sharedserver 0.1.0__tar.gz → 0.3.0__tar.gz

sharedserver-0.3.0/MANIFEST.in

@@ -0,0 +1,5 @@
+include sharedserver.example.yaml
+recursive-include docs *.md *.svg *.png *.gif
+recursive-include scripts *.cjs *.py
+
+include README_zh.md

sharedserver-0.3.0/PKG-INFO

@@ -0,0 +1,183 @@
+Metadata-Version: 2.4
+Name: sharedserver
+Version: 0.3.0
+Summary: Zero-configuration LAN file sharing and real-time text clipboard
+Author: Kyi Wong
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/NihaoKangkang/sharedserver
+Project-URL: Repository, https://github.com/NihaoKangkang/sharedserver
+Project-URL: Issues, https://github.com/NihaoKangkang/sharedserver/issues
+Keywords: file-sharing,clipboard,lan,fastapi,websocket
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Framework :: FastAPI
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: fastapi<1,>=0.115
+Requires-Dist: starlette<2,>=0.49.1
+Requires-Dist: ifaddr<1,>=0.2
+Requires-Dist: PyYAML<7,>=6
+Requires-Dist: qrcode<9,>=8
+Requires-Dist: uvicorn<1,>=0.30
+Requires-Dist: websockets<17,>=13
+Provides-Extra: https
+Requires-Dist: cryptography<52,>=43; extra == "https"
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.2; extra == "dev"
+Requires-Dist: httpx2<3,>=2; extra == "dev"
+Requires-Dist: pytest<9,>=8; extra == "dev"
+Requires-Dist: twine<7,>=5; extra == "dev"
+Dynamic: license-file
+
+# SharedServer
+
+[English](https://github.com/NihaoKangkang/sharedserver/blob/main/README.md) · [简体中文](https://github.com/NihaoKangkang/sharedserver/blob/main/README_zh.md)
+
+[![PyPI](https://img.shields.io/pypi/v/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![Python](https://img.shields.io/pypi/pyversions/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE)
+[![CI](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml/badge.svg)](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml)
+
+**Scan to move files, share text and images between browsers, or transfer from a headless terminal. No login by default.**
+
+## Start in seconds
+
+Run inside a **dedicated transfer folder** on trusted Wi-Fi:
+
+```bash
+uvx sharedserver
+# Or run without a permanent installation:
+pipx run sharedserver
+# Or install normally:
+python -m pip install sharedserver
+sharedserver
+```
+
+Scan the terminal QR code on your phone. Both devices need the same network. Keep the terminal open and press **Ctrl+C** when finished. Python 3.10+ is required. [Install uv](https://docs.astral.sh/uv/getting-started/installation/) or [pipx](https://pipx.pypa.io/stable/installation/) separately if needed.
+
+**Default access is open to every reachable device.** Use `sharedserver --token` for a private QR link, and share only the folder you intend to expose.
+
+![Demo: two browser sessions exchanging text and an image](https://raw.githubusercontent.com/NihaoKangkang/sharedserver/main/docs/assets/demo.gif)
+
+The short demo uses a desktop and a mobile-sized Chromium session, including ordinary LAN HTTP. It is not a physical iOS/Android certification.
+
+## Files, text and images
+
+- Upload from the file picker, paste images/files with **Ctrl+V / Cmd+V**, or drag files anywhere onto the page. Uploads show percentage, average speed and estimated remaining time.
+- Paste text anywhere outside another input to fill the shared text box. Full mode synchronizes edits live; receiving devices choose **Copy text**.
+- Uploaded supported images appear on connected pages. Use **Copy image** in a trusted secure context; otherwise a preview opens for long-press/right-click copying or saving. Files stay in the shared folder; this does not automatically read or write the OS clipboard.
+- Select up to **200 files in the current folder** and choose **Download ZIP**. ZIPs are staged on disk and downloaded natively, without buffering the archive into browser memory.
+- Downloads support **HTTP Range**, including resume and HEAD requests. Uploads stream in chunks and never silently overwrite a file. Add `--rename-on-conflict` to keep both copies as `name (1).ext`.
+- Text is limited to **2 MiB of UTF-8** by default. Full/readonly text is kept in memory; drop-only submissions are saved as unique `text_*.txt` files. Images are files, not large WebSocket messages.
+
+## Access modes
+
+| Mode | Browse / download / ZIP | Upload files | Read shared text/images | Submit text/images |
+| --- | --- | --- | --- | --- |
+| `--mode full` (default) | Yes | Yes | Yes | Yes |
+| `--mode readonly` | Yes | No | Yes | No |
+| `--mode droponly` | No | Yes, inbox root | No history | Text via **Submit text**, images via upload |
+
+Drop-only users cannot create folders or read earlier submissions through HTTP or WebSocket. The operator reads collected files directly on the host. Duplicate text submissions are saved separately.
+
+The legacy `--read-only` switch still means **file writes off, text editable**. Use `--mode readonly` to lock text too. It cannot be combined with `--mode droponly`.
+
+## CLI reference
+
+| Option | Default | Purpose |
+| --- | --- | --- |
+| `[port]` | `8000` | Original positional port, still supported |
+| `-p, --port PORT` | Config or `8000` | Named port; cannot be combined with positional port |
+| `-b, --bind, --host HOST` | `0.0.0.0` | Bind address; `127.0.0.1` limits access to this computer |
+| `-d, --directory PATH` | Current directory | Shared root |
+| `-c, --config PATH` | Auto-load `sharedserver.yaml` if present | YAML configuration |
+| `--mode full\|readonly\|droponly` | `full` | HTTP, WebSocket and UI permissions |
+| `--read-only / --no-read-only` | Off | Legacy file-only protection |
+| `--max-size, --max-upload-size MB` | `1024` | Per-file limit in MiB; explicit `0` means unlimited |
+| `--rename-on-conflict` | Off | Append a number instead of returning `409 Conflict` |
+| `--token` | Off | Generate a strong random token in the QR link |
+| `--pin PIN` | Off | 4–6 ASCII digits in `?pin=...`; choose PIN or token |
+| `--random-url` | Off | Serve only under a random `/s/<secret>/` prefix |
+| `--auth USER:PASS` | Off | Optional HTTP Basic Auth; can combine with a link or PIN |
+| `--https` | Off | Temporary self-signed certificate, valid for one day |
+| `--qr / --no-qr` | On in interactive terminals | Force / suppress QR output |
+| `--version`, `-h / --help` | — | Version / help |
+
+Examples:
+
+```bash
+sharedserver -p 8080 -d ~/Transfer --token
+sharedserver --mode readonly --random-url
+sharedserver --mode droponly --pin 123456 --rename-on-conflict
+sharedserver --max-size 0 --rename-on-conflict
+python -m sharedserver 8080 --host 127.0.0.1
+```
+
+For secrets that should not appear in process arguments, use **`SHAREDSERVER_AUTH`** (`username:password`) or **`SHAREDSERVER_TOKEN`** (16–256 printable ASCII characters without whitespace). CLI overrides the environment, which overrides YAML; `--token` generates a new token. Tokens/PINs bootstrap an HttpOnly, SameSite browser session and disappear from the URL. Sessions expire at restart. Basic Auth uses the browser's built-in prompt; no account database is created. PINs allow five failed attempts per client address per minute, with bounded tracking; strong token links are preferable to short PINs. Random paths and secrets are omitted from request access logs when protection is enabled.
