localvibe 2.0.0

package/README.md

@@ -0,0 +1,52 @@
+# wavecast
+
+Stream audio from your browser tab to every device on your Wi-Fi — one command, no config.
+
+## Install
+
+```bash
+npm install -g wavecast
+```
+
+You also need [FFmpeg](https://ffmpeg.org):
+
+| OS | Command |
+|---|---|
+| macOS | `brew install ffmpeg` |
+| Windows | `winget install ffmpeg` |
+| Linux | `sudo apt install ffmpeg` |
+
+## Quick start
+
+```bash
+wavecast
+```
+
+First launch asks for your station name, DJ name and tagline.
+A session key is printed in the terminal — paste it into the extension and click **Start Broadcast**.
+Share the listener URL with anyone on the same Wi-Fi.
+
+```bash
+wavecast setup   # update station name, DJ, tagline
+```
+
+## Extension
+
+Load the `extension/` folder as an unpacked Chrome extension:
+
+1. Open `chrome://extensions`
+2. Enable **Developer mode**
+3. Click **Load unpacked** → select the `extension` folder
+
+## Features
+
+- Plays on any device — Android, iPhone, desktop, smart TV
+- No virtual audio driver — captures any browser tab directly
+- Station name, DJ name and tagline on every listener's screen
+- Live "Now Playing" auto-pulled from the tab title (YouTube, Spotify, etc.)
+- Listener count shown on the player
+- Session key rotates on every restart — no credentials stored on disk
+
+## License
+
+MIT

package/bin/cli.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+const readline = require('readline');
+const crypto   = require('crypto');
+const https    = require('https');
+const http     = require('http');
+const { execSync } = require('child_process');
+const os = require('os');
+const config = require('../lib/config.js');
+const { createServer } = require('../lib/server.js');
+
+const PKG_VERSION = require('../package.json').version;
+const cmd = process.argv[2] || 'start';
+
+// ── Remote update check ───────────────────────────────────────────────────────
+// The developer publishes version.json to this URL and signs it with UPDATE_KEY.
+// CLI verifies the signature before trusting the payload — no one else can push
+// a fake forceUpdate even if they intercept the URL.
+const UPDATE_URL  = process.env.LOCALVIBE_UPDATE_URL || 'https://gist.githubusercontent.com/JahidDev24/03697454cf67054981b8213598bc0b85/raw/1af98afafa8f02b68ba83d518ebae2d814a20bff/version.json';
+const UPDATE_KEY  = process.env.LOCALVIBE_UPDATE_KEY || 'localvibe-update-v1';
+
+function verifyPayload(body) {
+  try {
+    const obj = JSON.parse(body);
+    const { sig, ...payload } = obj;
+    if (!sig) return null; // unsigned → ignore
+    const expected = crypto.createHmac('sha256', UPDATE_KEY)
+      .update(JSON.stringify(payload))
+      .digest('hex');
+    if (!crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expected, 'hex'))) return null;
+    return payload;
+  } catch (_) { return null; }
+}
+
+function fetchUpdate() {
+  return new Promise((resolve) => {
+    const get = UPDATE_URL.startsWith('https') ? https.get : http.get;
+    const req = get(UPDATE_URL, { timeout: 4000 }, (res) => {
+      let body = '';
+      res.on('data', d => { body += d; if (body.length > 4096) req.destroy(); });
+      res.on('end', () => resolve(verifyPayload(body)));
+    });
+    req.on('error', () => resolve(null));
+    req.on('timeout', () => { req.destroy(); resolve(null); });
+  });
+}
+
+function semverGt(a, b) {
+  // returns true if a > b (simple major.minor.patch compare)
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return true;
+    if ((pa[i] || 0) < (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
+async function checkUpdate() {
+  const update = await fetchUpdate();
+  if (!update) return; // network unavailable or bad signature → skip silently
+
+  if (update.forceUpdate && semverGt(update.version, PKG_VERSION)) {
+    console.error(`\n╔═══════════════════════════════════════════════════════╗`);
+    console.error(`║  🚨  WAVECAST UPDATE REQUIRED                         ║`);
+    console.error(`║  Your version : ${PKG_VERSION.padEnd(38)}║`);
