@decentnetwork/beagle 0.1.60 → 0.1.63

package/dist/embedded-host.d.ts

@@ -18,6 +18,9 @@ export interface EmbeddedHostOptions {
     }[];
     nickname?: string;
     statusMessage?: string;
+    /** Our CryptoPunks id, advertised to friends in the userinfo `gender`
+     *  field — the only avatar path that does not need a server. */
+    punkId?: number;
     autoAcceptFriends: boolean;
     onProfileChange?: (info: {
         name?: string;

package/dist/embedded-host.js

@@ -138,6 +138,9 @@ export class EmbeddedHost {
             expressNodes: this.#opts.expressNodes,
             nickname: this.#opts.nickname,
             statusMessage: this.#opts.statusMessage,
+            // Advertised from startup, not only after a profile edit — otherwise a
+            // restart silently stops telling friends what our avatar is.
+            punkId: this.#opts.punkId,
             fileResumeDir: resolve(this.#opts.configDir, "file-resume"),
         });
         this.#wire();
@@ -402,7 +405,9 @@ export class EmbeddedHost {
                 const id = this.#node.identity();
                 return {
                     identity: id,
-                    node: { name: this.#opts.nickname ?? "", backend: "embedded", autoAccept: this.#autoAccept },
+                    // punkId so the UI can report what is actually being advertised,
+                    // which is not necessarily what beagles.eth says.
+                    node: { name: this.#opts.nickname ?? "", backend: "embedded", autoAccept: this.#autoAccept, punkId: this.#opts.punkId ?? null },
                     // No TUN in this backend — say so explicitly rather than omitting
                     // the key, so the UI can distinguish "no LAN" from "unknown".
                     tun: null,
@@ -448,6 +453,10 @@ export class EmbeddedHost {
                                 f.status === "online" ||
                                 this.#messages.hasInbound(f.carrierId),
                             lastSeen: f.acceptedAt,
+                            // The avatar they advertised over Carrier (userinfo `gender`).
+                            // Peer-to-peer, so it works for a friend who never registered a
+                            // beagles.eth name — until now that meant an identicon.
+                            punkId: f.punkId ?? null,
                             pinned: meta?.pinned ?? false,
                             lastMessage: lastMsg ? { dir: lastMsg.dir, text: lastMsg.text, ts: lastMsg.ts } : undefined,
                             unread: this.#messages.unreadCount(f.carrierId, meta?.lastReadTs ?? 0),
@@ -511,12 +520,21 @@ export class EmbeddedHost {
                 this.#meta.setAlias(uid, req.alias);
                 return {};
             case "set-profile": {
-                const info = { name: req.name, description: req.description };
+                const info = {
+                    name: req.name,
+                    description: req.description,
+                    // null clears, undefined leaves alone. setUserInfo re-sends the
+                    // profile to every established friend, so a new avatar lands now
+                    // rather than on their next reconnect.
+                    punkId: req.punkId === undefined ? undefined : (req.punkId === null ? null : Number(req.punkId)),
+                };
                 this.#node.setUserInfo(info);
                 if (info.name)
                     this.#opts.nickname = info.name;
                 if (info.description !== undefined)
                     this.#opts.statusMessage = info.description;
+                if (info.punkId !== undefined)
+                    this.#opts.punkId = info.punkId ?? undefined;
                 this.#opts.onProfileChange?.(info);
                 return {};
             }

package/dist/server.js

@@ -273,7 +273,14 @@ function installMode() {
         return "npx";
     if (BEAGLE_ROOT.includes(join("node_modules", "@decentnetwork", "beagle")))
         return "global";
-    return "dev";
+    // "dev" has to be PROVEN, not assumed. It used to be the fallthrough for
+    // any layout this function did not recognise, so a user with a perfectly
+    // ordinary install was told to run `git pull` — against a private repo they
+    // cannot clone, with no other option offered. A dead end presented as
+    // instructions.
