@nightowne/tas-cli 2.3.0 → 2.4.0

package/README.md

@@ -198,11 +198,10 @@ TAS implements **zero-knowledge encryption** — we can't read your data, Telegr
 | **IV** | 12 bytes, cryptographically random | Unique per file — no pattern analysis |
 | **Auth Tag** | 16 bytes GCM authentication | Tamper detection — any bit flip = rejected |
 | **Bot Token** | Encrypted at rest (AES-256-GCM) | Even your config file is protected |
-| **Password Hash** | PBKDF2-based verification | Your password hash is computationally expensive to crack |
+| **Password Hash** | Timing-safe PBKDF2 verification | Resistant to timing side-channel attacks |
+| **Config Permissions** | `chmod 600` on config.json | Other users on your system can't read your credentials |
 | **Integrity** | SHA-256 verified on every download | Bit-perfect downloads, guaranteed |
-| **Share Server** | XSS-safe, RFC 6266 headers | Hardened against injection attacks |
-
-For the full threat model, cipher rationale, and file format spec, see **[docs/security.md](docs/security.md)**.
+| **Share Server** | Localhost-only, XSS-safe, RFC 6266 | Binds to 127.0.0.1 by default — your LAN doesn't see it |
 
 ### What Telegram Sees
 
@@ -224,7 +223,6 @@ Built like professional backup tools (inspired by restic, rclone, borg):
 | **Rate Limiting** | Built-in 1 msg/sec limiter — never hits Telegram's rate limits |
 | **Integrity Verification** | SHA-256 hash check after every single download |
 | **Resume Uploads** | Interrupted? Run `tas resume` to pick up where you left off |
-| **Atomic Transactions** | Upload pipeline uses SQLite transactions — pipeline failure = clean rollback, zero orphaned DB rows |
 | **Graceful Shutdown** | SIGINT/SIGTERM handled cleanly — zero data corruption risk |
 | **Self-Diagnostics** | `tas doctor` validates your entire setup in seconds |
 
@@ -290,27 +288,28 @@ tas tag list [tag]          # List tags or files with a specific tag
 
 ```
 src/
-├── cli.js              # Commander-based CLI — all commands
-├── index.js            # Streaming upload/download pipeline
+├── cli.js                  # Commander-based CLI — all commands
+├── index.js                # Streaming upload/download pipeline
 ├── crypto/
-│   └── encryption.js   # AES-256-GCM + PBKDF2-SHA512 key derivation
+│   └── encryption.js       # AES-256-GCM + PBKDF2-SHA512 key derivation
 ├── db/
-│   └── index.js        # SQLite index (files, chunks, tags, shares, sync)
+│   └── index.js            # SQLite index (files, chunks, tags, shares, sync)
 ├── telegram/
-│   └── client.js       # Bot API wrapper — retry, rate-limit, streaming
+│   └── client.js           # Bot API wrapper — retry, rate-limit, streaming
 ├── fuse/
-│   └── mount.js        # FUSE filesystem — mount Telegram as a folder
+│   └── mount.js            # FUSE filesystem — mount Telegram as a folder
 ├── share/
-│   └── server.js       # HTTP server — expiring download links
+│   └── server.js           # HTTP server — expiring download links
 ├── sync/
-│   └── sync.js         # Folder watcher — Dropbox-style auto-sync
+│   └── sync.js             # Folder watcher — Dropbox-style auto-sync
 └── utils/
-    ├── compression.js   # Smart gzip (skips already-compressed formats)
-    ├── chunker.js       # 49MB chunking with custom WAS1 file headers
-    ├── progress.js      # Terminal progress bar with speed + ETA
-    ├── throttle.js      # Bandwidth limiter (stream transform)
-    ├── branding.js      # ASCII art + version (auto-synced from package.json)
-    └── cli-helpers.js   # Password management + config resolution
+    ├── download-stream.js   # Shared Telegram→Decrypt→Decompress pipeline
+    ├── compression.js       # Smart gzip (skips already-compressed formats)
+    ├── chunker.js           # 49MB chunking with custom WAS1 file headers
+    ├── progress.js          # Terminal progress bar with speed + ETA
+    ├── throttle.js          # Bandwidth limiter (stream transform)
+    ├── branding.js          # ASCII art + formatting
+    └── cli-helpers.js       # Password management + config resolution
 ```
 
 **Tech stack:** Node.js · better-sqlite3 · node-telegram-bot-api · fuse-native · Commander · Chalk · Ora · Inquirer
@@ -334,27 +333,13 @@ src/
 ```bash
 git clone https://github.com/ixchio/tas
 cd tas && npm install
-npm test  # 83 tests across 16 suites, all passing
+npm test  # 71 tests, all passing
 ```
 
-For the full developer guide (architecture, testing, conventions, gotchas), see **[docs/development.md](docs/development.md)**.
-
 PRs welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
 <br>
 
-## 📚 Documentation
-
-| Doc | What's in it |
-|-----|-------------|
-| [docs/development.md](docs/development.md) | Developer onboarding — project structure, how to add commands, testing, conventions |
-| [docs/security.md](docs/security.md) | Threat model — what TAS protects against, cipher details, file format specs |
-| [CHANGELOG.md](CHANGELOG.md) | Version history with all changes documented |
-| [CONTRIBUTING.md](CONTRIBUTING.md) | How to contribute — fork, branch, PR |
-| [SECURITY.md](SECURITY.md) | Security vulnerability reporting |
-
-<br>
-
 ## 🌟 Contributing
 
 TAS is open source and we love contributions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nightowne/tas-cli",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Telegram as Storage - Automated encrypted cloud backup. Free, encrypted, scriptable. Mount as folder or use with cron/Docker.",
   "type": "module",
   "main": "src/index.js",
@@ -56,4 +56,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}

package/src/cli.js

@@ -133,6 +133,8 @@ program
                 createdAt: new Date().toISOString(),
                 configVersion: 2
             }, null, 2));
+            // Restrict config file permissions — contains encrypted token and password hash
+            try { fs.chmodSync(configPath, 0o600); } catch { /* ignore on Windows */ }
 
