@decentnetwork/beagle 0.1.87 → 0.1.88

package/dist/cli.js

@@ -145,6 +145,12 @@ async function main() {
         makeEmbedded: openEmbedded,
         makeDaemon: () => makeDaemonHost(decentlanCarrierDir(args.configDir)),
         onChange: (state) => console.log(`[LAN] backend is now: ${state}`),
+        // `--backend` has to reach the watcher, or it only ever pinned the FIRST
+        // choice: this wrapper re-detected on a 1500ms timer and overrode it a
+        // second and a half later. That is why `--backend embedded` did not
+        // protect Beagle Desktop on Windows, and why `--backend daemon` on 245
+        // still fell back and took the identity lock.
+        force: args.backend,
     });
     // If this machine also runs a dora, surface its allocation table.
     const doraCandidates = args.doraDir

package/dist/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.86";
+window.__DK_UI_VERSION="0.1.87";
 "use strict";
 (() => {
   // packages/beagle-ui/dist/beagle-ui.js
@@ -561,6 +561,9 @@ window.__DK_UI_VERSION="0.1.86";
       const ta = a.lastTs || 0, tb = b.lastTs || 0;
       if (ta !== tb)
         return tb - ta;
+      const aa = a.acceptedAt || 0, ba = b.acceptedAt || 0;
+      if (aa !== ba)
+        return ba - aa;
       return String(a.alias || a.userId || "").localeCompare(String(b.alias || b.userId || ""));
     });
     const online = peers.filter((p) => p.online).length;

package/dist/embedded-host.js

@@ -103,12 +103,18 @@ export class EmbeddedHost {
             // Infinity - Infinity = NaN, and the tie-break would only still work
             // by accident of NaN being falsy.
             last.has(f.carrierId) ? -last.get(f.carrierId).ts : Number.MAX_SAFE_INTEGER,
+            // Among friends you have never messaged, NEWEST FRIENDSHIP first.
+            // Alphabetical put someone you accepted ten seconds ago wherever their
+            // name happened to land — usually far down a 50-name list, so accepting
+            // a request looked like nothing had happened. The one friend you are
+            // most likely to open is the one you just added.
+            -(f.acceptedAt ?? 0),
             (f.name || f.carrierId).toLowerCase(),
         ];
         return [...friends].sort((a, b) => {
-            const [ap, at, an] = rank(a);
-            const [bp, bt, bn] = rank(b);
-            return ap - bp || at - bt || an.localeCompare(bn);
+            const [ap, at, aa, an] = rank(a);
+            const [bp, bt, ba, bn] = rank(b);
+            return ap - bp || at - bt || aa - ba || an.localeCompare(bn);
         });
     }
     get downloadsDir() {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { startBeagleServer, type BeagleServerOptions } from "./server.js";
 export { openPeerHost, defaultConfigDir, decentlanCarrierDir, type PeerHost, type BackendKind } from "./peer-host.js";
-export { ipcCall, ipcSocketPath, daemonIsRunning, type IpcRequest, type IpcResponse, type IpcOp } from "./ipc.js";
+export { ipcCall, ipcSocketPath, probeDaemon, daemonSocketMayExist, type IpcRequest, type IpcResponse, type IpcOp } from "./ipc.js";

package/dist/index.js

@@ -2,4 +2,4 @@
 // server and the backend abstraction are exported so it can be embedded.
 export { startBeagleServer } from "./server.js";
 export { openPeerHost, defaultConfigDir, decentlanCarrierDir } from "./peer-host.js";
-export { ipcCall, ipcSocketPath, daemonIsRunning } from "./ipc.js";
+export { ipcCall, ipcSocketPath, probeDaemon, daemonSocketMayExist } from "./ipc.js";

