peer-term 1.2.14 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.2.14",
+  "version": "1.3.1",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "repository": {

package/src/index.js

@@ -99,6 +99,10 @@ const RELAY_URLS = argv.relay
 const HEARTBEAT_INTERVAL_MS = 5000;
 const MAX_MISSED_PINGS = 2;
 
+const UPLOAD_MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 MB max
+const UPLOAD_MAX_CHUNKS_PER_FILE = Math.ceil(UPLOAD_MAX_FILE_SIZE / 16384);
+const UPLOAD_MAX_CONCURRENT = 3;
+
 // ─── Path Resolution ─────────────────────────────────────────────────────────
 
 function expandTilde(inputPath) {
@@ -336,6 +340,10 @@ class Session {
     this.webrtc = null;
     this.useDataChannel = false;
 
+    // File upload: in-progress file transfers from client
+    // Shape: { [id]: { name, size, totalChunks, chunks: Map<index, Buffer> } }
+    this._incomingFiles = {};
+
     // Local TCP viewer (new terminal window)
     this.viewerServer = null;
     this.viewerSocket = null;
@@ -601,6 +609,17 @@ class Session {
                 return;
               }
 
+              // Check if decrypted message is a file transfer message (file-start, file-chunk, file-end)
+              try {
+                const parsedMsg = JSON.parse(plaintext);
+                if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                  this._handleFileMessage(parsedMsg);
+                  return;
+                }
+              } catch {
+                // Not JSON — normal keystroke data, fall through
+              }
+
               // Normal keystroke — drop if read-only
               if (this.readOnly) return;
               this.ptyProcess.write(plaintext);
@@ -820,6 +839,171 @@ class Session {
     }
   }
 
+  // ─── File Upload Handling ─────────────────────────────────────────────
+
+  /**
+   * Route file transfer messages (file-start, file-chunk, file-end).
+   * All file messages arrive over the DataChannel only.
+   */
+  _handleFileMessage(msg) {
+    switch (msg.type) {
+      case 'file-start': {
+        // Validate required fields
+        if (!msg.id || !msg.name || msg.size === undefined || msg.totalChunks === undefined) {
+          this._sendFileError(msg.id, 'Invalid file-start message');
+          return;
+        }
+
+        if (msg.size > UPLOAD_MAX_FILE_SIZE) {
+          this._sendFileError(msg.id, `File exceeds maximum size of ${UPLOAD_MAX_FILE_SIZE / 1024 / 1024}MB`);
+          return;
+        }
+
+        if (msg.totalChunks > UPLOAD_MAX_CHUNKS_PER_FILE) {
+          this._sendFileError(msg.id, 'File requires too many chunks');
+          return;
+        }
+
+        if (Object.keys(this._incomingFiles).length >= UPLOAD_MAX_CONCURRENT) {
+          this._sendFileError(msg.id, 'Too many concurrent uploads');
+          return;
+        }
+
+        this.log(`File upload started: "${msg.name}" (${msg.size} bytes, ${msg.totalChunks} chunks)`);
+        this._incomingFiles[msg.id] = {
+          name: msg.name,
+          size: msg.size,
+          totalChunks: msg.totalChunks,
+          receivedSize: 0,
+          chunks: new Map(),
+        };
+        break;
+      }
+      case 'file-chunk': {
+        const transfer = this._incomingFiles[msg.id];
+        if (!transfer) {
+          this._sendFileError(msg.id, 'Unknown transfer ID');
+          return;
+        }
+
+        const chunkData = Buffer.from(msg.data, 'base64');
+        
+        if (transfer.chunks.size >= transfer.totalChunks) {
+          this._sendFileError(msg.id, 'Too many chunks received');
+          delete this._incomingFiles[msg.id];
+          return;
+        }
+
+        if (transfer.receivedSize + chunkData.length > transfer.size) {
+          this._sendFileError(msg.id, 'Received size exceeds declared size');
+          delete this._incomingFiles[msg.id];
+          return;
+        }
+
+        transfer.chunks.set(msg.index, chunkData);
+        transfer.receivedSize += chunkData.length;
+        this.logDebug(`File chunk ${msg.index + 1}/${transfer.totalChunks} received for "${transfer.name}"`);
+        break;
+      }
+      case 'file-end': {
+        this._finalizeFile(msg.id);
+        break;
+      }
+    }
+  }
+
+  /**
+   * Reassemble all chunks in order and write the completed file to disk.
+   * Saves to ~/peerterm-uploads/<filename>.
+   */
+  async _finalizeFile(id) {
+    const transfer = this._incomingFiles[id];
+    if (!transfer) {
+      this._sendFileError(id, 'Unknown transfer ID');
+      return;
+    }
+
+    // Check all chunks are present
+    for (let i = 0; i < transfer.totalChunks; i++) {
+      if (!transfer.chunks.has(i)) {
+        this.log(`File "${transfer.name}" missing chunk ${i}`);
+        this._sendFileError(id, `Missing chunk ${i}`);
+        delete this._incomingFiles[id];
+        return;
+      }
+    }
+
+    // Reassemble in order using Buffer.concat
+    const ordered = [];
+    for (let i = 0; i < transfer.totalChunks; i++) {
+      ordered.push(transfer.chunks.get(i));
+    }
+    const fileData = Buffer.concat(ordered);
+
+    // Determine save path: ~/peerterm-uploads/<filename>
+    const homeDir = os.homedir();
+    const uploadDir = path.join(homeDir, 'peerterm-uploads');
+    // Sanitize filename to prevent path traversal (e.g., "../../../etc/passwd")
+    const baseName = path.basename(transfer.name);
+    if (!baseName || baseName === '.' || baseName === '..') {
+      this._sendFileError(id, 'Invalid filename');
+      delete this._incomingFiles[id];
+      return;
+    }
+    const savePath = path.join(uploadDir, baseName);
+
+
+
+
+    try {
+      await fs.promises.mkdir(uploadDir, { recursive: true });
+      await fs.promises.writeFile(savePath, fileData);
+
+      this.log(`File saved: ${savePath}`);
+
+      // Write green ANSI message into the PTY to show the save path
+      if (this.ptyProcess) {
+        this.ptyProcess.write(`\r\n\x1b[32m[PeerTerm] File saved: ${savePath}\x1b[0m\r\n`);
+      }
+
+      // Send ack to client
+      this._sendFileAck(id, transfer.name);
+    } catch (err) {
+      this.log(`Failed to save file "${transfer.name}": ${err.message}`);
+      this._sendFileError(id, `Save failed: ${err.message}`);
+    }
+
+    delete this._incomingFiles[id];
+  }
+
+  /**
+   * Send file-ack to the client confirming successful file save.
+   */
+  async _sendFileAck(id, name) {
+    if (!this.sharedKey) return;
+    try {
+      const ackJson = JSON.stringify({ type: 'file-ack', id, name });
+      const payload = await encrypt(this.sharedKey, ackJson);
+      this._sendEncryptedToClient(payload);
+    } catch (err) {
+      this.log(`Failed to send file-ack: ${err.message}`);
+    }
+  }
+
+  /**
+   * Send file-error to the client with an error message.
+   */
+  async _sendFileError(id, msg) {
+    if (!this.sharedKey) return;
+    try {
+      const errJson = JSON.stringify({ type: 'file-error', id, msg });
+      const payload = await encrypt(this.sharedKey, errJson);
+      this._sendEncryptedToClient(payload);
+    } catch (err) {
+      this.log(`Failed to send file-error: ${err.message}`);
+    }
+  }
+
   _startViewerServer() {
     // Generate a random nonce for viewer authentication
     this.viewerToken = crypto.randomBytes(16).toString('hex');
@@ -1145,6 +1329,17 @@ class Session {
               return;
             }
 
