@inoku/lepan 0.7.65 → 0.7.67

package/README.md

@@ -86,7 +86,31 @@ The Linux/macOS legacy browser-owner setup uses the built-in AV1 registration en
 
 LifeDrive requires Leither V0.24.11 or newer. Linux/macOS browser-owner setup creates a separate Ed25519 `sodiumv2` identity for the primary browser. Windows prints a private ten-minute invitation for the first paired phone; later users and devices are managed from a paired device.
 
-After successful npm setup, the installer saves a private `lepan-pairing-<id>.png` and prints its full path. It also displays the QR code when the terminal is wide enough. In the iPhone or Android app, open **Settings → Set up users → Scan QR code** and scan the terminal or the saved image. The PNG is saved in the Leither root on Linux/macOS and its private `.lifedrive-household` directory on Windows. Household invitations expire ten minutes after creation; legacy identity codes contain a device private key, so keep them private and delete the image after pairing. Legacy `--add-device` and `--upgrade` also produce a code when an identity is available; household upgrades preserve existing pairings without issuing new invitations.
+After successful npm setup, the installer displays the QR code at the end of its output whenever the terminal is wide enough. If the whole code cannot fit on screen, it automatically opens the full-size QR image in the computer's image viewer. In the iPhone or Android app, open **Settings → Set up users → Scan QR code** and scan the displayed code. A private `lepan-pairing-<id>.png` is also saved, with its path printed as a fallback for remote sessions or computers without an image viewer. A private `.json` invitation is saved alongside it for apps without a setup scanner: transfer that file to the phone and use **Choose identity file**. These files are saved in the Leither root on Linux/macOS and its private `.lifedrive-household` directory on Windows. Household invitations expire ten minutes after creation; legacy identity codes contain a device private key, so keep them private and delete the transfer copies after pairing. Legacy `--add-device` and `--upgrade` also produce a code when an identity is available; household upgrades preserve existing pairings without issuing new invitations.
+
+### Renew an expired first-phone invitation
+
+Run this again **on the computer running Leither**:
+
+```bash
+npx --yes @inoku/lepan@latest --household
+```
+
+If more than one node is running, also pass `--leither-root` with the same node
+directory used during installation. On Windows, use an administrator terminal.
+The macOS setup package also supports renewal when run again.
+
+Before the first owner has been created, setup replaces the previous invitation
+and produces a fresh QR image and import file with a new ten-minute expiry. It
+briefly stops only the managed account service while issuing the invitation,
+then starts it and verifies readiness before displaying the new code. If issuance
+fails, it attempts to restore the service. Leither keeps running; existing node
+keys and drive data are preserved.
+
+Setup never replaces an existing owner or an interrupted account claim. If users
+already exist, use **My devices** on a paired phone to invite another device. An
+interrupted first claim must be resumed on the original phone with its original
+invitation. Ordinary `--upgrade` does not renew invitations.
 
 An existing installation is backed up before replacement. The explicit `--upgrade` path requires the saved application and key-auth owner state before changing files, synchronizes the same published application MID, and does not rerun device or domain setup. This release intentionally does not migrate the earlier password-owner prototype. Application files are active only after Leither advances the application from `cur` to `last`; a publication timeout leaves the prior `last` version serving users.
 

package/USER_MANUAL.md

@@ -142,8 +142,7 @@ This keeps what step 2.1 installed and adds users and phones:
 
 1. Creates LifeDrive's private configuration in `<Leither root>/.lifedrive-household/`.
 2. Installs and starts the identity service: `lifedrive-identity` through systemd on Linux, `uk.inoku.lifedrive-identity` through launchd on macOS, or `LifeDrive Identity` through Task Scheduler on Windows. Leither itself is not restarted and must be running separately.
-3. Prints a **setup invitation**: a block of text, followed by
-   *"Keep the invitation above private. It expires in ten minutes."*
+3. Displays a **setup invitation** as a QR code. If the terminal is too small, the full-size QR image opens automatically on this computer. The invitation expires in ten minutes.
 