+    console.error(`║  Required     : ${update.version.padEnd(38)}║`);
+    if (update.warning)
+      console.error(`║  ${update.warning.slice(0,52).padEnd(53)}║`);
+    console.error(`║  Run: npm install -g localvibe                         ║`);
+    console.error(`╚═══════════════════════════════════════════════════════╝\n`);
+    process.exit(1);
+  }
+
+  if (update.warning) {
+    console.warn(`\n⚠️  ${update.warning}\n`);
+  }
+
+  if (semverGt(update.version, PKG_VERSION)) {
+    console.log(`💡  New version ${update.version} available — npm install -g localvibe\n`);
+  }
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function ensureFfmpeg() {
+  try { execSync('ffmpeg -version', { stdio: 'ignore' }); return true; }
+  catch (_) {
+    const install = process.platform === 'darwin' ? 'brew install ffmpeg'
+      : process.platform === 'win32' ? 'winget install ffmpeg'
+      : 'sudo apt install ffmpeg';
+    console.error(`\n⚠️  FFmpeg not found. Install it:\n\n      ${install}\n`);
+    return false;
+  }
+}
+
+function ask(rl, question, fallback) {
+  return new Promise((resolve) => {
+    rl.question(`  ${question} (${fallback}): `, (a) => resolve(a.trim() || fallback));
+  });
+}
+
+async function runSetup(existing = {}) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  console.log('\n🎙  Welcome to Wavecast! Quick setup — press Enter to keep defaults.\n');
+
+  const cfg = {
+    stationName: await ask(rl, 'Station name',   existing.stationName || 'Wavecast FM'),
+    djName:      await ask(rl, 'Your name (DJ)', existing.djName || os.userInfo().username),
+    tagline:     await ask(rl, 'Tagline',        existing.tagline || 'Live from my desk'),
+    port:        Number(await ask(rl, 'Port',    String(existing.port || 8012))),
+    accent:      existing.accent || '#6c63ff',
+  };
+
+  rl.close();
+  config.save(cfg);
+  console.log('\n✅  Saved!\n');
+  return cfg;
+}
+
+// ── Commands ──────────────────────────────────────────────────────────────────
+async function start() {
+  if (!ensureFfmpeg()) process.exit(1);
+
+  // Run update check in background — don't block startup unless forceUpdate
+  checkUpdate().catch(() => {});
+
+  let cfg = config.isFirstRun()
+    ? await runSetup()
+    : config.load();
+
+  // Fresh key every session — never stored on disk
+  const sessionKey = crypto.randomBytes(20).toString('base64url');
+
+  createServer(cfg, sessionKey).start(sessionKey);
+}
+
+function setup() {
+  runSetup(config.isFirstRun() ? {} : config.load()).catch(console.error);
+}
+
+switch (cmd) {
+  case 'start':  start().catch(console.error); break;
+  case 'setup':
+  case 'init':   setup(); break;
+  default:
+    console.log(`
+🎙  localvibe — Wi-Fi audio streaming
+
+  localvibe          start your station
+  localvibe setup    change station name, DJ, tagline
+`);
+}

package/lib/config.js

@@ -0,0 +1,34 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CONFIG_DIR = path.join(os.homedir(), '.localvibe');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+
+const DEFAULTS = {
+  stationName: 'LocalVibe FM',
+  djName: '',
+  tagline: 'Live from my desk',
+  accent: '#6c63ff',
+  port: 8012,
+};
+
+function isFirstRun() {
+  return !fs.existsSync(CONFIG_FILE);
+}
+
+function load() {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  let cfg = {};
+  if (fs.existsSync(CONFIG_FILE)) {
+    try { cfg = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8')); } catch (_) {}
+  }
+  return { ...DEFAULTS, ...cfg };
+}
+
+function save(cfg) {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), { mode: 0o600 });
+}
+
+module.exports = { load, save, isFirstRun, CONFIG_FILE, CONFIG_DIR };

package/lib/server.js

@@ -0,0 +1,303 @@
+// server.js — LAN Radio core.
+//
+// Security model:
+//  • Mutating endpoints (/live, /live-chunk, /live-end, /api/nowplaying)
+//    require X-Broadcast-Key, verified as SHA-256 timing-safe compare.
+//  • Broadcast endpoints accept loopback connections only unless
+//    config.allowRemoteBroadcast is set.
