@decentnetwork/lan 0.1.277 → 0.1.279

package/dist/carrier/peer-manager.d.ts

@@ -95,8 +95,11 @@ export declare class PeerManager extends EventEmitter {
     sendAppPacket(userid: string, id: number, data: Uint8Array): Promise<void>;
     /** Send a file INLINE over the message channel (FileModel JSON envelope,
      *  bulkmsg-split) — the only file path native iOS/C Carrier clients can
-     *  receive online. Use for native friends; JS friends keep sendFile(). */
-    sendInlineFile(userid: string, data: Uint8Array, name: string): Promise<void>;
+     *  receive online. Use for native friends; JS friends keep sendFile().
+     *  Returns the SDK's delivery verdict: "acked" is the only outcome that
+     *  justifies a "sent" checkmark. Older SDKs (< 0.1.140) resolve void —
+     *  treat that as "accepted" (bytes out, delivery unproven). */
+    sendInlineFile(userid: string, data: Uint8Array, name: string): Promise<"acked" | "accepted" | "offline">;
     /**
      * Send a WebRTC call-signaling payload to a friend over the Carrier
      * friend-invite channel (the "carrier" extension), the exact transport the

package/dist/carrier/peer-manager.js

@@ -186,11 +186,15 @@ export class PeerManager extends EventEmitter {
     }
     /** Send a file INLINE over the message channel (FileModel JSON envelope,
      *  bulkmsg-split) — the only file path native iOS/C Carrier clients can
-     *  receive online. Use for native friends; JS friends keep sendFile(). */
+     *  receive online. Use for native friends; JS friends keep sendFile().
+     *  Returns the SDK's delivery verdict: "acked" is the only outcome that
+     *  justifies a "sent" checkmark. Older SDKs (< 0.1.140) resolve void —
+     *  treat that as "accepted" (bytes out, delivery unproven). */
     async sendInlineFile(userid, data, name) {
         if (!this.peer)
             throw new Error("Peer not created. Call create() first.");
-        await this.peer.sendInlineFile(userid, { name, data });
+        const r = (await this.peer.sendInlineFile(userid, { name, data }));
+        return r?.delivery ?? "accepted";
     }
     /**
      * Send a WebRTC call-signaling payload to a friend over the Carrier

package/dist/cli/commands.d.ts

@@ -533,6 +533,20 @@ export declare function cmdServiceRestart(args: {
  * the new code without a sudo prompt — the daemon already has the
  * privileges it needs to rebind the TUN.
  */
+/**
+ * One-shot repair for the classic root-owned-config-dir mess.
+ *
+ * The daemon runs as root for the TUN device; the Beagle chat UI runs as you.
+ * Every file the daemon created under ~/.agentnet before this was fixed came
+ * out root-owned, so the UI's writes into downloads/ and outbox/ fail with
+ * EACCES and file sends die. New daemons repair this themselves at startup —
+ * this is the command for an install that predates that, or one whose daemon
+ * cannot be restarted right now.
+ */
+export declare function cmdFixPerms(args: {
+    configDir?: string;
+    user?: string;
+}): Promise<void>;
 export declare function cmdRestart(args: {
     configDir?: string;
 }): Promise<void>;