+
+### HTTPS and clipboard trust
+
+`--https` generates a fresh certificate and key in a private, hidden temporary directory, then removes them on exit. It uses installed OpenSSL, or the optional `cryptography` extra:
+
+```bash
+python -m pip install 'sharedserver[https]'
+sharedserver --https --token
+# Run temporarily with HTTPS support:
+uvx --from 'sharedserver[https]' sharedserver --https
+```
+
+**Self-signed HTTPS does not automatically establish device trust.** The program never installs a root certificate, changes browser security, or bypasses a certificate warning. Image clipboard access still depends on certificate trust, browser support and permissions. A new certificate is generated on each run. For ordinary HTTP, text-copy fallback and image preview/download remain available. See [MDN secure contexts](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts).
+
+## Headless / curl cheat sheet
+
+These commands use the default full mode without access protection:
+
+```bash
+# Upload a file; PUT is the supported curl upload interface (not multipart -F).
+curl --fail --upload-file ./report.pdf http://192.168.1.23:8000/upload/report.pdf
+# Download, or resume a partial download.
+curl --fail -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+curl --fail -C - -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+# Read, save or update UTF-8 shared text. Inspect text before executing anything.
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw > clipboard.txt
+curl --fail --data-binary 'hello world' http://192.168.1.23:8000/api/clipboard/raw
+# Download selected files as a ZIP.
+curl --fail -H 'Content-Type: application/json' -d '{"paths":["one.txt","two.txt"]}' \
+  -o selected.zip http://192.168.1.23:8000/api/zip
+```
+
+Use the **complete printed base URL** for `--random-url`: endpoints then live under `/s/<secret>/api/...` and `/s/<secret>/upload/...`. Token clients send `Authorization: Bearer <token>`; PIN clients append `?pin=<pin>`; Basic clients use `curl --user username` to prompt for the password. With Basic plus token, use Basic credentials plus `?token=...` (one Authorization header cannot carry both). For HTTPS use a CA/certificate you have verified with curl's `--cacert`; the examples do not disable certificate verification. curl/Wget upload clients receive `OK: filename uploaded` with HTTP 201. Other API clients receive JSON.
+
+## Configuration and troubleshooting
+
+See [sharedserver.example.yaml](https://github.com/NihaoKangkang/sharedserver/blob/main/sharedserver.example.yaml). CLI values override YAML. Relative shared roots resolve from the config file's directory. Copy-format allowlists replace defaults, case-insensitively. Active HTML/SVG/JS/XML types are never served as inline images, even through a custom allowlist. Default image preview formats are PNG, JPEG and WebP, with signature checks. Other formats remain downloadable as attachments.
+
+If a phone cannot connect, check same Wi-Fi, guest-device isolation, and the host firewall. With a VPN or multiple adapters, choose the correct address explicitly: `sharedserver -b 192.168.1.23`. Use another port if 8000 is busy, and `--qr` for redirected terminal output. If the executable is missing, try `python -m sharedserver` with the same Python used to install it. For externally managed Python installations, use uvx/pipx or the [PyPA virtual environment guide](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/).
+
+## Security and development
+
+Share a dedicated directory on a trusted network and stop the process when finished. Basic/PIN/token/path protection controls access; **HTTP does not encrypt traffic**. This is not a public-internet hosting service. Hidden paths, symlinks, special files and the active config are blocked. Paths are resolved under the shared root; MIME sniffing is disabled and downloads are attachments. Names/text use DOM `textContent`, not HTML interpolation. Upload and archive work uses bounded chunks and disk staging. The shared directory must be controlled by its owner; untrusted local path replacement is outside the threat model.
+
+```bash
+git clone https://github.com/NihaoKangkang/sharedserver.git
+cd sharedserver
+python -m venv .venv
+# Activate the virtual environment with your shell, then:
+python -m pip install -e '.[dev,https]'
+python -m pytest
+python -m build
+python -m twine check dist/*
+```
+
+CI tests Linux/macOS/Windows on Python 3.10–3.14, packaged assets, and two Chromium suites. Browser reproduction: `npm install --no-save playwright`, `npx playwright install chromium`, then `SHARED_PYTHON=.venv/bin/python node scripts/browser_vnext.cjs` (shell environment syntax varies). `LAN_SMOKE=1` additionally tests a real LAN HTTP address. [Release runbook](https://github.com/NihaoKangkang/sharedserver/blob/main/docs/releasing.md).
+
+[MIT license](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE) · [Report an issue](https://github.com/NihaoKangkang/sharedserver/issues)

sharedserver-0.3.0/README.md

@@ -0,0 +1,144 @@
+# SharedServer
+
+[English](https://github.com/NihaoKangkang/sharedserver/blob/main/README.md) · [简体中文](https://github.com/NihaoKangkang/sharedserver/blob/main/README_zh.md)
+
+[![PyPI](https://img.shields.io/pypi/v/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![Python](https://img.shields.io/pypi/pyversions/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE)
+[![CI](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml/badge.svg)](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml)
+
+**Scan to move files, share text and images between browsers, or transfer from a headless terminal. No login by default.**
+
+## Start in seconds
+
+Run inside a **dedicated transfer folder** on trusted Wi-Fi:
+
+```bash
+uvx sharedserver
+# Or run without a permanent installation:
+pipx run sharedserver
+# Or install normally:
+python -m pip install sharedserver
+sharedserver
+```
+
+Scan the terminal QR code on your phone. Both devices need the same network. Keep the terminal open and press **Ctrl+C** when finished. Python 3.10+ is required. [Install uv](https://docs.astral.sh/uv/getting-started/installation/) or [pipx](https://pipx.pypa.io/stable/installation/) separately if needed.
