@nightowne/tas-cli 3.0.1 → 3.0.3

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to TAS (Telegram as Storage) will be documented in this file.
 
+## [3.0.3] - 2026-09-25
+
+### Fixed — desktop and SMB mount interoperability (#3)
+- **Complete directory surface** — FUSE now implements `statfs`, `access`, `opendir`, `releasedir`, flush/sync callbacks, stable inode metadata, and session extended attributes used by Linux file managers and Samba.
+- **Secure shared mounts** — `tas mount <path> --allow-other` opts into access by other local users and services. On Linux TAS requires `user_allow_other` in `/etc/fuse.conf`; private single-user mounts remain the default.
+- **Usable capacity reporting** — desktop clients receive real local staging-disk statistics rather than an empty or unsupported filesystem response. This is not presented as a Telegram quota.
+- **Version consistency** — the CLI banner now matches the package version.
+
+## [3.0.2] - 2026-09-25
+
+### Fixed — Apple Silicon install recovery
+- **Optional native source recovery** — if the legacy optional addon fails before TAS can patch it on arm64, postinstall restores only its source without lifecycle scripts, then rebuilds it against the user's installed macFUSE library. Failed rebuilds still leave every non-mount TAS command usable.
+
 ## [3.0.1] - 2026-09-25
 
 ### Fixed — current macFUSE mount support (#4)

package/FAQ.md

@@ -31,3 +31,7 @@ No. Each chunk has one owning bot. TAS records that bot so reads and deletes rou
 ## Does mount work on macOS?
 
 Yes with current macFUSE, Xcode Command Line Tools, and a locally rebuilt native addon. TAS never installs or replaces macFUSE; its install hook selects the system `libfuse` and compiles the optional addon for the active CPU. Run `tas doctor` before use. If the real mount/readdir/unmount smoke test does not pass, do not mount data.
+
+## Why can I list a mount locally but not open its Samba share?
+
+FUSE mounts are private to the mounting user by default. Add `user_allow_other` to `/etc/fuse.conf`, then mount with `tas mount /mnt/tg-drive --allow-other`. TAS keeps this opt-in because it grants other local users and services access subject to Unix permissions. Version 3.0.3 also implements the filesystem statistics, directory handles, sync operations, and extended attributes expected by desktop and SMB clients.

package/QUICKSTART.md

@@ -45,3 +45,5 @@ Multi-bot mode distributes chunks. It is not redundancy, quota assurance, ban pr
 ## Mount support
 
 `tas mount` needs a native FUSE runtime. On Linux install `fuse` and `libfuse-dev`. On macOS install current macFUSE and Xcode Command Line Tools before installing TAS; TAS rebuilds its optional native addon against the installed macFUSE library. Run `tas doctor` first and mount only when its real mount/readdir/unmount smoke test passes.
+
+For Samba or another service account, add `user_allow_other` to `/etc/fuse.conf` and mount with `tas mount /mnt/tg-drive --allow-other`. Shared access is opt-in because it exposes the mount to other local users subject to Unix permissions.

package/README.md

@@ -18,7 +18,7 @@
   <a href="https://github.com/ixchio/tas/network/members"><img src="https://img.shields.io/github/forks/ixchio/tas?style=social" alt="GitHub Forks"></a>
   <img src="https://img.shields.io/badge/node-%3E%3D18-brightgreen?logo=node.js" alt="Node.js >= 18">
   <img src="https://img.shields.io/badge/encryption-AES--256--GCM-blueviolet?logo=shield" alt="AES-256-GCM">
-  <img src="https://img.shields.io/badge/tests-101%20passing-success" alt="101 Tests Passing">
+  <img src="https://img.shields.io/badge/tests-104%20passing-success" alt="104 Tests Passing">
 </p>
 
 <p align="center">
@@ -115,6 +115,15 @@ tas unmount ~/cloud          # Clean unmount when done
 
 > **Native FUSE is verified, not assumed:** Linux needs `fuse`/`libfuse-dev`. macOS uses current macFUSE and rebuilds the optional native addon against the installed system library on first install. Install Xcode Command Line Tools before TAS, then run `tas doctor`; mount is available only when its real mount → readdir → unmount smoke test passes.
 
