@decentnetwork/lan 0.1.106 → 0.1.108

package/dist/carrier/peer-manager.d.ts

@@ -53,6 +53,10 @@ export declare class PeerManager extends EventEmitter {
         name?: string;
         description?: string;
     }): void;
+    /** Sign a message with this identity's private key (XEdDSA over the X25519
+     *  Carrier key). The signature verifies against the userid. Used by "Sign in
+     *  with Decent" to prove key possession to a website. Returns 64-byte sig. */
+    sign(message: Uint8Array): Uint8Array;
     /** Offer a file to a friend (toxcore-standard transfer). Returns the fileId. */
     sendFile(userid: string, data: Uint8Array, name: string): string | null;
     /** Accept an incoming file offer. */

package/dist/carrier/peer-manager.js

@@ -106,6 +106,14 @@ export class PeerManager extends EventEmitter {
         this.peer.setUserInfo(info);
         this.logger.info(`Profile updated (name="${info.name ?? "(unchanged)"}")`);
     }
+    /** Sign a message with this identity's private key (XEdDSA over the X25519
+     *  Carrier key). The signature verifies against the userid. Used by "Sign in
+     *  with Decent" to prove key possession to a website. Returns 64-byte sig. */
+    sign(message) {
+        if (!this.peer)
+            throw new Error("Peer not created. Call create() first.");
+        return this.peer.sign(message);
+    }
     /** Offer a file to a friend (toxcore-standard transfer). Returns the fileId. */
     sendFile(userid, data, name) {
         if (!this.peer)

package/dist/cli/commands.js

@@ -1176,6 +1176,7 @@ export async function cmdUi(args) {
         call: (req) => ipcCall(config, req),
         routesPath: resolve(dir, "routes.yaml"),
         doraRosterPath,
+        downloadsDir: resolve(dir, "downloads"),
         meExtra: {
             lanVer: readJsonVer(join(moduleDir, "..", "..", "package.json")),
             peerVer,

package/dist/daemon/ipc.d.ts

@@ -56,6 +56,14 @@ export interface IpcHandlers {
         name?: string;
         description?: string;
     }) => Promise<void>;
+    /** Sign `text` (UTF-8) with this node's Carrier identity key and return the
+     *  detached signature (hex) plus our userid. Backs "Sign in with Decent":
+     *  the UI server's local-only /connect flow calls this on Approve. Reachable
+     *  ONLY over this Unix socket — never exposed on a TCP interface. */
+    sign: (text: string) => Promise<{
+        sig: string;
+        userid: string;
+    }>;
     /** Subscribe to daemon push events (chat / presence / friend-request). The
      *  IPC server keeps the connection open and calls `emit` for each event;
      *  the returned function unsubscribes (called on socket close). Optional —
@@ -82,7 +90,7 @@ export interface IpcHandlers {
     selfRestart: () => Promise<Record<string, unknown>>;
 }
 export interface IpcRequest {
-    op: "friend-request" | "ping" | "diag" | "friends-pending" | "friends-accept" | "friends-reject" | "chat-send" | "chat-history" | "friends-list" | "friend-remove" | "friend-set-alias" | "set-profile" | "file-send" | "chat-mark-read" | "subscribe" | "proxy-reload" | "self-restart";
+    op: "friend-request" | "ping" | "diag" | "friends-pending" | "friends-accept" | "friends-reject" | "chat-send" | "chat-history" | "friends-list" | "friend-remove" | "friend-set-alias" | "set-profile" | "file-send" | "chat-mark-read" | "subscribe" | "sign" | "proxy-reload" | "self-restart";
     address?: string;
     hello?: string;
     userid?: string;

package/dist/daemon/ipc.js

@@ -221,6 +221,11 @@ export class IpcServer {
                 await this.handlers.chatMarkRead(req.userid, req.ts);
                 return;
             }
+            case "sign": {
+                if (typeof req.text !== "string")
+                    throw new Error("text is required");
+                return await this.handlers.sign(req.text);
+            }
             case "proxy-reload":
                 return await this.handlers.proxyReload();
             case "self-restart":

package/dist/daemon/message-store.d.ts

@@ -14,6 +14,13 @@ export interface ChatMessage {
     ts: number;
     /** Stable per-message id (ts + per-process sequence) for UI keys / dedup. */
     id: string;
+    /** Present when this entry is a file transfer rather than a text message.
+     *  `name`/`size` describe the file; received files (dir:"in") are saved to
+     *  <configDir>/downloads/<name> and downloadable via the UI. */
+    file?: {
+        name: string;
+        size: number;
+    };
 }
 export declare class MessageStore {
     private path;
@@ -26,6 +33,12 @@ export declare class MessageStore {
     private load;
     /** Append a message and schedule a flush. Returns the stored message. */
     append(peer: string, dir: "in" | "out", text: string, ts?: number): ChatMessage;
+    /** Append a file-transfer entry (shown as a download chip in the UI). */
+    appendFile(peer: string, dir: "in" | "out", file: {
+        name: string;
+        size: number;
+    }, ts?: number): ChatMessage;
+    private push;
     /**
      * Return history. With no peer, returns every peer's full thread (the legacy
      * chat-history shape). With a peer, supports pagination: `limit` newest

package/dist/daemon/message-store.js

@@ -45,7 +45,13 @@ export class MessageStore {
     }
     /** Append a message and schedule a flush. Returns the stored message. */
     append(peer, dir, text, ts = Date.now()) {
-        const msg = { dir, text, ts, id: `${ts}-${this.seq++}` };
+        return this.push(peer, { dir, text, ts, id: `${ts}-${this.seq++}` });
+    }
+    /** Append a file-transfer entry (shown as a download chip in the UI). */
+    appendFile(peer, dir, file, ts = Date.now()) {
+        return this.push(peer, { dir, text: "", ts, id: `${ts}-${this.seq++}`, file });
+    }
+    push(peer, msg) {
         let arr = this.byPeer.get(peer);
         if (!arr) {
             arr = [];

