@decentnetwork/lan 0.1.303 → 0.1.304

package/dist/cli/commands.d.ts

@@ -2,12 +2,10 @@
  * CLI command handlers
  */
 import type { BootstrapNode } from "../types.js";
-/**
- * Initialize ~/.agentnet directory and config
- */
 export declare function cmdInit(args: {
     name?: string;
     configDir?: string;
+    noDora?: boolean;
 }): Promise<void>;
 /**
  * Show identity information.
@@ -97,6 +95,8 @@ export declare function cmdFriendRequest(args: {
  * per-address ok/error so the caller can report which landed. If the
  * daemon is already running, each request is routed via IPC (no peer).
  */
+/** Reject when `deadlineAt` (epoch ms) passes first; a no-op for Infinity. */
+export declare function raceDeadline<T>(p: Promise<T>, deadlineAt: number, what: string): Promise<T>;
 export declare function cmdFriendRequestMany(args: {
     targets: {
         address: string;
@@ -105,6 +105,10 @@ export declare function cmdFriendRequestMany(args: {
     hello?: string;
     configDir?: string;
     waitMs?: number;
+    /** Overall cap for the standalone-peer path. Without it, joinNetwork and each
+     *  sendFriendRequest are unbounded — `init` was seen running past 2 minutes
+     *  while holding the identity, which also blocks the service from starting. */
+    deadlineMs?: number;
 }): Promise<{
     label: string;
     address: string;

package/dist/cli/commands.js

@@ -176,6 +176,10 @@ async function ipcCall(config, req, timeoutMs = 30_000) {
 /**
  * Initialize ~/.agentnet directory and config
  */
+/** Cap on init's best-effort dora friending: a normal run (join, 15 s announce,
+ *  send, 8 s delivery wait) fits; a stuck bootstrap no longer holds the
+ *  identity for minutes. The daemon friends a dora itself on first start. */
+const INIT_DORA_DEADLINE_MS = 45_000;
 export async function cmdInit(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const nodeName = args.name || `node-${Math.floor(Math.random() * 10000)}`;
@@ -209,7 +213,10 @@ export async function cmdInit(args) {
     // them gives redundancy: any one staying up is enough to get an IP.
     const configuredUserids = new Set(config.dora?.userids ?? []);
     const dorasToFriend = DEFAULT_DORAS.filter((d) => configuredUserids.has(d.userid));
-    if (dorasToFriend.length > 0) {
+    if (dorasToFriend.length > 0 && args.noDora) {
+        console.log(`\nSkipping dora friend-requests (--no-dora); the daemon joins a dora itself on first start.`);
+    }
+    else if (dorasToFriend.length > 0) {
         console.log(`\nFriending ${dorasToFriend.length} default dora${dorasToFriend.length > 1 ? "s" : ""} (${dorasToFriend
             .map((d) => d.name)
             .join(", ")}) in one Carrier session so the daemon can join the shared network on first start.`);
@@ -218,6 +225,7 @@ export async function cmdInit(args) {
                 targets: dorasToFriend.map((d) => ({ address: d.address, label: d.name })),
                 hello: `decentlan init (${nodeName})`,
                 waitMs: 8000,
+                deadlineMs: INIT_DORA_DEADLINE_MS,
                 configDir: dir,
             });
             const failed = results.filter((r) => !r.ok);
@@ -681,6 +689,17 @@ export async function cmdFriendRequest(args) {
  * per-address ok/error so the caller can report which landed. If the
  * daemon is already running, each request is routed via IPC (no peer).
