instbyte 1.9.2 → 1.9.4

package/README.md

@@ -308,6 +308,11 @@ The difference between *a tool you use* and *a tool you own.*
 **Read receipts** — see how many devices have viewed each shared item. Updates live as teammates open the page.
 
 **Item management** — add optional titles to label any item for future reference. Edit text items inline without deleting and re-pasting. Pinned items are protected from both manual deletion and auto-cleanup.
+
+**Mobile ready** — install as a PWA directly from your browser. Add to Home Screen on iOS or Android for a native app feel without the App Store.
+
+**Security hardened** — rate limiting on all write endpoints, magic number file validation, filename sanitisation, and forced download for executable file types.
+
 ---
 
 ## Keyboard Shortcuts
@@ -335,10 +340,46 @@ node server/server.js
 
 ## Use Cases
 
-- Moving content between your phone and laptop over WiFi
+- Moving content between your phone and laptop, or just any device over WiFi
 - Sharing API payloads, logs, or screenshots during a sprint
 - A lightweight team clipboard during standups or pair sessions
 - Home lab file sharing without setting up NAS or cloud sync
+- Piping build logs or stack traces from CI or terminal directly into a shared channel
+- Sharing sensitive credentials or config files over LAN without leaving a cloud trail
+
+---
+
+## Terminal Usage
+
+Since Instbyte exposes a simple HTTP API, you can push content directly from your terminal using `curl` — no browser needed.
+
+**Send a log file:**
+```bash
+curl -X POST http://192.168.x.x:3000/text \
+  -H "Content-Type: application/json" \
+  -d "{\"content\": \"$(cat error.log)\", \"channel\": \"general\", \"uploader\": \"terminal\"}"
+```
+
+**Pipe command output directly:**
+```bash
+npm run build 2>&1 | curl -X POST http://192.168.x.x:3000/text \
+  -H "Content-Type: application/json" \
+  --data-binary @-  \
+  -H "X-Channel: general" \
+  -H "X-Uploader: CI"
+```
+
+**Upload a file from the terminal:**
+```bash
+curl -X POST http://192.168.x.x:3000/upload \
+  -F "file=@./build.log" \
+  -F "channel=general" \
+  -F "uploader=terminal"
+```
+
+Replace `192.168.x.x:3000` with the URL shown when Instbyte starts. If auth is enabled, add `-b "instbyte_auth=your-token"` to each request.
+
+Useful for piping stack traces, build logs, or environment dumps straight into a channel your whole team can see instantly.
 
 ---
 
@@ -352,6 +393,8 @@ Instbyte follows [Semantic Versioning](https://semver.org). See [Releases](https
 
 Instbyte is intentionally lightweight and LAN-first. If you want to extend it — CLI tools, themes, integrations — open an issue or submit a pull request.
 
+The codebase has a full test suite (184 tests across unit and integration). Run `npm test` before submitting anything. Issues tagged **good first issue** are a good starting point.
+
 ---
 
 ## License

package/client/css/app.css

@@ -651,6 +651,38 @@ input[type=text]:focus {
     padding-left: 20px;
 }
 
+.item-text-collapsed {
+    position: relative;
+    max-height: 9em;
+    overflow: hidden;
+}
+
+.item-text-collapsed::after {
+    content: "";
+    position: absolute;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    height: 3em;
+    background: linear-gradient(to bottom, transparent, #ffffff);
+    pointer-events: none;
+}
+
+.item-text-expand-btn {
+    display: block;
+    margin-top: 4px;
+    font-size: 12px;
+    color: var(--color-secondary);
+    background: none;
+    border: none;
+    padding: 2px 0;
+    cursor: pointer;
+    text-align: left;
+}
+
+.item-text-expand-btn:hover {
+    color: var(--color-primary);
+}
 