package/dist/daemon/server.js

@@ -310,6 +310,10 @@ export class DaemonServer {
                     if (!fileId)
                         throw new Error("No free transfer slot (or friend unknown)");
                     this.logger.info(`Offering file "${name}" (${data.length}B) to ${userid.slice(0, 8)}`);
+                    // Record in chat history (as an outgoing file chip) and push to the UI.
+                    this.messageStore?.appendFile(userid, "out", { name, size: data.length });
+                    this.friendMeta?.ensure(userid);
+                    this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
                     return { fileId, name, size: data.length };
                 },
                 chatMarkRead: async (userid, ts) => {
@@ -320,6 +324,13 @@ export class DaemonServer {
                     this.ipcEvents.on("event", onEvent);
                     return () => this.ipcEvents.off("event", onEvent);
                 },
+                sign: async (text) => {
+                    const sig = this.peerManager.sign(new TextEncoder().encode(text));
+                    return {
+                        sig: Buffer.from(sig).toString("hex"),
+                        userid: this.peerManager.getIdentity().userid,
+                    };
+                },
                 proxyReload: async () => {
                     // Re-read the proxy allowlist from disk and push it into the
                     // running proxy without a daemon restart (which would drop
@@ -590,6 +601,10 @@ export class DaemonServer {
                     const safe = (p.name || "file").replace(/[/\\]/g, "_");
                     await fs.writeFile(resolve(dir, safe), Buffer.from(p.data));
                     this.logger.info(`Saved file "${p.name}" (${p.size}B) from ${p.friendId.slice(0, 8)} → ${resolve(dir, safe)}`);
+                    // Record in chat history (as a download chip) and push to the UI.
+                    this.messageStore?.appendFile(p.friendId, "in", { name: safe, size: p.size });
+                    this.friendMeta?.ensure(p.friendId);
+                    this.ipcEvents.emit("event", { type: "chat", userid: p.friendId, dir: "in" });
                 })().catch((e) => this.logger.warn(`Failed to save file: ${e.message}`));
             });
             this.peerManager.on("friend-request", (req) => {