 The setup invitation is what makes a phone the first user of this node. Treat it
 like a key: do not post it, email it to others, or paste it anywhere public.
@@ -152,7 +151,7 @@ like a key: do not post it, email it to others, or paste it anywhere public.
 
 Within ten minutes of the invitation being printed:
 
-1. Keep the installer’s final QR code visible, or open the saved `lepan-pairing-<id>.png` using the path it prints. If you used the standalone shell installer, copy the whole invitation block instead.
+1. Scan the installer’s final QR code or the QR image that opens automatically. The saved image path is a fallback for remote sessions or computers without an image viewer. If you used the standalone shell installer, copy the whole invitation block instead.
 2. Open LifeDrive on the phone. The **Set up your LifeDrive** screen opens by itself (or open **Settings → Set up users**).
 3. Enter **Your name** and a name for this device.
 4. Tap **Scan QR code** and point the phone at the terminal or saved image. You can also use **Paste node identity** or **Choose identity file**.
@@ -168,7 +167,7 @@ empty page, or **Settings → Set up users**, opens it again.
 
 | Situation | What to do |
 |---|---|
-| The invitation expired before you pasted it | On the node, stop the identity service (`sudo systemctl stop lifedrive-identity` on Linux, or `sudo launchctl bootout system/uk.inoku.lifedrive-identity` on macOS) and run the command from 2.2 again for a fresh invitation. |
+| The invitation expired before you pasted it | On the node, run `npx --yes @inoku/lepan@latest --household` again for a fresh QR code. Setup renews an unclaimed invitation and preserves the existing identity; no manual service commands are needed. |
 | You pasted it, but the app lost its connection or was closed | Open the app on **the same phone** and paste **the same invitation** again. A claim that has started can finish after the ten minutes have passed. Do not delete the app or ask for a new invitation: that would abandon the phone's pending key. |
 | Setup says the node already has users | The node has been claimed. Add further devices from **My devices** (section 4), not with a new setup invitation. |
 

package/bin/lifedrive.js

@@ -12,6 +12,31 @@ const distributionDirectory = path.resolve(__dirname, "..", "dist");
 const bundlePath = path.join(distributionDirectory, "lifedrive-bundle.tar.gz");
 const checksumPath = `${bundlePath}.sha256`;
 