+
+**Default access is open to every reachable device.** Use `sharedserver --token` for a private QR link, and share only the folder you intend to expose.
+
+![Demo: two browser sessions exchanging text and an image](https://raw.githubusercontent.com/NihaoKangkang/sharedserver/main/docs/assets/demo.gif)
+
+The short demo uses a desktop and a mobile-sized Chromium session, including ordinary LAN HTTP. It is not a physical iOS/Android certification.
+
+## Files, text and images
+
+- Upload from the file picker, paste images/files with **Ctrl+V / Cmd+V**, or drag files anywhere onto the page. Uploads show percentage, average speed and estimated remaining time.
+- Paste text anywhere outside another input to fill the shared text box. Full mode synchronizes edits live; receiving devices choose **Copy text**.
+- Uploaded supported images appear on connected pages. Use **Copy image** in a trusted secure context; otherwise a preview opens for long-press/right-click copying or saving. Files stay in the shared folder; this does not automatically read or write the OS clipboard.
+- Select up to **200 files in the current folder** and choose **Download ZIP**. ZIPs are staged on disk and downloaded natively, without buffering the archive into browser memory.
+- Downloads support **HTTP Range**, including resume and HEAD requests. Uploads stream in chunks and never silently overwrite a file. Add `--rename-on-conflict` to keep both copies as `name (1).ext`.
+- Text is limited to **2 MiB of UTF-8** by default. Full/readonly text is kept in memory; drop-only submissions are saved as unique `text_*.txt` files. Images are files, not large WebSocket messages.
+
+## Access modes
+
+| Mode | Browse / download / ZIP | Upload files | Read shared text/images | Submit text/images |
+| --- | --- | --- | --- | --- |
+| `--mode full` (default) | Yes | Yes | Yes | Yes |
+| `--mode readonly` | Yes | No | Yes | No |
+| `--mode droponly` | No | Yes, inbox root | No history | Text via **Submit text**, images via upload |
+
+Drop-only users cannot create folders or read earlier submissions through HTTP or WebSocket. The operator reads collected files directly on the host. Duplicate text submissions are saved separately.
+
+The legacy `--read-only` switch still means **file writes off, text editable**. Use `--mode readonly` to lock text too. It cannot be combined with `--mode droponly`.
+
+## CLI reference
+
+| Option | Default | Purpose |
+| --- | --- | --- |
+| `[port]` | `8000` | Original positional port, still supported |
+| `-p, --port PORT` | Config or `8000` | Named port; cannot be combined with positional port |
+| `-b, --bind, --host HOST` | `0.0.0.0` | Bind address; `127.0.0.1` limits access to this computer |
+| `-d, --directory PATH` | Current directory | Shared root |
+| `-c, --config PATH` | Auto-load `sharedserver.yaml` if present | YAML configuration |
+| `--mode full\|readonly\|droponly` | `full` | HTTP, WebSocket and UI permissions |
+| `--read-only / --no-read-only` | Off | Legacy file-only protection |
+| `--max-size, --max-upload-size MB` | `1024` | Per-file limit in MiB; explicit `0` means unlimited |
+| `--rename-on-conflict` | Off | Append a number instead of returning `409 Conflict` |
+| `--token` | Off | Generate a strong random token in the QR link |
+| `--pin PIN` | Off | 4–6 ASCII digits in `?pin=...`; choose PIN or token |
+| `--random-url` | Off | Serve only under a random `/s/<secret>/` prefix |
+| `--auth USER:PASS` | Off | Optional HTTP Basic Auth; can combine with a link or PIN |
+| `--https` | Off | Temporary self-signed certificate, valid for one day |
+| `--qr / --no-qr` | On in interactive terminals | Force / suppress QR output |
+| `--version`, `-h / --help` | — | Version / help |
+
+Examples:
+
+```bash
+sharedserver -p 8080 -d ~/Transfer --token
+sharedserver --mode readonly --random-url
+sharedserver --mode droponly --pin 123456 --rename-on-conflict
+sharedserver --max-size 0 --rename-on-conflict
+python -m sharedserver 8080 --host 127.0.0.1
+```
+
+For secrets that should not appear in process arguments, use **`SHAREDSERVER_AUTH`** (`username:password`) or **`SHAREDSERVER_TOKEN`** (16–256 printable ASCII characters without whitespace). CLI overrides the environment, which overrides YAML; `--token` generates a new token. Tokens/PINs bootstrap an HttpOnly, SameSite browser session and disappear from the URL. Sessions expire at restart. Basic Auth uses the browser's built-in prompt; no account database is created. PINs allow five failed attempts per client address per minute, with bounded tracking; strong token links are preferable to short PINs. Random paths and secrets are omitted from request access logs when protection is enabled.
+
+### HTTPS and clipboard trust
+
+`--https` generates a fresh certificate and key in a private, hidden temporary directory, then removes them on exit. It uses installed OpenSSL, or the optional `cryptography` extra:
+
+```bash
+python -m pip install 'sharedserver[https]'
+sharedserver --https --token
+# Run temporarily with HTTPS support:
+uvx --from 'sharedserver[https]' sharedserver --https
+```
+
+**Self-signed HTTPS does not automatically establish device trust.** The program never installs a root certificate, changes browser security, or bypasses a certificate warning. Image clipboard access still depends on certificate trust, browser support and permissions. A new certificate is generated on each run. For ordinary HTTP, text-copy fallback and image preview/download remain available. See [MDN secure contexts](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts).
+
+## Headless / curl cheat sheet
+
+These commands use the default full mode without access protection:
+
+```bash
+# Upload a file; PUT is the supported curl upload interface (not multipart -F).
+curl --fail --upload-file ./report.pdf http://192.168.1.23:8000/upload/report.pdf
+# Download, or resume a partial download.
+curl --fail -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+curl --fail -C - -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+# Read, save or update UTF-8 shared text. Inspect text before executing anything.
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw > clipboard.txt
+curl --fail --data-binary 'hello world' http://192.168.1.23:8000/api/clipboard/raw
+# Download selected files as a ZIP.