             // Initialize database
             spinner.start('Initializing local index...');

package/src/crypto/encryption.js

@@ -28,12 +28,18 @@ export class Encryptor {
 
     /**
      * Check password against a stored hash (supports both legacy SHA-256 and new PBKDF2 formats)
+     * Uses timing-safe comparison to prevent side-channel attacks.
      */
     static verifyPasswordHash(password, storedHash) {
         const encryptor = new Encryptor(password);
 
+        const computedHash = encryptor.getPasswordHash();
+        const computedBuf = Buffer.from(computedHash, 'utf-8');
+        const storedBuf = Buffer.from(storedHash, 'utf-8');
+
         // Try new PBKDF2-based verification first
-        if (encryptor.getPasswordHash() === storedHash) {
+        if (computedBuf.length === storedBuf.length &&
+            crypto.timingSafeEqual(computedBuf, storedBuf)) {
             return true;
         }
 
@@ -41,7 +47,14 @@ export class Encryptor {
         const legacyHash = crypto.createHash('sha256')
             .update(password + 'was-verify')
             .digest('hex');
-        return legacyHash === storedHash;
+        const legacyBuf = Buffer.from(legacyHash, 'utf-8');
+
+        if (legacyBuf.length === storedBuf.length &&
+            crypto.timingSafeEqual(legacyBuf, storedBuf)) {
+            return true;
+        }
+
+        return false;
     }
 
     /**

package/src/fuse/mount.js

@@ -7,8 +7,7 @@
 
 import path from 'path';
 import fs from 'fs';
-import crypto from 'crypto';
-import { processFile } from '../index.js';
+import { pipeline } from 'stream/promises';
 
 let Fuse;
 try {
@@ -20,8 +19,11 @@ import { TelegramClient } from '../telegram/client.js';
 import { Encryptor } from '../crypto/encryption.js';
 import { Compressor } from '../utils/compression.js';
 import { FileIndex } from '../db/index.js';
-import { createHeader, parseHeader, HEADER_SIZE } from '../utils/chunker.js';
+import { createHeader } from '../utils/chunker.js';
+import { createDownloadPipeline } from '../utils/download-stream.js';
 
+// File cache for performance (avoid re-downloading)
+const fileCache = new Map();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 const CACHE_MAX_ENTRIES = 100; // Prevent unbounded memory growth
 
@@ -52,9 +54,6 @@ export class TelegramFS {
 
         // Pending writes buffer
         this.writeBuffers = new Map();
-        
-        // Instance-level file cache to prevent cross-talk
-        this.fileCache = new Map();
     }
 
     async initialize() {
@@ -90,7 +89,7 @@ export class TelegramFS {
                 mtime: new Date(),
                 atime: new Date(),
                 ctime: new Date(),
-                size: wb.size,
+                size: wb.data.length,
                 mode: 0o100644, // regular file
                 uid: process.getuid?.() || 0,
                 gid: process.getgid?.() || 0
@@ -124,14 +123,9 @@ export class TelegramFS {
         }
 
         const files = this.db.listAll();
-        const nameSet = new Set(files.map(f => f.filename));
+        const names = files.map(f => f.filename);
 
-        // Include files currently being written (not yet released/uploaded)
-        for (const name of this.writeBuffers.keys()) {
-            nameSet.add(name);
-        }
-
-        return cb(0, [...nameSet]);
+        return cb(0, names);
     }
 
     /**
@@ -164,8 +158,9 @@ export class TelegramFS {
             // Check write buffers first
             const wb = this.writeBuffers.get(filename);
             if (wb) {
-                const bytesRead = fs.readSync(wb.fd, buffer, 0, length, position);
-                return cb(bytesRead);
+                const slice = wb.data.subarray(position, position + length);
+                slice.copy(buffer);
+                return cb(slice.length);
             }
 
             // Check cache first
@@ -190,55 +185,34 @@ export class TelegramFS {
     }
 
     /**
-     * Helper to get or create a disk-buffered write structure
+     * Write to a file (buffers until release)
      */
-    getOrCreateWriteBuffer(filename) {
-        if (this.writeBuffers.has(filename)) {
-            return this.writeBuffers.get(filename);
-        }
+    write(filepath, fd, buffer, length, position, cb) {
+        const filename = path.basename(filepath);
 
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (!fs.existsSync(fuseTmpDir)) {
-            fs.mkdirSync(fuseTmpDir, { recursive: true });
+        // Get or create write buffer
+        if (!this.writeBuffers.has(filename)) {
+            this.writeBuffers.set(filename, {
+                data: Buffer.alloc(0),
+                modified: true
+            });
         }
 
-        const tmpPath = path.join(fuseTmpDir, crypto.randomBytes(16).toString('hex'));
-        const fdDisk = fs.openSync(tmpPath, 'w+');
+        const wb = this.writeBuffers.get(filename);
 
-        // Check if there is an existing file cached
-        const cachedPath = this.getCached(filename);
-        let size = 0;
-        if (cachedPath && fs.existsSync(cachedPath)) {
-            const content = fs.readFileSync(cachedPath);
-            fs.writeSync(fdDisk, content, 0, content.length, 0);
-            size = content.length;
+        // Expand buffer if needed
+        const newSize = Math.max(wb.data.length, position + length);
+        if (newSize > wb.data.length) {
+            const newBuf = Buffer.alloc(newSize);
+            wb.data.copy(newBuf);
+            wb.data = newBuf;
         }
 
-        const wb = {
-            tmpPath,
-            fd: fdDisk,
-            size,
-            modified: true
-        };
-        this.writeBuffers.set(filename, wb);
-        return wb;
-    }
+        // Copy incoming data
+        buffer.copy(wb.data, position, 0, length);
+        wb.modified = true;
 
-    /**
-     * Write to a file (buffers until release)
-     */
-    write(filepath, fd, buffer, length, position, cb) {
-        const filename = path.basename(filepath);
-        try {
-            const wb = this.getOrCreateWriteBuffer(filename);
-            fs.writeSync(wb.fd, buffer, 0, length, position);
-            wb.size = Math.max(wb.size, position + length);
-            wb.modified = true;
-            return cb(length);
-        } catch (err) {
-            console.error('[FUSE] Write error:', err.message);
-            return cb(Fuse.EIO);
-        }
+        return cb(length);
     }
 
