@nightowne/tas-cli 2.3.0 → 2.4.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nightowne/tas-cli",
-  "version": "2.3.0",
-  "description": "Telegram as Storage - Automated encrypted cloud backup. Free, encrypted, scriptable. Mount as folder or use with cron/Docker.",
+  "version": "2.4.1",
+  "description": "Turn Telegram into unlimited free cloud storage ($0/month forever) • AES-256-GCM encryption • FUSE mount • CLI-first • Zero-knowledge • No signup required",
   "type": "module",
   "main": "src/index.js",
   "bin": {
@@ -47,7 +47,7 @@
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "inquirer": "^12.2.0",
-    "node-telegram-bot-api": "^0.66.0",
+    "node-telegram-bot-api": "^1.1.2",
     "ora": "^8.1.1"
   },
   "optionalDependencies": {
@@ -56,4 +56,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}

package/src/cli.js

@@ -133,6 +133,8 @@ program
                 createdAt: new Date().toISOString(),
                 configVersion: 2
             }, null, 2));
+            // Restrict config file permissions — contains encrypted token and password hash
+            try { fs.chmodSync(configPath, 0o600); } catch { /* ignore on Windows */ }
 
             // Initialize database
             spinner.start('Initializing local index...');
@@ -742,7 +744,7 @@ syncCmd
         if (options.limit) {
             const match = options.limit.match(/^(\d+)([kmg]?)$/i);
             if (!match) {
-                console.error(chalk.red('Invalid limit format. Use e.g. 500{}, 1m'));
+                console.error(chalk.red('Invalid limit format. Use e.g. 500k, 1m'));
                 process.exit(1);
             }
             const val = parseInt(match[1]);

package/src/crypto/encryption.js

@@ -28,12 +28,18 @@ export class Encryptor {
 
     /**
      * Check password against a stored hash (supports both legacy SHA-256 and new PBKDF2 formats)
+     * Uses timing-safe comparison to prevent side-channel attacks.
      */
     static verifyPasswordHash(password, storedHash) {
         const encryptor = new Encryptor(password);
 
+        const computedHash = encryptor.getPasswordHash();
+        const computedBuf = Buffer.from(computedHash, 'utf-8');
+        const storedBuf = Buffer.from(storedHash, 'utf-8');
+
         // Try new PBKDF2-based verification first
-        if (encryptor.getPasswordHash() === storedHash) {
+        if (computedBuf.length === storedBuf.length &&
+            crypto.timingSafeEqual(computedBuf, storedBuf)) {
             return true;
         }
 
@@ -41,7 +47,14 @@ export class Encryptor {
         const legacyHash = crypto.createHash('sha256')
             .update(password + 'was-verify')
             .digest('hex');
-        return legacyHash === storedHash;
+        const legacyBuf = Buffer.from(legacyHash, 'utf-8');
+
+        if (legacyBuf.length === storedBuf.length &&
+            crypto.timingSafeEqual(legacyBuf, storedBuf)) {
+            return true;
+        }
+
+        return false;
     }
 
     /**

package/src/fuse/mount.js

@@ -7,8 +7,7 @@
 
 import path from 'path';
 import fs from 'fs';
-import crypto from 'crypto';
-import { processFile } from '../index.js';
+import { pipeline } from 'stream/promises';
 
 let Fuse;
 try {
@@ -20,8 +19,11 @@ import { TelegramClient } from '../telegram/client.js';
 import { Encryptor } from '../crypto/encryption.js';
 import { Compressor } from '../utils/compression.js';
 import { FileIndex } from '../db/index.js';
-import { createHeader, parseHeader, HEADER_SIZE } from '../utils/chunker.js';
+import { createHeader } from '../utils/chunker.js';
+import { createDownloadPipeline } from '../utils/download-stream.js';
 
+// File cache for performance (avoid re-downloading)
+const fileCache = new Map();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 const CACHE_MAX_ENTRIES = 100; // Prevent unbounded memory growth
 