+curl --fail -H 'Content-Type: application/json' -d '{"paths":["one.txt","two.txt"]}' \
+  -o selected.zip http://192.168.1.23:8000/api/zip
+```
+
+Use the **complete printed base URL** for `--random-url`: endpoints then live under `/s/<secret>/api/...` and `/s/<secret>/upload/...`. Token clients send `Authorization: Bearer <token>`; PIN clients append `?pin=<pin>`; Basic clients use `curl --user username` to prompt for the password. With Basic plus token, use Basic credentials plus `?token=...` (one Authorization header cannot carry both). For HTTPS use a CA/certificate you have verified with curl's `--cacert`; the examples do not disable certificate verification. curl/Wget upload clients receive `OK: filename uploaded` with HTTP 201. Other API clients receive JSON.
+
+## Configuration and troubleshooting
+
+See [sharedserver.example.yaml](https://github.com/NihaoKangkang/sharedserver/blob/main/sharedserver.example.yaml). CLI values override YAML. Relative shared roots resolve from the config file's directory. Copy-format allowlists replace defaults, case-insensitively. Active HTML/SVG/JS/XML types are never served as inline images, even through a custom allowlist. Default image preview formats are PNG, JPEG and WebP, with signature checks. Other formats remain downloadable as attachments.
+
+If a phone cannot connect, check same Wi-Fi, guest-device isolation, and the host firewall. With a VPN or multiple adapters, choose the correct address explicitly: `sharedserver -b 192.168.1.23`. Use another port if 8000 is busy, and `--qr` for redirected terminal output. If the executable is missing, try `python -m sharedserver` with the same Python used to install it. For externally managed Python installations, use uvx/pipx or the [PyPA virtual environment guide](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/).
+
+## Security and development
+
+Share a dedicated directory on a trusted network and stop the process when finished. Basic/PIN/token/path protection controls access; **HTTP does not encrypt traffic**. This is not a public-internet hosting service. Hidden paths, symlinks, special files and the active config are blocked. Paths are resolved under the shared root; MIME sniffing is disabled and downloads are attachments. Names/text use DOM `textContent`, not HTML interpolation. Upload and archive work uses bounded chunks and disk staging. The shared directory must be controlled by its owner; untrusted local path replacement is outside the threat model.
+
+```bash
+git clone https://github.com/NihaoKangkang/sharedserver.git
+cd sharedserver
+python -m venv .venv
+# Activate the virtual environment with your shell, then:
+python -m pip install -e '.[dev,https]'
+python -m pytest
+python -m build
+python -m twine check dist/*
+```
+
+CI tests Linux/macOS/Windows on Python 3.10–3.14, packaged assets, and two Chromium suites. Browser reproduction: `npm install --no-save playwright`, `npx playwright install chromium`, then `SHARED_PYTHON=.venv/bin/python node scripts/browser_vnext.cjs` (shell environment syntax varies). `LAN_SMOKE=1` additionally tests a real LAN HTTP address. [Release runbook](https://github.com/NihaoKangkang/sharedserver/blob/main/docs/releasing.md).
+
+[MIT license](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE) · [Report an issue](https://github.com/NihaoKangkang/sharedserver/issues)

sharedserver-0.3.0/README_zh.md

@@ -0,0 +1,146 @@
+# SharedServer
+
+[English](https://github.com/NihaoKangkang/sharedserver/blob/main/README.md) · [简体中文](https://github.com/NihaoKangkang/sharedserver/blob/main/README_zh.md)
+
+[![PyPI](https://img.shields.io/pypi/v/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![Python](https://img.shields.io/pypi/pyversions/sharedserver.svg)](https://pypi.org/project/sharedserver/)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE)
+[![CI](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml/badge.svg)](https://github.com/NihaoKangkang/sharedserver/actions/workflows/ci.yml)
+
+**扫码跨设备传文件、在网页间共享图文，也能从无图形界面的终端传输。默认无需登录。**
+
+## 快速启动
+
+在可信 Wi-Fi 下，进入一个**专用传输文件夹**，运行：
+
+```bash
+uvx sharedserver
+# 或者临时运行，不永久安装：
+pipx run sharedserver
+# 也可以常规安装：
+python -m pip install sharedserver
+sharedserver
+```
+
+手机扫描终端二维码即可打开网页。两台设备需要处于同一网络。使用期间保持终端打开，结束后按 **Ctrl+C**。需要 Python 3.10+；如尚未安装，可先安装 [uv](https://docs.astral.sh/uv/getting-started/installation/) 或 [pipx](https://pipx.pypa.io/stable/installation/)。
+
+**默认所有能连接到服务的设备都能访问。** 可用 `sharedserver --token` 生成私密扫码链接，只共享你确实想公开的目录。
+
+![文件与图文共享演示](https://raw.githubusercontent.com/NihaoKangkang/sharedserver/main/docs/assets/demo.gif)
+
+演示使用桌面和手机尺寸的 Chromium 浏览器会话，包含普通局域网 HTTP 场景，不代表已完成真实 iPhone/Android 认证测试。
+
+## 文件与图文共享
+
+- 点击上传、用 **Ctrl+V / Cmd+V** 粘贴图片或文件，或将文件拖到页面任意位置。上传显示百分比、平均速度和预计剩余时间。
+- 在其他输入框之外粘贴文字，可填入共享文本区。完整模式下修改实时同步；接收端点击 **Copy text** 复制。
+- 支持的图片上传后会出现在其他已打开的页面中。可信安全上下文可使用 **Copy image**；否则打开预览，可长按/右键复制或保存。不会自动监控或写入操作系统剪贴板。
+- 可选择当前文件夹内最多 **200 个文件**，点击 **Download ZIP**。服务端临时打包到磁盘，由浏览器原生下载，不把整个压缩包读进浏览器内存。