     /**
@@ -249,19 +223,9 @@ export class TelegramFS {
 
         console.log(`[FUSE] Creating file: ${filename}`);
 
-        // Initialize empty disk-buffered write
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (!fs.existsSync(fuseTmpDir)) {
-            fs.mkdirSync(fuseTmpDir, { recursive: true });
-        }
-
-        const tmpPath = path.join(fuseTmpDir, crypto.randomBytes(16).toString('hex'));
-        const fdDisk = fs.openSync(tmpPath, 'w+');
-
+        // Initialize empty write buffer
         this.writeBuffers.set(filename, {
-            tmpPath,
-            fd: fdDisk,
-            size: 0,
+            data: Buffer.alloc(0),
             modified: true,
             isNew: true
         });
@@ -283,26 +247,15 @@ export class TelegramFS {
         const filename = path.basename(filepath);
 
         const wb = this.writeBuffers.get(filename);
-        if (!wb) {
-            return cb(0);
-        }
-
-        if (!wb.modified) {
-            try { fs.closeSync(wb.fd); } catch (e) {}
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
-            this.writeBuffers.delete(filename);
+        if (!wb || !wb.modified) {
             return cb(0);
         }
 
         try {
-            // Close fd so we can read and upload cleanly
-            try { fs.closeSync(wb.fd); } catch (e) {}
+            // Upload to Telegram
+            await this.uploadFile(filename, wb.data);
 
-            // Upload to Telegram from the temp path
-            await this.uploadFile(filename, wb.tmpPath);
-
-            // Clean up temp file
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
+            // Clear write buffer
             this.writeBuffers.delete(filename);
 
             // Invalidate cache
@@ -310,9 +263,7 @@ export class TelegramFS {
 
             return cb(0);
         } catch (err) {
-            console.error('[FUSE] Release error:', err.message);
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
-            this.writeBuffers.delete(filename);
+            console.error('Release error:', err.message);
             return cb(Fuse.EIO);
         }
     }
@@ -329,7 +280,7 @@ export class TelegramFS {
         }
 
         try {
-            // Delete from Telegram
+            // Delete from Telegram (optional - could just remove from index)
             const chunks = this.db.getChunks(file.id);
             for (const chunk of chunks) {
                 await this.client.deleteMessage(chunk.message_id);
@@ -343,7 +294,7 @@ export class TelegramFS {
 
             return cb(0);
         } catch (err) {
-            console.error('[FUSE] Unlink error:', err.message);
+            console.error('Unlink error:', err.message);
             return cb(Fuse.EIO);
         }
     }
@@ -365,10 +316,10 @@ export class TelegramFS {
             .run(newName, file.id);
 
         // Update cache key
-        const cached = this.fileCache.get(oldName);
+        const cached = fileCache.get(oldName);
         if (cached) {
-            this.fileCache.delete(oldName);
-            this.fileCache.set(newName, cached);
+            fileCache.delete(oldName);
+            fileCache.set(newName, cached);
         }
 
         return cb(0);
@@ -379,16 +330,35 @@ export class TelegramFS {
      */
     truncate(filepath, size, cb) {
         const filename = path.basename(filepath);
-        try {
-            const wb = this.getOrCreateWriteBuffer(filename);
-            fs.ftruncateSync(wb.fd, size);
-            wb.size = size;
-            wb.modified = true;
-            return cb(0);
-        } catch (err) {
-            console.error('[FUSE] Truncate error:', err.message);
-            return cb(Fuse.EIO);
+
+        // Get or load into write buffer
+        if (!this.writeBuffers.has(filename)) {
+            const cachedPath = this.getCached(filename);
+            if (cachedPath) {
+                this.writeBuffers.set(filename, {
+                    data: fs.readFileSync(cachedPath), // Note: RAM buffer here could be big, but it's okay for truncate/writes right now
+                    modified: true
+                });
+            } else {
+                this.writeBuffers.set(filename, {
+                    data: Buffer.alloc(0),
+                    modified: true
+                });
+            }
         }
+
+        const wb = this.writeBuffers.get(filename);
+
+        if (size < wb.data.length) {
+            wb.data = wb.data.subarray(0, size);
+        } else if (size > wb.data.length) {
+            const newBuf = Buffer.alloc(size);
+            wb.data.copy(newBuf);
+            wb.data = newBuf;
+        }
+
+        wb.modified = true;
+        return cb(0);
     }
 
     // ============== Helper Methods ==============
@@ -413,56 +383,18 @@ export class TelegramFS {
         }
 
         const chunks = this.db.getChunks(file.id);
-        if (chunks.length === 0) throw new Error('No chunks found');
-
-        // Pre-sort chunks
-        chunks.sort((a, b) => a.chunk_index - b.chunk_index);
-
-        const firstChunkData = await this.client.downloadFile(chunks[0].file_telegram_id);
-        const header = parseHeader(firstChunkData);
-        let wasCompressed = header.compressed;
-
-        const decryptStream = this.encryptor.getDecryptStream();
-        const decompressStream = this.compressor.getDecompressStream(wasCompressed);
-
-        const { Readable } = await import('stream');
-        const { pipeline } = await import('stream/promises');
-
-        const self = this;
-        let currentChunkIndex = 0;
-        let preloadedFirstChunk = firstChunkData;
-
-        const downloadStream = new Readable({
-            async read() {
-                try {
-                    if (currentChunkIndex >= chunks.length) {
-                        this.push(null);
-                        return;
-                    }
-
-                    const chunk = chunks[currentChunkIndex];
-                    let data;
-                    if (currentChunkIndex === 0 && preloadedFirstChunk) {
-                        data = preloadedFirstChunk;
-                        preloadedFirstChunk = null;
-                    } else {
-                        data = await self.client.downloadFile(chunk.file_telegram_id);
-                    }
-
-                    const payload = data.subarray(HEADER_SIZE);
-                    this.push(payload);
-                    currentChunkIndex++;
-                } catch (err) {
-                    this.destroy(err);
-                }
-            }
+
+        const { readable } = await createDownloadPipeline({
+            client: this.client,
+            chunks,
+            encryptor: this.encryptor,
+            compressor: this.compressor
         });
 
         const tmpOutputPath = outputPath + '.tmp';
         const writeStream = fs.createWriteStream(tmpOutputPath);
 