+Desktop file managers work with the normal private mount. Samba and other services run under a different local identity, so shared access must be enabled explicitly:
+
+```bash
+# Add this exact line to /etc/fuse.conf first: user_allow_other
+tas mount /mnt/tg-drive --allow-other
+```
+
+`--allow-other` exposes the mount to other local users subject to Unix permissions. Do not enable it on an untrusted multi-user host.
+
 ---
 
 ### 🔄 Auto-Sync Folders (Dropbox-style)
@@ -353,6 +362,7 @@ tas bot add|list|enable|disable|remove  # 🤖 Manage experimental bot pool
 ```bash
 # FUSE Mount (Linux/libfuse or macOS/current macFUSE)
 tas mount <path>                  # Mount Telegram storage as a local folder
+tas mount <path> --allow-other    # Opt in to Samba/service access
 tas unmount <path>                # Clean unmount
 
 # Dropbox-style Folder Sync

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nightowne/tas-cli",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Experimental local-first encrypted file transport over Telegram bots with resumable chunks, index recovery, and FUSE mount",
   "type": "module",
   "main": "src/index.js",

package/src/cli.js

@@ -816,6 +816,7 @@ program
     .command('mount <mountpoint>')
     .description('🔥 Mount Telegram storage as a local folder (Linux FUSE or current macFUSE)')
     .option('-p, --password <password>', 'Encryption password (uses TAS_PASSWORD env var if not provided)')
+    .option('--allow-other', 'Allow other local users and services such as Samba to access the mount')
     .action(async (mountpoint, options) => {
         console.log(chalk.cyan('\n🗂️  Mounting Telegram as filesystem...\n'));
 
@@ -836,7 +837,8 @@ program
                 dataDir: DATA_DIR,
                 password,
                 config,
-                mountPoint: absMount
+                mountPoint: absMount,
+                allowOther: options.allowOther
             });
 
             await tfs.initialize();
@@ -851,6 +853,9 @@ program
             console.log(chalk.dim(`   cat ${absMount}/file.txt  # Read`));
             console.log(chalk.dim(`   rm ${absMount}/file.pdf   # Delete`));
             console.log();
+            if (options.allowOther) {
+                console.log(chalk.yellow('Shared access is enabled; Unix file permissions still apply'));
+            }
             console.log(chalk.yellow('Press Ctrl+C to unmount'));
 
             // Handle graceful shutdown
@@ -873,6 +878,7 @@ program
             console.log(chalk.dim('  Ubuntu/Debian: sudo apt install fuse libfuse-dev'));
             console.log(chalk.dim('  Fedora: sudo dnf install fuse fuse-devel'));
             console.log(chalk.dim('  macOS: install current macFUSE and Xcode Command Line Tools, then reinstall TAS\n'));
+            console.log(chalk.dim('  Samba: enable user_allow_other in /etc/fuse.conf and mount with --allow-other\n'));
             process.exit(1);
         }
     });

package/src/fuse/macfuse.cjs

@@ -84,6 +84,23 @@ function getDarwinLibraryDirectory (packageRoot) {
   }
 }
 
+function installOptionalFuseNative (packageRoot) {
+  const npmCli = process.env.npm_execpath
+  if (!npmCli) return { ok: false, reason: 'npm did not provide its install executable' }
+
+  const install = childProcess.spawnSync(
+    process.execPath,
+    [npmCli, 'install', 'fuse-native@2.2.6', '--no-save', '--ignore-scripts', '--no-package-lock'],
+    {
+      cwd: packageRoot,
+      stdio: 'inherit',
+      env: { ...process.env, npm_config_ignore_scripts: 'true' }
+    }
+  )
+  if (install.status !== 0) return { ok: false, reason: 'could not restore optional fuse-native source' }
+  return { ok: true }
+}
+
 function validateMacFuseNativeBinding ({
   packageRoot = path.resolve(__dirname, '..', '..'),
   exists = fs.existsSync,
@@ -184,8 +201,20 @@ function installMacFuseAdapter ({
     return { skipped: true, ...installation }
   }
 
-  const fuseNativeDir = getFuseNativeDirectory(packageRoot)