+- 下载支持 **HTTP Range**、断点续传和 HEAD。上传采用分块写入，默认冲突返回 `409`，不会静默覆盖；加上 `--rename-on-conflict` 会保存为 `文件名 (1).扩展名`。
+- 共享文本默认上限为 **2 MiB UTF-8 字节**。完整/只读模式的文本仅在内存中保存；收集箱文本提交为唯一的 `text_*.txt` 文件。图片保存到共享目录，WebSocket 只传路径信息。
+
+## 权限模式
+
+| 模式 | 浏览、下载、ZIP | 上传文件 | 读取共享图文 | 提交图文 |
+| --- | --- | --- | --- | --- |
+| `--mode full`（默认） | 允许 | 允许 | 允许 | 允许 |
+| `--mode readonly` | 允许 | 禁止 | 允许 | 禁止 |
+| `--mode droponly` | 禁止 | 仅收集箱根目录 | 不显示历史 | 文字点击 **Submit text**；图片通过上传提交 |
+
+收集箱模式不能创建目录，也不能通过 HTTP 或 WebSocket 读取历史提交。服务主机的操作者直接查看收集目录；相同文字的重复提交也会分别保存。
+
+为兼容旧版，`--read-only` 仍只禁止**文件写入**，文字可以编辑。需要同时锁定文字请使用 `--mode readonly`。不要将旧开关与 `--mode droponly` 混用。
+
+## 完整参数表
+
+| 参数 | 默认值 | 作用 |
+| --- | --- | --- |
+| `[port]` | `8000` | 保留原有位置端口写法 |
+| `-p, --port PORT` | 配置值或 `8000` | 指定端口，不能与位置端口同时使用 |
+| `-b, --bind, --host HOST` | `0.0.0.0` | 绑定地址；`127.0.0.1` 仅本机可访问 |
+| `-d, --directory PATH` | 当前目录 | 共享根目录 |
+| `-c, --config PATH` | 有则自动读取 `sharedserver.yaml` | YAML 配置文件 |
+| `--mode full\|readonly\|droponly` | `full` | 同时约束 HTTP、WebSocket 与页面操作 |
+| `--read-only / --no-read-only` | 关闭 | 旧版“仅文件只读”开关 |
+| `--max-size, --max-upload-size MB` | `1024` | 单文件上限，单位 MiB；显式设为 `0` 表示不限 |
+| `--rename-on-conflict` | 关闭 | 重名追加序号，不覆盖原文件 |
+| `--token` | 关闭 | 生成高强度随机访问令牌并放进二维码 |
+| `--pin PIN` | 关闭 | 4–6 位 ASCII 数字，通过 `?pin=...` 访问；与 token 二选一 |
+| `--random-url` | 关闭 | 仅在随机 `/s/<secret>/` 路径下提供服务 |
+| `--auth USER:PASS` | 关闭 | 可选 HTTP Basic Auth，可与私密链接/PIN 叠加 |
+| `--https` | 关闭 | 临时自签名 HTTPS 证书，有效期一天 |
+| `--qr / --no-qr` | 交互终端默认显示 | 强制显示或隐藏二维码 |
+| `--version`, `-h / --help` | — | 版本与帮助 |
+
+```bash
+sharedserver -p 8080 -d ~/Transfer --token
+sharedserver --mode readonly --random-url
+sharedserver --mode droponly --pin 123456 --rename-on-conflict
+sharedserver --max-size 0 --rename-on-conflict
+python -m sharedserver 8080 --host 127.0.0.1
+```
+
+不想让密码出现在进程参数中，可以设置环境变量 **`SHAREDSERVER_AUTH`**（`用户名:密码`）或 **`SHAREDSERVER_TOKEN`**（16–256 个无空白的可打印 ASCII 字符）。优先级为 CLI > 环境变量 > YAML；`--token` 每次生成新令牌。Token/PIN 首次访问后换取 HttpOnly、SameSite 会话 Cookie，并从地址栏移除，重启会让会话失效。Basic Auth 使用浏览器内置认证提示，不创建用户数据库。
+
+PIN 每个客户端地址每分钟最多允许五次失败尝试，跟踪记录有固定数量上限；短 PIN 强度有限，优先使用强随机 token。启用保护时抑制请求访问日志，避免泄露随机路径和查询令牌。
+
+## HTTPS 与浏览器信任
+
+`--https` 在隐藏的私有临时目录中生成证书和密钥，退出时删除。可使用已安装的 OpenSSL，或安装可选依赖：
+
+```bash
+python -m pip install 'sharedserver[https]'
+sharedserver --https --token
+# 临时运行并启用 HTTPS 支持：
+uvx --from 'sharedserver[https]' sharedserver --https
+```
+
+**自签名 HTTPS 不会自动让设备信任证书。** 程序不会安装根证书、修改浏览器安全设置或绕过证书警告。图片剪贴板仍取决于证书信任、浏览器支持及权限。每次运行都会生成新证书。普通 HTTP 下仍可降级复制文字、预览和下载图片。可参考 [MDN 安全上下文说明](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts)。
+
+## 无头终端 / curl 速查
+
+以下示例使用默认完整模式，未开启访问保护：
+
+```bash
+# 上传文件：支持 PUT，不使用 multipart -F 接口。
+curl --fail --upload-file ./report.pdf http://192.168.1.23:8000/upload/report.pdf
+# 下载与断点续传。
+curl --fail -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+curl --fail -C - -o report.pdf 'http://192.168.1.23:8000/api/download?path=report.pdf'
+# 读取、保存和推送 UTF-8 文本；执行文字前应先确认其内容。
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw
+curl --fail --silent http://192.168.1.23:8000/api/clipboard/raw > clipboard.txt
+curl --fail --data-binary 'hello world' http://192.168.1.23:8000/api/clipboard/raw
+# 将选中的文件打包为 ZIP。
+curl --fail -H 'Content-Type: application/json' -d '{"paths":["one.txt","two.txt"]}' \
+  -o selected.zip http://192.168.1.23:8000/api/zip
+```
+
+使用 `--random-url` 时，必须保留终端打印的完整基础路径，例如 `/s/<secret>/api/...` 和 `/s/<secret>/upload/...`。Token 客户端带 `Authorization: Bearer <token>`；PIN 客户端带 `?pin=<pin>`；Basic Auth 可用 `curl --user 用户名` 交互输入密码。Basic 与 token 叠加时，用 Basic 加 `?token=...`，一个 Authorization 请求头无法同时放两种认证。
+
+HTTPS 应使用已核实的证书/CA 配合 curl `--cacert`，示例不会禁用证书验证。curl/Wget 上传成功返回 HTTP 201 和 `OK: filename uploaded`；其他 API 客户端返回 JSON。
+
+## 配置、排错与安全边界
+
+参见 [sharedserver.example.yaml](https://github.com/NihaoKangkang/sharedserver/blob/main/sharedserver.example.yaml)。CLI 覆盖 YAML；相对共享路径从配置文件所在目录计算。自定义复制扩展名列表替换默认列表，忽略大小写。HTML、SVG、JS、XML 等主动内容不会作为图片内联预览，即使写进自定义图片白名单。默认图片格式为 PNG/JPEG/WebP，并校验文件签名；其他文件通过附件下载。
+
+连不上时，检查同一 Wi-Fi、访客网络设备隔离和主机防火墙。VPN/多网卡可显式指定 `sharedserver -b 192.168.1.23`。端口被占用可换端口；重定向终端输出时可加 `--qr`。找不到命令时，使用安装时同一个 Python 执行 `python -m sharedserver`。系统限制全局 pip 安装时，可用 uvx/pipx 或 [PyPA 虚拟环境指南](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/)。
+
+**HTTP 不加密传输。** Basic/PIN/token/随机路径提供访问控制，不适合把这个临时局域网工具直接暴露到公网。共享目录内的隐藏路径、符号链接、特殊文件和正在使用的配置文件被屏蔽；路径限制在共享根目录内；下载强制附件，响应禁用 MIME 嗅探。页面通过 `textContent` 渲染名称与文字。文件传输使用分块读写和磁盘暂存。共享目录应由你控制，不支持在不可信本机进程持续替换文件路径的环境下提供隔离保证。
+
+## 开发
+
+```bash
+git clone https://github.com/NihaoKangkang/sharedserver.git
+cd sharedserver
+python -m venv .venv
+# 使用对应 shell 激活虚拟环境，然后：
+python -m pip install -e '.[dev,https]'
+python -m pytest
+python -m build
+python -m twine check dist/*
+```
+
+CI 覆盖 Linux/macOS/Windows、Python 3.10–3.14、安装包资源和两组 Chromium 测试。浏览器测试可安装 `npm install --no-save playwright`、`npx playwright install chromium` 后，设置 `SHARED_PYTHON=.venv/bin/python` 并运行 `node scripts/browser_vnext.cjs`；不同 shell 设置环境变量的语法不同。额外设置 `LAN_SMOKE=1` 可验证实际内网 IP 的 HTTP 场景。参见[发布流程](https://github.com/NihaoKangkang/sharedserver/blob/main/docs/releasing.md)。
