v2.0.0

What's new since v1.0.0

Native TUI client

• Full-screen terminal client that speaks the same protocol as the browser
• CLI split into clear modes:
  • LemurPouch --serve — run the relay
  • LemurPouch --connect <relay-url> — open the TUI
• Install scripts target ~/.local/bin and can launch either mode
• Send-path polish: safer transfer failure handling, friendlier path quoting/~ expansion in the send prompt

Multi-gig transfers

• Negotiated chunk sizes (up to 1 MiB) and windowed flow control so large files don't blow memory or hang the pipe
• Browser send/receive workers (crypto off the main thread)
• Disk receive via OPFS when the page is a secure context (https:// or http://localhost)
• Growing in-memory receive + clear warning when OPFS isn't available (plain http:// on a LAN IP)
• Rate + ETA in the transfer UI
• Send and receive stall detection (30 s): "flow-control stall" / "receive stall" instead of stuck progress forever

Transfer integrity & reliability

• End-to-end SHA-256 is streamed with the bytes (not a second full-file hash pass)
• Digest rides on transfer-end (not the offer), so offers can start immediately
• Fixes for:
  • Last chunk racing transfer-end (receiver stuck at ~100% streaming)
  • Windowed browser sends deadlocking after wiping lastAck
  • Large receives on Safari / plain HTTP

Project / packaging

• Renamed to LemurPouch (binary, docs, install paths)
• Browser app → portal/, marketing site → website/
• Marketing landing page for lemurpouch.com
• Docker image path is lowercase for GHCR:
  ghcr.io/steelbrain/lemurpouch:latest

Docs

• Install-first README pitch
• Captive-portal claim removed from the "works on restrictive networks" list (LAN relay focus)
• AGENTS / install / Docker notes updated for the new layout

Install

One-liner (relay):

curl -fsSL https://raw.githubusercontent.com/steelbrain/LemurPouch/main/scripts/install.sh | sh

TUI client:

curl -fsSL https://raw.githubusercontent.com/steelbrain/LemurPouch/main/scripts/install.sh | sh -s -- --connect http://<relay-host>:8080/

Docker:

docker run --rm -p 8080:8080 ghcr.io/steelbrain/lemurpouch:latest

Binaries: download the archive for your OS/arch from this release, verify with SHA256SUMS, unpack, run ./LemurPouch --serve or ./LemurPouch --connect <url>.

Breaking / note for upgraders from v1.0.0

• Binary and install paths use LemurPouch (not the old name)
• Docker/GHCR image is ghcr.io/steelbrain/lemurpouch (lowercase)
• Wire change: file integrity digest is on transfer-end, not transfer-offer — use matching client + portal builds (this release)

Full Changelog: v1.0.0...v2.0.0

v1.0.0 — first stable release

LemurPouch is LAN file sharing that works on the most restrictive networks. One relay binary on the LAN, two browsers connecting outbound — no inbound ports, no WebRTC, no UDP, no STUN/ICE/TURN. Every file is
end-to-end encrypted; the relay routes ciphertext byte-for-byte and never sees content.

Quick start

macOS / Linux:

curl -fsSL https://lemurpouch.com/install.sh | sh

Windows (PowerShell):

irm https://lemurpouch.com/install.ps1 | iex

Docker:

docker run --rm -p 8080:8080 ghcr.io/steelbrain/lemur-pouch:latest

Then open http://<your-LAN-IP>:8080/ on each device. The two browsers verify each other by a six-word BIP-39 fingerprint, exchange a friendship invite, and start sending files.

What it does

• Outbound-only transport. WebSocket to the relay — works wherever the firewall lets a browser load a webpage.
• End-to-end encrypted. Ed25519 identity, X25519 key agreement, HKDF-SHA256 session keys, XChaCha20-Poly1305 sealed envelopes. Six-word fingerprint for human verification.
• Two-tier consent. Friendship invite (per-IP rate-limited) plus a per-transfer accept on every individual file.
• Session-only state. Identities, friendships, and queued invites live in relay memory. Restart = clean slate.
• Single static binary. React frontend embedded via go:embed; cross-compiled with CGO disabled.

Platforms

Standalone binaries: macOS / Linux / Windows on amd64 and arm64 (six archives). Docker image: unified manifest spanning linux/amd64, linux/arm64, windows/amd64 — docker pull resolves to the right one for
the host.

Verify any download against the published SHA256SUMS.

What's not in this release (by design)

• No persistence — relay restart loses friendships and active transfers.
• No native daemon, no TLS, no resumable transfers.
• No payload logs, no metrics.

The full protocol, threat model, and wire format live in the Protocol Reference appendix of AGENTS.md.

Full Changelog: https://github.com/steelbrain/lemur-pouch/commits/v1.0.0