-        // Pipeline: Telegram -> Decrypt -> Decompress -> Disk Cache
-        await pipeline(downloadStream, decryptStream, decompressStream, writeStream);
+        await pipeline(readable, writeStream);
 
         // Rename to final atomic path
         fs.renameSync(tmpOutputPath, outputPath);
@@ -470,7 +402,10 @@ export class TelegramFS {
         return outputPath;
     }
 
-    async uploadFile(filename, tempPath) {
+    async uploadFile(filename, data) {
+        const { hashData } = await import('../crypto/encryption.js');
+        const hash = hashData(data);
+
         // Check if already exists by name
         const existingByName = this.db.findByName(filename);
         if (existingByName) {
@@ -482,17 +417,57 @@ export class TelegramFS {
             this.db.delete(existingByName.id);
         }
 
-        // Run the standard chunked upload pipeline (this handles chunking, encryption, compression, and DB entry)
-        await processFile(tempPath, {
-            password: this.password,
-            dataDir: this.dataDir,
-            customName: filename,
-            config: this.config
+        // Check if already exists by hash (same content, different name)
+        const existingByHash = this.db.findByHash(hash);
+        if (existingByHash) {
+            // Same content already exists, just skip
+            console.log(`[FUSE] File with same content already exists as ${existingByHash.filename}`);
+            return;
+        }
+
+        // Compress
+        const { data: compressedData, compressed } = await this.compressor.compress(data, filename);
+
+        // Encrypt
+        const encryptedData = this.encryptor.encrypt(compressedData);
+
+        // Create temp file with header
+        const tempDir = process.env.TAS_TMP_DIR || path.join(this.dataDir, 'tmp');
+        if (!fs.existsSync(tempDir)) {
+            fs.mkdirSync(tempDir, { recursive: true });
+        }
+
+        const flags = compressed ? 1 : 0;
+        const header = createHeader(filename, data.length, 0, 1, flags);
+        const fileData = Buffer.concat([header, encryptedData]);
+
+        const tempPath = path.join(tempDir, `${hash.substring(0, 12)}.tas`);
+        fs.writeFileSync(tempPath, fileData);
+
+        // Upload to Telegram
+        const result = await this.client.sendFile(tempPath, `📦 ${filename}`);
+
+        // Add to index
+        const fileId = this.db.addFile({
+            filename,
+            hash,
+            originalSize: data.length,
+            storedSize: encryptedData.length,
+            chunks: 1,
+            compressed
         });
+
+        this.db.addChunk(fileId, 0, result.messageId.toString(), fileData.length);
+        this.db.db.prepare('UPDATE chunks SET file_telegram_id = ? WHERE file_id = ? AND chunk_index = ?')
+            .run(result.fileId, fileId, 0);
+
+        // Cleanup
+        fs.unlinkSync(tempPath);
+        try { fs.rmdirSync(tempDir); } catch (e) { }
     }
 
     getCached(filename) {
-        const entry = this.fileCache.get(filename);
+        const entry = fileCache.get(filename);
         if (!entry) return null;
 
         if (Date.now() - entry.timestamp > CACHE_TTL) {
@@ -500,7 +475,7 @@ export class TelegramFS {
             try {
                 if (fs.existsSync(entry.path)) fs.unlinkSync(entry.path);
             } catch (e) { }
-            this.fileCache.delete(filename);
+            fileCache.delete(filename);
             return null;
         }
 
@@ -511,35 +486,35 @@ export class TelegramFS {
 
     setCache(filename, cachePath) {
         // Evict oldest entry if cache is full
-        if (this.fileCache.size >= CACHE_MAX_ENTRIES) {
+        if (fileCache.size >= CACHE_MAX_ENTRIES) {
             let oldestKey = null;
             let oldestTime = Infinity;
-            for (const [key, entry] of this.fileCache) {
+            for (const [key, entry] of fileCache) {
                 if (entry.timestamp < oldestTime) {
                     oldestTime = entry.timestamp;
                     oldestKey = key;
                 }
             }
             if (oldestKey) {
-                const evicted = this.fileCache.get(oldestKey);
+                const evicted = fileCache.get(oldestKey);
                 try { if (fs.existsSync(evicted.path)) fs.unlinkSync(evicted.path); } catch (e) { }
-                this.fileCache.delete(oldestKey);
+                fileCache.delete(oldestKey);
             }
         }
 
-        this.fileCache.set(filename, {
+        fileCache.set(filename, {
             path: cachePath,
             timestamp: Date.now()
         });
     }
 
     invalidateCache(filename) {
-        const entry = this.fileCache.get(filename);
+        const entry = fileCache.get(filename);
         if (entry) {
             try {
                 if (fs.existsSync(entry.path)) fs.unlinkSync(entry.path);
             } catch (e) { }
-            this.fileCache.delete(filename);
+            fileCache.delete(filename);
         }
     }
 
@@ -552,17 +527,6 @@ export class TelegramFS {
             fs.mkdirSync(this.mountPoint, { recursive: true });
         }
 
-        // Clean up any stray temp files from previous sessions
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (fs.existsSync(fuseTmpDir)) {
-            try {
-                const files = fs.readdirSync(fuseTmpDir);
-                for (const file of files) {
-                    fs.unlinkSync(path.join(fuseTmpDir, file));
-                }
-            } catch (e) {}
-        }
-
         const ops = {
             getattr: this.getattr.bind(this),
             readdir: this.readdir.bind(this),

package/src/index.js

@@ -8,7 +8,7 @@ import path from 'path';
 import { pipeline } from 'stream/promises';
 import { Encryptor, hashFile } from './crypto/encryption.js';
 import { Compressor } from './utils/compression.js';
-import { createHeader, parseHeader, HEADER_SIZE } from './utils/chunker.js';
+import { createHeader, HEADER_SIZE } from './utils/chunker.js';
 import { TelegramClient } from './telegram/client.js';
 import { FileIndex } from './db/index.js';
 
