Lanrunner v0.1.7-beta

Guest kits

Lan Runner could only talk to other Lan Runner instances. This release lets you invite someone who has installed nothing.

Name the person in the Guest Kits panel and press Generate guest folder. You get a folder holding one self-contained HTML file. Send it over; they open it in a browser on the same network and you have an encrypted conversation. Guest chats appear as ordinary tabs alongside your peers.

Phones scan a QR code

The folder works on a computer, but it cannot work on a phone — iOS previews a downloaded HTML file in Quick Look, which blocks scripts and the network. So phones fetch the page from you instead: expand QR code for phones on any kit and point a camera at it.

Phones connect over HTTPS, because browsers only expose the Web Crypto API in a secure context. The certificate is self-signed, so a phone warns once before you tap through — there is no certificate authority on an offline LAN. The connection is genuinely encrypted; the fingerprint is shown next to the QR so a guest can confirm it out loud.

What a guest can reach

Exactly one conversation — the invite's own. Never your peer list, console, diagnostics, the room, or another invite.

The guest gateway only exists while a usable invite exists, and closes and releases its ports as soon as the last one is revoked or expires. If you never make a kit, Lan Runner opens no LAN-facing port at all.

Security

Sessions are sealed with AES-256-GCM under a key agreed per session by P-256 ECDH, with the 256-bit invite token mixed into HKDF, so only a holder of the folder can derive it. Also: sliding-window replay protection, per-address backoff after failed handshakes, private-LAN-only by default, per-session rate limiting, constant-time token comparison, and a nonce-based CSP on served pages.

A guest kit is a bearer token. Anyone holding the folder is the guest — there is no second factor and no key to pin. That is the cost of requiring nothing to be installed. Send it the way you would send a password, and press Revoke when you're done. Invites also expire on their own after seven days.

Also in this release

primaryIP returned the first non-loopback IPv4 address, so it could report a 169.254.0.0/16 link-local address from an adapter that never got a DHCP lease. Nothing on the LAN can route to one, so it showed a dead address in the interface. Link-local is now only ever a fallback.

New flags

-guest 47102            LAN port for guest kits (opened only while an invite exists)
-guest-tls 47103        HTTPS port; phones can only connect over this
-no-guest               disable guest kits entirely
-no-guest-tls           no HTTPS gateway (phones will not work)
-kits <path>            where generated folders are written
-guest-ttl 168h         how long invites last (0 disables expiry)
-guest-any-source       accept guests from outside private LAN ranges

Ports

Unchanged for peer messaging: UDP 47100 discovery, TCP 47101 messaging, loopback 8080 for the interface. Guest kits add inbound TCP 47102 and 47103, and only while an invite exists.

Downloads

File	Platform
Lanrunner-Setup-0.1.7-beta.exe	Windows, per-user installer
Lanrunner-0.1.7-beta-linux-amd64.tar.gz	Linux x86_64
Lanrunner-0.1.7-beta-linux-arm64.tar.gz	Linux ARM64

Verify with SHA256SUMS.txt.

Still zero third-party dependencies — everything is Go's standard library, including the QR encoder, so it builds on a machine that has never been online.