v1.0.1

don't double-eof
actually this is better
2025-10-24 08:33:58 +00:00 · 2021-09-09 00:59:55 +02:00 · 2021-09-09 00:54:09 +02:00 · 2021-09-09 00:41:23 +02:00 · 2021-09-09 00:35:07 +02:00 · 2021-09-09 00:27:18 +02:00
44 changed files with 1628 additions and 766 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: bug
+assignees: '9001'
+
+---
+
+NOTE:
+all of the below are optional, consider them as inspiration, delete and rewrite at will, thx md
+
+
+**Describe the bug**
+a description of what the bug is
+
+**To Reproduce**
+List of steps to reproduce the issue, or, if it's hard to reproduce, then at least a detailed explanation of what you did to run into it
+
+**Expected behavior**
+a description of what you expected to happen
+
+**Screenshots**
+if applicable, add screenshots to help explain your problem, such as the kickass crashpage :^)
+
+**Server details**
+if the issue is possibly on the server-side, then mention some of the following:
+* server OS / version: 
+* python version: 
+* copyparty arguments: 
+* filesystem (`lsblk -f` on linux): 
+
+**Client details**
+if the issue is possibly on the client-side, then mention some of the following:
+* the device type and model: 
+* OS version: 
+* browser version: 
+
+**Additional context**
+any other context about the problem here
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: '9001'
+
+---
+
+all of the below are optional, consider them as inspiration, delete and rewrite at will
+
+**is your feature request related to a problem? Please describe.**
+a description of what the problem is, for example, `I'm always frustrated when [...]` or `Why is it not possible to [...]`
+
+**Describe the idea / solution you'd like**
+a description of what you want to happen
+
+**Describe any alternatives you've considered**
+a description of any alternative solutions or features you've considered
+
+**Additional context**
+add any other context or screenshots about the feature request here
--- a/.github/ISSUE_TEMPLATE/something-else.md
+++ b/.github/ISSUE_TEMPLATE/something-else.md
@@ -0,0 +1,10 @@
+---
+name: Something else
+about: "┐(ﾟ∀ﾟ)┌"
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+
--- a/.github/branch-rename.md
+++ b/.github/branch-rename.md
@@ -0,0 +1,7 @@
+modernize your local checkout of the repo like so,
+```sh
+git branch -m master hovudstraum
+git fetch origin
+git branch -u origin/hovudstraum hovudstraum
+git remote set-head origin -a
+```
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,24 @@
+in the words of Abraham Lincoln:
+
+> Be excellent to each other... and... PARTY ON, DUDES!
+
+more specifically I'll paraphrase some examples from a german automotive corporation as they cover all the bases without being too wordy
+
+## Examples of unacceptable behavior
+* intimidation, harassment, trolling
+* insulting, derogatory, harmful or prejudicial comments
+* posting private information without permission
+* political or personal attacks
+
+## Examples of expected behavior
+* being nice, friendly, welcoming, inclusive, mindful and empathetic
+* acting considerate, modest, respectful
+* using polite and inclusive language
+* criticize constructively and accept constructive criticism
+* respect different points of view
+
+## finally and even more specifically,
+* parse opinions and feedback objectively without prejudice
+  * it's the message that matters, not who said it
+
+aaand that's how you say `be nice` in a way that fills half a floppy w
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,3 @@
+* do something cool
+
+really tho, send a PR or an issue or whatever, all appreciated, anything goes, just behave aight
--- a/README.md
+++ b/README.md
@@ -8,21 +8,22 @@

 turn your phone or raspi into a portable file server with resumable uploads/downloads using *any* web browser

-* server runs on anything with `py2.7` or `py3.3+`
+* server only needs `py2.7` or `py3.3+`, all dependencies optional
 * browse/upload with IE4 / netscape4.0 on win3.11 (heh)
 * *resumable* uploads need `firefox 34+` / `chrome 41+` / `safari 7+` for full speed
 * code standard: `black`

