span></p>
+    <div id="targetRow" class="id" hidden>
+      <div class="lbl">Friend request to</div>
+      <div id="targetName" class="who" hidden></div>
+      <div id="targetAddr" class="userid"></div>
+    </div>
     <div class="id">
-      <div class="lbl">Your identity</div>
+      <div id="idLabel" class="lbl">Your identity</div>
       <div id="who" class="who" hidden></div>
       <div id="userid" class="userid">loading…</div>
     </div>
@@ -562,21 +567,49 @@ const CONNECT_PAGE = `<!doctype html>
       <button id="deny" class="btn ghost">Deny</button>
       <button id="approve" class="btn solid" disabled>Approve</button>
     </div>
-    <p class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
+    <p id="note" class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
   </div>
 <script>
 (function(){
   var qs=new URLSearchParams(location.search);
   var origin=qs.get("origin")||"", nonce=qs.get("nonce")||"";
+  // "signin" (default) or "add". One hands the site a signature; the other
+  // asks a stranger to be your friend. Both need consent, and only the second
+  // changes anything — so they are separate actions, never one grant.
+  var action=qs.get("action")==="add"?"add":"signin";
+  var target=(qs.get("address")||"").trim(), targetName=(qs.get("name")||"").trim();
   var oEl=document.getElementById("origin"), errEl=document.getElementById("err");
   var approve=document.getElementById("approve"), deny=document.getElementById("deny");
   oEl.textContent=origin||"(unknown site)";
   function fail(m){errEl.textContent=m;errEl.hidden=false;}
-  function reply(data){ if(window.opener&&validOrigin){ window.opener.postMessage(Object.assign({type:"decent-auth",nonce:nonce},data),origin);} }
+  function reply(data){
+    if(!window.opener||!validOrigin) return;
+    // A friend request is NOT an auth assertion and must never be mistaken for
+    // one by a listener written before this existed — hence its own type.
+    var base=action==="add"?{type:"beagle-action",nonce:nonce,action:"add"}:{type:"decent-auth",nonce:nonce};
+    window.opener.postMessage(Object.assign(base,data),origin);
+  }
   var validOrigin=false;
   try{var u=new URL(origin); validOrigin=(u.protocol==="http:"||u.protocol==="https:")&&u.origin===origin;}catch(e){}
   if(!validOrigin) fail("This sign-in request has an invalid origin and was blocked.");
-  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This sign-in request is missing a valid nonce."); }
+  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This request is missing a valid nonce."); }
+  if(action==="add"&&!(target.length>=50&&target.length<=60&&/^[1-9A-HJ-NP-Za-km-z]+$/.test(target))){
+    validOrigin=false; fail("That does not look like a Beagle address, so nothing was sent.");
+  }
+  if(action==="add"){
+    document.title="Add a friend on Beagle";
+    document.getElementById("headline").textContent="Add a friend";
+    // Set the TAIL, not the whole paragraph: rewriting it would remove the
+    // #origin span, and the site name would then render as "null".
+    document.getElementById("leadTail").textContent=" wants to send a friend request from your Beagle identity.";
+    document.getElementById("targetRow").hidden=false;
+    var tn=document.getElementById("targetName");
+    tn.textContent=targetName||""; tn.hidden=!targetName;
+    document.getElementById("targetAddr").textContent=target;
+    document.getElementById("idLabel").textContent="Sent as";
+    approve.textContent="Send request";
+    document.getElementById("note").textContent="The other person sees your name and has to accept. Nothing is shared with the site — it only asked; your Beagle sent it.";
+  }
   fetch("/api/state").then(function(r){return r.json();}).then(function(s){
     var uid=(s.me&&s.me.userid)||"", nm=(s.me&&s.me.name)||"";
     document.getElementById("userid").textContent=uid||"(no identity)";
@@ -586,12 +619,24 @@ const CONNECT_PAGE = `<!doctype html>
   }).catch(function(){ fail("Could not reach the local agentnet daemon."); });
   deny.onclick=function(){ reply({error:"denied"}); setTimeout(function(){window.close();},60); };
   approve.onclick=function(){
-    approve.disabled=true; approve.textContent="Signing…";
+    approve.disabled=true;
+    if(action==="add"){
+      approve.textContent="Sending…";
+      fetch("/api/add",{method:"POST",headers:{"content-type":"application/json"},
+        body:JSON.stringify({address:target,hello:targetName?("Hi — we met on "+new URL(origin).host+"."):""})})
+        .then(function(r){return r.json();})
+        .then(function(j){ if(j.ok===false) throw new Error(j.error||"could not send");
+          reply({ok:true,address:target}); setTimeout(function(){window.close();},60); })
+        .catch(function(e){ approve.disabled=false; approve.textContent="Send request";
+          fail("Could not send the request: "+e.message); });
+      return;
+    }
+    approve.textContent="Signing…";
     fetch("/api/connect-approve",{method:"POST",headers:{"content-type":"application/json"},
       body:JSON.stringify({origin:origin,nonce:nonce})})
       .then(function(r){return r.json();})
       .then(function(j){ if(!j.ok) throw new Error(j.error||"sign failed");
-        reply({userid:j.userid,sig:j.sig,name:j.name,avatar:j.avatar}); setTimeout(function(){window.close();},60); })
+        reply({userid:j.userid,sig:j.sig,name:j.name,avatar:j.avatar,punkId:j.punkId}); setTimeout(function(){window.close();},60); })
       .catch(function(e){ approve.disabled=false; approve.textContent="Approve"; fail("Signing failed: "+e.message); });
   };
 })();
@@ -734,14 +779,17 @@ export function startBeagleServer(opts) {
                 // neither is part of what the signature proves.
                 let name = "";
                 let avatar = null;
+                let punkId = null;
+                const diagId = await opts.call({ op: "diag" });
                 try {
-                    const diag = await opts.call({ op: "diag" });
+                    const diag = diagId;
                     name = ((diag.ok ? diag.data : {})?.node?.name) ?? "";
                     const pub = (await ensPublicByUserid(1200)).get(userid);
                     if (pub) {
                         if (!name)
                             name = pub.displayName ?? "";
                         avatar = pub.avatarUrl ?? null;
+                        punkId = pub.punkId;
                         if (!avatar && pub.punkId != null) {
                             const punk = await punksFetch(`/api/punks/${pub.punkId}`).catch(() => null);
                             avatar = punk?.image ?? null;
@@ -749,7 +797,11 @@ export function startBeagleServer(opts) {
                     }
                 }
                 catch { /* identity is what matters; the trimmings are best-effort */ }
-                sendJson(res, 200, { ok: true, userid, sig: r.data?.sig ?? "", name, avatar });
+                // The address, not just the userid: a friend request needs the full
+                // address (key + nospam + checksum), so without it a site that signed
+                // someone in still cannot offer to introduce them to anyone.
+                const address = ((diagId.ok ? diagId.data : {})?.identity?.address) ?? "";
+                sendJson(res, 200, { ok: true, userid, address, sig: r.data?.sig ?? "", name, avatar, punkId });
                 return;
             }
             // ── beagles.eth name registration ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,7 +33,7 @@
     "yargs": "^17.7.2"
   },
   "devDependencies": {
-    "@decentnetwork/beagle-ui": "0.1.1",
+    "@decentnetwork/beagle-ui": "0.1.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.11.0",
     "@types/yargs": "^17.0.32",