  */
+/** Reject when `deadlineAt` (epoch ms) passes first; a no-op for Infinity. */
+export function raceDeadline(p, deadlineAt, what) {
+    const left = deadlineAt - Date.now();
+    if (!Number.isFinite(left))
+        return p;
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out while ${what}`)), Math.max(0, left));
+    });
+    return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
 export async function cmdFriendRequestMany(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
@@ -699,6 +718,7 @@ export async function cmdFriendRequestMany(args) {
     // Daemon down → one standalone peer session for ALL requests.
     const { Peer } = await import("@decentnetwork/peer");
     const keyFile = resolve(config.carrier.dataDir, "keypair.json");
+    const deadlineAt = args.deadlineMs !== undefined ? Date.now() + args.deadlineMs : Infinity;
     console.log(`Opening peer with identity at ${keyFile}...`);
     const peer = await Peer.create({
         keyFile,
@@ -706,37 +726,52 @@ export async function cmdFriendRequestMany(args) {
         bootstrapNodes: config.carrier.bootstrapNodes,
         expressNodes: config.carrier.expressNodes,
     });
-    await peer.start();
-    console.log(`My address: ${peer.address()}`);
-    console.log(`My pubkey: ${peer.pubkey()}`);
-    console.log(`Joining Carrier network...`);
-    const joinResult = await peer.joinNetwork();
-    console.log(`Joined via ${joinResult.respondingNode.host}:${joinResult.respondingNode.port}`);
-    console.log(`Announcing self (15s)...`);
-    await peer.announceSelf(15000).catch((err) => {
-        console.warn(`Self-announce failed: ${err.message}`);
-    });
-    // Fire all requests on the one announced session.
-    for (const t of args.targets) {
-        try {
-            console.log(`Sending friend request to ${t.label} (${t.address.slice(0, 16)}...)...`);
-            await peer.sendFriendRequest(t.address, args.hello || "Decent AgentNet friend request");
-            results.push({ label: t.label, address: t.address, ok: true });
+    // The peer holds this identity until it stops; stop it on every exit path,
+    // including a missed deadline, or the process (and the identity) stays held.
+    try {
+        await raceDeadline(peer.start(), deadlineAt, "starting the peer");
+        console.log(`My address: ${peer.address()}`);
+        console.log(`My pubkey: ${peer.pubkey()}`);
+        console.log(`Joining Carrier network...`);
+        const joinResult = await raceDeadline(peer.joinNetwork(), deadlineAt, "joining the Carrier network");
+        console.log(`Joined via ${joinResult.respondingNode.host}:${joinResult.respondingNode.port}`);
+        console.log(`Announcing self (15s)...`);
+        await raceDeadline(peer.announceSelf(15000).catch((err) => {
+            console.warn(`Self-announce failed: ${err.message}`);
+        }), deadlineAt, "announcing");
+        // Fire all requests on the one announced session.
+        for (const t of args.targets) {
+            try {
+                console.log(`Sending friend request to ${t.label} (${t.address.slice(0, 16)}...)...`);
+                await raceDeadline(peer.sendFriendRequest(t.address, args.hello || "Decent AgentNet friend request"), deadlineAt, `sending to ${t.label}`);
+                results.push({ label: t.label, address: t.address, ok: true });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.warn(`  Failed to send to ${t.label}: ${msg}`);
+                results.push({ label: t.label, address: t.address, ok: false, error: msg });
+            }
         }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.warn(`  Failed to send to ${t.label}: ${msg}`);
-            results.push({ label: t.label, address: t.address, ok: false, error: msg });
+        // Single shared wait for relay delivery of all requests above.
+        const waitMs = Math.max(0, Math.min(args.waitMs ?? 8000, deadlineAt - Date.now()));
+        console.log(`Waiting ${waitMs}ms for relay delivery...`);
+        await new Promise((r) => setTimeout(r, waitMs));
+        console.log(`\nFriend requests sent. Recipients running with autoAccept (the default) have already`);
+        console.log(`accepted — they can confirm with 'agentnet diag' and look for userid ${peer.userid()}.`);
+    }
+    catch (err) {
+        // A deadline before the send loop (start/join/announce): nothing was sent.
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`Friend-requests abandoned: ${msg}`);
+        for (const t of args.targets) {
+            if (!results.some((r) => r.address === t.address)) {
+                results.push({ label: t.label, address: t.address, ok: false, error: msg });
+            }
         }
     }
-    // Single shared wait for relay delivery of all requests above.