-  const darwinLibraryDir = getDarwinLibraryDirectory(packageRoot)
+  let fuseNativeDir = getFuseNativeDirectory(packageRoot)
+  let darwinLibraryDir = getDarwinLibraryDirectory(packageRoot)
+  if (!fuseNativeDir || !darwinLibraryDir) {
+    // The legacy optional addon can fail to build on arm64 before our root
+    // postinstall runs. Restore its source without lifecycle scripts, then
+    // patch and rebuild it against the system macFUSE library below.
+    const restored = installOptionalFuseNative(packageRoot)
+    if (!restored.ok) {
+      log.warn(`[tas] macOS FUSE was not built: ${restored.reason}`)
+      return { ready: false, reason: restored.reason }
+    }
+    fuseNativeDir = getFuseNativeDirectory(packageRoot)
+    darwinLibraryDir = getDarwinLibraryDirectory(packageRoot)
+  }
   if (!fuseNativeDir || !darwinLibraryDir) {
     const reason = 'optional fuse-native dependencies are not installed'
     log.warn(`[tas] macOS FUSE was not built: ${reason}`)
@@ -228,6 +257,7 @@ module.exports = {
   MACFUSE_BUNDLE,
   findMacFuseInstallation,
   getFuseNativeDirectory,
+  installOptionalFuseNative,
   validateMacFuseNativeBinding,
   installMacFuseAdapter
 }

package/src/fuse/mount.js

@@ -45,6 +45,22 @@ function withTimeout(promise, ms, label) {
     return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
 
+function pathInode(logicalPath) {
+    if (!logicalPath) return 1;
+    let hash = 2166136261;
+    for (let index = 0; index < logicalPath.length; index++) {
+        hash ^= logicalPath.charCodeAt(index);
+        hash = Math.imul(hash, 16777619);
+    }
+    return (hash >>> 0) || 1;
+}
+
+function fuseStatNumber(value, fallback = 0) {
+    const number = Number(value);
+    if (!Number.isFinite(number) || number < 0) return fallback;
+    return Math.min(Math.floor(number), 0xffffffff);
+}
+
 /** Verify the native FUSE stack, not merely that the JS module imports. */
 export async function checkFuseRuntime() {
     if (process.platform === 'darwin') {
@@ -113,7 +129,9 @@ export class TelegramFS {
         this.password = options.password;
         this.config = options.config;
         this.mountPoint = options.mountPoint;
+        this.allowOther = options.allowOther === true;
         this.backupManifest = options.backupManifest || backupRemoteManifest;
+        this.mountStartedAt = new Date();
 
         this.db = new FileIndex(path.join(this.dataDir, 'index.db'));
         this.db.init();
@@ -131,6 +149,7 @@ export class TelegramFS {
         this.fileByLogicalPath = new Map();
         this.implicitDirs = new Set(['']);
         this.childrenByDir = new Map();
+        this.xattrs = new Map();
         this._refreshPathIndex();
     }
 
@@ -185,6 +204,10 @@ export class TelegramFS {
         return this.fileByLogicalPath.get(logicalPath);
     }
 
+    _exists(logicalPath) {
+        return this._isDirectory(logicalPath) || this.writeBuffers.has(logicalPath) || Boolean(this._file(logicalPath));
+    }
+
     _newWritePath(logicalPath) {
         const dir = path.join(this.dataDir, 'fuse-writes');
         fs.mkdirSync(dir, { recursive: true });
@@ -220,13 +243,17 @@ export class TelegramFS {
 
         if (this._isDirectory(logical)) {
             return cb(0, {
-                mtime: new Date(),
-                atime: new Date(),
-                ctime: new Date(),
+                mtime: this.mountStartedAt,
+                atime: this.mountStartedAt,
+                ctime: this.mountStartedAt,
                 size: 4096,
                 mode: 0o40755, // directory
                 uid: process.getuid?.() || 0,
-                gid: process.getgid?.() || 0
+                gid: process.getgid?.() || 0,
+                nlink: 2,
+                ino: pathInode(logical),
+                blksize: 4096,
+                blocks: 1
             });
         }
 
@@ -241,7 +268,10 @@ export class TelegramFS {
                 size: stats.size,
