most-box 0.1.1 → 0.1.3

package/README.md

@@ -14,7 +14,7 @@
 | 🚀 P2P直连，不限速  | ✅      | ❌      | 限流 |
 | 💾 去中心化存储     | ✅      | ❌      | ❌   |
 | 🌐 开源免费，自托管 | ✅      | ❌      |      |
-| 📦 无限文件大小     | ✅      | ❌      | 限流 |
+| 📦 大文件分享       | ✅      | ❌      | 限流 |
 
 ## 演示
 
@@ -48,7 +48,8 @@ npx most-box@latest
 git clone <your-repo-url>
 cd most
 npm i
-npm start
+npm run dev
+node server/index.js
 ```
 
 ## 测试
@@ -60,19 +61,24 @@ npm run test:unit # 只运行单元测试
 
 ## 访问场景
 
-| 场景 | 命令                                       | 访问地址                  |
-| ---- | ------------------------------------------ | ------------------------- |
-| 本地 | `npx most-box`                             | `http://localhost:1976`   |
-| 内网 | `set MOSTBOX_HOST=0.0.0.0 && npx most-box` | `http://<IP>:1976`        |
-| 外网 | Caddy 反向代理                             | `https://your-domain.com` |
+| 场景     | 方式                                  | 访问地址                |
+| -------- | ------------------------------------- | ----------------------- |
+| 本地     | `npx most-box`                        | `http://localhost:1976` |
+| 远程管理 | SSH 隧道 + `/admin/`                  | `http://localhost:1976` |
+| 外网     | Caddy 反向代理                        | `https://your-domain`   |
 
-### 内网访问
+### 远程管理节点
+
+MostBox 默认只监听 `127.0.0.1`，无需开放端口即可安全运行。
+
+要管理部署在远程服务器上的节点，使用 SSH 隧道将服务器的 1976 端口转发到本地：
 
 ```bash
-set MOSTBOX_HOST=0.0.0.0
-npx most-box
+ssh -L 1976:127.0.0.1:1976 user@your-server
 ```
 
+然后在本地浏览器打开 `http://localhost:1976/admin/` 即可管理远程节点。
+
 ### 外网访问（Caddy）
 
 ```caddy
@@ -81,6 +87,8 @@ mostbox.example.com {
 }
 ```
 
+开放到局域网或公网时，在 `/admin/` 中配置邀请码，远程请求必须携带有效邀请码。
+
 ## 核心功能
 
 1. **确定性 P2P 文件发布**
@@ -109,7 +117,7 @@ mostbox.example.com {
 
 ### 文件存储在哪里？
 
-文件以 **P2P 方式** 存储在分享者和接收者的设备上。当文件被分享时，内容会被分片存储在 P2P 网络中。**没有中心化服务器**，真正实现去中心化。
+文件以 **P2P 方式** 保存在分享者和接收者的设备上。每个做种节点都持有完整文件副本；MostBox 不会把文件集中上传到云端服务器。
 
 ### 如何分享文件给其他人？
 
@@ -124,7 +132,7 @@ mostbox.example.com {
 
 ### 支持大文件吗？
 
-支持。目前已测试通过 **GB 级别**的大文件传输，采用流式处理，内存占用低。
+支持。目前默认单文件上限为 **10GB**，可在本地节点策略中调整；传输采用流式处理，内存占用低。
 
 ### 频道聊天是什么？
 
@@ -133,7 +141,7 @@ mostbox.example.com {
 - 创建一个频道（如 `alice` 或 `team-project`）
 - 将频道名称分享给朋友
 - 朋友加入后即可实时聊天
-- 消息通过 P2P 网络加密传输，服务器只负责建立连接
+- 消息通过 P2P 通道复制，服务器或节点只负责连接与同步
 
 ### 如何使用频道聊天？
 
@@ -183,7 +191,6 @@ npx most-box
 - **前端**: React 19, Next.js 16, TypeScript, Zustand, Lucide React
 - **后端**: Hono + @hono/node-server + WebSocket
 - **P2P**: Hyperswarm 4.x, Hyperdrive 13.x, Corestore 7.x
-- **Web3**: ethers.js, Hardhat, Solidity, EIP-712
 - **桌面**: Electron 41, electron-builder
 - **测试**: Node.js built-in test runner
 
@@ -199,19 +206,32 @@ git push origin v0.0.7
 触发后自动执行：
 
 1. **npm 包发布** — 发布 `most-box` 到 npm registry
-2. **Windows 打包** — 构建 `.exe` 安装包（x64 + arm64）并上传 Release
+2. **Windows 打包** — 分别构建 `.exe` 安装包（x64 / arm64）并上传 Release
 3. **macOS 打包** — 构建 `.dmg` 安装包（x64 + arm64）并上传 Release
 4. **Linux 打包** — 构建 `.AppImage` 安装包（x64 + arm64）并上传 Release
+5. **下载镜像** — 将 Release 资产同步到 Cloudflare R2，并生成 `releases/latest.json`
 
-electron-builder 自动创建 GitHub Release 并附加所有平台安装包。
+GitHub Release 是可信备用源；下载页优先读取 R2 的 `releases/latest.json` 并使用 R2 下载链接。
 
 ### 配置 Secrets
 
+R2 发布资产使用独立公开桶，默认 bucket 为 `most-box-releases`，默认公开域名为
+`https://download.most.box`。不要复用 `api.most.box` 项目的 `most-box-backup` 备份桶。
+
 在仓库 Settings → Secrets and variables → Actions 中添加：
 
-| Secret      | 说明                                    |
-| ----------- | --------------------------------------- |
-| `NPM_TOKEN` | npm 发布令牌（`npm token create` 生成） |
+| Secret                 | 说明                                    |
