@decentnetwork/lan 0.1.276 → 0.1.278

package/dist/cli/commands.d.ts

@@ -533,6 +533,20 @@ export declare function cmdServiceRestart(args: {
  * the new code without a sudo prompt — the daemon already has the
  * privileges it needs to rebind the TUN.
  */
+/**
+ * One-shot repair for the classic root-owned-config-dir mess.
+ *
+ * The daemon runs as root for the TUN device; the Beagle chat UI runs as you.
+ * Every file the daemon created under ~/.agentnet before this was fixed came
+ * out root-owned, so the UI's writes into downloads/ and outbox/ fail with
+ * EACCES and file sends die. New daemons repair this themselves at startup —
+ * this is the command for an install that predates that, or one whose daemon
+ * cannot be restarted right now.
+ */
+export declare function cmdFixPerms(args: {
+    configDir?: string;
+    user?: string;
+}): Promise<void>;
 export declare function cmdRestart(args: {
     configDir?: string;
 }): Promise<void>;

package/dist/cli/commands.js

@@ -2665,6 +2665,54 @@ export async function cmdServiceRestart(args) {
  * the new code without a sudo prompt — the daemon already has the
  * privileges it needs to rebind the TUN.
  */
+/**
+ * One-shot repair for the classic root-owned-config-dir mess.
+ *
+ * The daemon runs as root for the TUN device; the Beagle chat UI runs as you.
+ * Every file the daemon created under ~/.agentnet before this was fixed came
+ * out root-owned, so the UI's writes into downloads/ and outbox/ fail with
+ * EACCES and file sends die. New daemons repair this themselves at startup —
+ * this is the command for an install that predates that, or one whose daemon
+ * cannot be restarted right now.
+ */
+export async function cmdFixPerms(args) {
+    const { configOwner, restoreOwnership } = await import("../utils/config-owner.js");
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    if (!existsSync(dir)) {
+        throw new Error(`No config dir at ${dir}. Run 'agentnet init' first, or pass --config-dir.`);
+    }
+    let owner = configOwner(dir);
+    if (args.user) {
+        // Explicit target: `sudo agentnet fix-perms --user alice`, for a dir whose
+        // own ownership is already wrong (a whole tree accidentally chowned root).
+        const { execFileSync } = await import("child_process");
+        const uid = parseInt(execFileSync("id", ["-u", args.user], { encoding: "utf-8" }).trim(), 10);
+        const gid = parseInt(execFileSync("id", ["-g", args.user], { encoding: "utf-8" }).trim(), 10);
+        if (!Number.isInteger(uid) || !Number.isInteger(gid))
+            throw new Error(`Unknown user: ${args.user}`);
+        owner = { uid, gid };
+    }
+    if (!owner) {
+        // Not root, or the dir genuinely belongs to root. Either way there is
+        // nothing this process can chown — say which, precisely.
+        if (process.getuid?.() !== 0) {
+            console.log(`Nothing to do: not running as root, so every file this user creates is already theirs.`);
+            console.log(`If a file send failed with EACCES, the root-owned files need root to repair:`);
+            console.log(`  sudo agentnet fix-perms`);
+            return;
+        }
+        console.log(`Nothing to do: ${dir} belongs to root and no invoking user was found.`);
+        console.log(`If this node should belong to a normal user, name them:  sudo agentnet fix-perms --user <name>`);
+        return;
+    }
+    const changed = await restoreOwnership(dir, owner);
+    if (changed === 0) {
+        console.log(`Already correct: everything under ${dir} belongs to uid ${owner.uid}.`);
+        return;
+    }
+    console.log(`Fixed ${changed} path(s) under ${dir} → uid ${owner.uid}:${owner.gid}.`);
+    console.log(`File sends from the Beagle UI should work now — no restart needed.`);
+}
 export async function cmdRestart(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdHardenSsh, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdHardenSsh, cmdServiceInstall, cmdFixPerms, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -203,6 +203,11 @@ async function main() {
                 throw new Error("path is required: agentnet file send <userid> <path>");
             await cmdFileSend({ to: argv.userid, path: argv.path, configDir: argv["config-dir"] });
         }
+    })
+        .command("fix-perms", "Repair root-owned files under ~/.agentnet (run with sudo) — fixes 'file send failed' EACCES", (y) => y
+        .option("config-dir", { type: "string" })
+        .option("user", { type: "string", describe: "Owner to restore to (default: the config dir's own user)" }), async (argv) => {
+        await cmdFixPerms({ configDir: argv["config-dir"], user: argv.user });
     })
         // Tell the running daemon to re-exec itself with its original argv.
         // The daemon inherits its own uid (root if it was launched as root)

package/dist/console/console.js

@@ -654,7 +654,7 @@ function now() {
 import { createConnection } from "node:net";
 import { resolve as resolve2 } from "node:path";
 import { homedir as homedir3 } from "node:os";
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 
 // src/config/loader.ts
 import { readFileSync, existsSync } from "fs";
@@ -975,7 +975,28 @@ var ConfigLoader = class {
 };
 