-    const waitMs = args.waitMs ?? 8000;
-    console.log(`Waiting ${waitMs}ms for relay delivery...`);
-    await new Promise((r) => setTimeout(r, waitMs));
-    const myUserid = peer.userid();
-    await peer.stop();
-    console.log(`\nFriend requests sent. Recipients running with autoAccept (the default) have already`);
-    console.log(`accepted — they can confirm with 'agentnet diag' and look for userid ${myUserid}.`);
+    finally {
+        await peer.stop().catch(() => { });
+    }
     return results;
 }
 /**
@@ -2320,16 +2355,62 @@ export async function cmdDoraAutofriend(args) {
  */
 export function windowsServiceLauncherScript(args) {
     const psq = (value) => `'${value.replace(/'/g, "''")}'`;
+    // Supervise a daemon that crashes after running, but stop on one that cannot
+    // start at all. The common case is the identity lock ("Another decentlan
+    // daemon (pid N) is already running for this identity" — Beagle's embedded
+    // peer holds it): retried every 5 s for ever, the loop ran invisibly for hours
+    // while schtasks still reported the task Running. Five quick exits in a row
+    // end the task with a non-zero code, so Last Result says something and the
+    // log's last line says why. Starting the task again begins a fresh count.
+    //
+    // One encoding for the log: Windows PowerShell 5.1 writes `*>>` as UTF-16 but
+    // Out-File -Encoding utf8 as UTF-8, and the old log interleaved both, so no
+    // reader could show the give-up reason. Every writer is UTF-8 now; a log left
+    // by an older launcher (UTF-16, BOM FF FE) is moved aside once rather than
+    // having UTF-8 appended into it.
     return `$ErrorActionPreference = 'Continue'
 $env:AGENTNET_SERVICE_WRAPPER = '1'
+$PSDefaultParameterValues['Out-File:Encoding'] = 'utf8'
+$PSDefaultParameterValues['Out-File:Width'] = 4096
+$log = ${psq(args.logPath)}
+if (Test-Path $log) {
+  $fs = [System.IO.File]::OpenRead($log); $h = New-Object byte[] 2; $n = $fs.Read($h, 0, 2); $fs.Close()
+  if ($n -eq 2 -and $h[0] -eq 0xFF -and $h[1] -eq 0xFE) { Move-Item -Force $log "$log.utf16.old" }
+}
+$quickExits = 0
 while ($true) {
-  & ${psq(args.nodeBin)} ${psq(args.cliEntry)} up --real-tun --config-dir ${psq(args.configDir)} *>> ${psq(args.logPath)}
+  $started = Get-Date
+  & ${psq(args.nodeBin)} ${psq(args.cliEntry)} up --real-tun --config-dir ${psq(args.configDir)} *>> $log
   $code = $LASTEXITCODE
-  "$(Get-Date -Format o) agentnet exited with code $code; restarting in 5 seconds" | Out-File -FilePath ${psq(args.logPath)} -Append -Encoding utf8
+  $ran = [int]((Get-Date) - $started).TotalSeconds
+  if ($ran -lt 30) { $quickExits++ } else { $quickExits = 0 }
+  if ($quickExits -ge 5) {
+    # PS 5.1 wraps native stderr as an ErrorRecord: skip its CategoryInfo lines, drop the "node.exe : " prefix.
+    $why = Get-Content -Path $log -Tail 80 -ErrorAction SilentlyContinue |
+      Where-Object { $_ -match 'already running|Error: ' -and $_ -notmatch 'CategoryInfo|FullyQualifiedErrorId' } |
+      Select-Object -Last 1
+    $why = ("$why" -replace '^node(\\.exe)? : ', '').Trim()
+    "$(Get-Date -Format o) agentnet could not start ($quickExits exits within 30 s, last code $code); giving up. Last error: $why" | Out-File -FilePath $log -Append -Encoding utf8
+    if ($code -eq 0) { $code = 1 }
+    exit $code
+  }
+  "$(Get-Date -Format o) agentnet exited with code $code after $ran s; restarting in 5 seconds" | Out-File -FilePath $log -Append -Encoding utf8
   Start-Sleep -Seconds 5
 }
 `;
 }
+/**
+ * The CLI entry of THIS install — what a service must run.