@@ -72,23 +72,15 @@ export async function processFile(filePath, options) {
     if (compressed && originalSize > 1024 * 1024) estimatedSize = originalSize * 0.8; // Rough guess
     let estimatedChunks = Math.ceil(estimatedSize / TELEGRAM_CHUNK_SIZE) || 1;
 
-    // Register file in DB inside a transaction for atomicity
-    db.db.exec('BEGIN');
-    let fileId;
-    try {
-        fileId = db.addFile({
-            filename,
-            hash,
-            originalSize,
-            storedSize: 0, // Will update later
-            chunks: estimatedChunks,
-            compressed
-        });
-    } catch (err) {
-        db.db.exec('ROLLBACK');
-        db.close();
-        throw err;
-    }
+    // Register file in DB
+    const fileId = db.addFile({
+        filename,
+        hash,
+        originalSize,
+        storedSize: 0, // Will update later
+        chunks: estimatedChunks,
+        compressed
+    });
 
     onProgress?.('Processing and uploading streams...');
     let uploadedBytes = 0;
@@ -170,25 +162,15 @@ export async function processFile(filePath, options) {
         }
     });
 
-    try {
-        const readStream = fs.createReadStream(filePath);
+    const readStream = fs.createReadStream(filePath);
 
-        // Run the pipeline: Read -> Compress -> Encrypt -> Chunk & Upload
-        await pipeline(readStream, compressStream, encryptStream, chunkingStream);
-    } catch (pipelineErr) {
-        // Pipeline failed — roll back the DB transaction so no orphaned rows remain
-        try { db.db.exec('ROLLBACK'); } catch (e) { /* already rolled back */ }
-        db.close();
-        throw pipelineErr;
-    }
+    // Run the pipeline: Read -> Compress -> Encrypt -> Chunk & Upload
+    await pipeline(readStream, compressStream, encryptStream, chunkingStream);
 
     // Update the DB with the final accurate values 
     db.db.prepare('UPDATE files SET stored_size = ?, chunks = ? WHERE id = ?')
         .run(totalStoredSize, chunkIndex, fileId);
 
-    // Commit the transaction — all DB rows are now permanent
-    db.db.exec('COMMIT');
-
     db.close();
 
     // Clean up temp dir (only if empty)
@@ -228,86 +210,32 @@ export async function retrieveFile(fileRecord, options) {
         throw new Error('No chunk metadata found for this file');
     }
 
-    // Prepare components
-    const encryptor = new Encryptor(password);
-    const decryptStream = encryptor.getDecryptStream();
-
-    const tempDir = process.env.TAS_TMP_DIR || path.join(dataDir, 'tmp');
-    if (!fs.existsSync(tempDir)) {
-        fs.mkdirSync(tempDir, { recursive: true });
-    }
-
     // Connect to Telegram
     const client = new TelegramClient(dataDir);
     await client.initialize(config.botToken);
     client.setChatId(config.chatId);
 
-    // Get total size from first chunk's header, or from DB
-    const firstChunkData = await client.downloadFile(chunks[0].file_telegram_id);
-    const header = parseHeader(firstChunkData);
-
-    // Total original uncompressed size
-    let expectedOriginalSize = header.originalSize;
-    let wasCompressed = header.compressed;
-
+    const encryptor = new Encryptor(password);
     const compressor = new Compressor();
-    const decompressStream = compressor.getDecompressStream(wasCompressed);
-
-    // We need a Readable stream that will lazily fetch chunks from Telegram
-    // and push them into the decryption pipeline.
-    const { Readable } = await import('stream');
-
-    const totalBytes = fileRecord.stored_size || chunks.reduce((acc, c) => acc + (c.size || 0), 0);
-    let downloadedBytes = 0;
-
-    // Pre-sort chunks by index so we download them in correct order
-    chunks.sort((a, b) => a.chunk_index - b.chunk_index);
-
-    let currentChunkIndex = 0;
-
-    // We already downloaded the first chunk to inspect its header, we shouldn't discard it.
-    let preloadedFirstChunk = firstChunkData;
 
-    const downloadStream = new Readable({
-        async read() {
-            try {
-                if (currentChunkIndex >= chunks.length) {
-                    this.push(null); // End of stream
-                    return;
-                }
-
-                const chunk = chunks[currentChunkIndex];
-                onProgress?.(`Downloading chunk ${chunk.chunk_index + 1}/${chunks.length}...`);
-
-                let data;
-                if (currentChunkIndex === 0 && preloadedFirstChunk) {
-                    data = preloadedFirstChunk;
-                    preloadedFirstChunk = null;
-                } else {
-                    data = await client.downloadFile(chunk.file_telegram_id);
-                }
+    const { createDownloadPipeline } = await import('./utils/download-stream.js');
 
-                downloadedBytes += data.length;
-                onByteProgress?.({ downloaded: downloadedBytes, total: totalBytes, chunk: chunk.chunk_index + 1, totalChunks: chunks.length });
-
-                // Strip header before pushing
-                const payload = data.subarray(HEADER_SIZE);
-                this.push(payload);
-
-                currentChunkIndex++;
-            } catch (err) {
-                this.destroy(err);
-            }
+    const { readable } = await createDownloadPipeline({
+        client,
+        chunks,
+        encryptor,
+        compressor,
+        onChunkDownloaded({ chunkIndex, totalChunks, bytesDownloaded, totalBytes }) {
+            onProgress?.(`Downloading chunk ${chunkIndex + 1}/${totalChunks}...`);
+            onByteProgress?.({ downloaded: bytesDownloaded, total: totalBytes, chunk: chunkIndex + 1, totalChunks });
         }
     });
 
     const writeStream = fs.createWriteStream(outputPath);
-    const { pipeline } = await import('stream/promises');
 
     onProgress?.('Decrypting, decompressing, and writing file...');
 