+
+[MIT 许可证](https://github.com/NihaoKangkang/sharedserver/blob/main/LICENSE) · [反馈问题](https://github.com/NihaoKangkang/sharedserver/issues)

sharedserver-0.3.0/docs/assets/terminal.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="920" height="350" viewBox="0 0 920 350" role="img" aria-label="Example terminal output: sharedserver prints a LAN link and QR code">
+<rect width="920" height="350" rx="14" fill="#0d1117"/>
+<g font-family="monospace" font-size="17" fill="#e6edf3">
+<text x="28" y="42" fill="#58a6ff">$ sharedserver</text>
+<text x="28" y="84">SharedServer 0.2.0</text>
+<text x="28" y="114">Sharing: /Users/you/Transfer</text>
+<text x="28" y="154">Local: http://127.0.0.1:8000/</text>
+<text x="28" y="184" fill="#7ee787">LAN:   http://192.168.1.23:8000/</text>
+<text x="28" y="224" fill="#e3b341">Trusted Wi-Fi only. Try --token for a private link.</text>
+<text x="28" y="264">Scan with your phone on the same Wi-Fi.</text>
+<text x="28" y="302" fill="#8d96a0">Example address · Ctrl+C to stop</text>
+</g>
+<g transform="translate(690 54)"><rect width="165" height="165" fill="white"/><g fill="black"><rect x="20" y="20" width="5" height="5"/><rect x="25" y="20" width="5" height="5"/><rect x="30" y="20" width="5" height="5"/><rect x="35" y="20" width="5" height="5"/><rect x="40" y="20" width="5" height="5"/><rect x="45" y="20" width="5" height="5"/><rect x="50" y="20" width="5" height="5"/><rect x="70" y="20" width="5" height="5"/><rect x="75" y="20" width="5" height="5"/><rect x="80" y="20" width="5" height="5"/><rect x="90" y="20" width="5" height="5"/><rect x="110" y="20" width="5" height="5"/><rect x="115" y="20" width="5" height="5"/><rect x="120" y="20" width="5" height="5"/><rect x="125" y="20" width="5" height="5"/><rect x="130" y="20" width="5" height="5"/><rect x="135" y="20" width="5" height="5"/><rect x="140" y="20" width="5" height="5"/><rect x="20" y="25" width="5" height="5"/><rect x="50" y="25" width="5" height="5"/><rect x="60" y="25" width="5" height="5"/><rect x="70" y="25" width="5" height="5"/><rect x="100" y="25" width="5" height="5"/><rect x="110" y="25" width="5" height="5"/><rect x="140" y="25" width="5" height="5"/><rect x="20" y="30" width="5" height="5"/><rect x="30" y="30" width="5" height="5"/><rect x="35" y="30" width="5" height="5"/><rect x="40" y="30" width="5" height="5"/><rect x="50" y="30" width="5" height="5"/><rect x="60" y="30" width="5" height="5"/><rect x="65" y="30" width="5" height="5"/><rect x="95" y="30" width="5" height="5"/><rect x="110" y="30" width="5" height="5"/><rect x="120" y="30" width="5" height="5"/><rect x="125" y="30" width="5" height="5"/><rect x="130" y="30" width="5" height="5"/><rect x="140" y="30" width="5" height="5"/><rect x="20" y="35" width="5" height="5"/><rect x="30" y="35" width="5" height="5"/><rect x="35" y="35" width="5" height="5"/><rect x="40" y="35" width="5" height="5"/><rect x="50" y="35" width="5" height="5"/><rect x="60" y="35" width="5" height="5"/><rect x="75" y="35" width="5" height="5"/><rect x="80" y="35" width="5" height="5"/><rect x="90" y="35" width="5" height="5"/><rect x="95" y="35" width="5" height="5"/><rect x="110" y="35" width="5" height="5"/><rect x="120" y="35" width="5" height="5"/><rect x="125" y="35" width="5" height="5"/><rect x="130" y="35" width="5" height="5"/><rect x="140" y="35" width="5" height="5"/><rect x="20" y="40" width="5" height="5"/><rect x="30" y="40" width="5" height="5"/><rect x="35" y="40" width="5" height="5"/><rect x="40" y="40" width="5" height="5"/><rect x="50" y="40" width="5" height="5"/><rect x="75" y="40" width="5" height="5"/><rect x="80" y="40" width="5" height="5"/><rect x="95" y="40" width="5" height="5"/><rect x="110" y="40" width="5" height="5"/><rect x="120" y="40" width="5" height="5"/><rect x="125" y="40" width="5" height="5"/><rect x="130" y="40" width="5" height="5"/><rect x="140" y="40" width="5" height="5"/><rect x="20" y="45" width="5" height="5"/><rect x="50" y="45" width="5" height="5"/><rect x="80" y="45" width="5" height="5"/><rect x="95" y="45" width="5" height="5"/><rect x="100" y="45" width="5" height="5"/><rect x="110" y="45" width="5" height="5"/><rect x="140" y="45" width="5" height="5"/><rect x="20" y="50" width="5" height="5"/><rect x="25" y="50" width="5" height="5"/><rect x="30" y="50" width="5" height="5"/><rect x="35" y="50" width="5" height="5"/><rect x="40" y="50" width="5" height="5"/><rect x="45" y="50" width="5" height="5"/><rect x="50" y="50" width="5" height="5"/><rect x="60" y="50" width="5" height="5"/><rect x="70" y="50" width="5" height="5"/><rect x="80" y="50" width="5" height="5"/><rect x="90" y="50" width="5" height="5"/><rect x="100" y="50" width="5" height="5"/><rect x="110" y="50" width="5" height="5"/><rect x="115" y="50" width="5" height="5"/><rect x="120" y="50" width="5" height="5"/><rect x="125" y="50" width="5" height="5"/><rect