package/dist/ipc.d.ts

@@ -43,6 +43,39 @@ export declare function ipcSocketPath(dataDir: string, platform?: NodeJS.Platfor
 /** fs.existsSync is meaningful for Unix-domain sockets but always false for
  *  Windows named pipes, so on Windows we connect and let net report. */
 export declare function ipcSocketSupportsFsExistenceCheck(platform?: NodeJS.Platform): boolean;
-export declare function daemonIsRunning(dataDir: string): boolean;
+/** How long the liveness probe waits for a connect before calling it dead.
+ *  Local IPC: a listening socket accepts in microseconds, so this is a
+ *  generous ceiling that still keeps the 1500ms watch tick honest. */
+export declare const DAEMON_PROBE_TIMEOUT_MS = 400;
+/**
+ * Is a decentlan daemon actually LISTENING for this identity?
+ *
+ * The only trustworthy answer is a connection. The previous check asked the
+ * filesystem, which cannot answer on either platform:
+ *
+ *   - Windows named pipes never appear to `existsSync`, so the old code
+ *     returned a hard-coded `true` — "can't tell; try it". Every beagle on
+ *     Windows therefore believed in a daemon that was not there, handed its
+ *     identity to a pipe nobody served, and failed every peer op with
+ *     `connect ENOENT \\.\pipe\agentnet-…`. That one wrong default is why
+ *     add-friend, renaming and .beagles.eth registration were all broken.
+ *   - On Unix a `daemon.sock` left behind by a crashed daemon exists just as
+ *     firmly as a live one, so the same promotion happened there too, only
+ *     rarer.
+ *
+ * Connecting costs a round trip to a local socket and removes both. It is the
+ * same code on every platform, which is the real win: no branch that only one
+ * of us can test.
+ */
+export declare function probeDaemon(dataDir: string, timeoutMs?: number): Promise<boolean>;
+/**
+ * Sync, best-effort: could a daemon socket be there?
+ *
+ * Only for callers that genuinely cannot await. It answers `false` when it
+ * cannot tell — the opposite of the old default, and the whole point. A `true`
+ * from this is still only a hint; confirm with {@link probeDaemon} before
+ * handing an identity to anything.
+ */
+export declare function daemonSocketMayExist(dataDir: string): boolean;
 /** One request, one newline-delimited JSON response. */
 export declare function ipcCall(dataDir: string, req: IpcRequest, timeoutMs?: number): Promise<IpcResponse>;

package/dist/ipc.js

@@ -27,9 +27,65 @@ export function ipcSocketPath(dataDir, platform = process.platform) {
 export function ipcSocketSupportsFsExistenceCheck(platform = process.platform) {
     return platform !== "win32";
 }
-export function daemonIsRunning(dataDir) {
+/** How long the liveness probe waits for a connect before calling it dead.
+ *  Local IPC: a listening socket accepts in microseconds, so this is a
+ *  generous ceiling that still keeps the 1500ms watch tick honest. */
+export const DAEMON_PROBE_TIMEOUT_MS = 400;
+/**
+ * Is a decentlan daemon actually LISTENING for this identity?
+ *
+ * The only trustworthy answer is a connection. The previous check asked the
+ * filesystem, which cannot answer on either platform:
+ *
+ *   - Windows named pipes never appear to `existsSync`, so the old code
+ *     returned a hard-coded `true` — "can't tell; try it". Every beagle on
+ *     Windows therefore believed in a daemon that was not there, handed its
+ *     identity to a pipe nobody served, and failed every peer op with
+ *     `connect ENOENT \\.\pipe\agentnet-…`. That one wrong default is why
+ *     add-friend, renaming and .beagles.eth registration were all broken.
+ *   - On Unix a `daemon.sock` left behind by a crashed daemon exists just as
+ *     firmly as a live one, so the same promotion happened there too, only
+ *     rarer.
+ *
+ * Connecting costs a round trip to a local socket and removes both. It is the
+ * same code on every platform, which is the real win: no branch that only one
+ * of us can test.
+ */
+export function probeDaemon(dataDir, timeoutMs = DAEMON_PROBE_TIMEOUT_MS) {
+    const sockPath = ipcSocketPath(dataDir);
+    // A cheap negative where the filesystem CAN answer. Never a positive: an
+    // existing socket file is not a listening daemon, which was the second bug.
+    if (ipcSocketSupportsFsExistenceCheck() && !existsSync(sockPath)) {
+        return Promise.resolve(false);
+    }
+    return new Promise((resolve) => {
+        const sock = createConnection(sockPath);
+        let settled = false;
+        const finish = (alive) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            sock.destroy();
+            resolve(alive);
+        };
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        timer.unref?.();
+        sock.on("connect", () => finish(true));
+        sock.on("error", () => finish(false));
+    });
+}
+/**
+ * Sync, best-effort: could a daemon socket be there?
+ *
+ * Only for callers that genuinely cannot await. It answers `false` when it
+ * cannot tell — the opposite of the old default, and the whole point. A `true`
+ * from this is still only a hint; confirm with {@link probeDaemon} before
+ * handing an identity to anything.
+ */
+export function daemonSocketMayExist(dataDir) {
     if (!ipcSocketSupportsFsExistenceCheck())
-        return true; // can't tell; try it
+        return false;
     return existsSync(ipcSocketPath(dataDir));
 }
 /** One request, one newline-delimited JSON response. */