 /* ============================================================
    PREVIEW PANEL
@@ -1174,6 +1206,122 @@ input[type=text]:focus {
         padding: 6px 12px;
         font-size: 12px;
     }
+
+    /* Backdrop */
+    .bottom-sheet-backdrop {
+        position: fixed;
+        inset: 0;
+        background: rgba(0, 0, 0, 0.4);
+        z-index: 9998;
+        display: none;
+        animation: fadeInBackdrop 0.2s ease;
+    }
+
+    .bottom-sheet-backdrop.open {
+        display: block;
+    }
+
+    @keyframes fadeInBackdrop {
+        from {
+            opacity: 0;
+        }
+
+        to {
+            opacity: 1;
+        }
+    }
+
+    /* Context menu becomes a bottom sheet */
+    .context-menu {
+        position: fixed;
+        top: auto !important;
+        left: 0 !important;
+        right: 0;
+        bottom: 0;
+        width: 100%;
+        max-width: 100%;
+        border-radius: 16px 16px 0 0;
+        padding: 8px 0 calc(8px + env(safe-area-inset-bottom));
+        z-index: 9999;
+        animation: slideUpSheet 0.25s ease;
+        box-sizing: border-box;
+    }
+
+    /* Drag handle */
+    .context-menu::before {
+        content: "";
+        display: block;
+        width: 36px;
+        height: 4px;
+        background: #d1d5db;
+        border-radius: 2px;
+        margin: 0 auto 10px;
+    }
+
+    .context-menu button {
+        padding: 14px 20px;
+        font-size: 15px;
+        border-radius: 0;
+    }
+
+    /* Move dropdown becomes a bottom sheet */
+    .move-dropdown {
+        position: fixed !important;
+        top: auto !important;
+        bottom: 0 !important;
+        left: 0 !important;
+        right: 0 !important;
+        width: 100% !important;
+        min-width: 100% !important;
+        border-radius: 16px 16px 0 0;
+        padding: 8px 0 calc(8px + env(safe-area-inset-bottom));
+        z-index: 9999;
+        animation: slideUpSheet 0.25s ease;
+        box-sizing: border-box;
+    }
+
+    .move-dropdown::before {
+        content: "";
+        display: block;
+        width: 36px;
+        height: 4px;
+        background: #d1d5db;
+        border-radius: 2px;
+        margin: 0 auto 10px;
+    }
+
+    .move-dropdown button {
+        padding: 14px 20px;
+        font-size: 15px;
+        border-radius: 0;
+    }
+
+    .move-dropdown .dropdown-label {
+        padding: 8px 20px 6px;
+        font-size: 12px;
+    }
+
+    .preview-panel pre {
+        overflow-x: scroll;
+        -webkit-overflow-scrolling: touch;
+        max-height: 300px;
+        font-size: 11px;
+    }
+
+    .markdown-body pre {
+        overflow-x: scroll;
+        -webkit-overflow-scrolling: touch;
+    }
+
+    @keyframes slideUpSheet {
+        from {
+            transform: translateY(100%);
+        }
+
+        to {
+            transform: translateY(0);
+        }
+    }
 }
 
 
@@ -1572,6 +1720,10 @@ input[type=text]:focus {
             background: #052e16;
         }
 
+        .item-text-collapsed::after {
+            background: linear-gradient(to bottom, transparent, #1e2433);
+        }
+
         #uploadStatus {
             background: #1a1d27 !important;
             color: #e5e7eb !important;
@@ -1966,6 +2118,10 @@ input[type=text]:focus {
         background: #052e16;
     }
 
+    .item-text-collapsed::after {
+        background: linear-gradient(to bottom, transparent, #1e2433);
+    }
+
     #uploadStatus {
         background: #1a1d27 !important;
         color: #e5e7eb !important;

package/client/index.html

@@ -5,6 +5,8 @@
   <title>Instbyte</title>
   <link rel="icon" type="image/png" sizes="32x32" href="/favicon-dynamic.png">
   <link rel="icon" type="image/png" sizes="16x16" href="/favicon-dynamic.png">
+  <link rel="manifest" href="/manifest.json">
+  <meta name="theme-color" id="themeColorMeta" content="#111827">
   <meta name="viewport" content="width=device-width,initial-scale=1">
 
   <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github.min.css">
@@ -89,7 +91,11 @@
   <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
   <script src="/js/app.js?v=1.9.1.2"></script>
 
-
+  <script>
+    if ('serviceWorker' in navigator) {
+      navigator.serviceWorker.register('/sw.js').catch(() => { });
+    }
+  </script>
 </body>
 
 </html>

package/client/js/app.js

@@ -116,6 +116,9 @@ async function applyBranding() {
         root.style.setProperty("--color-secondary-light", p.secondaryLight);
         root.style.setProperty("--color-on-secondary", p.onSecondary);
 