+| ---------------------- | --------------------------------------- |
+| `NPM_TOKEN`            | npm 发布令牌（`npm token create` 生成） |
+| `R2_ACCOUNT_ID`        | Cloudflare 账户 ID                      |
+| `R2_ACCESS_KEY_ID`     | R2 S3 API Access Key ID                 |
+| `R2_SECRET_ACCESS_KEY` | R2 S3 API Secret Access Key             |
+| `R2_BUCKET`            | 可选；默认 `most-box-releases`          |
+| `R2_PUBLIC_BASE_URL`   | 可选；默认 `https://download.most.box`  |
+
+下载页默认读取 `https://download.most.box/releases/latest.json`。部署环境可额外配置
+`NEXT_PUBLIC_R2_PUBLIC_BASE_URL` 覆盖公开域名，或直接配置
+`NEXT_PUBLIC_RELEASE_MANIFEST_URL` 指向指定的 `latest.json`。
 
 ## 社区
 

package/electron/afterPack.cjs

@@ -0,0 +1,87 @@
+const fs = require('node:fs')
+const path = require('node:path')
+
+const ARCH_BY_VALUE = new Map([
+  [0, 'ia32'],
+  [1, 'x64'],
+  [2, 'armv7l'],
+  [3, 'arm64'],
+  [4, 'universal'],
+])
+
+function normalizeArch(arch) {
+  if (typeof arch === 'string') return arch
+  if (typeof arch === 'number') return ARCH_BY_VALUE.get(arch) || String(arch)
+  return String(arch || '')
+}
+
+function findPrebuildDirs(root) {
+  const matches = []
+  const stack = [root]
+
+  while (stack.length > 0) {
+    const dir = stack.pop()
+    let entries
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true })
+    } catch {
+      continue
+    }
+
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+
+      const fullPath = path.join(dir, entry.name)
+      if (entry.name === 'prebuilds') {
+        matches.push(fullPath)
+        continue
+      }
+      stack.push(fullPath)
+    }
+  }
+
+  return matches
+}
+
+function shouldKeepPrebuild(name, target) {
+  return (
+    name === target ||
+    name.startsWith(`${target}-`) ||
+    name.startsWith(`${target}+`)
+  )
+}
+
+module.exports = async function afterPack(context) {
+  const platform = context.electronPlatformName
+  const arch = normalizeArch(context.arch)
+  const target = `${platform}-${arch}`
+  const nodeModulesDir = path.join(
+    context.appOutDir,
+    'resources',
+    'app.asar.unpacked',
+    'node_modules'
+  )
+
+  if (!platform || !arch || arch === 'universal' || !fs.existsSync(nodeModulesDir)) {
+    return
+  }
+
+  let removed = 0
+  for (const prebuildDir of findPrebuildDirs(nodeModulesDir)) {
+    const entries = fs.readdirSync(prebuildDir, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+      if (shouldKeepPrebuild(entry.name, target)) continue
+
+      fs.rmSync(path.join(prebuildDir, entry.name), {
+        force: true,
+        recursive: true,
+      })
+      removed += 1
+    }
+  }
+
+  if (removed > 0) {
+    console.log(`[MostBox] Pruned ${removed} native prebuild directories for ${target}`)
+  }
+}

package/electron/main.js

@@ -1,12 +1,85 @@
-import { app, BrowserWindow, Menu } from 'electron'
+import {
+  app,
+  BrowserWindow,
+  Menu,
+  Tray,
+  dialog,
+  nativeImage,
+  shell,
+} from 'electron'
+import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
+import {
+  formatBytes,
+  getAvailableUpdate,
+  getCurrentArch,
+  getCurrentPlatform,
+  getReleaseManifestUrl,
+} from './updateChecker.js'
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const PORT = Number(process.env.MOSTBOX_PORT) || 1976
+const PORT = 1976
 
 let mainWindow = null
 let engine = null
+let tray = null
+let isQuitting = false
+let hasCheckedForUpdates = false
+
+function getTrayIconPath() {
+  const candidates = [
+    path.join(__dirname, '..', 'out', 'favicon.ico'),
+    path.join(process.resourcesPath, 'app', 'out', 'favicon.ico'),
+    path.join(__dirname, '..', 'public', 'favicon.ico'),
+  ]
+