+    if (existsSync(join(BEAGLE_ROOT, ".git")))
+        return "dev";
+    return "unknown";
 }
 async function npmLatest(pkg) {
     const ctl = new AbortController();
@@ -550,10 +557,15 @@ const CONNECT_PAGE = `<!doctype html>
 <body>
   <div class="card">
     <div class="brand"><span class="d"></span>Beagle</div>
-    <h1>Sign in</h1>
-    <p class="sub"><span id="origin" class="origin">…</span> wants to sign you in with your Beagle identity.</p>
+    <h1 id="headline">Sign in</h1>
+    <p class="sub"><span id="origin" class="origin">…</span><span id="leadTail"> wants to sign you in with your Beagle identity.</span></p>
+    <div id="targetRow" class="id" hidden>
+      <div class="lbl">Friend request to</div>
+      <div id="targetName" class="who" hidden></div>
+      <div id="targetAddr" class="userid"></div>
+    </div>
     <div class="id">
-      <div class="lbl">Your identity</div>
+      <div id="idLabel" class="lbl">Your identity</div>
       <div id="who" class="who" hidden></div>
       <div id="userid" class="userid">loading…</div>
     </div>
@@ -562,21 +574,49 @@ const CONNECT_PAGE = `<!doctype html>
       <button id="deny" class="btn ghost">Deny</button>
       <button id="approve" class="btn solid" disabled>Approve</button>
     </div>
-    <p class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
+    <p id="note" class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
   </div>
 <script>
 (function(){
   var qs=new URLSearchParams(location.search);
   var origin=qs.get("origin")||"", nonce=qs.get("nonce")||"";
+  // "signin" (default) or "add". One hands the site a signature; the other
+  // asks a stranger to be your friend. Both need consent, and only the second
+  // changes anything — so they are separate actions, never one grant.
+  var action=qs.get("action")==="add"?"add":"signin";
+  var target=(qs.get("address")||"").trim(), targetName=(qs.get("name")||"").trim();
   var oEl=document.getElementById("origin"), errEl=document.getElementById("err");
   var approve=document.getElementById("approve"), deny=document.getElementById("deny");
   oEl.textContent=origin||"(unknown site)";
   function fail(m){errEl.textContent=m;errEl.hidden=false;}
-  function reply(data){ if(window.opener&&validOrigin){ window.opener.postMessage(Object.assign({type:"decent-auth",nonce:nonce},data),origin);} }
+  function reply(data){
+    if(!window.opener||!validOrigin) return;
+    // A friend request is NOT an auth assertion and must never be mistaken for
+    // one by a listener written before this existed — hence its own type.
+    var base=action==="add"?{type:"beagle-action",nonce:nonce,action:"add"}:{type:"decent-auth",nonce:nonce};
+    window.opener.postMessage(Object.assign(base,data),origin);
+  }
   var validOrigin=false;
   try{var u=new URL(origin); validOrigin=(u.protocol==="http:"||u.protocol==="https:")&&u.origin===origin;}catch(e){}
   if(!validOrigin) fail("This sign-in request has an invalid origin and was blocked.");
-  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This sign-in request is missing a valid nonce."); }
+  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This request is missing a valid nonce."); }
+  if(action==="add"&&!(target.length>=50&&target.length<=60&&/^[1-9A-HJ-NP-Za-km-z]+$/.test(target))){
+    validOrigin=false; fail("That does not look like a Beagle address, so nothing was sent.");
+  }
+  if(action==="add"){
+    document.title="Add a friend on Beagle";
+    document.getElementById("headline").textContent="Add a friend";
+    // Set the TAIL, not the whole paragraph: rewriting it would remove the
+    // #origin span, and the site name would then render as "null".