package/dist/cli/commands.js

@@ -2665,6 +2665,54 @@ export async function cmdServiceRestart(args) {
  * the new code without a sudo prompt — the daemon already has the
  * privileges it needs to rebind the TUN.
  */
+/**
+ * One-shot repair for the classic root-owned-config-dir mess.
+ *
+ * The daemon runs as root for the TUN device; the Beagle chat UI runs as you.
+ * Every file the daemon created under ~/.agentnet before this was fixed came
+ * out root-owned, so the UI's writes into downloads/ and outbox/ fail with
+ * EACCES and file sends die. New daemons repair this themselves at startup —
+ * this is the command for an install that predates that, or one whose daemon
+ * cannot be restarted right now.
+ */
+export async function cmdFixPerms(args) {
+    const { configOwner, restoreOwnership } = await import("../utils/config-owner.js");
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    if (!existsSync(dir)) {
+        throw new Error(`No config dir at ${dir}. Run 'agentnet init' first, or pass --config-dir.`);
+    }
+    let owner = configOwner(dir);
+    if (args.user) {
+        // Explicit target: `sudo agentnet fix-perms --user alice`, for a dir whose
+        // own ownership is already wrong (a whole tree accidentally chowned root).
+        const { execFileSync } = await import("child_process");
+        const uid = parseInt(execFileSync("id", ["-u", args.user], { encoding: "utf-8" }).trim(), 10);
+        const gid = parseInt(execFileSync("id", ["-g", args.user], { encoding: "utf-8" }).trim(), 10);
+        if (!Number.isInteger(uid) || !Number.isInteger(gid))
+            throw new Error(`Unknown user: ${args.user}`);
+        owner = { uid, gid };
+    }
+    if (!owner) {
+        // Not root, or the dir genuinely belongs to root. Either way there is
+        // nothing this process can chown — say which, precisely.
+        if (process.getuid?.() !== 0) {
+            console.log(`Nothing to do: not running as root, so every file this user creates is already theirs.`);
+            console.log(`If a file send failed with EACCES, the root-owned files need root to repair:`);
+            console.log(`  sudo agentnet fix-perms`);
+            return;
+        }
+        console.log(`Nothing to do: ${dir} belongs to root and no invoking user was found.`);
+        console.log(`If this node should belong to a normal user, name them:  sudo agentnet fix-perms --user <name>`);
+        return;
+    }
+    const changed = await restoreOwnership(dir, owner);
+    if (changed === 0) {
+        console.log(`Already correct: everything under ${dir} belongs to uid ${owner.uid}.`);
+        return;
+    }
+    console.log(`Fixed ${changed} path(s) under ${dir} → uid ${owner.uid}:${owner.gid}.`);
+    console.log(`File sends from the Beagle UI should work now — no restart needed.`);
+}
 export async function cmdRestart(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdHardenSsh, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdHardenSsh, cmdServiceInstall, cmdFixPerms, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -203,6 +203,11 @@ async function main() {
                 throw new Error("path is required: agentnet file send <userid> <path>");
             await cmdFileSend({ to: argv.userid, path: argv.path, configDir: argv["config-dir"] });
         }
+    })
+        .command("fix-perms", "Repair root-owned files under ~/.agentnet (run with sudo) — fixes 'file send failed' EACCES", (y) => y
+        .option("config-dir", { type: "string" })
+        .option("user", { type: "string", describe: "Owner to restore to (default: the config dir's own user)" }), async (argv) => {
+        await cmdFixPerms({ configDir: argv["config-dir"], user: argv.user });
     })
         // Tell the running daemon to re-exec itself with its original argv.
         // The daemon inherits its own uid (root if it was launched as root)