+        const themeMeta = document.getElementById('themeColorMeta');
+        if (themeMeta) themeMeta.setAttribute('content', p.primary);
+
     } catch (e) {
         // Branding failed — default styles remain, no crash
     }
@@ -210,18 +213,30 @@ function renderText(text) {
     if (!text) return "";
     if (looksLikeMarkdown(text)) {
         const html = marked.parse(text);
-        // highlight code blocks after parse
         const wrap = document.createElement("div");
         wrap.innerHTML = html;
         wrap.querySelectorAll("pre code").forEach(el => hljs.highlightElement(el));
         return `<div class="markdown-body">${wrap.innerHTML}</div>`;
     }
-    // plain text — just escape and preserve newlines
-    return text
+    // plain text — escape and preserve newlines
+    const escaped = text
         .replace(/&/g, "&amp;")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
         .replace(/\n/g, "<br>");
+
+    // collapse long plain text (more than 8 newlines)
+    const lineCount = (text.match(/\n/g) || []).length;
+    if (lineCount > 8) {
+        const id = 'expand-' + Math.random().toString(36).slice(2, 8);
+        return `<div class="item-text-collapsed" id="${id}">${escaped}</div>
+<button class="item-text-expand-btn" onclick="
+    document.getElementById('${id}').classList.remove('item-text-collapsed');
+    this.remove();
+">Show more</button>`;
+    }
+
+    return escaped;
 }
 
 const TEXT_EXTENSIONS = [
@@ -452,6 +467,7 @@ function toggleMoveDropdown(e, id, currentChannel) {
 
     dropdown.classList.add("open");
     openDropdown = dropdown;
+    if (window.innerWidth <= 640) openBottomSheet(dropdown);
 }
 
 function toggleMoreMenu(e, id, currentChannel) {
@@ -1315,6 +1331,7 @@ async function uploadFiles(files) {
                     setTimeout(resolve, 1200);
                     return;
                 }
+                if (navigator.vibrate) navigator.vibrate([50]);
                 resolve();
             };
 
@@ -1476,21 +1493,27 @@ function showChannelMenu(e, ch) {
     </button>
   `;
 
-    menu.style.top = e.clientY + "px";
-    menu.style.left = e.clientX + "px";
-    menu.classList.add("open");
-
-    requestAnimationFrame(() => {
-        const rect = menu.getBoundingClientRect();
-        if (rect.right > window.innerWidth - 8)
-            menu.style.left = (e.clientX - rect.width) + "px";
-        if (rect.bottom > window.innerHeight - 8)
-            menu.style.top = (e.clientY - rect.height) + "px";
-    });
+    if (window.innerWidth <= 640) {
+        // mobile — bottom sheet, no positioning needed
+        menu.classList.add("open");
+        openBottomSheet(menu);
+    } else {
+        // desktop — position by click coordinates
+        menu.style.top = e.clientY + "px";
+        menu.style.left = e.clientX + "px";
+        menu.classList.add("open");
+        requestAnimationFrame(() => {
+            const rect = menu.getBoundingClientRect();
+            if (rect.right > window.innerWidth - 8)
+                menu.style.left = (e.clientX - rect.width) + "px";
+            if (rect.bottom > window.innerHeight - 8)
+                menu.style.top = (e.clientY - rect.height) + "px";
+        });
+    }
 }
 
 document.addEventListener("click", () => {
-    document.getElementById("channelMenu").classList.remove("open");
+    closeAllBottomSheets();
 });
 
 document.addEventListener("contextmenu", (e) => {
@@ -1635,6 +1658,27 @@ document.addEventListener("keydown", e => {
 
 });
 
+// Create shared backdrop for bottom sheets
+const bottomSheetBackdrop = document.createElement('div');
+bottomSheetBackdrop.className = 'bottom-sheet-backdrop';
+document.body.appendChild(bottomSheetBackdrop);
+
+function openBottomSheet(el) {
+    bottomSheetBackdrop.classList.add('open');
+    bottomSheetBackdrop.onclick = () => closeAllBottomSheets();
+}
+
+function closeAllBottomSheets() {
+    bottomSheetBackdrop.classList.remove('open');
+    // close context menu
+    document.getElementById('channelMenu').classList.remove('open');
+    // close any open move dropdown
+    if (openDropdown) {
+        openDropdown.classList.remove('open');
+        openDropdown = null;
+    }
+}
+
 (async function init() {
     await applyBranding();
     await initName();