@@ -52,9 +54,6 @@ export class TelegramFS {
 
         // Pending writes buffer
         this.writeBuffers = new Map();
-        
-        // Instance-level file cache to prevent cross-talk
-        this.fileCache = new Map();
     }
 
     async initialize() {
@@ -90,7 +89,7 @@ export class TelegramFS {
                 mtime: new Date(),
                 atime: new Date(),
                 ctime: new Date(),
-                size: wb.size,
+                size: wb.data.length,
                 mode: 0o100644, // regular file
                 uid: process.getuid?.() || 0,
                 gid: process.getgid?.() || 0
@@ -124,14 +123,9 @@ export class TelegramFS {
         }
 
         const files = this.db.listAll();
-        const nameSet = new Set(files.map(f => f.filename));
+        const names = files.map(f => f.filename);
 
-        // Include files currently being written (not yet released/uploaded)
-        for (const name of this.writeBuffers.keys()) {
-            nameSet.add(name);
-        }
-
-        return cb(0, [...nameSet]);
+        return cb(0, names);
     }
 
     /**
@@ -164,8 +158,9 @@ export class TelegramFS {
             // Check write buffers first
             const wb = this.writeBuffers.get(filename);
             if (wb) {
-                const bytesRead = fs.readSync(wb.fd, buffer, 0, length, position);
-                return cb(bytesRead);
+                const slice = wb.data.subarray(position, position + length);
+                slice.copy(buffer);
+                return cb(slice.length);
             }
 
             // Check cache first
@@ -190,55 +185,34 @@ export class TelegramFS {
     }
 
     /**
-     * Helper to get or create a disk-buffered write structure
+     * Write to a file (buffers until release)
      */
-    getOrCreateWriteBuffer(filename) {
-        if (this.writeBuffers.has(filename)) {
-            return this.writeBuffers.get(filename);
-        }
+    write(filepath, fd, buffer, length, position, cb) {
+        const filename = path.basename(filepath);
 
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (!fs.existsSync(fuseTmpDir)) {
-            fs.mkdirSync(fuseTmpDir, { recursive: true });
+        // Get or create write buffer
+        if (!this.writeBuffers.has(filename)) {
+            this.writeBuffers.set(filename, {
+                data: Buffer.alloc(0),
+                modified: true
+            });
         }
 
-        const tmpPath = path.join(fuseTmpDir, crypto.randomBytes(16).toString('hex'));
-        const fdDisk = fs.openSync(tmpPath, 'w+');
+        const wb = this.writeBuffers.get(filename);
 
-        // Check if there is an existing file cached
-        const cachedPath = this.getCached(filename);
-        let size = 0;
-        if (cachedPath && fs.existsSync(cachedPath)) {
-            const content = fs.readFileSync(cachedPath);
-            fs.writeSync(fdDisk, content, 0, content.length, 0);
-            size = content.length;
+        // Expand buffer if needed
+        const newSize = Math.max(wb.data.length, position + length);
+        if (newSize > wb.data.length) {
+            const newBuf = Buffer.alloc(newSize);
+            wb.data.copy(newBuf);
+            wb.data = newBuf;
         }
 
-        const wb = {
-            tmpPath,
-            fd: fdDisk,
-            size,
-            modified: true
-        };
-        this.writeBuffers.set(filename, wb);
-        return wb;
-    }
+        // Copy incoming data
+        buffer.copy(wb.data, position, 0, length);
+        wb.modified = true;
 
-    /**
-     * Write to a file (buffers until release)
-     */
-    write(filepath, fd, buffer, length, position, cb) {
-        const filename = path.basename(filepath);
-        try {
-            const wb = this.getOrCreateWriteBuffer(filename);
-            fs.writeSync(wb.fd, buffer, 0, length, position);
-            wb.size = Math.max(wb.size, position + length);
-            wb.modified = true;
-            return cb(length);
-        } catch (err) {
-            console.error('[FUSE] Write error:', err.message);
-            return cb(Fuse.EIO);
-        }
+        return cb(length);
     }
 