package/dist/daemon/server.js

@@ -289,6 +289,20 @@ export class DaemonServer {
         catch (err) {
             this.logger.warn(`Could not write pidfile ${this.pidFile}: ${err}`);
         }
+        // We are probably root (TUN needs it) while the config dir belongs to a
+        // normal user, and unprivileged apps — the Beagle chat UI above all — write
+        // into downloads/ and outbox/. Anything root left behind there would fail
+        // their writes with EACCES, so hand it back before we create anything new.
+        try {
+            const { restoreConfigDirOwnership } = await import("../utils/config-owner.js");
+            const fixed = await restoreConfigDirOwnership(this.configDir);
+            if (fixed > 0) {
+                this.logger.info(`Restored ownership of ${fixed} path(s) under ${this.configDir} to the config dir's user`);
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Could not restore config dir ownership: ${err.message}`);
+        }
         this.logger.info(`Starting daemon (node: ${this.config.node.name})`);
         this.startedAt = Date.now();
         try {
@@ -564,12 +578,35 @@ export class DaemonServer {
                             throw new Error(`This friend is a native (iOS/Android) client — files are sent inline and limited to ` +
                                 `${(INLINE_MAX / 1024 / 1024).toFixed(1)} MB (this is ${(data.length / 1024 / 1024).toFixed(1)} MB).`);
                         }
-                        await this.peerManager.sendInlineFile(userid, new Uint8Array(data), name);
-                        this.logger.info(`Sent inline file "${name}" (${data.length}B) to native peer ${userid.slice(0, 8)}`);
-                        this.messageStore?.appendFile(userid, "out", { name: sanitizeFileName(name), size: data.length, status: "sent", sent: data.length });
+                        // Append the chip as "sending" FIRST, then let the SDK's delivery
+                        // verdict decide what it becomes. Marking "sent" the moment
+                        // sendInlineFile resolved was a lie — that only meant the bytes
+                        // left this machine; a half-open session swallowed them silently
+                        // while the sender stared at a checkmark (INBOX 2026-08-21 A).
+                        const safeName = sanitizeFileName(name);
+                        const chip = this.messageStore?.appendFile(userid, "out", { name: safeName, size: data.length, status: "sending", sent: 0 });
                         this.friendMeta?.ensure(userid);
                         this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
-                        return { inline: true, name, size: data.length };
+                        let delivery;
+                        try {
+                            delivery = await this.peerManager.sendInlineFile(userid, new Uint8Array(data), name);
+                        }
+                        catch (e) {
+                            if (chip)
+                                this.messageStore?.patchFile(userid, chip.id, { status: "failed" });
+                            this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
+                            throw e;
+                        }
+                        const status = delivery === "acked" ? "sent" : delivery === "offline" ? "queued" : "failed";
+                        if (chip)
+                            this.messageStore?.patchFile(userid, chip.id, { status, sent: delivery === "acked" ? data.length : 0 });
+                        this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
+                        this.logger.info(`Inline file "${name}" (${data.length}B) to native ${userid.slice(0, 8)}: delivery=${delivery} → ${status}`);
+                        if (delivery === "accepted") {
+                            throw new Error(`The peer never confirmed receiving "${name}" — it likely did not arrive. ` +
+                                `Check that their app is in the foreground and try again.`);
+                        }
+                        return { inline: true, name, size: data.length, delivery };
                     }
                     // Add the "out" chip immediately as STATUS=sending (not "sent" — the
                     // transfer is reliable+acked, so it only flips to "sent" once the

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.277";
+window.__DK_UI_VERSION="0.1.279";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/dist/utils/config-owner.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Ownership of the config dir when the daemon runs as root.
+ *
+ * The daemon needs root for the TUN device, but `~/.agentnet` belongs to a
+ * normal user — and so do the other programs that read and write it. The Beagle
+ * chat UI runs unprivileged and writes uploads into `downloads/`, queues into
+ * `outbox/`, and appends to the message store; every file root creates there
+ * comes out root-owned, so those writes fail with EACCES and a file send dies
+ * with nothing but a permission error in a log the user never sees.
+ *
+ * So: hand ownership of everything under the config dir back to the user who
+ * owns the dir itself. Best-effort throughout — a failure here must never stop
+ * the daemon from starting, it just leaves the user where they were.
+ */
+export interface ConfigOwner {
+    uid: number;
+    gid: number;
+}
+/**
+ * The uid/gid that SHOULD own the config dir, or null when there is nothing to
+ * do (not root, or the dir is already root's own — a genuinely root-run node).
+ *
+ * `SUDO_UID` covers `sudo agentnet up`; the config dir's own owner covers a
+ * daemon started by launchd/systemd, where sudo never set anything.
+ */
+export declare function configOwner(dir: string): ConfigOwner | null;
+/**
+ * Recursively hand `dir` to `owner`, touching only the paths that are actually
+ * wrong. A full walk of the config dir costs a readdir per directory — cheap
+ * enough to run on every daemon start, and the steady state changes nothing.
+ *
+ * Note we cannot skip a correctly-owned directory: the daemon writing into a
+ * user-created `downloads/` produces exactly that shape — right dir, wrong
+ * files inside.
+ */
+export declare function restoreOwnership(dir: string, owner: ConfigOwner): Promise<number>;
+/**
+ * Startup sweep: if we are root and the config dir belongs to someone else,
+ * give everything under it back to them. Returns how many paths changed (0 when
+ * there was nothing to do, which is the steady state).
+ */
+export declare function restoreConfigDirOwnership(dir: string): Promise<number>;