+function openPairingImage(imagePath) {
+  // A remote server must not open a window in another user's desktop session.
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
+  let command;
+  let args;
+  if (process.platform === "darwin") {
+    command = "/usr/bin/open";
+    args = [imagePath];
+  } else if (process.platform === "win32") {
+    command = "powershell.exe";
+    args = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command",
+      "Start-Process -FilePath $env:LEPAN_PAIRING_IMAGE -ErrorAction Stop"];
+  } else if (process.platform === "linux" && (process.env.DISPLAY || process.env.WAYLAND_DISPLAY)) {
+    command = "xdg-open";
+    args = [imagePath];
+  } else {
+    return false;
+  }
+  const result = spawnSync(command, args, {
+    stdio: "ignore", timeout: 5000,
+    env: { ...process.env, LEPAN_PAIRING_IMAGE: imagePath },
+  });
+  return !result.error && result.status === 0;
+}
+
 async function showPairingCode(resultPath) {
   if (!fs.existsSync(resultPath)) return;
   // The child writes this only after setup succeeds. Never scrape its output:
@@ -22,24 +47,69 @@ async function showPairingCode(resultPath) {
   }
   const directory = fs.readFileSync(`${resultPath}.directory`, "utf8");
   if (!path.isAbsolute(directory)) throw new Error("Invalid pairing image directory");
-  const QRCode = require("qrcode");
   const payload = JSON.stringify(pairing);
+  // Only encode fields consumed by the existing Android and iOS setup parsers.
+  // The node enforces expiry and returns account details after a successful claim.
+  // Keep the full invitation in the import file, and leave legacy identities intact.
+  // iOS still requires certificate_sha256 even when Leither transport uses a key.
+  const qrPayload = pairing.type === "lifedrive-node-setup"
+    ? JSON.stringify(Object.fromEntries([
+      "type", "version", "app_id", "node_id", "endpoint", "transport",
+      "transport_key", "certificate_sha256", "request_id", "secret",
+    ].filter(key => Object.hasOwn(pairing, key)).map(key => [key, pairing[key]])))
+    : payload;
+  const basename = path.join(directory, `lepan-pairing-${randomUUID()}`);
+  const imagePath = `${basename}.png`;
+  const identityPath = `${basename}.json`;
+  // Older mobile releases support importing this file but have no setup scanner.
+  // Keep a private copy even when QR generation succeeds.
+  fs.writeFileSync(identityPath, payload, { flag: "wx", mode: 0o600 });
   const options = { errorCorrectionLevel: "M", margin: 4, scale: 8 };
-  const png = await QRCode.toBuffer(payload, options);
-  // Unique names and exclusive creation avoid overwriting another device's
-  // code or following a pre-existing symlink. Keep this outside the app bundle.
-  const imagePath = path.join(directory, `lepan-pairing-${randomUUID()}.png`);
-  fs.writeFileSync(imagePath, png, { flag: "wx", mode: 0o600 });
-  process.stdout.write(`\nPair your phone: open LePan → Settings → Set up users → Scan QR code.\n`);
-  process.stdout.write(`Pairing image saved: ${imagePath}\n`);
-  process.stdout.write(pairing.type === "lifedrive-node-setup"
-    ? "Keep this code private. The invitation expires ten minutes after creation.\n"
-    : "This code contains your device private key. Keep it private and delete the image after pairing.\n");
-  // Small terminal codes use half-height blocks. If the terminal would wrap,
-  // direct the user to the full-resolution PNG instead of a broken code.
-  const modules = QRCode.create(payload, options).modules;
+  const privacyNote = pairing.type === "lifedrive-node-setup"
+    ? "Keep it private. This invitation expires ten minutes after creation."
+    : "This contains your device private key. Keep it private and delete it after pairing.";
+  const renewalHint = pairing.type === "lifedrive-node-setup"
+    ? "\nInvitation expired? Run this again on the node:\n  npx --yes @inoku/lepan@latest --household\n"
+    : "";
+  let modules;
+  try {
+    const QRCode = require("qrcode");
+    const png = await QRCode.toBuffer(qrPayload, options);
+    modules = QRCode.create(qrPayload, options).modules;
+    // Unique names and exclusive creation avoid overwriting another device's
+    // code or following a pre-existing symlink. Keep this outside the app bundle.
+    fs.writeFileSync(imagePath, png, { flag: "wx", mode: 0o600 });
+  } catch {
+    // The child no longer prints secrets. Preserve an importable fallback
+    // before runInstaller removes the temporary handoff directory.
+    process.stderr.write("\nNext: pair your phone\n\nThe QR code could not be created. Use the saved pairing file instead.\n");
+    process.stderr.write(`  ${identityPath}\n\n`);
+    process.stderr.write("Transfer this file to your phone, then select it in LePan > Settings > Set up users > Choose identity file.\n");
+    process.stderr.write(`${privacyNote}\n`);
+    process.stderr.write(renewalHint);
+    return;
+  }
+  // Never hide a terminal code just because the window is short. Open the PNG
+  // automatically when the whole code cannot be visible at once, and put the
+  // terminal code last so subsequent instructions cannot scroll it away.
   const width = modules.size + options.margin * 2;
-  if (process.stdout.isTTY && (!process.stdout.columns || process.stdout.columns > width)) {
+  const height = Math.ceil(width / 2);
+  const fitsWidth = process.stdout.isTTY && process.stdout.columns > width;
+  const fitsScreen = fitsWidth && process.stdout.rows >= height + 3;
+  const imageOpened = !fitsScreen && openPairingImage(imagePath);
+  process.stdout.write("\nPair your phone\n\n");
+  process.stdout.write("Open LePan > Settings > Set up users > Scan QR code.\n");
+  process.stdout.write(imageOpened
+    ? "The QR image has opened automatically. Scan it with your phone.\n"
+    : fitsWidth ? "Scan the QR code below with your phone.\n"
+    : "This terminal is too narrow for the QR code and no image viewer could be opened. Open the saved image below.\n");
+  process.stdout.write(`${privacyNote}\n`);
+  process.stdout.write(`\nSaved QR image: ${imagePath}\n`);
+  process.stdout.write(`Pairing file (Choose identity file): ${identityPath}\n`);
+  process.stdout.write("Keep this computer on and connected while using LePan.\n");
+  process.stdout.write(renewalHint);
+  if (fitsWidth) {
+    process.stdout.write("\n");
     // Explicit colors and a four-module quiet zone work on light/dark themes.
     const dark = (x, y) => x >= 0 && y >= 0 && x < modules.size && y < modules.size && modules.get(y, x);
     let terminal = "";
@@ -51,8 +121,6 @@ async function showPairingCode(resultPath) {
       terminal += "\x1b[0m\n";
     }
     process.stdout.write(terminal);
-  } else {
-    process.stdout.write("Open the saved PNG on this computer to scan it.\n");
   }
 }
 