+            // Check if decrypted message is a file transfer message
+            try {
+              const parsedMsg = JSON.parse(plaintext);
+              if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                this._handleFileMessage(parsedMsg);
+                return;
+              }
+            } catch {
+              // Not JSON — normal keystroke data, fall through
+            }
+
             if (this.readOnly) return;
             this.ptyProcess.write(plaintext);
           } catch (err) {
@@ -1221,6 +1416,8 @@ class Session {
     this.intentionalClose = true;
     this.stopHeartbeat();
     this._stopReconnecting();
+    // Clean up in-progress file uploads
+    this._incomingFiles = {};
     // Clean up viewer
     if (this.viewerSocket) {
       try { this.viewerSocket.destroy(); } catch {}
@@ -1267,7 +1464,7 @@ class Session {
     });
 
     this.webrtc.onMessage(async (data) => {
-      if (!this.sharedKey || !this.ptyProcess) return;
+      if (!this.sharedKey) return;
       try {
         // Check if this is a tagged message (resize)
         let parsed;
@@ -1286,8 +1483,22 @@ class Session {
           return;
         }
 
-        // Normal encrypted terminal data
+        // Normal encrypted data — decrypt first
         const plaintext = await decrypt(this.sharedKey, data);
+
+        // Check if decrypted message is a file transfer message (file-start, file-chunk, file-end)
+        try {
+          const msg = JSON.parse(plaintext);
+          if (msg && typeof msg.type === 'string' && msg.type.startsWith('file-')) {
+            this._handleFileMessage(msg);
+            return;
+          }
+        } catch {
+          // Not JSON — normal keystroke data, fall through
+        }
+
+        // Normal keystroke — drop if read-only or no PTY
+        if (!this.ptyProcess) return;
         if (this.readOnly) return;
         this.ptyProcess.write(plaintext);
       } catch (err) {