package/dist/ui/desktop/app.js

@@ -131,6 +131,16 @@ function dkClock(ts) {
   const d = new Date(ts);
   return String(d.getHours()).padStart(2, "0") + ":" + String(d.getMinutes()).padStart(2, "0");
 }
+function dkFileSize(n) {
+  if (!n || n < 0) return "0 B";
+  if (n < 1024) return n + " B";
+  if (n < 1024 * 1024) return (n / 1024).toFixed(1) + " KB";
+  if (n < 1024 * 1024 * 1024) return (n / (1024 * 1024)).toFixed(1) + " MB";
+  return (n / (1024 * 1024 * 1024)).toFixed(2) + " GB";
+}
+function dkFileUrl(name) {
+  return "/api/file-download?name=" + encodeURIComponent(name);
+}
 function dkDayLabel(ts) {
   if (!ts) return "Today";
   const d = new Date(ts), now = /* @__PURE__ */ new Date();
@@ -186,7 +196,11 @@ const dkApi = {
   remove: (userid) => dkPost("/api/friend-remove", { userid }),
   alias: (userid, alias) => dkPost("/api/friend-alias", { userid, alias }),
   markRead: (userid) => dkPost("/api/chat-mark-read", { userid }),
-  setProfile: (name, description) => dkPost("/api/set-profile", { name, description })
+  setProfile: (name, description) => dkPost("/api/set-profile", { name, description }),
+  sendFile: (userid, file) => fetch(
+    "/api/file-send?userid=" + encodeURIComponent(userid) + "&name=" + encodeURIComponent(file.name),
+    { method: "POST", body: file }
+  ).then((r) => r.json()).catch((e) => ({ ok: false, error: String(e) }))
 };
 const DK_ME_FALLBACK = {
   name: "\u2026",
@@ -240,6 +254,7 @@ function useDaemonData() {
         from: m.dir === "out" ? "me" : "them",
         time: dkClock(m.ts),
         text: m.text,
+        file: m.file ? { name: m.file.name, size: dkFileSize(m.file.size), dir: m.dir } : void 0,
         status: m.dir === "out" ? "read" : void 0
       }));
       const withDay = msgs.length ? [{ day: dkDayLabel(arr[0].ts) }].concat(msgs) : [];
@@ -987,16 +1002,27 @@ const inputStyle = {
 };
 function Msg({ m, peer, T }) {
   const mine = m.from === "me";
-  return /* @__PURE__ */ React.createElement("div", { style: { display: "flex", justifyContent: mine ? "flex-end" : "flex-start", alignItems: "flex-end", gap: 8, margin: "3px 0" } }, !mine && /* @__PURE__ */ React.createElement(DkAvatar, { peer, size: 24, radius: 6, dot: false }), /* @__PURE__ */ React.createElement("div", { style: { maxWidth: "64%", display: "flex", flexDirection: "column", alignItems: mine ? "flex-end" : "flex-start" } }, m.file ? /* @__PURE__ */ React.createElement("div", { style: {
-    display: "flex",
-    alignItems: "center",
-    gap: 10,
-    padding: "10px 12px",
-    borderRadius: 10,
-    background: mine ? "var(--bub-me)" : "var(--bub-them)",
-    border: "1px solid " + (mine ? "transparent" : "var(--line)"),
-    minWidth: 200
-  } }, /* @__PURE__ */ React.createElement("div", { style: { width: 34, height: 34, borderRadius: 7, flexShrink: 0, background: mine ? "rgba(255,255,255,0.16)" : "var(--chip)", display: "flex", alignItems: "center", justifyContent: "center", color: mine ? "#fff" : "var(--accent)" } }, /* @__PURE__ */ React.createElement(Icon, { name: m.file.kind || "file", size: 18, stroke: 1.9 })), /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0, flex: 1 } }, /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 12.5, fontWeight: 600, color: mine ? "#fff" : "var(--text)", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" } }, m.file.name), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 11, color: mine ? "rgba(255,255,255,0.7)" : "var(--faint)", marginTop: 1 } }, m.file.size)), /* @__PURE__ */ React.createElement(Icon, { name: "download", size: 16, stroke: 2, color: mine ? "rgba(255,255,255,0.85)" : "var(--dim)" })) : /* @__PURE__ */ React.createElement("div", { style: {
+  return /* @__PURE__ */ React.createElement("div", { style: { display: "flex", justifyContent: mine ? "flex-end" : "flex-start", alignItems: "flex-end", gap: 8, margin: "3px 0" } }, !mine && /* @__PURE__ */ React.createElement(DkAvatar, { peer, size: 24, radius: 6, dot: false }), /* @__PURE__ */ React.createElement("div", { style: { maxWidth: "64%", display: "flex", flexDirection: "column", alignItems: mine ? "flex-end" : "flex-start" } }, m.file ? React.createElement(
+    mine ? "div" : "a",
+    {
+      ...mine ? {} : { href: dkFileUrl(m.file.name), download: m.file.name, title: "download" },
+      style: {
+        display: "flex",
+        alignItems: "center",
+        gap: 10,
+        padding: "10px 12px",
+        borderRadius: 10,
+        background: mine ? "var(--bub-me)" : "var(--bub-them)",
+        border: "1px solid " + (mine ? "transparent" : "var(--line)"),
+        minWidth: 200,
+        textDecoration: "none",
+        cursor: mine ? "default" : "pointer"
+      }
+    },
+    /* @__PURE__ */ React.createElement("div", { style: { width: 34, height: 34, borderRadius: 7, flexShrink: 0, background: mine ? "rgba(255,255,255,0.16)" : "var(--chip)", display: "flex", alignItems: "center", justifyContent: "center", color: mine ? "#fff" : "var(--accent)" } }, /* @__PURE__ */ React.createElement(Icon, { name: m.file.kind || "file", size: 18, stroke: 1.9 })),
+    /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0, flex: 1 } }, /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 12.5, fontWeight: 600, color: mine ? "#fff" : "var(--text)", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" } }, m.file.name), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 11, color: mine ? "rgba(255,255,255,0.7)" : "var(--faint)", marginTop: 1 } }, m.file.size, mine ? "" : " \xB7 download")),
+    mine ? /* @__PURE__ */ React.createElement(Icon, { name: "checkCheck", size: 16, stroke: 2, color: "rgba(255,255,255,0.85)" }) : /* @__PURE__ */ React.createElement(Icon, { name: "download", size: 16, stroke: 2, color: "var(--accent)" })
+  ) : /* @__PURE__ */ React.createElement("div", { style: {
     padding: "8px 12px",
     borderRadius: 12,
     borderBottomRightRadius: mine ? 4 : 12,
@@ -1011,14 +1037,17 @@ function Msg({ m, peer, T }) {
     wordBreak: "break-word"
   } }, m.text), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 4, margin: "3px 3px 0" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 10, color: "var(--faint)" } }, m.time), mine && m.status && /* @__PURE__ */ React.createElement(Icon, { name: "checkCheck", size: 12, stroke: 2.2, color: m.status === "read" ? "var(--accent)" : "var(--faint)" }))));
 }
-function Conversation({ T, peer, lang, thread: threadProp, onSend, onAlias, onRemove, onOpenNet }) {
+function Conversation({ T, peer, lang, thread: threadProp, onSend, onSendFile, onAlias, onRemove, onOpenNet }) {
   const scrollRef = React.useRef(null);
+  const fileRef = React.useRef(null);