+//  • Optional TLS (self-signed, SAN includes LAN IPs) for encrypted packets.
+//  • Failed-auth rate limiting, body-size caps, hardened response headers.
+//  • Public surface is read-only: player page, HLS files, status JSON.
+
+const express = require('express');
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const http = require('http');
+const crypto = require('crypto');
+const { spawn } = require('child_process');
+
+const PUBLIC_DIR = path.join(__dirname, '..', 'public');
+const MAX_CHUNK_BYTES = 2 * 1024 * 1024; // one MediaRecorder chunk is ~32 KB
+const MAX_BODY_BYTES = 16 * 1024;        // for small JSON endpoints
+
+function createServer(config, sessionKey) {
+  const tls = null; // HTTPS removed — key auth is the security boundary
+  const app = express();
+  app.disable('x-powered-by');
+
+  const HLS_DIR = path.join(os.tmpdir(), `localvibe-hls-${process.pid}`);
+  fs.mkdirSync(HLS_DIR, { recursive: true });
+
+  const keyHash = crypto.createHash('sha256').update(sessionKey).digest();
+
+  // ── State ────────────────────────────────────────────
+  let broadcasterConnected = false;
+  let broadcastStartTime = null;
+  let totalBytesIn = 0;
+  let chunkTimeout = null;
+  let ffmpegProc = null;
+  let nowPlaying = '';
+  const listenerSeen = new Map();
+  const authFailures = new Map(); // ip -> [timestamps]
+
+  // ── Hardened headers on everything ───────────────────
+  app.use((req, res, next) => {
+    res.header('Access-Control-Allow-Origin', '*');
+    res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.header('Access-Control-Allow-Headers', 'Content-Type, X-Broadcast-Key');
+    res.header('X-Content-Type-Options', 'nosniff');
+    res.header('X-Frame-Options', 'DENY');
+    res.header('Referrer-Policy', 'no-referrer');
+    if (req.method === 'OPTIONS') return res.sendStatus(204);
+    next();
+  });
+
+  // ── Auth: SHA-256 timing-safe broadcast key ──────────
+  function rateLimited(ip) {
+    const now = Date.now();
+    const fails = (authFailures.get(ip) || []).filter((t) => now - t < 60000);
+    authFailures.set(ip, fails);
+    return fails.length >= 5;
+  }
+
+  function requireKey(req, res, next) {
+    const ip = req.socket.remoteAddress || '';
+
+    if (rateLimited(ip)) return res.status(429).json({ error: 'too many attempts' });
+
+    const provided = req.headers['x-broadcast-key'] || '';
+    const providedHash = crypto.createHash('sha256').update(String(provided)).digest();
+    if (!crypto.timingSafeEqual(providedHash, keyHash)) {
+      (authFailures.get(ip) || authFailures.set(ip, []).get(ip)).push(Date.now());
+      return res.status(401).json({ error: 'invalid broadcast key' });
+    }
+    next();
+  }
+
+  // Collect a request body with a hard size cap
+  function readBody(req, res, cap, cb) {
+    const parts = [];
+    let size = 0;
+    req.on('data', (d) => {
+      size += d.length;
+      if (size > cap) { res.status(413).json({ error: 'payload too large' }); req.destroy(); return; }
+      parts.push(d);
+    });
+    req.on('end', () => { if (!res.headersSent) cb(Buffer.concat(parts)); });
+  }
+
+  // ── ffmpeg transcoder: audio in → HLS (fMP4/AAC) ─────
+  function startTranscoder() {
+    ffmpegProc = spawn('ffmpeg', [
+      '-loglevel', 'error',
+      '-analyzeduration', '0',
+      '-i', 'pipe:0',
+      '-c:a', 'aac', '-b:a', '128k', '-ar', '44100', '-ac', '2',
+      '-af', 'asetpts=N/SR/TB',
+      '-f', 'hls',
+      '-hls_time', '2',
+      '-hls_list_size', '6',
+      '-hls_flags', 'delete_segments+append_list+discont_start',
+      '-hls_segment_type', 'fmp4',