     /**
@@ -249,19 +223,9 @@ export class TelegramFS {
 
         console.log(`[FUSE] Creating file: ${filename}`);
 
-        // Initialize empty disk-buffered write
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (!fs.existsSync(fuseTmpDir)) {
-            fs.mkdirSync(fuseTmpDir, { recursive: true });
-        }
-
-        const tmpPath = path.join(fuseTmpDir, crypto.randomBytes(16).toString('hex'));
-        const fdDisk = fs.openSync(tmpPath, 'w+');
-
+        // Initialize empty write buffer
         this.writeBuffers.set(filename, {
-            tmpPath,
-            fd: fdDisk,
-            size: 0,
+            data: Buffer.alloc(0),
             modified: true,
             isNew: true
         });
@@ -283,26 +247,15 @@ export class TelegramFS {
         const filename = path.basename(filepath);
 
         const wb = this.writeBuffers.get(filename);
-        if (!wb) {
-            return cb(0);
-        }
-
-        if (!wb.modified) {
-            try { fs.closeSync(wb.fd); } catch (e) {}
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
-            this.writeBuffers.delete(filename);
+        if (!wb || !wb.modified) {
             return cb(0);
         }
 
         try {
-            // Close fd so we can read and upload cleanly
-            try { fs.closeSync(wb.fd); } catch (e) {}
+            // Upload to Telegram
+            await this.uploadFile(filename, wb.data);
 
-            // Upload to Telegram from the temp path
-            await this.uploadFile(filename, wb.tmpPath);
-
-            // Clean up temp file
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
+            // Clear write buffer
             this.writeBuffers.delete(filename);
 
             // Invalidate cache
@@ -310,9 +263,7 @@ export class TelegramFS {
 
             return cb(0);
         } catch (err) {
-            console.error('[FUSE] Release error:', err.message);
-            try { fs.unlinkSync(wb.tmpPath); } catch (e) {}
-            this.writeBuffers.delete(filename);
+            console.error('Release error:', err.message);
             return cb(Fuse.EIO);
         }
     }
@@ -329,7 +280,7 @@ export class TelegramFS {
         }
 
         try {
-            // Delete from Telegram
+            // Delete from Telegram (optional - could just remove from index)
             const chunks = this.db.getChunks(file.id);
             for (const chunk of chunks) {
                 await this.client.deleteMessage(chunk.message_id);
@@ -343,7 +294,7 @@ export class TelegramFS {
 
             return cb(0);
         } catch (err) {
-            console.error('[FUSE] Unlink error:', err.message);
+            console.error('Unlink error:', err.message);
             return cb(Fuse.EIO);
         }
     }
@@ -365,10 +316,10 @@ export class TelegramFS {
             .run(newName, file.id);
 
         // Update cache key
-        const cached = this.fileCache.get(oldName);
+        const cached = fileCache.get(oldName);
         if (cached) {
-            this.fileCache.delete(oldName);
-            this.fileCache.set(newName, cached);
+            fileCache.delete(oldName);
+            fileCache.set(newName, cached);
         }
 
         return cb(0);
@@ -379,16 +330,35 @@ export class TelegramFS {
      */
     truncate(filepath, size, cb) {
         const filename = path.basename(filepath);
-        try {
-            const wb = this.getOrCreateWriteBuffer(filename);
-            fs.ftruncateSync(wb.fd, size);
-            wb.size = size;
-            wb.modified = true;
-            return cb(0);
-        } catch (err) {
-            console.error('[FUSE] Truncate error:', err.message);
-            return cb(Fuse.EIO);
+
+        // Get or load into write buffer
+        if (!this.writeBuffers.has(filename)) {
+            const cachedPath = this.getCached(filename);
+            if (cachedPath) {
+                this.writeBuffers.set(filename, {
+                    data: fs.readFileSync(cachedPath), // Note: RAM buffer here could be big, but it's okay for truncate/writes right now
+                    modified: true
+                });
+            } else {
+                this.writeBuffers.set(filename, {
+                    data: Buffer.alloc(0),
+                    modified: true
+                });
+            }
         }
+
+        const wb = this.writeBuffers.get(filename);
+
+        if (size < wb.data.length) {
+            wb.data = wb.data.subarray(0, size);
+        } else if (size > wb.data.length) {
+            const newBuf = Buffer.alloc(size);
+            wb.data.copy(newBuf);
+            wb.data = newBuf;
+        }
+
+        wb.modified = true;
+        return cb(0);
     }
 