package/dist/lan-handoff.d.ts

@@ -1,7 +1,11 @@
 import { type IpcRequest, type IpcResponse } from "./ipc.js";
 import { Logger } from "./logger.js";
-import type { PeerHost } from "./peer-host.js";
-export type HandoffState = "embedded" | "releasing" | "daemon";
+import type { BackendKind, PeerHost } from "./peer-host.js";
+export type HandoffState = "embedded" | "releasing" | "daemon" | "waiting";
+/** How long a vanished daemon is treated as "restarting" before auto mode
+ *  gives up on it and takes the identity back. `agentnet restart` and a
+ *  launchd/systemd kickstart are both back well inside this. */
+export declare const DAEMON_GRACE_MS: number;
 export interface SwitchableHostOptions {
     dataDir: string;
     /** Build a fresh embedded host. Called on first start and on every fallback,
@@ -11,6 +15,14 @@ export interface SwitchableHostOptions {
     makeDaemon: () => PeerHost;
     onChange?: (state: HandoffState, host: PeerHost | null) => void;
     log?: Logger;
+    /** The backend the user pinned with `--backend`, if any. A forced backend is
+     *  never switched away from automatically — in EITHER direction. Auto mode
+     *  (undefined) keeps the full state machine. */
+    force?: BackendKind;
+    /** Grace period before auto mode falls back from a vanished daemon. */
+    graceMs?: number;
+    /** Liveness probe, injectable for tests. Defaults to a real connect. */
+    probe?: (dataDir: string) => Promise<boolean>;
 }
 /**
  * A PeerHost whose backend can change under it.