+ *
+ * Every platform's service installer runs as root/Administrator, so resolving
+ * `agentnet` through PATH looks at root's PATH: it can name a missing binary,
+ * or a different install of a different version (the dual-install trap:
+ * `agentnet --version` says one thing, the service runs another). The
+ * installer's own module file is the one version the user just asked to install.
+ */
+function serviceCliEntry() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), "index.js");
+}
 /**
  * Key-only SSH for connections arriving over the AgentNet subnet.
  *
@@ -2460,12 +2541,15 @@ export async function cmdServiceInstall(args) {
             console.log(`Removed Windows startup task '${taskName}'.`);
             return;
         }
-        const cliEntry = resolve(dirname(fileURLToPath(import.meta.url)), "index.js");
+        const cliEntry = serviceCliEntry();
         const psq = (value) => `'${value.replace(/'/g, "''")}'`;
         const script = windowsServiceLauncherScript({ nodeBin, cliEntry, configDir: dir, logPath });
         const fs = await import("fs/promises");
         await fs.mkdir(dir, { recursive: true });
-        await fs.writeFile(scriptPath, script, "utf-8");
+        // With a BOM: the task runs powershell.exe (5.1), which reads a BOM-less
+        // script in the ANSI code page, so a non-ASCII profile path (C:\Users\张伟\…)
+        // would reach node mangled and the service could never start.
+        await fs.writeFile(scriptPath, "\ufeff" + script, "utf-8");
         const taskCommand = `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${scriptPath}"`;
         const created = spawnSync("schtasks.exe", [
             "/Create", "/F", "/TN", taskName, "/SC", "ONSTART", "/RU", "SYSTEM", "/RL", "HIGHEST", "/TR", taskCommand,
@@ -2497,19 +2581,7 @@ export async function cmdServiceInstall(args) {
             }
             return;
         }
-        // Resolve the `agentnet` binary. argv[1] is dist/cli/index.js when
-        // invoked as `node …/index.js`, so a `which` lookup is more
-        // portable. Fall back to /usr/local/bin/agentnet (npm-default
-        // global prefix on most Linux setups) if the lookup fails.
-        let agentnetBin;
-        try {
-            agentnetBin = execSync("command -v agentnet", { encoding: "utf-8" }).trim();
-            if (!agentnetBin)
-                throw new Error("not found");
-        }
-        catch {
-            agentnetBin = "/usr/local/bin/agentnet";
-        }
+        const cliEntry = serviceCliEntry();
         const unit = `[Unit]
