@decentnetwork/lan 0.1.112 → 0.1.113

package/dist/daemon/server.js

@@ -33,6 +33,21 @@ function shellQuote(parts) {
         .map((p) => "'" + p.replace(/'/g, `'\\''`) + "'")
         .join(" ");
 }
+/** Make an incoming filename safe to write to disk AND friendly to open from a
+ *  shell. Strips path separators + control chars and normalizes exotic Unicode
+ *  whitespace (e.g. macOS's U+202F narrow no-break space before "PM" in
+ *  screenshot/recording names) to a plain space, so files don't need shell
+ *  escaping. Never empty. */
+function sanitizeFileName(name) {
+    const cleaned = (name || "file")
+        .replace(/[/\\]/g, "_")
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f]/g, "")
+        .replace(/[\u00a0\u2000-\u200f\u2028\u2029\u202f\u205f\u3000\ufeff]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    return cleaned || "file";
+}
 import { ConfigLoader, DEFAULT_DORAS } from "../config/loader.js";
 export class DaemonServer {
     config;
@@ -598,7 +613,7 @@ export class DaemonServer {
                     const dir = resolve(this.configDir, "downloads");
                     const fs = await import("fs/promises");
                     await fs.mkdir(dir, { recursive: true });
-                    const safe = (p.name || "file").replace(/[/\\]/g, "_");
+                    const safe = sanitizeFileName(p.name);
                     await fs.writeFile(resolve(dir, safe), Buffer.from(p.data));
                     this.logger.info(`Saved file "${p.name}" (${p.size}B) from ${p.friendId.slice(0, 8)} → ${resolve(dir, safe)}`);
                     // Record in chat history (as a download chip) and push to the UI.

package/dist/ui/server.js

@@ -307,9 +307,15 @@ export function startFriendUi(opts) {
                     res.end("not found");
                     return;
                 }
+                // Content-Disposition must be ASCII — Node throws ERR_INVALID_CHAR on a
+                // non-ASCII header value (filenames from macOS contain U+202F before
+                // "PM", and others may be Chinese, etc.). Provide an ASCII-only
+                // `filename=` fallback plus the RFC 5987 `filename*=UTF-8''…` with the
+                // real (percent-encoded) name for clients that support it.
+                const asciiName = name.replace(/[^\x20-\x7e]/g, "_").replace(/"/g, "");
                 res.writeHead(200, {
                     "content-type": "application/octet-stream",
-                    "content-disposition": `attachment; filename="${name.replace(/"/g, "")}"`,
+                    "content-disposition": `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(name)}`,
                 });
                 res.end(readFileSync(file));
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.112",
+  "version": "0.1.113",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",