                 mode: 0o100644, // regular file
                 uid: process.getuid?.() || 0,
-                gid: process.getgid?.() || 0
+                gid: process.getgid?.() || 0,
+                ino: pathInode(logical),
+                blksize: 4096,
+                blocks: Math.ceil(stats.size / 512)
             });
         }
 
@@ -259,7 +289,10 @@ export class TelegramFS {
             size: file.original_size,
             mode: 0o100644, // regular file
             uid: process.getuid?.() || 0,
-            gid: process.getgid?.() || 0
+            gid: process.getgid?.() || 0,
+            ino: pathInode(logical),
+            blksize: 4096,
+            blocks: Math.ceil(file.original_size / 512)
         });
     }
 
@@ -278,6 +311,109 @@ export class TelegramFS {
         return cb(0, [...names].sort((a, b) => a.localeCompare(b)));
     }
 
+    /** Report the local staging disk because Telegram exposes no storage quota. */
+    statfs(filepath, cb) {
+        try {
+            const stats = typeof fs.statfsSync === 'function' ? fs.statfsSync(this.dataDir) : null;
+            const fileCount = this.filePaths.size + this.virtualDirs.size + this.writeBuffers.size + 1;
+            return cb(0, {
+                bsize: fuseStatNumber(stats?.bsize, 4096),
+                frsize: fuseStatNumber(stats?.bsize, 4096),
+                blocks: fuseStatNumber(stats?.blocks, 1),
+                bfree: fuseStatNumber(stats?.bfree, 1),
+                bavail: fuseStatNumber(stats?.bavail, 1),
+                files: fuseStatNumber(stats?.files, fileCount),
+                ffree: fuseStatNumber(stats?.ffree, 0),
+                favail: fuseStatNumber(stats?.ffree, 0),
+                fsid: 0,
+                flag: 0,
+                namemax: 255
+            });
+        } catch (error) {
+            return cb(Fuse.EIO);
+        }
+    }
+
+    access(filepath, mode, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        return cb(this._exists(logical) ? 0 : Fuse.ENOENT);
+    }
+
+    opendir(filepath, flags, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        return this._isDirectory(logical) ? cb(0, pathInode(logical)) : cb(Fuse.ENOTDIR);
+    }
+
+    releasedir(filepath, fd, cb) {
+        return cb(0);
+    }
+
+    flush(filepath, fd, cb) {
+        return cb(0);
+    }
+
+    fsync(filepath, datasync, fd, cb) {
+        return cb(0);
+    }
+
+    fsyncdir(filepath, datasync, fd, cb) {
+        return cb(0);
+    }
+
+    utimens(filepath, atime, mtime, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        return cb(this._exists(logical) ? 0 : Fuse.ENOENT);
+    }
+
+    chmod(filepath, mode, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        return cb(this._exists(logical) ? 0 : Fuse.ENOENT);
+    }
+
+    chown(filepath, uid, gid, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        return cb(this._exists(logical) ? 0 : Fuse.ENOENT);
+    }
+
+    getxattr(filepath, name, position, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        if (!this._exists(logical)) return cb(Fuse.ENOENT);
+        const value = this.xattrs.get(logical)?.get(name);
+        return value ? cb(0, Buffer.from(value)) : cb(Fuse.ENODATA);
+    }
+
+    setxattr(filepath, name, value, position, flags, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        if (!this._exists(logical)) return cb(Fuse.ENOENT);
+        if (!this.xattrs.has(logical)) this.xattrs.set(logical, new Map());
+        this.xattrs.get(logical).set(name, Buffer.from(value));
+        return cb(0);
+    }
+
+    listxattr(filepath, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        if (!this._exists(logical)) return cb(Fuse.ENOENT);
+        return cb(0, [...(this.xattrs.get(logical)?.keys() || [])]);
+    }
+
+    removexattr(filepath, name, cb) {
+        let logical;
+        try { logical = this._logical(filepath, true); } catch { return cb(Fuse.ENOENT); }