 Description=Decent AgentNet daemon
 After=network-online.target
@@ -2519,7 +2591,7 @@ Wants=network-online.target
 Type=simple
 User=root
 Environment=PATH=${servicePath}
-ExecStart=${nodeBin} ${agentnetBin} up --real-tun --config-dir ${dir}
+ExecStart=${nodeBin} ${cliEntry} up --real-tun --config-dir ${dir}
 Restart=on-failure
 RestartSec=5
 # Log to the journal so the intuitive 'journalctl -u agentnet -f' just works.
@@ -2569,15 +2641,7 @@ WantedBy=multi-user.target
             }
             return;
         }
-        let agentnetBin;
-        try {
-            agentnetBin = execSync("command -v agentnet", { encoding: "utf-8" }).trim();
-            if (!agentnetBin)
-                throw new Error("not found");
-        }
-        catch {
-            agentnetBin = "/usr/local/bin/agentnet";
-        }
+        const cliEntry = serviceCliEntry();
         const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
@@ -2585,7 +2649,7 @@ WantedBy=multi-user.target
   <key>UserName</key><string>root</string>
   <key>ProgramArguments</key><array>
     <string>${nodeBin}</string>
-    <string>${agentnetBin}</string>
+    <string>${cliEntry}</string>
     <string>up</string>
     <string>--real-tun</string>
     <string>--config-dir</string>

package/dist/cli/index.js

@@ -17,8 +17,13 @@ async function main() {
         .usage("Usage: $0 <command> [options]")
         .command("init", "Initialize ~/.agentnet directory", (y) => y
         .option("name", { type: "string", describe: "Node name" })
-        .option("config-dir", { type: "string", describe: "Config directory" }), async (argv) => {
-        await cmdInit({ name: argv.name, configDir: argv["config-dir"] });
+        .option("config-dir", { type: "string", describe: "Config directory" })
+        .option("dora", {
+        type: "boolean",
+        default: true,
+        describe: "Friend the default doras now; --no-dora skips it (the daemon does it on first start) — use when 'up' runs next",
+    }), async (argv) => {
+        await cmdInit({ name: argv.name, configDir: argv["config-dir"], noDora: argv.dora === false });
     })
         .command("identity show", "Display Carrier identity", (y) => y.option("config-dir", { type: "string" }), async (argv) => {
         await cmdIdentityShow({ configDir: argv["config-dir"] });

package/dist/daemon/ipc.d.ts

@@ -20,6 +20,8 @@
  * so the user's CLI can connect when the daemon ran via sudo (otherwise
  * the socket is root-owned). That's acceptable for a single-user box;
  * multi-user hardening can come later via peer-credential filtering.
+ * On Windows the equivalent is a DACL that admits interactive users — see
+ * grantInteractiveUsers() for why it is not simply "Everyone".
  */
 export interface IpcHandlers {
     /** Send a friend-request via the daemon's Carrier peer. Returns
@@ -175,11 +177,54 @@ export declare class IpcServer {
     private logger;
     constructor(socketPath: string, handlers: IpcHandlers);
     start(): Promise<void>;
+    /**
+     * Windows: let a non-elevated app in the user's session open the pipe.
+     *
+     * The service runs the daemon as SYSTEM, so the pipe gets the default
+     * named-pipe DACL: SYSTEM and Administrators full control, Everyone read.
+     * Clients open it read/write, and an app the user launches runs with the
+     * filtered token (Administrators deny-only), so it gets EPERM. Beagle Desktop
+     * then waits on the daemon forever while the same command over ssh — which
+     * hands out a full token — attaches at once. chmod has no effect on a pipe.
+     *
+     * listen({ readableAll, writableAll }) would fix the EPERM, but libuv does it
+     * with an Everyone ACE, and Everyone matches network logons: any account that
+     * can authenticate to the box over SMB could then drive a SYSTEM daemon. Unix
+     * 0666 is local-only; that would not be.
+     *
+     * Node cannot set a pipe's security descriptor, so replace the DACL once
+     * through .NET: SYSTEM and Administrators keep full control, and the
+     * Interactive group (S-1-5-4) gets read/write. Interactive is in every console
+     * and RDP logon token and in no network logon token. All instances of a pipe
+     * name share one security descriptor, so this also covers every instance the
+     * server creates later.
+     *
+     * Fails closed: on any error the pipe keeps the default DACL (the previous
+     * behaviour), never a wider one.
+     */
+    private grantInteractiveUsers;
     stop(): Promise<void>;
     private isWindowsNamedPipe;
     private handleConnection;
     private dispatch;
 }
+/** The namespace every Windows named-pipe path starts with. */
+export declare const WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
+/** Named-pipe DACL: SYSTEM and Administrators full control, the Interactive
+ *  group (S-1-5-4) read/write. Protected, so nothing is inherited — in
+ *  particular no Everyone. See IpcServer.grantInteractiveUsers(). */
+export declare const WINDOWS_PIPE_SDDL = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
+/**
+ * PowerShell that replaces a named pipe's DACL with WINDOWS_PIPE_SDDL and
+ * prints the resulting DACL. It must run as the pipe's creator (SYSTEM, which
+ * the default DACL grants full control) and opens the pipe as a client with
+ * ChangePermissions. Two .NET details, both learned on a real box:
+ * ReadData/WriteData are required because NamedPipeClientStream derives the
+ * pipe direction from the rights, and only the Access section may be persisted,
+ * because the default (All) also writes the SACL, which needs
+ * SeSecurityPrivilege and fails as "unauthorized".