   const thread = threadProp && threadProp.length ? threadProp : [{ day: "Today" }, { from: "them", time: "\u2014", text: lang === "zh" ? "\u6682\u65E0\u6D88\u606F\u8BB0\u5F55\uFF0C\u53D1\u4E2A\u6D88\u606F\u6253\u4E2A\u62DB\u547C\u5427\u3002" : "No messages yet. Say hi." }];
   React.useEffect(() => {
     if (scrollRef.current) scrollRef.current.scrollTop = scrollRef.current.scrollHeight;
   }, [peer.id, threadProp]);
   const [menu, setMenu] = React.useState(false);
   const [draft, setDraft] = React.useState("");
+  const [dragOver, setDragOver] = React.useState(false);
+  const [sending, setSending] = React.useState(null);
   React.useEffect(() => {
     setDraft("");
   }, [peer.id]);
@@ -1028,27 +1057,68 @@ function Conversation({ T, peer, lang, thread: threadProp, onSend, onAlias, onRe
       setDraft("");
     }
   };
-  return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, minWidth: 0, minHeight: 0, display: "flex", flexDirection: "column", background: "var(--bg)" } }, /* @__PURE__ */ React.createElement("div", { style: { height: 60, flexShrink: 0, borderBottom: "1px solid var(--line)", display: "flex", alignItems: "center", gap: 12, padding: "0 16px", background: "var(--panel)" } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer, size: 34, radius: 8 }), /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: peer.alias ? "var(--ui)" : "var(--mono)", fontSize: 15, fontWeight: 700, color: "var(--text)" } }, peer.alias || shortKey(peer.userId, 10, 6)), peer.agent && /* @__PURE__ */ React.createElement(Tag, { tone: "accent" }, "agent"), /* @__PURE__ */ React.createElement(RouteTag, { peer })), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 2 } }, /* @__PURE__ */ React.createElement(Mono, { size: 11.5, dim: true, copy: peer.userId, title: peer.userId }, shortKey(peer.userId, 10, 6)), /* @__PURE__ */ React.createElement("span", { style: { color: "var(--line)" } }, "\xB7"), /* @__PURE__ */ React.createElement("button", { onClick: () => onOpenNet(peer), style: { background: "none", border: "none", cursor: "pointer", padding: 0, fontFamily: "var(--mono)", fontSize: 11.5, color: "var(--accent)", display: "inline-flex", alignItems: "center", gap: 4 } }, /* @__PURE__ */ React.createElement(Icon, { name: "network", size: 12, stroke: 2 }), " ", peer.ip))), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, /* @__PURE__ */ React.createElement(Btn, { icon: "more", onClick: () => setMenu((v) => !v) }), menu && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("div", { onClick: () => setMenu(false), style: { position: "fixed", inset: 0, zIndex: 40 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "absolute", right: 0, top: 36, zIndex: 50, width: 180, background: "var(--panel-2)", border: "1px solid var(--line)", borderRadius: 9, padding: 6, boxShadow: "0 14px 40px rgba(0,0,0,0.4)" } }, /* @__PURE__ */ React.createElement(MenuItem, { icon: "hash", label: T.alias, onClick: () => {
-    setMenu(false);
-    onAlias(peer);
-  } }), /* @__PURE__ */ React.createElement("div", { style: { height: 1, background: "var(--line)", margin: "5px 4px" } }), /* @__PURE__ */ React.createElement(MenuItem, { icon: "trash", label: T.remove, danger: true, onClick: () => {
-    setMenu(false);
-    onRemove(peer);
-  } }))))), /* @__PURE__ */ React.createElement("div", { ref: scrollRef, style: { flex: 1, overflow: "auto", padding: "18px 22px" } }, /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto" } }, thread.map((m, i) => m.day ? /* @__PURE__ */ React.createElement("div", { key: i, style: { display: "flex", justifyContent: "center", margin: "14px 0" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 10.5, fontWeight: 600, color: "var(--faint)", background: "var(--chip)", padding: "3px 10px", borderRadius: 999 } }, m.day)) : /* @__PURE__ */ React.createElement(Msg, { key: i, m, peer, T })))), /* @__PURE__ */ React.createElement("div", { style: { flexShrink: 0, borderTop: "1px solid var(--line)", padding: "12px 16px", background: "var(--panel)" } }, /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto", display: "flex", alignItems: "center", gap: 10 } }, /* @__PURE__ */ React.createElement(
-    "input",
+  const sendFiles = (files) => {
+    if (!files || !files.length || !onSendFile) return;
+    const file = files[0];
+    setSending({ name: file.name });
+    Promise.resolve(onSendFile(file)).then((r) => {
+      if (r && r.ok === false) window.alert((lang === "zh" ? "\u53D1\u9001\u5931\u8D25: " : "Send failed: ") + (r.error || ""));
+    }).finally(() => setSending(null));
+  };
+  const onDrop = (e) => {
+    e.preventDefault();
+    setDragOver(false);
+    sendFiles(e.dataTransfer.files);
+  };
+  return /* @__PURE__ */ React.createElement(
+    "div",
     {
-      value: draft,
-      onChange: (e) => setDraft(e.target.value),
-      onKeyDown: (e) => {
-        if (e.key === "Enter" && !e.shiftKey) {
-          e.preventDefault();
-          sendDraft();
-        }
+      style: { flex: 1, minWidth: 0, minHeight: 0, display: "flex", flexDirection: "column", background: "var(--bg)", position: "relative" },
+      onDragOver: (e) => {
+        e.preventDefault();
+        if (!dragOver) setDragOver(true);
       },
-      placeholder: `${T.message} ${peer.alias || shortKey(peer.userId, 6, 4)}\u2026`,
-      style: { flex: 1, height: 38, borderRadius: 9, border: "1px solid var(--line)", background: "var(--panel-2)", color: "var(--text)", fontFamily: "var(--ui)", fontSize: 13.5, padding: "0 14px", outline: "none", minWidth: 0 }
-    }
-  ), /* @__PURE__ */ React.createElement(Btn, { tone: "solid", icon: "arrowUp", title: T.send, onClick: sendDraft }))));
+      onDragLeave: (e) => {
+        if (e.currentTarget === e.target) setDragOver(false);
+      },
+      onDrop
+    },
+    dragOver && /* @__PURE__ */ React.createElement("div", { style: { position: "absolute", inset: 0, zIndex: 30, background: "rgba(91,140,255,0.10)", border: "2px dashed var(--accent)", borderRadius: 12, display: "flex", alignItems: "center", justifyContent: "center", pointerEvents: "none", fontFamily: "var(--mono)", fontSize: 14, color: "var(--accent)" } }, lang === "zh" ? "\u677E\u5F00\u53D1\u9001\u6587\u4EF6" : "Drop to send file"),
