filament-cli 0.8.4

P2P file transfer between terminals and browsers, no upload, no account. The terminal end of filament.autumated.com.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

[package]
name = "filament-cli"
version = "0.8.4"
authors = ["Abdk4Moura <pro.kaiserlautern@gmail.com>"]
edition = "2024"
description = "P2P file transfer between terminals and browsers, no upload, no account. The terminal end of filament.autumated.com."
license = "MIT"
repository = "https://github.com/Abdk4Moura/filament"
homepage = "https://filament.autumated.com"
readme = "README.md"
keywords = ["p2p", "file-transfer", "webrtc", "cli", "airdrop"]
categories = ["command-line-utilities", "network-programming"]

[[bin]]
name = "filament"
path = "src/main.rs"

[features]
# Fully static builds (musl): compile OpenSSL from source instead of linking
# the system one. rust_socketio hard-depends on native-tls, so a rustls-only
# tree is not possible without forking it upstream (ledger C16).
static = ["dep:openssl-sys"]
# Env-gated fault/injection hooks used ONLY by the resilience gates
# (runner/sim/*). NOT in `default` and NOT pulled by the release profile, so a
# default `cargo build --release` (what users install) strips every test hook
# from the binary — no `FILAMENT_TEST_*` env reads, no corruption/freeze/drop
# injection logic. Build the gates' binary with `--features test-hooks`.
test-hooks = []
# Dev-debug logging (TRACE / STALL / worker-ports internals). Stripped from
# default release builds so no debug strings reach the shipped binary.
debug-logs = []
# Opt-in cross-platform mount adapters. Linux FUSE remains default-on and does
# not require a feature. macOS needs macFUSE SDK; Windows needs WinFsp SDK.
# These are OFF by default so stock CI runners (which lack the SDKs) stay green.
mount-windows = ["dep:winfsp", "dep:winfsp-sys"]