-    // Pipeline: Download from Telegram -> Decrypt -> Decompress -> Disk
-    await pipeline(downloadStream, decryptStream, decompressStream, writeStream);
+    await pipeline(readable, writeStream);
 
     const finalStats = fs.statSync(outputPath);
 

package/src/share/server.js

@@ -7,11 +7,12 @@
 import http from 'http';
 import crypto from 'crypto';
 import path from 'path';
+import { pipeline } from 'stream/promises';
 import { FileIndex } from '../db/index.js';
 import { TelegramClient } from '../telegram/client.js';
 import { Encryptor } from '../crypto/encryption.js';
 import { Compressor } from '../utils/compression.js';
-import { parseHeader, HEADER_SIZE } from '../utils/chunker.js';
+import { createDownloadPipeline } from '../utils/download-stream.js';
 
 /**
  * Generate a secure random share token
@@ -239,7 +240,7 @@ export class ShareServer {
         this.password = options.password;
         this.config = options.config;
         this.port = options.port || 3000;
-        this.host = options.host || '0.0.0.0';
+        this.host = options.host || '127.0.0.1';
 
         this.db = null;
         this.client = null;
@@ -261,64 +262,19 @@ export class ShareServer {
     }
 
     /**
-     * Prepare download streams from Telegram — fetches and verifies
-     * the first chunk before returning, so the caller can decide
-     * whether to commit to a 200 response.
-     *
-     * Returns: { downloadStream, decryptStream, decompressStream }
+     * Stream a decrypted file from Telegram directly to the HTTP response
      */
-    async prepareDownloadStreams(fileRecord) {
+    async streamToResponse(fileRecord, res) {
         const chunks = this.db.getChunks(fileRecord.id);
-        if (chunks.length === 0) throw new Error('No chunks found');
-
-        // Pre-sort chunks by index so we download them in correct order
-        chunks.sort((a, b) => a.chunk_index - b.chunk_index);
-
-        // Fetch and verify the first chunk eagerly
-        const firstChunkData = await this.client.downloadFile(chunks[0].file_telegram_id);
-        const header = parseHeader(firstChunkData);
-        let wasCompressed = header.compressed;
-
-        // Prepare streams
-        const decryptStream = this.encryptor.getDecryptStream();
-        const decompressStream = this.compressor.getDecompressStream(wasCompressed);
-
-        const { Readable } = await import('stream');
-
-        const self = this;
-        let currentChunkIndex = 0;
-        let preloadedFirstChunk = firstChunkData;
-
-        const downloadStream = new Readable({
-            async read() {
-                try {
-                    if (currentChunkIndex >= chunks.length) {
-                        this.push(null); // End of stream
-                        return;
-                    }
-
-                    const chunk = chunks[currentChunkIndex];
-                    let data;
-
-                    if (currentChunkIndex === 0 && preloadedFirstChunk) {
-                        data = preloadedFirstChunk;
-                        preloadedFirstChunk = null;
-                    } else {
-                        data = await self.client.downloadFile(chunk.file_telegram_id);
-                    }
-
-                    // Strip header before pushing
-                    const payload = data.subarray(HEADER_SIZE);
-                    this.push(payload);
-
-                    currentChunkIndex++;
-                } catch (err) {
-                    this.destroy(err);
-                }
-            }
+
+        const { readable } = await createDownloadPipeline({
+            client: this.client,
+            chunks,
+            encryptor: this.encryptor,
+            compressor: this.compressor
         });
 
-        return { downloadStream, decryptStream, decompressStream };
+        await pipeline(readable, res);
     }
 
     /**
@@ -401,31 +357,14 @@ export class ShareServer {
             const contentType = contentTypes[ext] || 'application/octet-stream';
             const safeName = sanitizeFilenameForHeader(fileRecord.filename);
 
-            try {
-                // Verify first chunk can be fetched and decrypted BEFORE sending 200 OK.
-                // This prevents sending a truncated/corrupt file on Telegram or decrypt failure.
-                const { downloadStream, decryptStream, decompressStream } = await this.prepareDownloadStreams(fileRecord);
-
-                // First chunk verified — commit to the 200 response
-                res.writeHead(200, {
-                    'Content-Type': contentType,
-                    'Content-Disposition': `attachment; filename="${safeName}"; filename*=UTF-8''${encodeURIComponent(fileRecord.filename)}`,
-                    'Transfer-Encoding': 'chunked'
-                });
+            res.writeHead(200, {
+                'Content-Type': contentType,
+                'Content-Disposition': `attachment; filename="${safeName}"; filename*=UTF-8''${encodeURIComponent(fileRecord.filename)}`,
+                'Transfer-Encoding': 'chunked'
+            });
 
-                const { pipeline } = await import('stream/promises');
-                await pipeline(downloadStream, decryptStream, decompressStream, res);
-            } catch (streamErr) {
-                console.error('Share stream error:', streamErr.message);
-                // Headers not yet sent — we can still return a proper error
-                if (!res.headersSent) {
-                    res.writeHead(500, { 'Content-Type': 'text/plain' });
-                    res.end('Download failed — file could not be decrypted or fetched.');
-                } else {
-                    // Headers already sent (shouldn't happen now, but safety net)
-                    res.end();
-                }
-            }
+            // Download the file from Telegram, decrypt, decompress and stream directly to 'res'
+            await this.streamToResponse(fileRecord, res);
 
         } catch (err) {
             console.error('Share server error:', err.message);

package/src/sync/sync.js

@@ -13,10 +13,6 @@ import { processFile } from '../index.js';
 // Debounce time in ms to batch rapid file changes
 const DEBOUNCE_MS = 1000;
 