+    document.getElementById("leadTail").textContent=" wants to send a friend request from your Beagle identity.";
+    document.getElementById("targetRow").hidden=false;
+    var tn=document.getElementById("targetName");
+    tn.textContent=targetName||""; tn.hidden=!targetName;
+    document.getElementById("targetAddr").textContent=target;
+    document.getElementById("idLabel").textContent="Sent as";
+    approve.textContent="Send request";
+    document.getElementById("note").textContent="The other person sees your name and has to accept. Nothing is shared with the site — it only asked; your Beagle sent it.";
+  }
   fetch("/api/state").then(function(r){return r.json();}).then(function(s){
     var uid=(s.me&&s.me.userid)||"", nm=(s.me&&s.me.name)||"";
     document.getElementById("userid").textContent=uid||"(no identity)";
@@ -586,12 +626,24 @@ const CONNECT_PAGE = `<!doctype html>
   }).catch(function(){ fail("Could not reach the local agentnet daemon."); });
   deny.onclick=function(){ reply({error:"denied"}); setTimeout(function(){window.close();},60); };
   approve.onclick=function(){
-    approve.disabled=true; approve.textContent="Signing…";
+    approve.disabled=true;
+    if(action==="add"){
+      approve.textContent="Sending…";
+      fetch("/api/add",{method:"POST",headers:{"content-type":"application/json"},
+        body:JSON.stringify({address:target,hello:targetName?("Hi — we met on "+new URL(origin).host+"."):""})})
+        .then(function(r){return r.json();})
+        .then(function(j){ if(j.ok===false) throw new Error(j.error||"could not send");
+          reply({ok:true,address:target}); setTimeout(function(){window.close();},60); })
+        .catch(function(e){ approve.disabled=false; approve.textContent="Send request";
+          fail("Could not send the request: "+e.message); });
+      return;
+    }
+    approve.textContent="Signing…";
     fetch("/api/connect-approve",{method:"POST",headers:{"content-type":"application/json"},
       body:JSON.stringify({origin:origin,nonce:nonce})})
       .then(function(r){return r.json();})
       .then(function(j){ if(!j.ok) throw new Error(j.error||"sign failed");
-        reply({userid:j.userid,sig:j.sig,name:j.name,avatar:j.avatar}); setTimeout(function(){window.close();},60); })
+        reply({userid:j.userid,sig:j.sig,name:j.name,avatar:j.avatar,punkId:j.punkId}); setTimeout(function(){window.close();},60); })
       .catch(function(e){ approve.disabled=false; approve.textContent="Approve"; fail("Signing failed: "+e.message); });
   };
 })();
@@ -615,6 +667,10 @@ const fmtTime = (ts) => {
     return `${d.getDate()} ${["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"][d.getMonth()]}`;
 };
 const viaFromTransport = (t) => t === "udp" || t === "both" ? "direct" : t === "tcp-relay" ? "relay" : null;
+// What we last told the daemon to advertise. Module-scoped on purpose: the
+// value is per-process, and re-sending it on every /api/desktop poll would
+// re-push the profile to every friend several times a second.
+let lastAdvertisedPunk;
 export function startBeagleServer(opts) {
     const host = opts.listenHost ?? "127.0.0.1";
     const port = opts.listenPort ?? 8765;
@@ -640,6 +696,32 @@ export function startBeagleServer(opts) {
     const handler = async (req, res) => {
         try {
             const url = (req.url || "/").split("?")[0];
+            // Let Sign-in-with-Beagle pages (meet, billing, …) detect this daemon
+            // from a public https origin. Chrome Local Network Access blocks the
+            // probe unless we answer the private-network preflight.
+            const detect = url === "/api/state" || url === "/api/ping" || url === "/connect";
+            if (detect) {
+                const origin = String(req.headers.origin || "");
+                if (origin) {
+                    res.setHeader("Access-Control-Allow-Origin", origin);
+                    res.setHeader("Vary", "Origin");
+                }
+                else {
+                    res.setHeader("Access-Control-Allow-Origin", "*");
+                }
+                res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+                res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+                res.setHeader("Access-Control-Allow-Private-Network", "true");
+                if (req.method === "OPTIONS") {
+                    res.writeHead(204);
+                    res.end();
+                    return;
+                }
+            }
+            if (req.method === "GET" && url === "/api/ping") {
+                sendJson(res, 200, { ok: true });
+                return;
+            }
             // Desktop UI bundle (the design). Falls back to the classic page when
             // the bundle hasn't been built (dist/ui/desktop missing).
             const desktopIndex = join(DESKTOP_DIR, "index.html");
@@ -694,7 +776,7 @@ export function startBeagleServer(opts) {
             // LOCALHOST-ONLY: the popup always runs in the local user's browser
             // (localhost), so binding the UI to a LAN IP must never let a remote
             // host request signatures with this identity.