x="130" y="50" width="5" height="5"/><rect x="135" y="50" width="5" height="5"/><rect x="140" y="50" width="5" height="5"/><rect x="60" y="55" width="5" height="5"/><rect x="65" y="55" width="5" height="5"/><rect x="75" y="55" width="5" height="5"/><rect x="80" y="55" width="5" height="5"/><rect x="100" y="55" width="5" height="5"/><rect x="20" y="60" width="5" height="5"/><rect x="50" y="60" width="5" height="5"/><rect x="60" y="60" width="5" height="5"/><rect x="70" y="60" width="5" height="5"/><rect x="80" y="60" width="5" height="5"/><rect x="95" y="60" width="5" height="5"/><rect x="105" y="60" width="5" height="5"/><rect x="110" y="60" width="5" height="5"/><rect x="125" y="60" width="5" height="5"/><rect x="130" y="60" width="5" height="5"/><rect x="135" y="60" width="5" height="5"/><rect x="25" y="65" width="5" height="5"/><rect x="30" y="65" width="5" height="5"/><rect x="35" y="65" width="5" height="5"/><rect x="40" y="65" width="5" height="5"/><rect x="45" y="65" width="5" height="5"/><rect x="55" y="65" width="5" height="5"/><rect x="65" y="65" width="5" height="5"/><rect x="75" y="65" width="5" height="5"/><rect x="100" y="65" width="5" height="5"/><rect x="105" y="65" width="5" height="5"/><rect x="110" y="65" width="5" height="5"/><rect x="115" y="65" width="5" height="5"/><rect x="120" y="65" width="5" height="5"/><rect x="125" y="65" width="5" height="5"/><rect x="130" y="65" width="5" height="5"/><rect x="135" y="65" width="5" height="5"/><rect x="20" y="70" width="5" height="5"/><rect x="25" y="70" width="5" height="5"/><rect x="30" y="70" width="5" height="5"/><rect x="40" y="70" width="5" height="5"/><rect x="50" y="70" width="5" height="5"/><rect x="55" y="70" width="5" height="5"/><rect x="60" y="70" width="5" height="5"/><rect x="75" y="70" width="5" height="5"/><rect x="90" y="70" width="5" height="5"/><rect x="95" y="70" width="5" height="5"/><rect x="100" y="70" width="5" height="5"/><rect x="105" y="70" width="5" height="5"/><rect x="120" y="70" width="5" height="5"/><rect x="125" y="70" width="5" height="5"/><rect x="135" y="70" width="5" height="5"/><rect x="140" y="70" width="5" height="5"/><rect x="20" y="75" width="5" height="5"/><rect x="30" y="75" width="5" height="5"/><rect x="40" y="75" width="5" height="5"/><rect x="65" y="75" width="5" height="5"/><rect x="70" y="75" width="5" height="5"/><rect x="80" y="75" width="5" height="5"/><rect x="85" y="75" width="5" height="5"/><rect x="90" y="75" width="5" height="5"/><rect x="105" y="75" width="5" height="5"/><rect x="115" y="75" width="5" height="5"/><rect x="125" y="75" width="5" height="5"/><rect x="140" y="75" width="5" height="5"/><rect x="20" y="80" width="5" height="5"/><rect x="25" y="80" width="5" height="5"/><rect x="35" y="80" width="5" height="5"/><rect x="40" y="80" width="5" height="5"/><rect x="50" y="80" width="5" height="5"/><rect x="55" y="80" width="5" height="5"/><rect x="65" y="80" width="5" height="5"/><rect x="75" y="80" width="5" height="5"/><rect x="80" y="80" width="5" height="5"/><rect x="85" y="80" width="5" height="5"/><rect x="90" y="80" width="5" height="5"/><rect x="105" y="80" width="5" height="5"/><rect x="115" y="80" width="5" height="5"/><rect x="120" y="80" width="5" height="5"/><rect x="140" y="80" width="5" height="5"/><rect x="20" y="85" width="5" height="5"/><rect x="25" y="85" width="5" height="5"/><rect x="30" y="85" width="5" height="5"/><rect x="65" y="85" width="5" height="5"/><rect x="70" y="85" width="5" height="5"/><rect x="100" y="85" width="5" height="5"/><rect x="105" y="85" width="5" height="5"/><rect x="135" y="85" width="5" height="5"/><rect x="20" y="90" width="5" height="5"/><rect x="30" y="90" width="5" height="5"/><rect x="50" y="90" width="5" height="5"/><rect x="60" y="90" width="5" height="5"/><rect x="65" y="90" width="5" height="5"/><rect x="75" y="90" width="5" height="5"/><rect x="80" y="90" width="5" height="5"/><rect x="100" y="90" width="5" height="5"/><rect x="110" y="90" width="5" height="5"/><rect x="120" y="90" width="5" height="5"/><rect x="125" y="90" width="5" height="5"/><rect x="135" y="90" width="5" height="5"/><rect x="140" y="90" width="5" height="5"/><rect x="20" y="95" width="5" height="5"/><rect x="30" y="95" width="5" height="5"/><rect x="35" y="95" width="5" height="5"/><rect x="40" y="95" width="5" height="5"/><rect x="45" y="95" width="5" height="5"/><rect x="60" y="95" width="5" height="5"/><rect x="75" y="95" width="5" height="5"/><rect x="90" y="95" width="5" height="5"/><rect x="95" y="95" width="5" height="5"/><rect x="105" y="95" width="5" height="5"/><rect x="110" y="95" width="5" height="5"/><rect x="120" y="95" width="5" height="5"/><rect x="130" y="95" width="5" height="5"/><rect x="140" y="95" width="5" height="5"/><rect x="20" y="100" width="5" height="5"/><rect x="30" y="100" width="5" height="5"/><rect x="40" y="100" width="5" height="5"/><rect x="50" y="100" width="5" height="5"/><rect x="55" y="100" width="5" height="5"/><rect x="65" y="100" width="5" height="5"/><rect