-// Exponential backoff limits for upload errors
-const INITIAL_BACKOFF_MS = 2000;
-const MAX_BACKOFF_MS = 60000;
-
 // Ignore patterns
 const IGNORE_PATTERNS = [
     /^\./, // Hidden files
@@ -35,7 +31,6 @@ export class SyncEngine extends EventEmitter {
         this.config = options.config;
         this.limitRate = options.limitRate || null;
         this.watchers = new Map(); // path -> FSWatcher
-        this.rootWatchers = new Map(); // rootPath -> Set of watched subpaths (for Linux recursive watch fallback)
         this.pendingChanges = new Map(); // path -> timeout
         this.db = null;
         this.running = false;
@@ -110,8 +105,6 @@ export class SyncEngine extends EventEmitter {
         const promises = [];
 
         const worker = async () => {
-            let consecutiveErrors = 0;
-
             while (queue.length > 0) {
                 const file = queue.shift();
                 const existing = stateMap.get(file.relativePath);
@@ -148,7 +141,6 @@ export class SyncEngine extends EventEmitter {
                     // Update sync state
                     this.db.updateSyncState(folder.id, file.relativePath, hash, file.mtime);
                     uploaded++;
-                    consecutiveErrors = 0; // Reset on success
 
                     this.emit('file-upload-complete', { file: file.relativePath });
                 } catch (err) {
@@ -156,12 +148,9 @@ export class SyncEngine extends EventEmitter {
                     if (err.message.includes('duplicate')) {
                         this.db.updateSyncState(folder.id, file.relativePath, hash, file.mtime);
                         skipped++;
-                        consecutiveErrors = 0;
                     } else {
-                        consecutiveErrors++;
-                        // Exponential backoff: 2s → 4s → 8s → 16s → ... → 60s max
-                        const delay = Math.min(INITIAL_BACKOFF_MS * Math.pow(2, consecutiveErrors - 1), MAX_BACKOFF_MS);
-                        await new Promise(r => setTimeout(r, delay));
+                        // Sleep briefly on non-duplicate error (potential rate limits)
+                        await new Promise(r => setTimeout(r, 2000));
                         this.emit('file-upload-error', { file: file.relativePath, error: err.message });
                     }
                 }
@@ -249,148 +238,37 @@ export class SyncEngine extends EventEmitter {
         }
     }
 
-    /**
-     * Recursively list all subdirectories of a directory
-     */
-    getSubdirectories(dirPath) {
-        const subdirs = [];
-        try {
-            const entries = fs.readdirSync(dirPath, { withFileTypes: true });
-            for (const entry of entries) {
-                if (entry.isDirectory()) {
-                    if (this.shouldIgnore(entry.name)) continue;
-                    const fullPath = path.join(dirPath, entry.name);
-                    subdirs.push(fullPath);
-                    subdirs.push(...this.getSubdirectories(fullPath));
-                }
-            }
-        } catch (err) {
-            // Ignore folder reading errors
-        }
-        return subdirs;
-    }
-
-    /**
-     * Watch a single directory (non-recursively) and dynamically watch new folders
-     */
-    watchSingleDir(rootPath, dir) {
-        if (this.watchers.has(dir)) return;
-
-        try {
-            const watcher = fs.watch(dir, { recursive: false }, (event, filename) => {
-                if (!filename) return;
-
-                const fullPath = path.join(dir, filename);
-                const relativePath = path.relative(rootPath, fullPath);
-
-                // If a new directory is created, watch it recursively
-                try {
-                    if (fs.existsSync(fullPath) && fs.statSync(fullPath).isDirectory()) {
-                        if (!this.shouldIgnore(filename)) {
-                            this.watchDirRecursively(rootPath, fullPath);
-                        }
-                    }
-                } catch (e) {
-                    // Ignore stats errors
-                }
-
-                this.handleFileChange(rootPath, relativePath);
-            });
-
-            watcher.on('error', (err) => {
-                this.emit('watch-error', { folder: rootPath, error: err.message });
-            });
-
-            this.watchers.set(dir, watcher);
-
-            if (!this.rootWatchers.has(rootPath)) {
-                this.rootWatchers.set(rootPath, new Set());
-            }
-            this.rootWatchers.get(rootPath).add(dir);
-        } catch (err) {
-            this.emit('watch-error', { folder: rootPath, error: err.message });
-        }
-    }
-
-    /**
-     * Recursively watch a newly created directory and its subdirectories
-     */
-    watchDirRecursively(rootPath, dirPath) {
-        this.watchSingleDir(rootPath, dirPath);
-        const subdirs = this.getSubdirectories(dirPath);
-        for (const subdir of subdirs) {
-            this.watchSingleDir(rootPath, subdir);
-        }
-    }
-
     /**
      * Start watching a folder
      */
     watchFolder(folderPath) {
-        const isRecursiveSupported = process.platform === 'darwin' || process.platform === 'win32';
-
-        if (isRecursiveSupported) {
-            if (this.watchers.has(folderPath)) {
-                return; // Already watching
-            }
-
-            const watcher = fs.watch(folderPath, { recursive: true }, (event, filename) => {
-                if (filename) {
-                    this.handleFileChange(folderPath, filename);
-                }
-            });
-
-            watcher.on('error', (err) => {
-                this.emit('watch-error', { folder: folderPath, error: err.message });
-            });
+        if (this.watchers.has(folderPath)) {
+            return; // Already watching
+        }
 
-            this.watchers.set(folderPath, watcher);
-            this.emit('watch-start', { folder: folderPath });
-        } else {
-            // Manual recursive watch for Linux/other platforms
-            if (this.rootWatchers.has(folderPath)) {
-                return; // Already watching
+        const watcher = fs.watch(folderPath, { recursive: true }, (event, filename) => {
+            if (filename) {
+                this.handleFileChange(folderPath, filename);
             }
+        });
 
-            // Watch root
-            this.watchSingleDir(folderPath, folderPath);
+        watcher.on('error', (err) => {
+            this.emit('watch-error', { folder: folderPath, error: err.message });
+        });
 
-            // Watch all existing subdirectories
-            const subdirs = this.getSubdirectories(folderPath);
-            for (const subdir of subdirs) {
-                this.watchSingleDir(folderPath, subdir);
-            }
-
-            this.emit('watch-start', { folder: folderPath });
-        }
+        this.watchers.set(folderPath, watcher);
+        this.emit('watch-start', { folder: folderPath });
     }
 