package/client/sw.js

@@ -0,0 +1,10 @@
+// sw.js — Instbyte service worker
+// Minimal install-only service worker.
+// We do not cache anything — Instbyte is a real-time LAN tool and must
+// always fetch live data. This file exists solely to satisfy the PWA
+// installability requirement.
+
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', e => e.waitUntil(self.clients.claim()));
+
+// No fetch handler — all requests go straight to the network as normal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instbyte",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "A self-hosted LAN sharing utility for fast, frictionless file, link, and snippet exchange across devices — no cloud required.",
   "main": "bin/instbyte.js",
   "bin": {
@@ -13,7 +13,9 @@
   ],
   "scripts": {
     "start": "node bin/instbyte.js",
-    "dev": "nodemon bin/instbyte.js"
+    "dev": "nodemon bin/instbyte.js",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "keywords": [
     "lan",
@@ -46,6 +48,8 @@
     "sqlite3": "^5.1.6"
   },
   "devDependencies": {
-    "nodemon": "^3.1.0"
+    "nodemon": "^3.1.0",
+    "supertest": "^7.2.2",
+    "vitest": "^2.1.8"
   }
-}
+}

package/server/server.js

@@ -67,7 +67,14 @@ app.use((req, res, next) => {
 });
 app.use(cookieParser());
 app.use(requireAuth);
-app.use("/uploads", express.static(UPLOADS_DIR));
+app.use("/uploads", (req, res, next) => {
+  const ext = req.path.split('.').pop().toLowerCase();
+  if (FORCE_DOWNLOAD_EXTENSIONS.has(ext)) {
+    const filename = path.basename(req.path);
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+  }
+  next();
+}, express.static(UPLOADS_DIR));
 app.use(express.static(CLIENT_DIR));
 
 const storage = multer.diskStorage({
@@ -75,7 +82,8 @@ const storage = multer.diskStorage({
     cb(null, UPLOADS_DIR);
   },
   filename: (req, file, cb) => {
-    const unique = Date.now() + "-" + file.originalname;
+    const safe = sanitiseFilename(file.originalname);
+    const unique = Date.now() + "-" + safe;
     cb(null, unique);
   },
 });
@@ -85,6 +93,64 @@ const upload = multer({
   limits: { fileSize: config.storage.maxFileSize },
 });
 
+// FILE SECURITY
+
+// Extensions that must never be rendered inline by a browser.
+// These are served with Content-Disposition: attachment always.
+const FORCE_DOWNLOAD_EXTENSIONS = new Set([
+  'svg', 'html', 'htm', 'xml', 'xhtml', 'js', 'mjs', 'php',
+  'sh', 'bash', 'py', 'rb', 'pl', 'ps1', 'bat', 'cmd', 'exe',
+  'dll', 'jar', 'vbs', 'ws', 'hta'
+]);
+
+// Magic number signatures — first bytes that identify real file types.
+// Key = expected extension group, value = array of valid byte signatures.
+const MAGIC_NUMBERS = {
+  jpg: [Buffer.from([0xFF, 0xD8, 0xFF])],
+  png: [Buffer.from([0x89, 0x50, 0x4E, 0x47])],
+  gif: [Buffer.from([0x47, 0x49, 0x46, 0x38])],
+  webp: [Buffer.from([0x52, 0x49, 0x46, 0x46])],
+  pdf: [Buffer.from([0x25, 0x50, 0x44, 0x46])],
+  zip: [Buffer.from([0x50, 0x4B, 0x03, 0x04]), Buffer.from([0x50, 0x4B, 0x05, 0x06])],
+  mp4: [Buffer.from([0x00, 0x00, 0x00, 0x18]), Buffer.from([0x00, 0x00, 0x00, 0x20])],
+};
+
+// Extension → magic group mapping
+const EXT_TO_MAGIC = {
+  jpg: 'jpg', jpeg: 'jpg',
+  png: 'png',
+  gif: 'gif',
+  webp: 'webp',
+  pdf: 'pdf',
+  zip: 'zip',
+  mp4: 'mp4',
+};
+
+function sanitiseFilename(name) {
+  return name
+    .replace(/[/\\?%*:|"<>\x00]/g, '_')  // strip path separators and dangerous chars
+    .replace(/\.{2,}/g, '.')              // collapse .. sequences
+    .trim()
+    .slice(0, 255);                        // max filename length
+}
+
+function checkMagicNumber(filePath, ext) {
+  const group = EXT_TO_MAGIC[ext.toLowerCase()];
+  if (!group) return true; // no check defined for this type — allow through
+
+  const signatures = MAGIC_NUMBERS[group];
+  if (!signatures) return true;
+
+  try {
+    const fd = fs.openSync(filePath, 'r');
+    const buf = Buffer.alloc(8);
+    fs.readSync(fd, buf, 0, 8, 0);
+    fs.closeSync(fd);
+    return signatures.some(sig => buf.slice(0, sig.length).equals(sig));
+  } catch (e) {
+    return false; // can't read → reject
+  }
+}
 