@@ -73,7 +141,7 @@ async function runInstaller(command, args) {
       try { await showPairingCode(resultPath); }
       catch {
         // Parser errors may contain identity text; never print them.
-        process.stderr.write("LePan is installed, but its pairing QR code could not be created. Use the identity file or invitation shown above.\n");
+        process.stderr.write("\nPhone pairing could not be prepared. Use your existing identity file, or create a new setup invitation from the node.\n");
       }
     }
   } finally {

package/dist/lifedrive-bundle.tar.gz

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/lifedrive-bundle.tar.gz
-size: 44150306 bytes
-sha256: ef901f174a43f1a7288516db7834821dbdde61a2eb46d4916c82f6ec880972cd
+size: 44139682 bytes
+sha256: 2173717546eb881f72dce0fdd7a5a6727bfc5286b4c23f948528b9d8f1a2fde8

package/dist/lifedrive-bundle.tar.gz.sha256

@@ -1 +1 @@
-ef901f174a43f1a7288516db7834821dbdde61a2eb46d4916c82f6ec880972cd  lifedrive-bundle.tar.gz
+2173717546eb881f72dce0fdd7a5a6727bfc5286b4c23f948528b9d8f1a2fde8  lifedrive-bundle.tar.gz

package/dist/lifedrive-install.ps1

@@ -27,7 +27,7 @@ Windows options:
   --no-install-leither      Require an already running Leither node.
   --leither-service         Configure Leither startup only.
   --upgrade                 Upgrade an existing Windows LePan installation.
-  --household               Accepted for parity; Windows uses household mode by default.
+  --household               Set up household users or renew an unclaimed setup invitation.
 
 Run Windows Terminal or PowerShell as Administrator. Windows setup supports
 native x64 Windows 10/11 and Windows Server; WSL and Git Bash are not required.
@@ -382,8 +382,8 @@ if ($Upgrade) {
     if (Test-Path -LiteralPath (Join-Path $root "lifeDrive.owner") -PathType Leaf) {
         throw "This node uses the legacy browser-owner setup, which Windows does not migrate automatically. Its files were left unchanged."
     }
-    if (Test-Path -LiteralPath $routes -PathType Leaf) {
-        throw "An initialized LePan household already exists. Rerun with --upgrade."
+    if ((Test-Path -LiteralPath $routes -PathType Leaf) -and -not $Household) {
+        throw "A LePan household already exists. Use --household for phone setup, or --upgrade for application updates."
     }
 }
 

package/dist/lifedrive-install.sh

@@ -28,7 +28,7 @@ Installer options:
   --storage-max-gb GB       Maximum disk space for a newly installed Leither node (default: 100 GB).
   --release-base URL        Alternate GitHub Release asset base URL.
   --upgrade                 Upgrade an existing LePan without changing device authorization.
-  --household              Prepare mobile household setup using the existing node address.
+  --household              Set up household users or renew an unclaimed setup invitation.
   --household-config FILE   Install mobile-led household setup using a private service configuration.
 