+    /* @__PURE__ */ React.createElement("div", { style: { height: 60, flexShrink: 0, borderBottom: "1px solid var(--line)", display: "flex", alignItems: "center", gap: 12, padding: "0 16px", background: "var(--panel)" } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer, size: 34, radius: 8 }), /* @__PURE__ */ React.createElement("div", { style: { minWidth: 0 } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: peer.alias ? "var(--ui)" : "var(--mono)", fontSize: 15, fontWeight: 700, color: "var(--text)" } }, peer.alias || shortKey(peer.userId, 10, 6)), peer.agent && /* @__PURE__ */ React.createElement(Tag, { tone: "accent" }, "agent"), /* @__PURE__ */ React.createElement(RouteTag, { peer })), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8, marginTop: 2 } }, /* @__PURE__ */ React.createElement(Mono, { size: 11.5, dim: true, copy: peer.userId, title: peer.userId }, shortKey(peer.userId, 10, 6)), /* @__PURE__ */ React.createElement("span", { style: { color: "var(--line)" } }, "\xB7"), /* @__PURE__ */ React.createElement("button", { onClick: () => onOpenNet(peer), style: { background: "none", border: "none", cursor: "pointer", padding: 0, fontFamily: "var(--mono)", fontSize: 11.5, color: "var(--accent)", display: "inline-flex", alignItems: "center", gap: 4 } }, /* @__PURE__ */ React.createElement(Icon, { name: "network", size: 12, stroke: 2 }), " ", peer.ip))), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, /* @__PURE__ */ React.createElement(Btn, { icon: "more", onClick: () => setMenu((v) => !v) }), menu && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("div", { onClick: () => setMenu(false), style: { position: "fixed", inset: 0, zIndex: 40 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "absolute", right: 0, top: 36, zIndex: 50, width: 180, background: "var(--panel-2)", border: "1px solid var(--line)", borderRadius: 9, padding: 6, boxShadow: "0 14px 40px rgba(0,0,0,0.4)" } }, /* @__PURE__ */ React.createElement(MenuItem, { icon: "hash", label: T.alias, onClick: () => {
+      setMenu(false);
+      onAlias(peer);
+    } }), /* @__PURE__ */ React.createElement("div", { style: { height: 1, background: "var(--line)", margin: "5px 4px" } }), /* @__PURE__ */ React.createElement(MenuItem, { icon: "trash", label: T.remove, danger: true, onClick: () => {
+      setMenu(false);
+      onRemove(peer);
+    } }))))),
+    /* @__PURE__ */ React.createElement("div", { ref: scrollRef, style: { flex: 1, overflow: "auto", padding: "18px 22px" } }, /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto" } }, thread.map((m, i) => m.day ? /* @__PURE__ */ React.createElement("div", { key: i, style: { display: "flex", justifyContent: "center", margin: "14px 0" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 10.5, fontWeight: 600, color: "var(--faint)", background: "var(--chip)", padding: "3px 10px", borderRadius: 999 } }, m.day)) : /* @__PURE__ */ React.createElement(Msg, { key: i, m, peer, T })))),
+    /* @__PURE__ */ React.createElement("div", { style: { flexShrink: 0, borderTop: "1px solid var(--line)", padding: "12px 16px", background: "var(--panel)" } }, sending && /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto 8px", display: "flex", alignItems: "center", gap: 8, fontFamily: "var(--mono)", fontSize: 11.5, color: "var(--faint)" } }, /* @__PURE__ */ React.createElement(Icon, { name: "paperclip", size: 13, stroke: 2, color: "var(--accent)" }), (lang === "zh" ? "\u53D1\u9001\u4E2D: " : "Sending: ") + sending.name), /* @__PURE__ */ React.createElement("div", { style: { maxWidth: 760, margin: "0 auto", display: "flex", alignItems: "center", gap: 10 } }, /* @__PURE__ */ React.createElement(
+      "input",
+      {
+        ref: fileRef,
+        type: "file",
+        style: { display: "none" },
+        onChange: (e) => {
+          sendFiles(e.target.files);
+          e.target.value = "";
+        }
+      }
+    ), /* @__PURE__ */ React.createElement(Btn, { icon: "paperclip", title: T.sendFile, onClick: () => fileRef.current && fileRef.current.click() }), /* @__PURE__ */ React.createElement(
+      "input",
+      {
+        value: draft,
+        onChange: (e) => setDraft(e.target.value),
+        onKeyDown: (e) => {
+          if (e.key === "Enter" && !e.shiftKey) {
+            e.preventDefault();
+            sendDraft();
+          }
+        },
+        placeholder: `${T.message} ${peer.alias || shortKey(peer.userId, 6, 4)}\u2026`,
+        style: { flex: 1, height: 38, borderRadius: 9, border: "1px solid var(--line)", background: "var(--panel-2)", color: "var(--text)", fontFamily: "var(--ui)", fontSize: 13.5, padding: "0 14px", outline: "none", minWidth: 0 }
+      }
+    ), /* @__PURE__ */ React.createElement(Btn, { tone: "solid", icon: "arrowUp", title: T.send, onClick: sendDraft })))
+  );
 }
 function MenuItem({ icon, label, onClick, danger }) {
   return /* @__PURE__ */ React.createElement("button", { onClick, style: {
@@ -1071,9 +1141,9 @@ function MenuItem({ icon, label, onClick, danger }) {
 function ChatEmpty({ T }) {
   return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, display: "flex", flexDirection: "column", alignItems: "center", justifyContent: "center", gap: 12, color: "var(--faint)", background: "var(--bg)" } }, /* @__PURE__ */ React.createElement(Icon, { name: "message", size: 40, stroke: 1.4, color: "var(--line)" }), /* @__PURE__ */ React.createElement("div", { style: { fontFamily: "var(--mono)", fontSize: 13 } }, T.pickPeer));
 }
-function ChatTab({ T, lang, peers, requests, activeId, thread, onSelect, onAct, onAdd, onSend, onAlias, onRemove, onOpenNet }) {
+function ChatTab({ T, lang, peers, requests, activeId, thread, onSelect, onAct, onAdd, onSend, onSendFile, onAlias, onRemove, onOpenNet }) {
   const peer = peers.find((p) => p.id === activeId);
-  return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, display: "flex", minWidth: 0, minHeight: 0 } }, /* @__PURE__ */ React.createElement(PeerSidebar, { T, peers, requests, activeId, onSelect, onAct, onAdd }), peer ? /* @__PURE__ */ React.createElement(Conversation, { T, peer, lang, thread, onSend, onAlias, onRemove, onOpenNet }) : /* @__PURE__ */ React.createElement(ChatEmpty, { T }));
+  return /* @__PURE__ */ React.createElement("div", { style: { flex: 1, display: "flex", minWidth: 0, minHeight: 0 } }, /* @__PURE__ */ React.createElement(PeerSidebar, { T, peers, requests, activeId, onSelect, onAct, onAdd }), peer ? /* @__PURE__ */ React.createElement(Conversation, { T, peer, lang, thread, onSend, onSendFile, onAlias, onRemove, onOpenNet }) : /* @__PURE__ */ React.createElement(ChatEmpty, { T }));
 }
 Object.assign(window, { ChatTab });
 function StatTile({ label, value, sub, tone }) {
@@ -1427,6 +1497,14 @@ function DkApp() {
     if (!activeId || !text || !text.trim()) return;
     dkApi.send(activeId, text.trim()).then(() => data.loadThread(activeId)).then(data.refresh);
   };
+  const onSendFile = (file) => {
+    if (!activeId || !file) return Promise.resolve({ ok: false });
+    return dkApi.sendFile(activeId, file).then((r) => {
+      data.loadThread(activeId);
+      data.refresh();
+      return r;
+    });