+ */
+export declare function windowsPipeDaclScript(pipeName: string): string;
 /** Derive the socket path that pairs with a given carrier data dir.
  *  Kept as a one-liner helper so daemon and client agree. */
 export declare function ipcSocketPath(dataDir: string, platform?: NodeJS.Platform): string;

package/dist/daemon/ipc.js

@@ -20,7 +20,10 @@
  * so the user's CLI can connect when the daemon ran via sudo (otherwise
  * the socket is root-owned). That's acceptable for a single-user box;
  * multi-user hardening can come later via peer-credential filtering.
+ * On Windows the equivalent is a DACL that admits interactive users — see
+ * grantInteractiveUsers() for why it is not simply "Everyone".
  */
+import { execFile } from "child_process";
 import { createServer } from "net";
 import { chmodSync, existsSync, readFileSync, unlinkSync } from "fs";
 import { createHash } from "crypto";
@@ -100,7 +103,10 @@ export class IpcServer {
         // 0666 so non-root CLI can reach a sudo-launched daemon. SO_PEERCRED
         // / SO_PEEREID would be a tighter filter, but for v0.1 the trust
         // boundary is "anyone with shell access to this box".
-        if (!this.isWindowsNamedPipe()) {
+        if (this.isWindowsNamedPipe()) {
+            await this.grantInteractiveUsers();
+        }
+        else {
             try {
                 chmodSync(this.socketPath, 0o666);
             }
@@ -110,6 +116,51 @@ export class IpcServer {
         }
         this.logger.info(`Listening on ${this.socketPath}`);
     }
+    /**
+     * Windows: let a non-elevated app in the user's session open the pipe.
+     *
+     * The service runs the daemon as SYSTEM, so the pipe gets the default
+     * named-pipe DACL: SYSTEM and Administrators full control, Everyone read.
+     * Clients open it read/write, and an app the user launches runs with the
+     * filtered token (Administrators deny-only), so it gets EPERM. Beagle Desktop
+     * then waits on the daemon forever while the same command over ssh — which
+     * hands out a full token — attaches at once. chmod has no effect on a pipe.
+     *
+     * listen({ readableAll, writableAll }) would fix the EPERM, but libuv does it
+     * with an Everyone ACE, and Everyone matches network logons: any account that
+     * can authenticate to the box over SMB could then drive a SYSTEM daemon. Unix
+     * 0666 is local-only; that would not be.
+     *
+     * Node cannot set a pipe's security descriptor, so replace the DACL once
+     * through .NET: SYSTEM and Administrators keep full control, and the
+     * Interactive group (S-1-5-4) gets read/write. Interactive is in every console
+     * and RDP logon token and in no network logon token. All instances of a pipe
+     * name share one security descriptor, so this also covers every instance the
+     * server creates later.
+     *
+     * Fails closed: on any error the pipe keeps the default DACL (the previous
+     * behaviour), never a wider one.