+      '-hls_fmp4_init_filename', 'init.mp4',
+      '-hls_segment_filename', path.join(HLS_DIR, 'seg%06d.m4s'),
+      path.join(HLS_DIR, 'live.m3u8'),
+    ]);
+    ffmpegProc.stderr.on('data', (d) => console.error('   ffmpeg:', d.toString().trim()));
+    ffmpegProc.stdin.on('error', () => {});
+    ffmpegProc.on('close', () => { ffmpegProc = null; });
+  }
+
+  function stopTranscoder() {
+    if (ffmpegProc) {
+      const proc = ffmpegProc;
+      ffmpegProc = null;
+      try { proc.stdin.end(); } catch (_) {}
+      setTimeout(() => { try { proc.kill('SIGKILL'); } catch (_) {} }, 500);
+    }
+  }
+
+  function wipeHlsDir() {
+    for (const f of fs.readdirSync(HLS_DIR)) {
+      try { fs.unlinkSync(path.join(HLS_DIR, f)); } catch (_) {}
+    }
+  }
+
+  function resetBroadcast() {
+    broadcasterConnected = false;
+    broadcastStartTime = null;
+    stopTranscoder();
+  }
+
+  function isWebmHeader(chunk) {
+    return chunk.length >= 4 &&
+      chunk[0] === 0x1a && chunk[1] === 0x45 &&
+      chunk[2] === 0xdf && chunk[3] === 0xa3;
+  }
+
+  // ── Broadcast endpoints (key-protected) ──────────────
+  app.post('/live', requireKey, (req, res) => {
+    if (ffmpegProc) stopTranscoder();
+    wipeHlsDir();
+    broadcasterConnected = true;
+    broadcastStartTime = Date.now();
+    totalBytesIn = 0;
+    startTranscoder();
+    console.log('\n🎙  Broadcaster connected (direct stream)');
+
+    req.on('data', (chunk) => {
+      totalBytesIn += chunk.length;
+      try { ffmpegProc?.stdin.write(chunk); } catch (_) {}
+    });
+    req.on('end', () => { resetBroadcast(); console.log('\n🔇  Broadcaster disconnected'); res.status(200).end(); });
+    req.on('error', resetBroadcast);
+  });
+
+  app.post('/live-chunk', requireKey, (req, res) => {
+    readBody(req, res, MAX_CHUNK_BYTES, (chunk) => {
+      if (isWebmHeader(chunk)) {
+        if (ffmpegProc) stopTranscoder();
+        if (!broadcasterConnected) {
+          wipeHlsDir();
+          broadcasterConnected = true;
+          broadcastStartTime = Date.now();
+          totalBytesIn = 0;
+          console.log('\n🎙  Broadcaster connected (extension)');
+        }
+        startTranscoder();
+      } else if (!ffmpegProc) {
+        return res.status(200).json({ needInit: true });
+      }
+
+      clearTimeout(chunkTimeout);
+      chunkTimeout = setTimeout(() => {
+        resetBroadcast();
+        console.log('\n🔇  Broadcaster timed out');
+      }, 3000);
+
+      totalBytesIn += chunk.length;
+      try { ffmpegProc?.stdin.write(chunk); } catch (_) {}
+      res.status(200).json({ ok: true });
+    });
+  });
+
+  app.post('/live-end', requireKey, (_req, res) => {
+    clearTimeout(chunkTimeout);
+    resetBroadcast();
+    nowPlaying = '';
+    console.log('\n🔇  Broadcaster disconnected');
+    res.status(200).end();
+  });
+
+  app.post('/api/nowplaying', requireKey, (req, res) => {
+    readBody(req, res, MAX_BODY_BYTES, (body) => {
+      try {
+        const { text } = JSON.parse(body.toString('utf8'));
+        nowPlaying = String(text || '').slice(0, 120);
+        res.json({ ok: true, nowPlaying });
+      } catch (_) {
+        res.status(400).json({ error: 'bad json' });
+      }
+    });
+  });
+
+  // ── Public read-only endpoints ───────────────────────
+  app.use('/hls', (req, res, next) => {
+    if (req.path.endsWith('.m3u8')) {
+      listenerSeen.set(req.ip, Date.now());
+      res.setHeader('Cache-Control', 'no-cache, no-store');
+    } else {
+      res.setHeader('Cache-Control', 'max-age=60');
+    }
+    next();
+  }, express.static(HLS_DIR));
+
+  app.get('/status', (_req, res) => {