[dependencies]
openssl-sys = { version = "0.9", features = ["vendored"], optional = true }
anyhow = "1.0.102"
async-trait = "0.1.89"
base64 = "0.22"
bytes = "1.11.1"
chrono = "0.4"
clap = { version = "4.6.1", features = ["derive", "env"] }
futures-util = "0.3.32"
reqwest = { version = "0.13.4", features = ["json"] }
directories = "6"
rust_socketio = { version = "0.6.0", features = ["async"] }
rustls = { version = "0.23.40", features = ["ring"] }
serde = "1.0.228"
serde_json = "1.0.150"
sha2 = "0.11.0"
# pake-internal: sha2 0.10 (for hkdf/hmac 0.12 trait compat). Renamed to
# avoid the 0.10/0.11 name clash; the pake module aliases it as `sha2`.
sha2_pake = { package = "sha2", version = "0.10" }
hkdf = "0.12"
hmac = "0.12"
spake2 = "=0.4.0"
# PAKE first-pairing core, carved into its own crate (zero app coupling).
filament-pair = { path = "../crates/filament-pair", version = "0.1.0" }
# Standalone atomic owner-only secret-file writer (chmod 0600 / icacls DACL),
# re-exported as `crate::platform::SecretFile`.
secret-write = { path = "../crates/secret-write", version = "0.1.0" }
# Filament-managed authorized_keys block + managed ssh keypair, decoupled from
# the CLI's config-dir resolution. `crate::sshkeys` is a thin shim over this.
authkeys-managed = { path = "../crates/authkeys-managed", version = "0.1.0" }
# Multi-device user identity (user key over device certs, no CA). Aliased as
# `crate::identity`; key persistence is injected via `platform::PlatformKeyStore`.
filament-id = { path = "../crates/filament-id", version = "0.1.0" }
# Capability primitives + pure authorization evaluation. `crate::capability` and
# `crate::ephemeral` re-export it; the host-bound orchestration (store I/O, mode
# flag, observability counters, DeviceCert-reading glue) stays in those modules.
filament-cap = { path = "../crates/filament-cap", version = "0.1.1" }
hex = "0.4"
rand_core = "0.6"
getrandom = "0.2"
tar = "0.4.46"
zip = { version = "2", default-features = false, features = ["deflate"] }
tokio = { version = "1.52.3", features = ["full"] }
webrtc = "0.17.1"
clap_complete = "4.6.5"
clap_mangen = "0.3.0"
flate2 = "1.1.9"
qrcode = { version = "0.14.1", default-features = false }
# web-shell: spawn a login shell in a PTY and bridge it to the browser terminal.
portable-pty = "0.8"
# rung-1 direct CLI<->CLI transport (FILAMENT_DIRECT=1). ring crypto to match
# the rest of the rustls tree; we hand quinn an explicit ring-based config so
# no process-default crypto provider is required.
quinn = { version = "0.11.9", default-features = false, features = ["runtime-tokio", "rustls-ring", "log"] }
quinn-proto = "0.11"
rcgen = { version = "=0.13.2", default-features = false, features = ["ring", "pem"] }
# L3 overlay crypto: a per-device Ed25519 identity whose public key IS the overlay
# address (self-certifying, Yggdrasil-style). ring is already in the tree via
# rustls/quinn/rcgen; this is a direct handle for Ed25519 sign/verify + CSPRNG, so
# we never hand-roll the crypto.
ring = "0.17"
zeroize = "1.8"
socket2 = { version = "0.5", features = ["all"] }
# Userspace L3 netstack: an in-process TCP/IP stack so a zero-privilege node (no
# CAP_NET_ADMIN, no /dev/net/tun, e.g. a container) is a first-class overlay member.
# Pure Rust, no OS device (more portable than the kernel-TUN/Wintun backends); it
# feeds/drains bare IPv6 packets to/from the same direct-QUIC datagram carrier. IPv6
# is mandatory (the overlay is an IPv6 ULA); TCP only for now.
smoltcp = { version = "0.12", default-features = false, features = ["std", "medium-ip", "proto-ipv4", "proto-ipv6", "socket-tcp"] }
# Interactive guided code entry (raw mode + key events + styled output;
# cross-platform incl. Windows). Used ONLY behind the interactivity gate; a
# non-TTY / scripted run never enters its event loop.
crossterm = "0.29"
# L3 TUN backends (unix): Linux opens /dev/net/tun via a TUNSETIFF ioctl; macOS
# opens a utun via a PF_SYSTEM control socket. Both wrap the fd in tokio's AsyncFd
# and set addr/mtu/route through the system CLI (iproute2 / ifconfig+route), so no
# netlink crate is pulled. libc is the only addition on unix.
[target.'cfg(unix)'.dependencies]
libc = "0.2"

# Linux mount client adapter: present the mesh-native mount protocol as a real
# local filesystem via FUSE. Server side needs no FUSE; only the client mount does.
# This stays default-on: it builds on stock Linux runners and is fully exercised
# by mount-gates.sh.
[target.'cfg(target_os = "linux")'.dependencies]
fuser = "0.17"



# Windows L3 backend: Wintun (WireGuard's userspace TUN driver) via wintun.dll,
# loaded at runtime with libloading. The DLL is bundled beside filament.exe by the
# release packaging; adapter creation needs Administrator.
# Windows L3 backend: Wintun (WireGuard's userspace TUN driver) via wintun.dll,
# loaded at runtime with libloading. The DLL is bundled beside filament.exe by the
# release packaging; adapter creation needs Administrator.
[target.'cfg(target_os = "windows")'.dependencies]
wintun = "0.5"
# Pinned to 0.12: 0.13 is a significant API refactor (FileSystemHost::new
# takes 2 args, DirInfo is now generic DirInfo<N>, VolumeParams is a builder).
# Upgrade tracked as follow-up item.
winfsp = { version = "=0.12.0", features = ["full", "windows-61"], optional = true }
winfsp-sys = { version = "=0.3.0", optional = true }
# Used for reparse-point (symlink/junction) refusal in safe_create_part /
# safe_resume_part — closes the Windows half deferred in 0.7.2/0.7.3.
windows-sys = { version = "0.59", features = [
    "Win32_Storage_FileSystem",
    "Win32_Foundation",
    "Win32_Security",
] }

[profile.release]
lto = "thin"
codegen-units = 16
strip = true

# Fast functional iteration for real-binary gates. This is not release evidence:
# optimization-sensitive measurements must be repeated with `--release`.
[profile.measure]
inherits = "release"
opt-level = 1
lto = false
debug = 0
incremental = true