+  };
   const onAlias = (peer) => {
     const a = window.prompt("Set alias for this peer (empty to clear):", peer.alias || "");
     if (a !== null) dkApi.alias(peer.id, a).then(data.refresh);
@@ -1444,7 +1522,7 @@ function DkApp() {
     { id: "network", icon: "network", label: T.network },
     { id: "profile", icon: "userRound", label: T.profile }
   ];
-  return /* @__PURE__ */ React.createElement("div", { style: { ...vars, "--row-pad": rowPad, position: "fixed", inset: 0, display: "flex", background: "var(--bg)", color: "var(--text)", fontFamily: "var(--ui)" } }, /* @__PURE__ */ React.createElement("div", { style: { width: 68, flexShrink: 0, borderRight: "1px solid var(--line)", background: "var(--rail)", display: "flex", flexDirection: "column", alignItems: "center", padding: "14px 0", gap: 8 } }, /* @__PURE__ */ React.createElement("div", { style: { width: 38, height: 38, borderRadius: 10, background: "var(--accent)", display: "flex", alignItems: "center", justifyContent: "center", marginBottom: 8 } }, /* @__PURE__ */ React.createElement(Icon, { name: "terminal", size: 20, color: "#fff", stroke: 2.2 })), nav.map((n) => /* @__PURE__ */ React.createElement(RailBtn, { key: n.id, icon: n.icon, label: n.label, active: tab === n.id, soon: n.soon, onClick: () => setTab(n.id) })), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer: { ...me, id: me.userId, agent: false }, size: 36, radius: 9 }))), /* @__PURE__ */ React.createElement("div", { style: { flex: 1, minWidth: 0, minHeight: 0, display: "flex", flexDirection: "column" } }, /* @__PURE__ */ React.createElement("div", { style: { height: 46, flexShrink: 0, borderBottom: "1px solid var(--line)", background: "var(--panel)", display: "flex", alignItems: "center", gap: 12, padding: "0 16px" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 14, fontWeight: 700, letterSpacing: -0.3, color: "var(--text)" } }, "decentlan"), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 12, color: "var(--faint)" } }, "\xB7 ", nav.find((n) => n.id === tab).label.toLowerCase()), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement(Tag, { tone: "accent" }, me.channel, " \xB7 lan ", me.lanVer), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 7, padding: "0 4px" } }, /* @__PURE__ */ React.createElement(StatusDot, { online: me.online }), /* @__PURE__ */ React.createElement(Mono, { size: 12.5, copy: me.ip }, me.ip)), /* @__PURE__ */ React.createElement("span", { style: { width: 1, height: 22, background: "var(--line)" } }), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer: { ...me, id: me.userId, agent: false }, size: 26, radius: 7 }), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 12.5, fontWeight: 600, color: "var(--text)" } }, me.name))), tab === "chat" && /* @__PURE__ */ React.createElement(ChatTab, { T, lang: t.lang, peers, requests, activeId, thread: data.threads[activeId], onSelect, onAct, onAdd, onSend, onAlias, onRemove, onOpenNet }), tab === "network" && /* @__PURE__ */ React.createElement(NetworkTab, { T, me, peers, exits, activeExit, reqCount: requests.length, onSetExit, onOpenChat }), tab === "profile" && /* @__PURE__ */ React.createElement(ProfileTab, { T, me, onEdit })), /* @__PURE__ */ React.createElement(TweaksPanel, null, /* @__PURE__ */ React.createElement(TweakSection, { label: t.lang === "zh" ? "\u5916\u89C2" : "Appearance" }), /* @__PURE__ */ React.createElement(
+  return /* @__PURE__ */ React.createElement("div", { style: { ...vars, "--row-pad": rowPad, position: "fixed", inset: 0, display: "flex", background: "var(--bg)", color: "var(--text)", fontFamily: "var(--ui)" } }, /* @__PURE__ */ React.createElement("div", { style: { width: 68, flexShrink: 0, borderRight: "1px solid var(--line)", background: "var(--rail)", display: "flex", flexDirection: "column", alignItems: "center", padding: "14px 0", gap: 8 } }, /* @__PURE__ */ React.createElement("div", { style: { width: 38, height: 38, borderRadius: 10, background: "var(--accent)", display: "flex", alignItems: "center", justifyContent: "center", marginBottom: 8 } }, /* @__PURE__ */ React.createElement(Icon, { name: "terminal", size: 20, color: "#fff", stroke: 2.2 })), nav.map((n) => /* @__PURE__ */ React.createElement(RailBtn, { key: n.id, icon: n.icon, label: n.label, active: tab === n.id, soon: n.soon, onClick: () => setTab(n.id) })), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement("div", { style: { position: "relative" } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer: { ...me, id: me.userId, agent: false }, size: 36, radius: 9 }))), /* @__PURE__ */ React.createElement("div", { style: { flex: 1, minWidth: 0, minHeight: 0, display: "flex", flexDirection: "column" } }, /* @__PURE__ */ React.createElement("div", { style: { height: 46, flexShrink: 0, borderBottom: "1px solid var(--line)", background: "var(--panel)", display: "flex", alignItems: "center", gap: 12, padding: "0 16px" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 14, fontWeight: 700, letterSpacing: -0.3, color: "var(--text)" } }, "decentlan"), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 12, color: "var(--faint)" } }, "\xB7 ", nav.find((n) => n.id === tab).label.toLowerCase()), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement(Tag, { tone: "accent" }, me.channel, " \xB7 lan ", me.lanVer), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 7, padding: "0 4px" } }, /* @__PURE__ */ React.createElement(StatusDot, { online: me.online }), /* @__PURE__ */ React.createElement(Mono, { size: 12.5, copy: me.ip }, me.ip)), /* @__PURE__ */ React.createElement("span", { style: { width: 1, height: 22, background: "var(--line)" } }), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 8 } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer: { ...me, id: me.userId, agent: false }, size: 26, radius: 7 }), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 12.5, fontWeight: 600, color: "var(--text)" } }, me.name))), tab === "chat" && /* @__PURE__ */ React.createElement(ChatTab, { T, lang: t.lang, peers, requests, activeId, thread: data.threads[activeId], onSelect, onAct, onAdd, onSend, onSendFile, onAlias, onRemove, onOpenNet }), tab === "network" && /* @__PURE__ */ React.createElement(NetworkTab, { T, me, peers, exits, activeExit, reqCount: requests.length, onSetExit, onOpenChat }), tab === "profile" && /* @__PURE__ */ React.createElement(ProfileTab, { T, me, onEdit })), /* @__PURE__ */ React.createElement(TweaksPanel, null, /* @__PURE__ */ React.createElement(TweakSection, { label: t.lang === "zh" ? "\u5916\u89C2" : "Appearance" }), /* @__PURE__ */ React.createElement(
     TweakRadio,
     {
       label: t.lang === "zh" ? "\u4E3B\u9898" : "Theme",

