openfused 0.3.13 → 0.3.14

package/README.md

@@ -181,7 +181,7 @@ Pull peer context, pull their outbox for your mail, push your outbox. Two transp
 
 ```bash
 # LAN — rsync over SSH (uses your ~/.ssh/config for host aliases)
-openfuse peer add ssh://alice.local:/home/agent/context --name wisp
+openfuse peer add ssh://your-server:/home/agent/store --name wisp
 
 # WAN — HTTP against the OpenFused daemon
 openfuse peer add https://wisp.openfused.dev --name wisp
@@ -193,7 +193,7 @@ openfuse sync
 openfuse watch
 
 # Watch + reverse SSH tunnel (NAT traversal)
-openfuse watch --tunnel alice.local
+openfuse watch --tunnel your-server
 ```
 
 Sync does three things:
@@ -276,7 +276,7 @@ Public mode endpoints:
 openfuse watch -d ./store                      # sync every 60s
 openfuse watch -d ./store --sync-interval 30   # sync every 30s
 openfuse watch -d ./store --sync-interval 0    # local watch only
-openfuse watch -d ./store --tunnel alice.local  # + reverse SSH tunnel
+openfuse watch -d ./store --tunnel your-server  # + reverse SSH tunnel
 ```
 
 ## Reachability

package/dist/sync.js

@@ -203,15 +203,33 @@ async function syncHttp(store, peer, baseUrl, peerDir) {
             for (const msg of messages) {
                 const ts = (msg.timestamp || new Date().toISOString()).replace(/[:.]/g, "-");
                 const from = msg.from || "unknown";
-                // SECURITY: sanitize remote-controlled values before constructing local filenames.
-                // Without this, a malicious "from" like "../../.keys/x" could write outside inbox/.
                 const safeFrom = from.replace(/[^a-zA-Z0-9\-_]/g, "");
                 const safeTs = ts.replace(/[^a-zA-Z0-9\-_]/g, "");
                 const fname = `${safeTs}_from-${safeFrom}_to-${myName}.json`;
+                const outboxFile = msg._outboxFile; // filename on sender's outbox
                 const dest = join(inboxDir, fname);
                 if (!existsSync(dest)) {
-                    await writeFile(dest, JSON.stringify(msg, null, 2));
+                    // Strip the _outboxFile metadata before saving
+                    const { _outboxFile, ...cleanMsg } = msg;
+                    await writeFile(dest, JSON.stringify(cleanMsg, null, 2));
                     pulled.push(`outbox→${fname}`);
+                    // ACK: tell sender to move this message to .sent/
+                    if (outboxFile) {
+                        try {
+                            const ackTs = new Date().toISOString();
+                            const ackChallenge = `ACK:${myName}:${outboxFile}:${ackTs}`;
+                            const ackSig = await signChallenge(store.root, ackChallenge);
+                            await fetch(`${baseUrl}/outbox/${myName}/${outboxFile}`, {
+                                method: "DELETE",
+                                headers: {
+                                    "X-OpenFuse-PublicKey": ackSig.publicKey,
+                                    "X-OpenFuse-Signature": ackSig.signature,
+                                    "X-OpenFuse-Timestamp": ackTs,
+                                },
+                            });
+                        }
+                        catch { } // best-effort ACK
+                    }
                 }
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openfused",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "The file protocol for AI agent context. Encrypted, signed, peer-to-peer.",
   "license": "MIT",
   "type": "module",