 function hexToHsl(hex) {
   let r = parseInt(hex.slice(1, 3), 16) / 255;
@@ -284,6 +350,20 @@ const loginLimiter = rateLimit({
   message: { error: "Too many attempts, try again later" }
 });
 
+const dropLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 60,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many requests,  try again later" }
+});
+
+const channelLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 20,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many requests,  try again later" }
+});
+
 /* LOGIN POST */
 app.post("/login", loginLimiter, (req, res) => {
   if (!config.auth.passphrase) return res.redirect("/");
@@ -313,11 +393,19 @@ app.post("/logout", (req, res) => {
 
 
 /* FILE UPLOAD */
-app.post("/upload", upload.single("file"), (req, res) => {
+app.post("/upload", dropLimiter, upload.single("file"), (req, res) => {
   if (!req.file) {
     return res.status(400).json({ error: "No file received" });
   }
 
+  // Magic number check — verify file content matches its extension
+  const ext = req.file.originalname.split('.').pop().toLowerCase();
+  const filePath = path.join(UPLOADS_DIR, req.file.filename);
+  if (!checkMagicNumber(filePath, ext)) {
+    fs.unlinkSync(filePath); // delete the suspicious file immediately
+    return res.status(400).json({ error: "File content does not match its extension" });
+  }
+
   const { channel, uploader } = req.body;
 
   const item = {
@@ -359,7 +447,7 @@ app.use((err, req, res, next) => {
 });
 
 /* TEXT/LINK */
-app.post("/text", (req, res) => {
+app.post("/text", dropLimiter, (req, res) => {
   const { content, channel, uploader } = req.body;
 
   const item = {
@@ -496,7 +584,7 @@ app.get("/channels", (req, res) => {
 });
 
 /* ADD CHANNEL */
-app.post("/channels", (req, res) => {
+app.post("/channels", channelLimiter, (req, res) => {
 
   const { name } = req.body;
   if (!name) return res.status(400).json({ error: "Name required" });
@@ -684,6 +772,37 @@ app.get("/branding", (req, res) => {
   });
 });
 
+/* PWA MANIFEST */
+app.get("/manifest.json", (req, res) => {
+  const b = config.branding;
+  const name = b.appName || "Instbyte";
+  const color = b.primaryColor || "#111827";
+
+  res.json({
+    name,
+    short_name: name.length > 12 ? name.slice(0, 12) : name,
+    description: "Real-time LAN sharing — no cloud, no accounts",
+    start_url: "/",
+    display: "standalone",
+    background_color: "#f3f4f6",
+    theme_color: color,
+    icons: [
+      {
+        src: "/logo-dynamic.png",
+        sizes: "192x192",
+        type: "image/png",
+        purpose: "any maskable"
+      },
+      {
+        src: "/logo-dynamic.png",
+        sizes: "512x512",
+        type: "image/png",
+        purpose: "any maskable"
+      }
+    ]
+  });
+});
+
 /* HEALTH MONITOR */
 app.get("/health", (req, res) => {
   res.json({
@@ -822,7 +941,6 @@ const PREFERRED = parseInt(process.env.PORT) || config.server.port;
 const localIP = getLocalIP();
 
 let PORT;
-
 findFreePort(PREFERRED).then(p => {
   PORT = p;
   server.listen(PORT, () => {
@@ -833,10 +951,12 @@ findFreePort(PREFERRED).then(p => {
       console.log(`(port ${PREFERRED} was busy, switched to ${PORT})`);
     }
     console.log("");
-    scanOrphans(); // clean up any pre-v1.9.1 ghost files
+    scanOrphans();
   });
 });
 
+module.exports = { app, server, sessions };
+
 
 // ========================
 // GRACEFUL SHUTDOWN