package/dist/lan-handoff.js

@@ -13,12 +13,16 @@
 // `releasing` is the honest name for the middle state: our peer is down and the
 // daemon is not up yet, so messaging is offline and the UI must say so. Hiding
 // that gap would make dropped messages look like a network fault.
-import { daemonIsRunning } from "./ipc.js";
+import { probeDaemon } from "./ipc.js";
 import { Logger } from "./logger.js";
 /** How often we look for the daemon socket appearing or vanishing. */
 const WATCH_INTERVAL_MS = 1500;
 /** How long we stay in `releasing` before giving up and coming back. */
 const RELEASE_TIMEOUT_MS = 10 * 60 * 1000;
+/** How long a vanished daemon is treated as "restarting" before auto mode
+ *  gives up on it and takes the identity back. `agentnet restart` and a
+ *  launchd/systemd kickstart are both back well inside this. */
+export const DAEMON_GRACE_MS = 60 * 1000;
 /**
  * A PeerHost whose backend can change under it.
  *
@@ -34,11 +38,16 @@ export class SwitchablePeerHost {
     #timer = null;
     #releaseDeadline = 0;
     #busy = false;
+    /** When the daemon was first seen missing, 0 while it is present. Drives the
+     *  grace period; reset the moment it answers again. */
+    #daemonMissingSince = 0;
+    #probe;
     constructor(initial, opts) {
         this.#inner = initial;
         this.#state = initial.kind === "daemon" ? "daemon" : "embedded";
         this.#opts = opts;
         this.#log = opts.log ?? new Logger({ prefix: "LAN" });
+        this.#probe = opts.probe ?? ((dir) => probeDaemon(dir));
         this.#watch();
     }
     get kind() {
@@ -62,7 +71,9 @@ export class SwitchablePeerHost {
             // freezing, which reads as a bug rather than as "you have a step to do".
             return {
                 ok: false,
-                error: "Beagle released its peer and is waiting for the decentlan daemon to start. Messaging resumes when it does.",
+                error: this.#state === "waiting"
+                    ? "The decentlan daemon is restarting. Beagle is holding this identity for it and will re-attach automatically."
+                    : "Beagle released its peer and is waiting for the decentlan daemon to start. Messaging resumes when it does.",
             };
         }
         return this.#inner.call(req);
@@ -122,7 +133,39 @@ export class SwitchablePeerHost {
     async #tick() {
         if (this.#busy)
             return;
-        const daemonUp = daemonIsRunning(this.#opts.dataDir);
+        const daemonUp = await this.#probe(this.#opts.dataDir);
+        if (daemonUp)
+            this.#daemonMissingSince = 0;
+        else if (this.#daemonMissingSince === 0)
+            this.#daemonMissingSince = Date.now();
+        // A tick can await; make sure nothing started while we were probing.
+        if (this.#busy)
+            return;
+        // `--backend daemon` means "this box's identity belongs to the daemon".
+        // Honour that at RUNTIME too, not just at startup. Falling back here is
+        // what deadlocked 245 twice: the embedded peer took <dataDir>/daemon.pid,
+        // launchd then could not restart the daemon (it refuses when a live
+        // process holds the identity), and the "way back" could never fire because
+        // it waits for a daemon that our own lock is keeping down. `waiting` is
+        // the honest state — no peer, no lock, ops rejected with a reason — and it
+        // costs a minute of messaging instead of needing a human to kill beagle
+        // and rm the pidfile.
+        if (this.#opts.force === "daemon") {
+            if (this.#state === "daemon" && !daemonUp) {
+                this.#log.info("the daemon went away — waiting for it to come back (forced daemon backend)");
+                const old = this.#inner;
+                this.#inner = null;
+                this.#setState("waiting");
+                await old?.stop();
+                return;
+            }
+            if (this.#state === "waiting" && daemonUp) {
+                this.#log.info("the daemon is back — re-attaching");
+                this.#inner = this.#opts.makeDaemon();
+                this.#setState("daemon");
+            }
+            return;
+        }
         if (this.#state === "releasing") {
             if (daemonUp) {
                 this.#busy = true;
@@ -143,7 +186,18 @@ export class SwitchablePeerHost {
         // The daemon went away (stopped, uninstalled, crashed). Take the identity
         // back so messaging keeps working — a user who stops the LAN service should
         // not silently lose chat.
+        //
+        // But WAIT first. A daemon that was here a second ago is far more often
+        // restarting than gone: `agentnet restart` is the documented upgrade step,
+        // and a supervisor kickstart looks identical. Grabbing the identity lock in
+        // that gap is what stops the daemon coming back at all, so the fast path
+        // was the deadlock. One minute of the daemon's own downtime is cheap; the
+        // deadlock cost 20 minutes and a human.
         if (this.#state === "daemon" && !daemonUp) {
+            const downMs = Date.now() - this.#daemonMissingSince;
+            const graceMs = this.#opts.graceMs ?? DAEMON_GRACE_MS;
+            if (downMs < graceMs)
+                return; // probably a restart — say nothing, just wait
             await this.#backToEmbedded("the daemon is no longer running");
             return;
         }
@@ -155,7 +209,12 @@ export class SwitchablePeerHost {
         // was running the whole time, invisible to it. The version panel then
         // reported the APP's peer as the daemon's, so an update that had actually
         // landed looked like it had not.
-        if (this.#state === "embedded" && daemonUp) {
+        //
+        // Not when the user pinned `--backend embedded`, though. That flag used to
+        // stop at startup: cli.ts wrapped the forced host in this watcher, which
+        // promoted it right back. Beagle Desktop passes `--backend embedded` and
+        // was demoted within 1.5s anyway — on Windows to a pipe nobody served.
+        if (this.#state === "embedded" && daemonUp && this.#opts.force !== "embedded") {
             await this.#backToDaemon();
         }
     }
@@ -189,6 +248,19 @@ export class SwitchablePeerHost {
             return;
         this.#busy = true;
         try {
+            // Last look before we commit. makeEmbedded() takes <dataDir>/daemon.pid,
+            // and that write is the point of no return: from then on the daemon
+            // cannot start, so it cannot prove us wrong. Rather than thread a probe
+            // into acquireIdentityLock — which would have to be sync, and a sync
+            // check is exactly what could not answer on Windows — close the window
+            // here, where the decision is actually made and awaiting is free.
+            if (await this.#probe(this.#opts.dataDir)) {
+                this.#log.info("the daemon answered after all — staying off the identity lock");
+                this.#daemonMissingSince = 0;
+                this.#inner = this.#opts.makeDaemon();
+                this.#setState("daemon");
+                return;
+            }
             this.#log.info(`falling back to the embedded peer: ${why}`);
             this.#inner = null;
             this.#inner = await this.#opts.makeEmbedded();