 // src/daemon/ipc.ts
+import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync2, unlinkSync } from "fs";
 import { createHash } from "crypto";
+import { createRequire } from "module";
+import { dirname as dirname2, join } from "path";
+import { fileURLToPath } from "url";
+var daemonVersions = (() => {
+  const readVer = (file) => {
+    try {
+      return JSON.parse(readFileSync2(file, "utf-8")).version ?? "";
+    } catch {
+      return "";
+    }
+  };
+  const lanVer = readVer(join(dirname2(fileURLToPath(import.meta.url)), "..", "..", "package.json"));
+  let peerVer = "";
+  try {
+    peerVer = readVer(createRequire(import.meta.url).resolve("@decentnetwork/peer/package.json"));
+  } catch {
+    peerVer = "";
+  }
+  return { lanVer, peerVer };
+})();
 function ipcSocketPath(dataDir, platform = process.platform) {
   if (platform === "win32") {
     const id = createHash("sha256").update(dataDir.toLowerCase()).digest("hex").slice(0, 16);
@@ -999,7 +1020,7 @@ function hhmm(ts) {
 }
 function lanVersion() {
   try {
-    const req = createRequire(import.meta.url);
+    const req = createRequire2(import.meta.url);
     return req("../../package.json").version ?? "";
   } catch {
     return "";

package/dist/daemon/ipc.js

@@ -22,9 +22,41 @@
  * multi-user hardening can come later via peer-credential filtering.
  */
 import { createServer } from "net";
-import { chmodSync, existsSync, unlinkSync } from "fs";
+import { chmodSync, existsSync, readFileSync, unlinkSync } from "fs";
 import { createHash } from "crypto";
+import { createRequire } from "module";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { Logger } from "../utils/logger.js";
+/**
+ * Versions of the code THIS daemon process is actually running.
+ *
+ * A UI that reads the versions off its own node_modules describes the package
+ * it was installed beside, not the process answering its calls — so after
+ * `npm i -g` but before a restart it cheerfully reports the fix as live while
+ * the daemon still runs the old build. `ping` carries these so the panel can
+ * show what is genuinely loaded.
+ */
+const daemonVersions = (() => {
+    const readVer = (file) => {
+        try {
+            return JSON.parse(readFileSync(file, "utf-8")).version ?? "";
+        }
+        catch {
+            return "";
+        }
+    };
+    // dist/daemon/ipc.js → ../../package.json
+    const lanVer = readVer(join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json"));
+    let peerVer = "";
+    try {
+        peerVer = readVer(createRequire(import.meta.url).resolve("@decentnetwork/peer/package.json"));
+    }
+    catch {
+        peerVer = "";
+    }
+    return { lanVer, peerVer };
+})();
 export class IpcServer {
     socketPath;
     handlers;
@@ -167,7 +199,8 @@ export class IpcServer {
     async dispatch(req) {
         switch (req.op) {
             case "ping":
-                return { pong: true };
+                // Carries the running daemon's versions — see `daemonVersions`.
+                return { pong: true, ...daemonVersions };
             case "friend-request": {
                 if (!req.address)
                     throw new Error("address is required");

package/dist/daemon/server.js

@@ -289,6 +289,20 @@ export class DaemonServer {
         catch (err) {
             this.logger.warn(`Could not write pidfile ${this.pidFile}: ${err}`);
         }
+        // We are probably root (TUN needs it) while the config dir belongs to a
+        // normal user, and unprivileged apps — the Beagle chat UI above all — write
+        // into downloads/ and outbox/. Anything root left behind there would fail
+        // their writes with EACCES, so hand it back before we create anything new.
+        try {
+            const { restoreConfigDirOwnership } = await import("../utils/config-owner.js");
+            const fixed = await restoreConfigDirOwnership(this.configDir);
+            if (fixed > 0) {
+                this.logger.info(`Restored ownership of ${fixed} path(s) under ${this.configDir} to the config dir's user`);
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Could not restore config dir ownership: ${err.message}`);
+        }
         this.logger.info(`Starting daemon (node: ${this.config.node.name})`);
         this.startedAt = Date.now();
         try {