+  return candidates.find(candidate => fs.existsSync(candidate))
+}
+
+function showMainWindow() {
+  if (!mainWindow) {
+    createWindow()
+    return
+  }
+
+  if (mainWindow.isMinimized()) {
+    mainWindow.restore()
+  }
+  mainWindow.show()
+  mainWindow.focus()
+}
+
+function quitFromTray() {
+  isQuitting = true
+  if (tray) {
+    tray.destroy()
+    tray = null
+  }
+  app.quit()
+}
+
+function createTray() {
+  if (tray) {
+    return
+  }
+
+  const iconPath = getTrayIconPath()
+  const image = iconPath ? nativeImage.createFromPath(iconPath) : null
+
+  tray = new Tray(image && !image.isEmpty() ? image : nativeImage.createEmpty())
+  tray.setToolTip('MostBox')
+  tray.setContextMenu(
+    Menu.buildFromTemplate([
+      { label: '打开 MostBox', click: showMainWindow },
+      { type: 'separator' },
+      { label: '退出', click: quitFromTray },
+    ])
+  )
+  tray.on('click', showMainWindow)
+  tray.on('double-click', showMainWindow)
+}
 
 function createWindow() {
   mainWindow = new BrowserWindow({
@@ -25,6 +98,15 @@ function createWindow() {
 
   mainWindow.loadURL(`http://localhost:${PORT}`)
 
+  mainWindow.on('close', event => {
+    if (isQuitting) {
+      return
+    }
+
+    event.preventDefault()
+    mainWindow.hide()
+  })
+
   mainWindow.on('closed', () => {
     mainWindow = null
   })
@@ -37,30 +119,96 @@ async function startServer() {
   engine = await main()
 }
 
+async function fetchReleaseManifest(manifestUrl) {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 8000)
+
+  try {
+    const response = await fetch(manifestUrl, {
+      cache: 'no-store',
+      signal: controller.signal,
+    })
+    if (!response.ok) return null
+    return await response.json()
+  } finally {
+    clearTimeout(timeout)
+  }
+}
+
+async function checkForUpdates() {
+  if (hasCheckedForUpdates) return
+  hasCheckedForUpdates = true
+
+  try {
+    const platform = getCurrentPlatform()
+    const arch = getCurrentArch()
+    if (!platform || !arch) return
+
+    const manifest = await fetchReleaseManifest(getReleaseManifestUrl())
+    const update = getAvailableUpdate(manifest, {
+      currentVersion: app.getVersion(),
+      platform,
+      arch,
+    })
+
+    if (!update) return
+
+    const sizeText = formatBytes(update.asset.size)
+    const detail = [
+      `当前版本：${app.getVersion()}`,
+      `最新版本：${update.version}`,
+      sizeText ? `安装包大小：${sizeText}` : null,
+      '',
+      '是否现在打开浏览器下载更新？',
+    ]
+      .filter(line => line !== null)
+      .join('\n')
+
+    const result = await dialog.showMessageBox(mainWindow, {
+      type: 'info',
+      buttons: ['立即下载', '稍后'],
+      defaultId: 0,
+      cancelId: 1,
+      title: '发现 MostBox 新版本',
+      message: `MostBox ${update.version} 已可下载`,
+      detail,
+      noLink: true,
+    })
+
+    if (result.response === 0) {
+      await shell.openExternal(update.downloadUrl)
+    }
+  } catch (error) {
+    console.warn('[Electron] Update check skipped:', error)
+  }
+}
+
 app.whenReady().then(async () => {
   try {
     await startServer()
     createWindow()
+    createTray()
     Menu.setApplicationMenu(null)
+    setTimeout(() => {
+      checkForUpdates()
+    }, 3000)
 
     app.on('activate', () => {
-      if (BrowserWindow.getAllWindows().length === 0) {
-        createWindow()
-      }
+      showMainWindow()
     })
   } catch (err) {
     console.error('[Electron] Failed to start server:', err)
+    isQuitting = true
     app.quit()
   }
 })
 
 app.on('window-all-closed', () => {
-  if (process.platform !== 'darwin') {
-    app.quit()
-  }
+  // Keep the daemon alive; users exit from the tray menu.