package/dist/ui/server.d.ts

@@ -17,6 +17,9 @@ export interface FriendUiOptions {
         wire?: string;
         channel?: string;
     };
+    /** Directory where the daemon saves received files (<configDir>/downloads).
+     *  Used to serve GET /api/file-download. Undefined disables downloads. */
+    downloadsDir?: string;
     listenHost?: string;
     listenPort?: number;
     log?: (msg: string) => void;

package/dist/ui/server.js

@@ -21,6 +21,115 @@ import { DEFAULT_EXITS } from "../config/loader.js";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
 // scripts/build-ui.mjs emits it next to this compiled module at dist/ui/desktop/.
 const DESKTOP_DIR = join(dirname(fileURLToPath(import.meta.url)), "desktop");
+/** True only when the request came from the local machine. Used to gate the
+ *  "Sign in with Decent" routes so binding the UI to a LAN IP can't expose
+ *  identity signing to other hosts. The popup always runs in the local user's
+ *  browser, so it connects over the loopback interface. */
+function isLocalRequest(req) {
+    const a = req.socket.remoteAddress ?? "";
+    return a === "127.0.0.1" || a === "::1" || a === "::ffff:127.0.0.1";
+}
+/** Validate and normalize a website origin (scheme://host[:port], no path).
+ *  Returns the canonical origin string or null if malformed. Only http/https
+ *  are accepted. */
+function validateOrigin(raw) {
+    if (typeof raw !== "string" || raw.length === 0 || raw.length > 256)
+        return null;
+    try {
+        const u = new URL(raw);
+        if (u.protocol !== "http:" && u.protocol !== "https:")
+            return null;
+        // u.origin drops any path/query/hash and lowercases the host.
+        if (u.origin === "null" || !u.origin)
+            return null;
+        return u.origin;
+    }
+    catch {
+        return null;
+    }
+}
+// The "Sign in with Decent" consent popup. Self-contained (no external assets),
+// dark theme matching the desktop UI. Reads origin+nonce from its own query,
+// shows the requesting site and this node's identity, and on Approve calls the
+// local /api/connect-approve to sign, then postMessages the result to the
+// opener at the exact requesting origin. Mandatory explicit consent — never
+// returns identity without an Approve click.
+const CONNECT_PAGE = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in with Decent</title>
+<style>
+  :root{--bg:#0c0d11;--panel:#14161d;--line:#262a35;--text:#e7e9ef;--faint:#8b91a3;
+        --accent:#5b8cff;--good:#46a758;--bad:#e5604d;--mono:ui-monospace,SFMono-Regular,Menlo,monospace}
+  *{box-sizing:border-box}
+  html,body{margin:0;height:100%}
+  body{background:var(--bg);color:var(--text);font:14px/1.5 system-ui,-apple-system,Segoe UI,sans-serif;
+       display:flex;align-items:center;justify-content:center;padding:18px}
+  .card{width:100%;max-width:380px;background:var(--panel);border:1px solid var(--line);
+        border-radius:14px;padding:22px 20px}
+  .brand{font-weight:600;letter-spacing:.2px;color:var(--accent);font-size:13px;display:flex;align-items:center;gap:7px}
+  .brand .d{width:11px;height:11px;background:var(--accent);transform:rotate(45deg);border-radius:2px}
+  h1{font-size:18px;margin:14px 0 6px}
+  .sub{color:var(--faint);margin:0 0 16px}
+  .origin{color:var(--text);font-weight:600;word-break:break-all}
+  .id{background:#0e1016;border:1px solid var(--line);border-radius:10px;padding:11px 12px;margin-bottom:14px}
+  .lbl{font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:var(--faint);margin-bottom:4px}
+  .userid{font-family:var(--mono);font-size:12.5px;color:var(--text);word-break:break-all}
+  .err{background:rgba(229,96,77,.12);border:1px solid rgba(229,96,77,.4);color:#ffb4a8;
+       border-radius:9px;padding:9px 11px;font-size:12.5px;margin-bottom:13px}
+  .row{display:flex;gap:10px;margin-top:4px}
+  .btn{flex:1;border:0;border-radius:9px;padding:11px;font-size:14px;font-weight:600;cursor:pointer}
+  .ghost{background:transparent;border:1px solid var(--line);color:var(--text)}
+  .ghost:hover{border-color:#3a4050}
+  .solid{background:var(--accent);color:#fff}
+  .solid:disabled{opacity:.45;cursor:not-allowed}
+  .note{color:var(--faint);font-size:11.5px;margin:15px 0 0;line-height:1.45}
+</style></head>
+<body>
+  <div class="card">
+    <div class="brand"><span class="d"></span>Decent</div>
+    <h1>Sign in</h1>
+    <p class="sub"><span id="origin" class="origin">…</span> wants to sign you in with your Decent identity.</p>
+    <div class="id"><div class="lbl">Your identity</div><div id="userid" class="userid">loading…</div></div>
+    <div id="err" class="err" hidden></div>
+    <div class="row">
+      <button id="deny" class="btn ghost">Deny</button>
+      <button id="approve" class="btn solid" disabled>Approve</button>
+    </div>
+    <p class="note">Approving sends the site a signature bound to that site, proving you control this identity. Your private key never leaves this device.</p>
+  </div>
+<script>
+(function(){
+  var qs=new URLSearchParams(location.search);
+  var origin=qs.get("origin")||"", nonce=qs.get("nonce")||"";
+  var oEl=document.getElementById("origin"), errEl=document.getElementById("err");
+  var approve=document.getElementById("approve"), deny=document.getElementById("deny");
+  oEl.textContent=origin||"(unknown site)";
+  function fail(m){errEl.textContent=m;errEl.hidden=false;}
+  function reply(data){ if(window.opener&&validOrigin){ window.opener.postMessage(Object.assign({type:"decent-auth",nonce:nonce},data),origin);} }
+  var validOrigin=false;
+  try{var u=new URL(origin); validOrigin=(u.protocol==="http:"||u.protocol==="https:")&&u.origin===origin;}catch(e){}
+  if(!validOrigin) fail("This sign-in request has an invalid origin and was blocked.");
+  if(nonce.length===0||nonce.length>512){ validOrigin=false; fail("This sign-in request is missing a valid nonce."); }
+  fetch("/api/state").then(function(r){return r.json();}).then(function(s){
+    var uid=(s.me&&s.me.userid)||"";
+    document.getElementById("userid").textContent=uid||"(no identity)";
+    if(uid&&validOrigin) approve.disabled=false;
+    else if(!uid) fail("No local Decent identity found — is the daemon running?");
+  }).catch(function(){ fail("Could not reach the local agentnet daemon."); });
+  deny.onclick=function(){ reply({error:"denied"}); setTimeout(function(){window.close();},60); };
+  approve.onclick=function(){
+    approve.disabled=true; approve.textContent="Signing…";
+    fetch("/api/connect-approve",{method:"POST",headers:{"content-type":"application/json"},
+      body:JSON.stringify({origin:origin,nonce:nonce})})
+      .then(function(r){return r.json();})
+      .then(function(j){ if(!j.ok) throw new Error(j.error||"sign failed");