-            if (url === "/connect" || url === "/api/connect-approve") {
+            if (url === "/connect" || url === "/api/connect-approve" || url === "/api/launch-token") {
                 if (!isLocalRequest(req)) {
                     res.writeHead(403, { "content-type": "text/plain" });
                     res.end("Sign in with Beagle is available only on this machine (localhost).");
@@ -734,14 +816,17 @@ export function startBeagleServer(opts) {
                 // neither is part of what the signature proves.
                 let name = "";
                 let avatar = null;
+                let punkId = null;
+                const diagId = await opts.call({ op: "diag" });
                 try {
-                    const diag = await opts.call({ op: "diag" });
+                    const diag = diagId;
                     name = ((diag.ok ? diag.data : {})?.node?.name) ?? "";
                     const pub = (await ensPublicByUserid(1200)).get(userid);
                     if (pub) {
                         if (!name)
                             name = pub.displayName ?? "";
                         avatar = pub.avatarUrl ?? null;
+                        punkId = pub.punkId;
                         if (!avatar && pub.punkId != null) {
                             const punk = await punksFetch(`/api/punks/${pub.punkId}`).catch(() => null);
                             avatar = punk?.image ?? null;
@@ -749,7 +834,47 @@ export function startBeagleServer(opts) {
                     }
                 }
                 catch { /* identity is what matters; the trimmings are best-effort */ }
-                sendJson(res, 200, { ok: true, userid, sig: r.data?.sig ?? "", name, avatar });
+                // The address, not just the userid: a friend request needs the full
+                // address (key + nospam + checksum), so without it a site that signed
+                // someone in still cannot offer to introduce them to anyone.
+                const address = ((diagId.ok ? diagId.data : {})?.identity?.address) ?? "";
+                sendJson(res, 200, { ok: true, userid, address, sig: r.data?.sig ?? "", name, avatar, punkId });
+                return;
+            }
+            // Mint the "launch an app as me" assertion the Apps tab puts in an app's
+            // URL fragment, so someone opening an app from their own client is not
+            // asked to sign in to it. LOCALHOST-ONLY like /connect: it is a
+            // signature with this identity.
+            if (req.method === "POST" && url === "/api/launch-token") {
+                const body = await readBody(req);
+                const target = validateOrigin(body.origin);
+                if (!target) {
+                    sendJson(res, 400, { ok: false, error: "invalid origin" });
+                    return;
+                }
+                const ts = Date.now();
+                // A DIFFERENT prefix from decent-auth on purpose: an assertion minted
+                // here must never be replayable as a "a site asked me to sign in"
+                // proof, nor the reverse.
+                const signed = await opts.call({ op: "sign", text: `decent-launch\n${target}\n${ts}` });
+                if (!signed.ok) {
+                    sendJson(res, 502, { ok: false, error: signed.error || "sign failed" });
+                    return;
+                }
+                const diag = await opts.call({ op: "diag" });
+                const d = (diag.ok ? diag.data : {}) ?? {};
+                const identity = d.identity ?? {};
+                const node = d.node ?? {};
+                sendJson(res, 200, {
+                    ok: true,
+                    v: 1,
+                    userid: signed.data?.userid ?? identity.userid ?? "",
+                    address: identity.address ?? "",
+                    name: node.name ?? "",
+                    punkId: null,
+                    ts,
+                    sig: signed.data?.sig ?? "",
+                });
                 return;
             }
             // ── beagles.eth name registration ──
@@ -1515,6 +1640,10 @@ export function startBeagleServer(opts) {
                     sendJson(res, 400, { ok: false, error: "running from a source checkout — update with: git pull && npm run build" });
                     return;
                 }
+                // Layout we do not recognise: try the thing that works for almost
+                // everyone rather than refusing. If it genuinely cannot install, the
+                // npm error says so — which is still more use than a git command
+                // against a repo the user has no access to.