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.276";
+window.__DK_UI_VERSION="0.1.278";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/dist/utils/config-owner.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Ownership of the config dir when the daemon runs as root.
+ *
+ * The daemon needs root for the TUN device, but `~/.agentnet` belongs to a
+ * normal user — and so do the other programs that read and write it. The Beagle
+ * chat UI runs unprivileged and writes uploads into `downloads/`, queues into
+ * `outbox/`, and appends to the message store; every file root creates there
+ * comes out root-owned, so those writes fail with EACCES and a file send dies
+ * with nothing but a permission error in a log the user never sees.
+ *
+ * So: hand ownership of everything under the config dir back to the user who
+ * owns the dir itself. Best-effort throughout — a failure here must never stop
+ * the daemon from starting, it just leaves the user where they were.
+ */
+export interface ConfigOwner {
+    uid: number;
+    gid: number;
+}
+/**
+ * The uid/gid that SHOULD own the config dir, or null when there is nothing to
+ * do (not root, or the dir is already root's own — a genuinely root-run node).
+ *
+ * `SUDO_UID` covers `sudo agentnet up`; the config dir's own owner covers a
+ * daemon started by launchd/systemd, where sudo never set anything.
+ */
+export declare function configOwner(dir: string): ConfigOwner | null;
+/**
+ * Recursively hand `dir` to `owner`, touching only the paths that are actually
+ * wrong. A full walk of the config dir costs a readdir per directory — cheap
+ * enough to run on every daemon start, and the steady state changes nothing.
+ *
+ * Note we cannot skip a correctly-owned directory: the daemon writing into a
+ * user-created `downloads/` produces exactly that shape — right dir, wrong
+ * files inside.
+ */
+export declare function restoreOwnership(dir: string, owner: ConfigOwner): Promise<number>;
+/**
+ * Startup sweep: if we are root and the config dir belongs to someone else,
+ * give everything under it back to them. Returns how many paths changed (0 when
+ * there was nothing to do, which is the steady state).
+ */
+export declare function restoreConfigDirOwnership(dir: string): Promise<number>;

package/dist/utils/config-owner.js

@@ -0,0 +1,103 @@
+/**
+ * Ownership of the config dir when the daemon runs as root.
+ *
+ * The daemon needs root for the TUN device, but `~/.agentnet` belongs to a
+ * normal user — and so do the other programs that read and write it. The Beagle
+ * chat UI runs unprivileged and writes uploads into `downloads/`, queues into
+ * `outbox/`, and appends to the message store; every file root creates there
+ * comes out root-owned, so those writes fail with EACCES and a file send dies
+ * with nothing but a permission error in a log the user never sees.
+ *
+ * So: hand ownership of everything under the config dir back to the user who
+ * owns the dir itself. Best-effort throughout — a failure here must never stop
+ * the daemon from starting, it just leaves the user where they were.
+ */
+import { lchown, lstat, readdir } from "fs/promises";
+import { statSync } from "fs";
+import { join } from "path";
+/**
+ * The uid/gid that SHOULD own the config dir, or null when there is nothing to
+ * do (not root, or the dir is already root's own — a genuinely root-run node).
+ *
+ * `SUDO_UID` covers `sudo agentnet up`; the config dir's own owner covers a
+ * daemon started by launchd/systemd, where sudo never set anything.
+ */
+export function configOwner(dir) {
+    if (process.getuid?.() !== 0)
+        return null; // not root: whatever we create is already ours
+    const sudoUid = Number(process.env.SUDO_UID);
+    const sudoGid = Number(process.env.SUDO_GID);
+    if (Number.isInteger(sudoUid) && sudoUid > 0) {
+        return { uid: sudoUid, gid: Number.isInteger(sudoGid) && sudoGid >= 0 ? sudoGid : sudoUid };
+    }
+    try {
+        const st = statSync(dir);
+        if (st.uid > 0)
+            return { uid: st.uid, gid: st.gid };
+    }
+    catch {
+        // No dir yet — nothing to own.
+    }
+    return null;
+}
+/** Give one path to `owner` if it isn't already. Returns true when changed. */
+async function chownOne(path, owner) {
+    try {
+        const st = await lstat(path);
+        if (st.uid === owner.uid && st.gid === owner.gid)
+            return false;
+        // lchown, not chown: a symlink inside the config dir must not let us
+        // retarget ownership of whatever it points at.
+        await lchown(path, owner.uid, owner.gid);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Recursively hand `dir` to `owner`, touching only the paths that are actually
+ * wrong. A full walk of the config dir costs a readdir per directory — cheap
+ * enough to run on every daemon start, and the steady state changes nothing.
+ *
+ * Note we cannot skip a correctly-owned directory: the daemon writing into a
+ * user-created `downloads/` produces exactly that shape — right dir, wrong
+ * files inside.
+ */
+export async function restoreOwnership(dir, owner) {
+    let changed = 0;
+    const walk = async (path, depth) => {
+        if (depth > 12)
+            return; // pathological nesting / symlink loop guard
+        let entries;
+        try {
+            entries = await readdir(path, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable or vanished — nothing we can fix here
+        }
+        for (const entry of entries) {
+            const child = join(path, entry.name);
+            if (await chownOne(child, owner))
+                changed++;
+            // Directories only: never follow a symlink out of the config dir.
+            if (entry.isDirectory())
+                await walk(child, depth + 1);
+        }
+    };
+    if (await chownOne(dir, owner))
+        changed++;
+    await walk(dir, 0);
+    return changed;
+}
+/**
+ * Startup sweep: if we are root and the config dir belongs to someone else,
+ * give everything under it back to them. Returns how many paths changed (0 when
+ * there was nothing to do, which is the steady state).
+ */
+export async function restoreConfigDirOwnership(dir) {
+    const owner = configOwner(dir);
+    if (!owner)
+        return 0;
+    return restoreOwnership(dir, owner);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.276",
+  "version": "0.1.278",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",