+        if (!this._exists(logical)) return cb(Fuse.ENOENT);
+        const attributes = this.xattrs.get(logical);
+        if (!attributes?.delete(name)) return cb(Fuse.ENODATA);
+        if (attributes.size === 0) this.xattrs.delete(logical);
+        return cb(0);
+    }
+
     /**
      * Open a file (just validates it exists)
      */
@@ -398,6 +534,7 @@ export class TelegramFS {
 
             // Invalidate cache
             this.invalidateCache(logical);
+            this.xattrs.delete(logical);
 
             return cb(0);
         } catch (err) {
@@ -517,6 +654,11 @@ export class TelegramFS {
             fileCache.delete(oldName);
             fileCache.set(newName, cached);
         }
+        const attributes = this.xattrs.get(oldName);
+        if (attributes) {
+            this.xattrs.delete(oldName);
+            this.xattrs.set(newName, attributes);
+        }
 
         return cb(0);
     }
@@ -539,6 +681,7 @@ export class TelegramFS {
             return cb(Fuse.ENOTEMPTY || Fuse.EINVAL);
         }
         this.virtualDirs.delete(logical);
+        this.xattrs.delete(logical);
         return cb(0);
     }
 
@@ -679,10 +822,32 @@ export class TelegramFS {
         }
     }
 
+    _mountOptions() {
+        return {
+            debug: false,
+            force: true,
+            mkdir: true,
+            allowOther: this.allowOther,
+            defaultPermissions: true,
+            fsname: 'tas',
+            subtype: 'tas'
+        };
+    }
+
     /**
      * Mount the filesystem
      */
     mount() {
+        if (this.allowOther && process.platform === 'linux' && (process.getuid?.() || 0) !== 0) {
+            let fuseConfig = '';
+            try { fuseConfig = fs.readFileSync('/etc/fuse.conf', 'utf8'); } catch { }
+            if (!/^\s*user_allow_other\s*$/m.test(fuseConfig)) {
+                throw new Error(
+                    '--allow-other requires user_allow_other on its own line in /etc/fuse.conf'
+                );
+            }
+        }
+
         // Ensure mount point exists
         if (!fs.existsSync(this.mountPoint)) {
             fs.mkdirSync(this.mountPoint, { recursive: true });
@@ -691,11 +856,25 @@ export class TelegramFS {
         const ops = {
             getattr: this.getattr.bind(this),
             readdir: this.readdir.bind(this),
+            statfs: this.statfs.bind(this),
+            access: this.access.bind(this),
+            opendir: this.opendir.bind(this),
+            releasedir: this.releasedir.bind(this),
             open: this.open.bind(this),
             read: this.read.bind(this),
             write: this.write.bind(this),
             create: this.create.bind(this),
             release: this.release.bind(this),
+            flush: this.flush.bind(this),
+            fsync: this.fsync.bind(this),
+            fsyncdir: this.fsyncdir.bind(this),
+            utimens: this.utimens.bind(this),
+            chmod: this.chmod.bind(this),
+            chown: this.chown.bind(this),
+            getxattr: this.getxattr.bind(this),
+            setxattr: this.setxattr.bind(this),
+            listxattr: this.listxattr.bind(this),
+            removexattr: this.removexattr.bind(this),
             unlink: this.unlink.bind(this),
             rename: this.rename.bind(this),
             mkdir: this.mkdir.bind(this),
@@ -704,11 +883,7 @@ export class TelegramFS {
             ftruncate: this.ftruncate.bind(this)
         };
 
-        this.fuse = new Fuse(this.mountPoint, ops, {
-            debug: false,
-            force: true,
-            mkdir: true
-        });
+        this.fuse = new Fuse(this.mountPoint, ops, this._mountOptions());
 
         return new Promise((resolve, reject) => {
             this.fuse.mount((err) => {

package/src/utils/branding.js

@@ -14,7 +14,7 @@ export const LOGO = `
 `;
 
 export const TAGLINE = 'Telegram as Storage';
-export const VERSION = '3.0.0';
+export const VERSION = '3.0.3';
 
 /**
  * Print the TAS banner