                 if (mode === "npx") {
                     // npx with @latest re-resolves on every launch: restarting IS the update.
                     sendJson(res, 200, { ok: true, npx: true });
@@ -1592,6 +1721,20 @@ export function startBeagleServer(opts) {
                 ]);
                 const d = (diag.ok ? diag.data : {}) ?? {};
                 const identity = d.identity ?? {};
+                // A desktop install has no locally-picked punk: its avatar is whatever
+                // it registered on beagles.eth. Advertise THAT over Carrier, so an iOS
+                // friend sees a picture instead of nothing. Sent only when the value
+                // CHANGES — set-profile re-pushes the profile to every established
+                // friend, and doing that on every poll would be a packet storm.
+                const myPunk = ensPub.get(identity.userid ?? "")?.punkId ?? null;
+                // Only ever PUSH a real punk, never a null. A null here means "nothing
+                // registered on beagles.eth", which is not the same as "no avatar" —
+                // pushing it wiped a punk set directly through /api/set-profile, on
+                // the very next poll. Registration seeds the avatar; it does not own it.
+                if (myPunk != null && myPunk !== lastAdvertisedPunk) {
+                    lastAdvertisedPunk = myPunk;
+                    void opts.call({ op: "set-profile", punkId: myPunk }).catch(() => undefined);
+                }
                 const tun = d.tun ?? {};
                 const node = d.node ?? {};
                 const diagFriends = d.friends ?? [];
@@ -1647,7 +1790,7 @@ export function startBeagleServer(opts) {
                     // toggle rather than showing a state it cannot know.
                     autoAccept: typeof node.autoAccept === "boolean" ? node.autoAccept : null,
                     avatarUrl: ensPub.get(identity.userid ?? "")?.avatarUrl ?? null,
-                    punkId: ensPub.get(identity.userid ?? "")?.punkId ?? null,
+                    punkId: myPunk ?? node.punkId ?? null,
                     // The UI compares this against its baked-in __DK_UI_VERSION and
                     // reloads itself when they differ — an open tab otherwise runs a
                     // stale bundle forever after a beagle update (multi-tab call fixes
@@ -1688,7 +1831,11 @@ export function startBeagleServer(opts) {
                         lastTs: lm?.ts ?? 0,
                         wire: "163",
                         avatarUrl: ensPub.get(uid)?.avatarUrl ?? null,
-                        punkId: ensPub.get(uid)?.punkId ?? null,
+                        // What they advertised over Carrier wins over the directory: it is
+                        // what they are using on their device right now, it needs no
+                        // gateway, and it is the only avatar a friend who never registered
+                        // a beagles.eth name will ever have.
+                        punkId: f.punkId ?? ensPub.get(uid)?.punkId ?? null,
                     };
                 });
                 const pend = pending.ok ? (pending.data?.pending ?? []) : [];
@@ -1921,8 +2068,10 @@ export function startBeagleServer(opts) {
                 return;
             }
             if (req.method === "POST" && url === "/api/set-profile") {
-                const { name, description } = await readBody(req);
-                const r = await opts.call({ op: "set-profile", name, description });
+                // punkId passes through so an avatar can be set without a beagles.eth
+                // registration — the daemon advertises it over Carrier either way.
+                const { name, description, punkId } = await readBody(req);
+                const r = await opts.call({ op: "set-profile", name, description, punkId });
                 sendJson(res, r.ok ? 200 : 400, r);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.60",
+  "version": "0.1.63",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,13 +27,13 @@
   "dependencies": {
     "@decentnetwork/chat-components": "^0.1.3",
     "@decentnetwork/lan": "^0.1.283",
-    "@decentnetwork/peer": "^0.1.141",
+    "@decentnetwork/peer": "0.1.143",
     "@decentnetwork/peer-webrtc": "^0.2.16",
     "js-yaml": "^4.1.0",
     "yargs": "^17.7.2"
   },
   "devDependencies": {
-    "@decentnetwork/beagle-ui": "0.1.1",
+    "@decentnetwork/beagle-ui": "0.2.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.11.0",
     "@types/yargs": "^17.0.32",