+        reply({userid:j.userid,sig:j.sig}); setTimeout(function(){window.close();},60); })
+      .catch(function(e){ approve.disabled=false; approve.textContent="Approve"; fail("Signing failed: "+e.message); });
+  };
+})();
+</script>
+</body></html>`;
 // ---- shapes the desktop UI (src/ui/desktop) consumes (DK_* in the design) ----
 const fmtTime = (ts) => {
     if (!ts)
@@ -94,6 +203,117 @@ export function startFriendUi(opts) {
                 res.end("not found");
                 return;
             }
+            // ── Sign in with Decent ────────────────────────────────────────────
+            // A website opens http://localhost:8765/connect?origin=…&nonce=… in a
+            // popup; on Approve we sign "decent-auth\n<origin>\n<nonce>" with this
+            // node's Carrier identity and postMessage {userid,nonce,sig} back to the
+            // site, which verifies the signature against the userid. BOTH routes are
+            // LOCALHOST-ONLY: the popup always runs in the local user's browser
+            // (localhost), so binding the UI to a LAN IP must never let a remote
+            // host request signatures with this identity.
+            if (url === "/connect" || url === "/api/connect-approve") {
+                if (!isLocalRequest(req)) {
+                    res.writeHead(403, { "content-type": "text/plain" });
+                    res.end("Sign in with Decent is available only on this machine (localhost).");
+                    return;
+                }
+            }
+            if (req.method === "GET" && url === "/connect") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end(CONNECT_PAGE);
+                return;
+            }
+            if (req.method === "POST" && url === "/api/connect-approve") {
+                const body = await readBody(req);
+                const origin = validateOrigin(body.origin);
+                const nonce = typeof body.nonce === "string" ? body.nonce : "";
+                if (!origin) {
+                    sendJson(res, 400, { ok: false, error: "invalid origin" });
+                    return;
+                }
+                if (!nonce || nonce.length > 512) {
+                    sendJson(res, 400, { ok: false, error: "invalid nonce" });
+                    return;
+                }
+                // Bind BOTH the origin and the nonce into the signed message so a
+                // signature minted for site A can't be replayed at site B.
+                const message = `decent-auth\n${origin}\n${nonce}`;
+                const r = await opts.call({ op: "sign", text: message });
+                if (!r.ok) {
+                    sendJson(res, 502, { ok: false, error: r.error || "sign failed" });
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    userid: r.data?.userid ?? "",
+                    sig: r.data?.sig ?? "",
+                });
+                return;
+            }
+            // ── File transfer ──────────────────────────────────────────────────
+            // Upload: the browser POSTs raw file bytes with ?userid=&name= in the
+            // query. We stream them to a temp file (no in-memory buffering of large
+            // files) and hand the daemon that path over the existing file-send IPC.
+            if (req.method === "POST" && url === "/api/file-send") {
+                const q = new URL(req.url || "", "http://x").searchParams;
+                const userid = q.get("userid") || "";
+                const rawName = q.get("name") || "file";
+                const safe = rawName.replace(/[/\\]/g, "_").slice(0, 200) || "file";
+                if (!userid) {
+                    sendJson(res, 400, { ok: false, error: "userid required" });
+                    return;
+                }
+                const os = await import("node:os");
+                const fs = await import("node:fs");
+                const fsp = await import("node:fs/promises");
+                const tmpDir = await fsp.mkdtemp(join(os.tmpdir(), "agentnet-up-"));
+                const tmpPath = join(tmpDir, safe);
+                try {
+                    await new Promise((resolve2, reject) => {
+                        const ws = fs.createWriteStream(tmpPath);
+                        req.pipe(ws);
+                        req.on("error", reject);
+                        ws.on("error", reject);
+                        ws.on("finish", () => resolve2());
+                    });
+                    const r = await opts.call({ op: "file-send", userid, path: tmpPath });
+                    if (!r.ok) {
+                        sendJson(res, 502, r);
+                        return;
+                    }
+                    sendJson(res, 200, { ok: true, ...(r.data ?? {}) });
+                }
+                catch (e) {
+                    sendJson(res, 500, { ok: false, error: e instanceof Error ? e.message : String(e) });
+                }
+                finally {
+                    await fsp.rm(tmpDir, { recursive: true, force: true }).catch(() => undefined);
+                }
+                return;
+            }
+            // Download a received file by name, served from <configDir>/downloads.
+            if (req.method === "GET" && url === "/api/file-download") {
+                if (!opts.downloadsDir) {
+                    res.writeHead(404);
+                    res.end("downloads disabled");
+                    return;
+                }
+                const q = new URL(req.url || "", "http://x").searchParams;
+                const name = (q.get("name") || "").replace(/[/\\]/g, "");
+                const file = join(opts.downloadsDir, name);
+                // Path-traversal guard: the resolved path must stay under downloadsDir.
+                if (!name || !file.startsWith(opts.downloadsDir) || !existsSync(file)) {
+                    res.writeHead(404);
+                    res.end("not found");
+                    return;
+                }
+                res.writeHead(200, {
+                    "content-type": "application/octet-stream",
+                    "content-disposition": `attachment; filename="${name.replace(/"/g, "")}"`,
+                });
+                res.end(readFileSync(file));
+                return;
+            }
             if (req.method === "GET" && url === "/api/state") {
                 const [diag, pending] = await Promise.all([
                     opts.call({ op: "diag" }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.106",
+  "version": "0.1.108",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -79,7 +79,7 @@
   },
   "dependencies": {
     "@decentnetwork/dora": "^0.1.11",
-    "@decentnetwork/peer": "^0.1.46",
+    "@decentnetwork/peer": "^0.1.47",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",
     "react": "^18.3.1",