     // ============== Helper Methods ==============
@@ -413,56 +383,18 @@ export class TelegramFS {
         }
 
         const chunks = this.db.getChunks(file.id);
-        if (chunks.length === 0) throw new Error('No chunks found');
-
-        // Pre-sort chunks
-        chunks.sort((a, b) => a.chunk_index - b.chunk_index);
-
-        const firstChunkData = await this.client.downloadFile(chunks[0].file_telegram_id);
-        const header = parseHeader(firstChunkData);
-        let wasCompressed = header.compressed;
-
-        const decryptStream = this.encryptor.getDecryptStream();
-        const decompressStream = this.compressor.getDecompressStream(wasCompressed);
-
-        const { Readable } = await import('stream');
-        const { pipeline } = await import('stream/promises');
-
-        const self = this;
-        let currentChunkIndex = 0;
-        let preloadedFirstChunk = firstChunkData;
-
-        const downloadStream = new Readable({
-            async read() {
-                try {
-                    if (currentChunkIndex >= chunks.length) {
-                        this.push(null);
-                        return;
-                    }
-
-                    const chunk = chunks[currentChunkIndex];
-                    let data;
-                    if (currentChunkIndex === 0 && preloadedFirstChunk) {
-                        data = preloadedFirstChunk;
-                        preloadedFirstChunk = null;
-                    } else {
-                        data = await self.client.downloadFile(chunk.file_telegram_id);
-                    }
-
-                    const payload = data.subarray(HEADER_SIZE);
-                    this.push(payload);
-                    currentChunkIndex++;
-                } catch (err) {
-                    this.destroy(err);
-                }
-            }
+
+        const { readable } = await createDownloadPipeline({
+            client: this.client,
+            chunks,
+            encryptor: this.encryptor,
+            compressor: this.compressor
         });
 
         const tmpOutputPath = outputPath + '.tmp';
         const writeStream = fs.createWriteStream(tmpOutputPath);
 
-        // Pipeline: Telegram -> Decrypt -> Decompress -> Disk Cache
-        await pipeline(downloadStream, decryptStream, decompressStream, writeStream);
+        await pipeline(readable, writeStream);
 
         // Rename to final atomic path
         fs.renameSync(tmpOutputPath, outputPath);
@@ -470,7 +402,10 @@ export class TelegramFS {
         return outputPath;
     }
 
-    async uploadFile(filename, tempPath) {
+    async uploadFile(filename, data) {
+        const { hashData } = await import('../crypto/encryption.js');
+        const hash = hashData(data);
+
         // Check if already exists by name
         const existingByName = this.db.findByName(filename);
         if (existingByName) {
@@ -482,17 +417,57 @@ export class TelegramFS {
             this.db.delete(existingByName.id);
         }
 