+    const now = Date.now();
+    let n = 0;
+    for (const [ip, t] of listenerSeen) {
+      if (now - t < 15000) n++;
+      else listenerSeen.delete(ip);
+    }
+    res.json({
+      broadcasting: broadcasterConnected,
+      listeners: n,
+      uptimeSeconds: broadcastStartTime ? Math.floor((now - broadcastStartTime) / 1000) : 0,
+      nowPlaying,
+    });
+  });
+
+  app.get('/api/info', (_req, res) => {
+    const ip = getLocalIP();
+    res.json({
+      stationName: config.stationName,
+      djName: config.djName,
+      tagline: config.tagline,
+      accent: config.accent,
+      urls: {
+        listen: `http://${ip}:${config.port}`,
+        listenSecure: config.https ? `https://${ip}:${config.httpsPort}` : null,
+        // mDNS name — resolves on Apple devices, Windows 10+, Android 12+
+        local: `http://${os.hostname()}:${config.port}`,
+      },
+    });
+  });
+
+  app.get('/', (_req, res) => {
+    res.set('Cache-Control', 'no-store');
+    res.sendFile(path.join(PUBLIC_DIR, 'index.html'));
+  });
+  app.get('/hls.light.min.js', (_req, res) => {
+    res.set('Cache-Control', 'no-store');
+    res.sendFile(path.join(PUBLIC_DIR, 'hls.light.min.js'));
+  });
+  app.get('/bg.jpg', (_req, res) => {
+    res.set('Cache-Control', 'max-age=86400');
+    res.sendFile(path.join(PUBLIC_DIR, 'bg.jpg'));
+  });
+
+  // ── Boot ─────────────────────────────────────────────
+  function start(sessionKey) {
+    const ip = getLocalIP();
+    const host = os.hostname();
+
+    http.createServer(app).listen(config.port, '0.0.0.0').on('error', (e) => {
+      if (e.code === 'EADDRINUSE') {
+        console.error(`\n❌  Port ${config.port} is already in use.`);
+        console.error(`   Kill it: lsof -ti :${config.port} | xargs kill -9\n`);
+      } else { console.error(e.message); }
+      process.exit(1);
+    });
+
+    const W = 54;
+    const pad = (s) => ('║  ' + s).padEnd(W - 1) + '║';
+    const line = '═'.repeat(W - 2);
+    console.log(`\n╔${line}╗`);
+    console.log(pad(`📻  ${config.stationName}`));
+    if (config.djName) console.log(pad(`🎧  DJ ${config.djName}`));
+    if (config.tagline) console.log(pad(`✨  ${config.tagline}`));
+    console.log(`╠${line}╣`);
+    console.log(pad(`Listen:  http://${ip}:${config.port}`));
+    console.log(pad(`         http://${host}:${config.port}`));
+    console.log(`╠${line}╣`);
+    console.log(pad(`🔑  Session key (paste into extension):`));
+    console.log(pad(`    ${sessionKey}`));
+    console.log(`╚${line}╝`);
+    console.log('\n  ↑  Copy the key → open extension → paste → Start Broadcast\n');
+    console.log('Waiting for broadcaster…\n');
+  }
+
+  return { app, start };
+}
+
+function getLocalIP() {
+  for (const ifaces of Object.values(os.networkInterfaces())) {
+    for (const iface of ifaces) {
+      if (iface.family === 'IPv4' && !iface.internal) return iface.address;
+    }
+  }
+  return 'localhost';
+}
+
+module.exports = { createServer };

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "localvibe",
+  "version": "2.0.0",
+  "description": "Stream audio from your browser tab to every device on your Wi-Fi — one command, no config.",
+  "keywords": ["radio", "streaming", "hls", "lan", "audio", "broadcast", "wifi", "ffmpeg"],
+  "license": "MIT",
+  "author": "",
+  "main": "lib/server.js",
+  "bin": {
+    "localvibe": "bin/cli.js"
+  },
+  "files": ["bin", "lib", "public", "scripts", "README.md"],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "start": "node bin/cli.js",
+    "postinstall": "node scripts/postinstall.js"
+  },
+  "dependencies": {
+    "express": "^4.19.0"
+  }
+}