     /**
      * Stop watching a folder
      */
     unwatchFolder(folderPath) {
-        const isRecursiveSupported = process.platform === 'darwin' || process.platform === 'win32';
-
-        if (isRecursiveSupported) {
-            const watcher = this.watchers.get(folderPath);
-            if (watcher) {
-                watcher.close();
-                this.watchers.delete(folderPath);
-                this.emit('watch-stop', { folder: folderPath });
-            }
-        } else {
-            if (this.rootWatchers.has(folderPath)) {
-                const dirs = this.rootWatchers.get(folderPath);
-                for (const dir of dirs) {
-                    const watcher = this.watchers.get(dir);
-                    if (watcher) {
-                        watcher.close();
-                        this.watchers.delete(dir);
-                    }
-                }
-                this.rootWatchers.delete(folderPath);
-                this.emit('watch-stop', { folder: folderPath });
-            }
+        const watcher = this.watchers.get(folderPath);
+        if (watcher) {
+            watcher.close();
+            this.watchers.delete(folderPath);
+            this.emit('watch-stop', { folder: folderPath });
         }
     }
 
@@ -424,25 +302,11 @@ export class SyncEngine extends EventEmitter {
         this.pendingChanges.clear();
 
         // Close all watchers
-        const isRecursiveSupported = process.platform === 'darwin' || process.platform === 'win32';
-        if (isRecursiveSupported) {
-            for (const [folderPath, watcher] of this.watchers) {
-                watcher.close();
-                this.emit('watch-stop', { folder: folderPath });
-            }
-            this.watchers.clear();
-        } else {
-            for (const rootPath of this.rootWatchers.keys()) {
-                this.unwatchFolder(rootPath);
-            }
-            this.rootWatchers.clear();
-            
-            // Just in case, close any stray watchers
-            for (const watcher of this.watchers.values()) {
-                try { watcher.close(); } catch (e) {}
-            }
-            this.watchers.clear();
+        for (const [folderPath, watcher] of this.watchers) {
+            watcher.close();
+            this.emit('watch-stop', { folder: folderPath });
         }
+        this.watchers.clear();
 
         if (this.db) {
             this.db.close();

package/src/utils/branding.js

@@ -3,13 +3,6 @@
  */
 
 import chalk from 'chalk';
-import { readFileSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const pkg = JSON.parse(readFileSync(join(__dirname, '..', '..', 'package.json'), 'utf-8'));
 
 export const LOGO = `
 ████████╗ █████╗ ███████╗
@@ -21,7 +14,7 @@ export const LOGO = `
 `;
 
 export const TAGLINE = 'Telegram as Storage';
-export const VERSION = pkg.version;
+export const VERSION = '2.4.0';
 
 /**
  * Print the TAS banner

package/src/utils/download-stream.js

@@ -0,0 +1,87 @@
+/**
+ * Shared download pipeline — Telegram → Decrypt → Decompress
+ *
+ * Eliminates the triplicated download-stream pattern across
+ * index.js, share/server.js, and fuse/mount.js.
+ */
+
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
+import { parseHeader, HEADER_SIZE } from './chunker.js';
+
+/**
+ * Create the download pipeline streams for a file stored in Telegram.
+ *
+ * @param {object} options
+ * @param {object} options.client     – TelegramClient instance (initialized, with chatId set)
+ * @param {Array}  options.chunks     – Chunk records from DB, each with { chunk_index, file_telegram_id, size }
+ * @param {object} options.encryptor  – Encryptor instance
+ * @param {object} options.compressor – Compressor instance
+ * @param {function} [options.onChunkDownloaded] – Optional callback({ chunkIndex, totalChunks, bytesDownloaded, totalBytes })
+ * @returns {Promise<{ readable: Readable, header: object }>}
+ *   readable: a stream of decrypted (and decompressed) file content
+ *   header: parsed WAS1 header from the first chunk
+ */
+export async function createDownloadPipeline({ client, chunks, encryptor, compressor, onChunkDownloaded }) {
+    if (chunks.length === 0) throw new Error('No chunks found');
+
+    // Sort by chunk_index
+    const sortedChunks = [...chunks].sort((a, b) => a.chunk_index - b.chunk_index);
+
+    // Download the first chunk to inspect the header
+    const firstChunkData = await client.downloadFile(sortedChunks[0].file_telegram_id);
+    const header = parseHeader(firstChunkData);
+
+    const decryptStream = encryptor.getDecryptStream();
+    const decompressStream = compressor.getDecompressStream(header.compressed);
+
+    const totalBytes = sortedChunks.reduce((acc, c) => acc + (c.size || 0), 0);
+    let bytesDownloaded = 0;
+    let currentIndex = 0;
+    let preloadedFirst = firstChunkData;
+
+    const telegramStream = new Readable({
+        async read() {
+            try {
+                if (currentIndex >= sortedChunks.length) {
+                    this.push(null);
+                    return;
+                }
+
+                let data;
+                if (currentIndex === 0 && preloadedFirst) {
+                    data = preloadedFirst;
+                    preloadedFirst = null;
+                } else {
+                    data = await client.downloadFile(sortedChunks[currentIndex].file_telegram_id);
+                }
+
+                bytesDownloaded += data.length;
+                onChunkDownloaded?.({
+                    chunkIndex: currentIndex,
+                    totalChunks: sortedChunks.length,
+                    bytesDownloaded,
+                    totalBytes
+                });
+
+                // Strip the WAS1 header before pushing into the decrypt pipeline
+                this.push(data.subarray(HEADER_SIZE));
+                currentIndex++;
+            } catch (err) {
+                this.destroy(err);
+            }
+        }
+    });
+
+    // Wire the internal pipeline: telegram → decrypt → decompress
+    // We use a PassThrough as the readable end so callers can pipe/pipeline it freely.
+    const { PassThrough } = await import('stream');
+    const output = new PassThrough();
+
+    // Run the internal pipeline in the background; errors propagate through the output stream.
+    pipeline(telegramStream, decryptStream, decompressStream, output).catch((err) => {
+        if (!output.destroyed) output.destroy(err);
+    });
+
+    return { readable: output, header };
+}