 })
 
 app.on('before-quit', () => {
+  isQuitting = true
   if (engine && engine.stop) {
     engine.stop().catch(() => {})
   }

package/electron/preload.js

@@ -0,0 +1,6 @@
+import { contextBridge } from 'electron'
+
+contextBridge.exposeInMainWorld('electronAPI', {
+  platform: process.platform,
+  isElectron: true,
+})

package/electron/updateChecker.js

@@ -0,0 +1,97 @@
+export const DEFAULT_RELEASE_MANIFEST_URL =
+  'https://download.most.box/releases/latest.json'
+
+const PLATFORM_BY_PROCESS = {
+  darwin: 'macos',
+  linux: 'linux',
+  win32: 'windows',
+}
+
+export function getReleaseManifestUrl(env = process.env) {
+  return env.MOSTBOX_RELEASE_MANIFEST_URL || DEFAULT_RELEASE_MANIFEST_URL
+}
+
+export function getCurrentPlatform(processPlatform = process.platform) {
+  return PLATFORM_BY_PROCESS[processPlatform] || null
+}
+
+export function getCurrentArch(processArch = process.arch) {
+  if (processArch === 'x64' || processArch === 'arm64') return processArch
+  return null
+}
+
+function parseVersion(version) {
+  if (typeof version !== 'string') return null
+
+  const match = version.trim().match(/^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/)
+  if (!match) return null
+
+  return match.slice(1).map(part => Number(part))
+}
+
+export function isNewerVersion(candidateVersion, currentVersion) {
+  const candidate = parseVersion(candidateVersion)
+  const current = parseVersion(currentVersion)
+
+  if (!candidate || !current) return false
+
+  for (let index = 0; index < candidate.length; index += 1) {
+    if (candidate[index] > current[index]) return true
+    if (candidate[index] < current[index]) return false
+  }
+
+  return false
+}
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null
+}
+
+export function findUpdateAsset(manifest, platform, arch) {
+  if (!isRecord(manifest) || !Array.isArray(manifest.assets)) return null
+
+  return (
+    manifest.assets.find(
+      asset =>
+        isRecord(asset) &&
+        asset.platform === platform &&
+        asset.arch === arch &&
+        asset.kind === 'installer' &&
+        typeof asset.githubUrl === 'string' &&
+        (typeof asset.r2Url === 'string' || typeof asset.r2Url === 'undefined')
+    ) || null
+  )
+}
+
+export function formatBytes(size) {
+  if (!Number.isFinite(size) || size <= 0) return ''
+
+  const mb = size / 1024 / 1024
+  return `${mb.toFixed(mb >= 100 ? 0 : 1)} MB`
+}
+
+export function getAvailableUpdate(manifest, options = {}) {
+  const currentVersion = options.currentVersion
+  const platform = options.platform
+  const arch = options.arch
+
+  if (
+    !isRecord(manifest) ||
+    typeof manifest.version !== 'string' ||
+    !isNewerVersion(manifest.version, currentVersion)
+  ) {
+    return null
+  }
+
+  const asset = findUpdateAsset(manifest, platform, arch)
+  if (!asset) return null
+
+  const downloadUrl = asset.r2Url || asset.githubUrl
+  if (!downloadUrl) return null
+
+  return {
+    version: manifest.version,
+    asset,
+    downloadUrl,
+  }
+}

package/electron/updateChecker.test.js

@@ -0,0 +1,147 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  findUpdateAsset,
+  formatBytes,
+  getAvailableUpdate,
+  getCurrentArch,
+  getCurrentPlatform,
+  getReleaseManifestUrl,
+  isNewerVersion,
+} from './updateChecker.js'
+
+const manifest = {
+  version: '0.1.3',
+  publishedAt: '2026-06-01T00:00:00.000Z',
+  assets: [
+    {
+      platform: 'windows',
+      arch: 'x64',
+      kind: 'installer',
+      filename: 'MostBox-0.1.3-win-x64-setup.exe',
+      size: 112197632,
+      sha256: 'hash',
+      r2Url:
+        'https://download.most.box/releases/v0.1.3/MostBox-0.1.3-win-x64-setup.exe',
+      githubUrl:
+        'https://github.com/most-people/most/releases/download/v0.1.3/MostBox-0.1.3-win-x64-setup.exe',