-        // Run the standard chunked upload pipeline (this handles chunking, encryption, compression, and DB entry)
-        await processFile(tempPath, {
-            password: this.password,
-            dataDir: this.dataDir,
-            customName: filename,
-            config: this.config
+        // Check if already exists by hash (same content, different name)
+        const existingByHash = this.db.findByHash(hash);
+        if (existingByHash) {
+            // Same content already exists, just skip
+            console.log(`[FUSE] File with same content already exists as ${existingByHash.filename}`);
+            return;
+        }
+
+        // Compress
+        const { data: compressedData, compressed } = await this.compressor.compress(data, filename);
+
+        // Encrypt
+        const encryptedData = this.encryptor.encrypt(compressedData);
+
+        // Create temp file with header
+        const tempDir = process.env.TAS_TMP_DIR || path.join(this.dataDir, 'tmp');
+        if (!fs.existsSync(tempDir)) {
+            fs.mkdirSync(tempDir, { recursive: true });
+        }
+
+        const flags = compressed ? 1 : 0;
+        const header = createHeader(filename, data.length, 0, 1, flags);
+        const fileData = Buffer.concat([header, encryptedData]);
+
+        const tempPath = path.join(tempDir, `${hash.substring(0, 12)}.tas`);
+        fs.writeFileSync(tempPath, fileData);
+
+        // Upload to Telegram
+        const result = await this.client.sendFile(tempPath, `📦 ${filename}`);
+
+        // Add to index
+        const fileId = this.db.addFile({
+            filename,
+            hash,
+            originalSize: data.length,
+            storedSize: encryptedData.length,
+            chunks: 1,
+            compressed
         });
+
+        this.db.addChunk(fileId, 0, result.messageId.toString(), fileData.length);
+        this.db.db.prepare('UPDATE chunks SET file_telegram_id = ? WHERE file_id = ? AND chunk_index = ?')
+            .run(result.fileId, fileId, 0);
+
+        // Cleanup
+        fs.unlinkSync(tempPath);
+        try { fs.rmdirSync(tempDir); } catch (e) { }
     }
 
     getCached(filename) {
-        const entry = this.fileCache.get(filename);
+        const entry = fileCache.get(filename);
         if (!entry) return null;
 
         if (Date.now() - entry.timestamp > CACHE_TTL) {
@@ -500,7 +475,7 @@ export class TelegramFS {
             try {
                 if (fs.existsSync(entry.path)) fs.unlinkSync(entry.path);
             } catch (e) { }
-            this.fileCache.delete(filename);
+            fileCache.delete(filename);
             return null;
         }
 
@@ -511,35 +486,35 @@ export class TelegramFS {
 
     setCache(filename, cachePath) {
         // Evict oldest entry if cache is full
-        if (this.fileCache.size >= CACHE_MAX_ENTRIES) {
+        if (fileCache.size >= CACHE_MAX_ENTRIES) {
             let oldestKey = null;
             let oldestTime = Infinity;
-            for (const [key, entry] of this.fileCache) {
+            for (const [key, entry] of fileCache) {
                 if (entry.timestamp < oldestTime) {
                     oldestTime = entry.timestamp;
                     oldestKey = key;
                 }
             }
             if (oldestKey) {
-                const evicted = this.fileCache.get(oldestKey);
+                const evicted = fileCache.get(oldestKey);
                 try { if (fs.existsSync(evicted.path)) fs.unlinkSync(evicted.path); } catch (e) { }
-                this.fileCache.delete(oldestKey);
+                fileCache.delete(oldestKey);
             }
         }
 
-        this.fileCache.set(filename, {
+        fileCache.set(filename, {
             path: cachePath,
             timestamp: Date.now()
         });
     }
 
     invalidateCache(filename) {
-        const entry = this.fileCache.get(filename);
+        const entry = fileCache.get(filename);
         if (entry) {
             try {
                 if (fs.existsSync(entry.path)) fs.unlinkSync(entry.path);
             } catch (e) { }
-            this.fileCache.delete(filename);
+            fileCache.delete(filename);
         }
     }
 
@@ -552,17 +527,6 @@ export class TelegramFS {
             fs.mkdirSync(this.mountPoint, { recursive: true });
         }
 
-        // Clean up any stray temp files from previous sessions
-        const fuseTmpDir = path.join(this.dataDir, 'fuse-tmp');
-        if (fs.existsSync(fuseTmpDir)) {
-            try {
-                const files = fs.readdirSync(fuseTmpDir);
-                for (const file of files) {
-                    fs.unlinkSync(path.join(fuseTmpDir, file));
-                }
-            } catch (e) {}
-        }
-
         const ops = {
             getattr: this.getattr.bind(this),
             readdir: this.readdir.bind(this),