package/dist/utils/config-owner.js

@@ -0,0 +1,103 @@
+/**
+ * Ownership of the config dir when the daemon runs as root.
+ *
+ * The daemon needs root for the TUN device, but `~/.agentnet` belongs to a
+ * normal user — and so do the other programs that read and write it. The Beagle
+ * chat UI runs unprivileged and writes uploads into `downloads/`, queues into
+ * `outbox/`, and appends to the message store; every file root creates there
+ * comes out root-owned, so those writes fail with EACCES and a file send dies
+ * with nothing but a permission error in a log the user never sees.
+ *
+ * So: hand ownership of everything under the config dir back to the user who
+ * owns the dir itself. Best-effort throughout — a failure here must never stop
+ * the daemon from starting, it just leaves the user where they were.
+ */
+import { lchown, lstat, readdir } from "fs/promises";
+import { statSync } from "fs";
+import { join } from "path";
+/**
+ * The uid/gid that SHOULD own the config dir, or null when there is nothing to
+ * do (not root, or the dir is already root's own — a genuinely root-run node).
+ *
+ * `SUDO_UID` covers `sudo agentnet up`; the config dir's own owner covers a
+ * daemon started by launchd/systemd, where sudo never set anything.
+ */
+export function configOwner(dir) {
+    if (process.getuid?.() !== 0)
+        return null; // not root: whatever we create is already ours
+    const sudoUid = Number(process.env.SUDO_UID);
+    const sudoGid = Number(process.env.SUDO_GID);
+    if (Number.isInteger(sudoUid) && sudoUid > 0) {
+        return { uid: sudoUid, gid: Number.isInteger(sudoGid) && sudoGid >= 0 ? sudoGid : sudoUid };
+    }
+    try {
+        const st = statSync(dir);
+        if (st.uid > 0)
+            return { uid: st.uid, gid: st.gid };
+    }
+    catch {
+        // No dir yet — nothing to own.
+    }
+    return null;
+}
+/** Give one path to `owner` if it isn't already. Returns true when changed. */
+async function chownOne(path, owner) {
+    try {
+        const st = await lstat(path);
+        if (st.uid === owner.uid && st.gid === owner.gid)
+            return false;
+        // lchown, not chown: a symlink inside the config dir must not let us
+        // retarget ownership of whatever it points at.
+        await lchown(path, owner.uid, owner.gid);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Recursively hand `dir` to `owner`, touching only the paths that are actually
+ * wrong. A full walk of the config dir costs a readdir per directory — cheap
+ * enough to run on every daemon start, and the steady state changes nothing.
+ *
+ * Note we cannot skip a correctly-owned directory: the daemon writing into a
+ * user-created `downloads/` produces exactly that shape — right dir, wrong
+ * files inside.
+ */
+export async function restoreOwnership(dir, owner) {
+    let changed = 0;
+    const walk = async (path, depth) => {
+        if (depth > 12)
+            return; // pathological nesting / symlink loop guard
+        let entries;
+        try {
+            entries = await readdir(path, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable or vanished — nothing we can fix here
+        }
+        for (const entry of entries) {
+            const child = join(path, entry.name);
+            if (await chownOne(child, owner))
+                changed++;
+            // Directories only: never follow a symlink out of the config dir.
+            if (entry.isDirectory())
+                await walk(child, depth + 1);
+        }
+    };
+    if (await chownOne(dir, owner))
+        changed++;
+    await walk(dir, 0);
+    return changed;
+}
+/**
+ * Startup sweep: if we are root and the config dir belongs to someone else,
+ * give everything under it back to them. Returns how many paths changed (0 when
+ * there was nothing to do, which is the steady state).
+ */
+export async function restoreConfigDirOwnership(dir) {
+    const owner = configOwner(dir);
+    if (!owner)
+        return 0;
+    return restoreOwnership(dir, owner);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.277",
+  "version": "0.1.279",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -84,7 +84,7 @@
   },
   "dependencies": {
     "@decentnetwork/dora": "^0.1.14",
-    "@decentnetwork/peer": "^0.1.139",
+    "@decentnetwork/peer": "^0.1.140",
     "@decentnetwork/peer-webrtc": "^0.2.10",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",