+    },
+    {
+      platform: 'windows',
+      arch: 'arm64',
+      kind: 'installer',
+      filename: 'MostBox-0.1.3-win-arm64-setup.exe',
+      githubUrl:
+        'https://github.com/most-people/most/releases/download/v0.1.3/MostBox-0.1.3-win-arm64-setup.exe',
+    },
+    {
+      platform: 'macos',
+      arch: 'arm64',
+      kind: 'installer',
+      filename: 'MostBox-0.1.3-mac-arm64.dmg',
+      githubUrl:
+        'https://github.com/most-people/most/releases/download/v0.1.3/MostBox-0.1.3-mac-arm64.dmg',
+    },
+  ],
+}
+
+describe('desktop update checker', () => {
+  it('uses the public R2 manifest by default and allows env override', () => {
+    assert.equal(
+      getReleaseManifestUrl({}),
+      'https://download.most.box/releases/latest.json'
+    )
+    assert.equal(
+      getReleaseManifestUrl({
+        MOSTBOX_RELEASE_MANIFEST_URL: 'http://localhost:9999/latest.json',
+      }),
+      'http://localhost:9999/latest.json'
+    )
+  })
+
+  it('maps process platform and arch to release manifest values', () => {
+    assert.equal(getCurrentPlatform('win32'), 'windows')
+    assert.equal(getCurrentPlatform('darwin'), 'macos')
+    assert.equal(getCurrentPlatform('linux'), 'linux')
+    assert.equal(getCurrentPlatform('freebsd'), null)
+
+    assert.equal(getCurrentArch('x64'), 'x64')
+    assert.equal(getCurrentArch('arm64'), 'arm64')
+    assert.equal(getCurrentArch('ia32'), null)
+  })
+
+  it('compares stable and prefixed semver strings safely', () => {
+    assert.equal(isNewerVersion('0.1.3', '0.1.2'), true)
+    assert.equal(isNewerVersion('v0.2.0', '0.1.9'), true)
+    assert.equal(isNewerVersion('0.1.2', '0.1.2'), false)
+    assert.equal(isNewerVersion('0.1.1', '0.1.2'), false)
+    assert.equal(isNewerVersion('0.1.3-beta.1', '0.1.2'), true)
+    assert.equal(isNewerVersion('not-a-version', '0.1.2'), false)
+    assert.equal(isNewerVersion('0.1.3', 'not-a-version'), false)
+  })
+
+  it('matches the current platform installer asset', () => {
+    assert.equal(
+      findUpdateAsset(manifest, 'windows', 'x64')?.filename,
+      'MostBox-0.1.3-win-x64-setup.exe'
+    )
+    assert.equal(
+      findUpdateAsset(manifest, 'windows', 'arm64')?.filename,
+      'MostBox-0.1.3-win-arm64-setup.exe'
+    )
+    assert.equal(findUpdateAsset(manifest, 'linux', 'x64'), null)
+  })
+
+  it('returns an available update only for newer compatible manifests', () => {
+    const update = getAvailableUpdate(manifest, {
+      currentVersion: '0.1.2',
+      platform: 'windows',
+      arch: 'x64',
+    })
+
+    assert.equal(update?.version, '0.1.3')
+    assert.equal(update?.downloadUrl, manifest.assets[0].r2Url)
+
+    assert.equal(
+      getAvailableUpdate(manifest, {
+        currentVersion: '0.1.3',
+        platform: 'windows',
+        arch: 'x64',
+      }),
+      null
+    )
+    assert.equal(
+      getAvailableUpdate(manifest, {
+        currentVersion: '0.1.2',
+        platform: 'linux',
+        arch: 'x64',
+      }),
+      null
+    )
+    assert.equal(
+      getAvailableUpdate({ version: '0.1.3', assets: [] }, {
+        currentVersion: '0.1.2',
+        platform: 'windows',
+        arch: 'x64',
+      }),
+      null
+    )
+  })
+
+  it('falls back to GitHub when an R2 URL is absent', () => {
+    const update = getAvailableUpdate(manifest, {
+      currentVersion: '0.1.2',
+      platform: 'windows',
+      arch: 'arm64',
+    })
+
+    assert.equal(update?.downloadUrl, manifest.assets[1].githubUrl)
+  })
+
+  it('formats installer sizes for update prompts', () => {
+    assert.equal(formatBytes(112197632), '107 MB')
+    assert.equal(formatBytes(2.5 * 1024 * 1024), '2.5 MB')
+    assert.equal(formatBytes(0), '')
+  })
+})