package/dist/peer-host.js

@@ -21,7 +21,7 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import yaml from "js-yaml";
-import { daemonIsRunning, ipcCall, ipcSocketPath } from "./ipc.js";
+import { ipcCall, ipcSocketPath, probeDaemon } from "./ipc.js";
 /** Where decentlan keeps its Carrier identity and daemon socket. Beagle reuses
  *  this identity when it exists so a user's friends carry over — the whole
  *  point of the split is that it is the same node, not a new one. */
@@ -73,7 +73,7 @@ export function makeDaemonHost(dataDir) {
  */
 export async function openPeerHost(opts) {
     const dataDir = decentlanCarrierDir(opts.configDir);
-    if (opts.force !== "embedded" && daemonIsRunning(dataDir)) {
+    if (opts.force !== "embedded" && (await probeDaemon(dataDir))) {
         return { host: new DaemonHost(dataDir), why: `decentlan daemon at ${dataDir}` };
     }
     if (opts.force === "daemon") {
@@ -91,7 +91,7 @@ export async function openPeerHost(opts) {
         const waitMs = Math.max(0, opts.waitForDaemonMs ?? 60_000);
         const deadline = Date.now() + waitMs;
         let waited = false;
-        while (!daemonIsRunning(dataDir)) {
+        while (!(await probeDaemon(dataDir))) {
             if (Date.now() >= deadline) {
                 throw new Error(`--backend daemon was requested but no decentlan daemon appeared within ${Math.round(waitMs / 1000)}s ` +
                     `(looked for ${ipcSocketPath(dataDir)}).`);

package/dist/server.js

@@ -1975,6 +1975,11 @@ export function startBeagleServer(opts) {
                         // be ordered, which is why the sidebar never reordered on new
                         // activity.
                         lastTs: lm?.ts ?? 0,
+                        // When the friendship was established. The sidebar sorts by last
+                        // message and falls back to this, so a friend you just accepted —
+                        // who by definition has no messages — lands at the top of the
+                        // no-history group instead of alphabetically halfway down it.
+                        acceptedAt: f.lastSeen ?? 0,
                         wire: "163",
                         avatarUrl: ensPub.get(uid)?.avatarUrl ?? null,
                         // What they advertised over Carrier wins over the directory: it is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/beagle",
-  "version": "0.1.87",
+  "version": "0.1.88",
   "description": "Beagle — P2P chat, file transfer and calls for regular users, on the Decent Network. No admin privilege required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,6 +21,7 @@
   "scripts": {
     "build": "npm run build -w @decentnetwork/beagle-ui && tsc -p tsconfig.json && chmod +x dist/cli.js && node scripts/build-ui.mjs",
     "typecheck": "tsc --noEmit",
+    "test": "tsc -p tsconfig.test.json && node --test .test-build/test/*.test.js",
     "clean": "rm -rf dist",
     "start": "node dist/cli.js"
   },