 Setup options are forwarded to lifeDrive-setup.sh. Common examples:
@@ -172,14 +172,14 @@ choose_new_node_storage() {
     valid_storage_gb "$STORAGE_MAX_GB" || { echo "Invalid saved Leither storage choice." >&2; return 1; }
   fi
   available_gb=$(available_storage_gb)
-  echo
-  echo "Choose the maximum hard-drive space Leither may use for LePan and any other data on this node."
+  printf '\nStorage\n'
+  echo "Set the disk space limit for this node (LePan and other Leither data)."
   if [[ "$available_gb" =~ ^[0-9]+$ ]]; then
-    echo "Available now on the selected drive: ${available_gb} GB."
+    echo "  Available: ${available_gb} GB"
   fi
   if [[ -n "$STORAGE_MAX_GB" ]]; then
     selected_gb="$STORAGE_MAX_GB"
-    echo "Leither storage limit: ${selected_gb} GB."
+    echo "  Selected limit: ${selected_gb} GB"
   elif [[ -t 0 ]]; then
     while true; do
       read -r -p "Maximum Leither storage in GB [$default_gb]: " selected_gb
@@ -252,7 +252,6 @@ try {
   throw error;
 }
 NODE
-  echo "Leither storage limit saved as ${STORAGE_MAX_GB} GB."
 }
 
 install_leither_binary() (
@@ -475,7 +474,8 @@ configure_macos_leither_firewall() {
     return 1
   }
 
-  echo "Allowing Leither through the macOS Application Firewall..."
+  printf '\nNetwork access\n'
+  echo "Allowing connections through the macOS firewall..."
   firewall_apps=$("$firewall" --listapps) || {
     echo "LePan setup could not read the macOS Application Firewall rules." >&2
     return 1
@@ -501,7 +501,7 @@ configure_macos_leither_firewall() {
     echo "The macOS Application Firewall still reports Leither as blocked." >&2
     return 1
   }
-  echo "macOS Application Firewall allows incoming connections to Leither."
+  echo "  Firewall access ready."
 
   block_all_state=$("$firewall" --getblockall 2>/dev/null || true)
   if [[ "$block_all_state" == *"enabled"* ]]; then
@@ -566,7 +566,7 @@ finish_new_node_storage() {
   version=$(leither_version "$LEITHER_WORKDIR") || return 1
   port=$(node -e 'const fs=require("node:fs"),p=require("node:path"),r=process.argv[1];const f=["SystemVars.json","systemvars.json"].map(n=>p.join(r,n)).find(f=>fs.existsSync(f));const v=JSON.parse(fs.readFileSync(f)).ServicePort??4800;if(!Number.isInteger(v)||v<1||v>65535)process.exit(1);process.stdout.write(String(v));' "$LEITHER_WORKDIR") || return 1
   previous_pid=$(leither_service_pid) || return 1
-  echo "Restarting the newly created Leither node to activate its storage limit..."
+  echo "Applying the storage limit (restarting the newly created node)..."
   case "$(uname -s)" in
     Linux) sudo systemctl restart lifedrive-leither.service || return 1 ;;
     Darwin) sudo launchctl kickstart -k system/uk.inoku.leither || return 1 ;;
@@ -578,7 +578,7 @@ finish_new_node_storage() {
     return 1
   }
   rm -f -- "$pending" || return 1
-  echo "Leither restarted with the ${STORAGE_MAX_GB} GB storage limit."
+  echo "  Storage ready: ${STORAGE_MAX_GB} GB limit."
 }
 
 bootstrap_leither() {
@@ -801,6 +801,7 @@ cleanup() {
 }
 trap cleanup EXIT HUP INT TERM
 
+printf '\nInstall LePan\n'
 if [[ "$RELEASE_BASE" == file://* ]]; then
   echo "Loading the LePan release included with the npm package..."
 else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inoku/lepan",
-  "version": "0.7.65",
+  "version": "0.7.67",
   "description": "Install LePan and its Leither runtime on Linux, macOS, or Windows",
   "os": [
     "linux",