+     */
+    async grantInteractiveUsers() {
+        let script;
+        try {
+            script = windowsPipeDaclScript(this.socketPath.slice(WINDOWS_PIPE_PREFIX.length));
+        }
+        catch (err) {
+            this.logger.warn(err instanceof Error ? err.message : String(err));
+            return;
+        }
+        const encoded = Buffer.from(script, "utf16le").toString("base64");
+        const result = await new Promise((resolve) => {
+            execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], { timeout: 20_000, windowsHide: true }, (err, stdout, stderr) => resolve({ err, stdout: String(stdout).trim(), stderr: String(stderr).trim() }));
+        });
+        if (result.err) {
+            this.logger.warn(`Could not open ${this.socketPath} to interactive users; apps without admin rights ` +
+                `(Beagle Desktop, a non-elevated CLI) will get EPERM: ${result.stderr || result.err.message}`);
+            return;
+        }
+        this.logger.info(`Pipe DACL set for interactive users: ${result.stdout}`);
+    }
     async stop() {
         if (!this.server)
             return;
@@ -144,7 +195,7 @@ export class IpcServer {
         }
     }
     isWindowsNamedPipe() {
-        return this.socketPath.startsWith("\\\\.\\pipe\\");
+        return this.socketPath.startsWith(WINDOWS_PIPE_PREFIX);
     }
     handleConnection(sock) {
         let buf = "";
@@ -370,6 +421,45 @@ export class IpcServer {
         }
     }
 }
+/** The namespace every Windows named-pipe path starts with. */
+export const WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
+/** Named-pipe DACL: SYSTEM and Administrators full control, the Interactive
+ *  group (S-1-5-4) read/write. Protected, so nothing is inherited — in
+ *  particular no Everyone. See IpcServer.grantInteractiveUsers(). */
+export const WINDOWS_PIPE_SDDL = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
+/**
+ * PowerShell that replaces a named pipe's DACL with WINDOWS_PIPE_SDDL and
+ * prints the resulting DACL. It must run as the pipe's creator (SYSTEM, which
+ * the default DACL grants full control) and opens the pipe as a client with
+ * ChangePermissions. Two .NET details, both learned on a real box:
+ * ReadData/WriteData are required because NamedPipeClientStream derives the
+ * pipe direction from the rights, and only the Access section may be persisted,
+ * because the default (All) also writes the SACL, which needs
+ * SeSecurityPrivilege and fails as "unauthorized".
+ */
+export function windowsPipeDaclScript(pipeName) {
+    // The name is interpolated into the script; ipcSocketPath only ever yields
+    // agentnet-<hex>, but refuse anything that could break out of the quotes.
+    if (!/^[A-Za-z0-9._-]+$/.test(pipeName)) {
+        throw new Error(`Refusing to set a DACL on unexpected pipe name ${JSON.stringify(pipeName)}`);
+    }
+    return [
+        "$ErrorActionPreference = 'Stop'",
+        "$ProgressPreference = 'SilentlyContinue'",
+        "try {",
+        "$rights = [System.IO.Pipes.PipeAccessRights]'ReadData, WriteData, ReadPermissions, ChangePermissions'",
+        `$c = New-Object System.IO.Pipes.NamedPipeClientStream('.', '${pipeName}', $rights, ` +
+            "[System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::None, " +
+            "[System.IO.HandleInheritability]::None)",
+        "$c.Connect(5000)",
+        "$s = New-Object System.IO.Pipes.PipeSecurity",
+        `$s.SetSecurityDescriptorSddlForm('${WINDOWS_PIPE_SDDL}', [System.Security.AccessControl.AccessControlSections]::Access)`,
+        "$c.SetAccessControl($s)",
+        "$c.GetAccessControl().GetSecurityDescriptorSddlForm('Access')",
+        "$c.Dispose()",
+        "} catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }",
+    ].join("; ");
+}
 /** Derive the socket path that pairs with a given carrier data dir.
  *  Kept as a one-liner helper so daemon and client agree. */
 export function ipcSocketPath(dataDir, platform = process.platform) {

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.303";
+window.__DK_UI_VERSION="0.1.304";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.303",
+  "version": "0.1.304",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -84,7 +84,7 @@
   },
   "dependencies": {
     "@decentnetwork/dora": "^0.1.14",
-    "@decentnetwork/peer": "^0.1.166",
+    "@decentnetwork/peer": "^0.1.168",
     "@decentnetwork/peer-webrtc": "^0.2.10",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",