x="70" y="100" width="5" height="5"/><rect x="75" y="100" width="5" height="5"/><rect x="95" y="100" width="5" height="5"/><rect x="100" y="100" width="5" height="5"/><rect x="105" y="100" width="5" height="5"/><rect x="110" y="100" width="5" height="5"/><rect x="115" y="100" width="5" height="5"/><rect x="120" y="100" width="5" height="5"/><rect x="125" y="100" width="5" height="5"/><rect x="130" y="100" width="5" height="5"/><rect x="60" y="105" width="5" height="5"/><rect x="65" y="105" width="5" height="5"/><rect x="70" y="105" width="5" height="5"/><rect x="80" y="105" width="5" height="5"/><rect x="85" y="105" width="5" height="5"/><rect x="100" y="105" width="5" height="5"/><rect x="120" y="105" width="5" height="5"/><rect x="20" y="110" width="5" height="5"/><rect x="25" y="110" width="5" height="5"/><rect x="30" y="110" width="5" height="5"/><rect x="35" y="110" width="5" height="5"/><rect x="40" y="110" width="5" height="5"/><rect x="45" y="110" width="5" height="5"/><rect x="50" y="110" width="5" height="5"/><rect x="65" y="110" width="5" height="5"/><rect x="70" y="110" width="5" height="5"/><rect x="75" y="110" width="5" height="5"/><rect x="95" y="110" width="5" height="5"/><rect x="100" y="110" width="5" height="5"/><rect x="110" y="110" width="5" height="5"/><rect x="120" y="110" width="5" height="5"/><rect x="125" y="110" width="5" height="5"/><rect x="130" y="110" width="5" height="5"/><rect x="140" y="110" width="5" height="5"/><rect x="20" y="115" width="5" height="5"/><rect x="50" y="115" width="5" height="5"/><rect x="80" y="115" width="5" height="5"/><rect x="85" y="115" width="5" height="5"/><rect x="95" y="115" width="5" height="5"/><rect x="100" y="115" width="5" height="5"/><rect x="120" y="115" width="5" height="5"/><rect x="130" y="115" width="5" height="5"/><rect x="140" y="115" width="5" height="5"/><rect x="20" y="120" width="5" height="5"/><rect x="30" y="120" width="5" height="5"/><rect x="35" y="120" width="5" height="5"/><rect x="40" y="120" width="5" height="5"/><rect x="50" y="120" width="5" height="5"/><rect x="65" y="120" width="5" height="5"/><rect x="70" y="120" width="5" height="5"/><rect x="80" y="120" width="5" height="5"/><rect x="90" y="120" width="5" height="5"/><rect x="100" y="120" width="5" height="5"/><rect x="105" y="120" width="5" height="5"/><rect x="110" y="120" width="5" height="5"/><rect x="115" y="120" width="5" height="5"/><rect x="120" y="120" width="5" height="5"/><rect x="125" y="120" width="5" height="5"/><rect x="130" y="120" width="5" height="5"/><rect x="135" y="120" width="5" height="5"/><rect x="140" y="120" width="5" height="5"/><rect x="20" y="125" width="5" height="5"/><rect x="30" y="125" width="5" height="5"/><rect x="35" y="125" width="5" height="5"/><rect x="40" y="125" width="5" height="5"/><rect x="50" y="125" width="5" height="5"/><rect x="70" y="125" width="5" height="5"/><rect x="90" y="125" width="5" height="5"/><rect x="115" y="125" width="5" height="5"/><rect x="125" y="125" width="5" height="5"/><rect x="140" y="125" width="5" height="5"/><rect x="20" y="130" width="5" height="5"/><rect x="30" y="130" width="5" height="5"/><rect x="35" y="130" width="5" height="5"/><rect x="40" y="130" width="5" height="5"/><rect x="50" y="130" width="5" height="5"/><rect x="65" y="130" width="5" height="5"/><rect x="70" y="130" width="5" height="5"/><rect x="75" y="130" width="5" height="5"/><rect x="80" y="130" width="5" height="5"/><rect x="100" y="130" width="5" height="5"/><rect x="105" y="130" width="5" height="5"/><rect x="110" y="130" width="5" height="5"/><rect x="115" y="130" width="5" height="5"/><rect x="120" y="130" width="5" height="5"/><rect x="130" y="130" width="5" height="5"/><rect x="140" y="130" width="5" height="5"/><rect x="20" y="135" width="5" height="5"/><rect x="50" y="135" width="5" height="5"/><rect x="65" y="135" width="5" height="5"/><rect x="70" y="135" width="5" height="5"/><rect x="75" y="135" width="5" height="5"/><rect x="90" y="135" width="5" height="5"/><rect x="100" y="135" width="5" height="5"/><rect x="110" y="135" width="5" height="5"/><rect x="115" y="135" width="5" height="5"/><rect x="120" y="135" width="5" height="5"/><rect x="125" y="135" width="5" height="5"/><rect x="130" y="135" width="5" height="5"/><rect x="140" y="135" width="5" height="5"/><rect x="20" y="140" width="5" height="5"/><rect x="25" y="140" width="5" height="5"/><rect x="30" y="140" width="5" height="5"/><rect x="35" y="140" width="5" height="5"/><rect x="40" y="140" width="5" height="5"/><rect x="45" y="140" width="5" height="5"/><rect x="50" y="140" width="5" height="5"/><rect x="60" y="140" width="5" height="5"/><rect x="85" y="140" width="5" height="5"/><rect x="90" y="140" width="5" height="5"/><rect x="100" y="140" width="5" height="5"/><rect x="110" y="140" width="5" height="5"/><rect x="120" y="140" width="5" height="5"/><rect x="125" y="140" width="5" height="5"/><rect x="140" y="140" width="5" height="5"/></g></g>
+</svg>