-📷 **screenshots:** [browser](#the-browser) // [upload](#uploading) // [thumbnails](#thumbnails) // [md-viewer](#markdown-viewer) // [search](#searching) // [fsearch](#file-search) // [zip-DL](#zip-downloads) // [ie4](#browser-support)
+📷 **screenshots:** [browser](#the-browser) // [upload](#uploading) // [unpost](#unpost) // [thumbnails](#thumbnails) // [search](#searching) // [fsearch](#file-search) // [zip-DL](#zip-downloads) // [md-viewer](#markdown-viewer) // [ie4](#browser-support)


 ## readme toc

 * top
-    * [quickstart](#quickstart) - download [copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) and you're all set!
+    * **[quickstart](#quickstart)** - download **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** and you're all set!
+        * [on servers](#on-servers) - you may also want these, especially on servers
        * [on debian](#on-debian) - recommended additional steps on debian
    * [notes](#notes) - general notes
-    * [status](#status) - summary: all planned features work! now please enjoy the bloatening
+    * [status](#status) - feature summary
    * [testimonials](#testimonials) - small collection of user feedback
 * [bugs](#bugs)
    * [general bugs](#general-bugs)
@@ -30,30 +31,33 @@ turn your phone or raspi into a portable file server with resumable uploads/down
 * [accounts and volumes](#accounts-and-volumes) - per-folder, per-user permissions
 * [the browser](#the-browser) - accessing a copyparty server using a web-browser
    * [tabs](#tabs) - the main tabs in the ui
-    * [hotkeys](#hotkeys) - the browser has the following hotkeys (always qwerty)
+    * [hotkeys](#hotkeys) - the browser has the following hotkeys
    * [navpane](#navpane) - switching between breadcrumbs or navpane
-    * [thumbnails](#thumbnails) - press `g` to toggle image/video thumbnails instead of the file listing
+    * [thumbnails](#thumbnails) - press `g` to toggle grid-view instead of the file listing
    * [zip downloads](#zip-downloads) - download folders (or file selections) as `zip` or `tar` files
-    * [uploading](#uploading) - web-browsers can upload using `bup` and `up2k`
-        * [file-search](#file-search) - drop files/folders into up2k to see if they exist on the server
+    * [uploading](#uploading) - drag files/folders into the web-browser to upload
+        * [file-search](#file-search) - dropping files into the browser also lets you see if they exist on the server
        * [unpost](#unpost) - undo/delete accidental uploads
    * [file manager](#file-manager) - cut/paste, rename, and delete files/folders (if you have permission)
-    * [batch rename](#batch-rename) - select some files and press F2 to bring up the rename UI
+    * [batch rename](#batch-rename) - select some files and press `F2` to bring up the rename UI
    * [markdown viewer](#markdown-viewer) - and there are *two* editors
    * [other tricks](#other-tricks)
    * [searching](#searching) - search by size, date, path/name, mp3-tags, ...
 * [server config](#server-config)
    * [file indexing](#file-indexing)
-    * [upload rules](#upload-rules) - set upload rules using volume flags, some examples
+    * [upload rules](#upload-rules) - set upload rules using volume flags
    * [compress uploads](#compress-uploads) - files can be autocompressed on upload
-    * [database location](#database-location) - can be stored in-volume (default) or elsewhere
+    * [database location](#database-location) - in-volume (`.hist/up2k.db`, default) or somewhere else
    * [metadata from audio files](#metadata-from-audio-files) - set `-e2t` to index tags on upload
    * [file parser plugins](#file-parser-plugins) - provide custom parsers to index additional tags
    * [complete examples](#complete-examples)
 * [browser support](#browser-support) - TLDR: yes
 * [client examples](#client-examples) - interact with copyparty using non-browser clients
 * [up2k](#up2k) - quick outline of the up2k protocol, see [uploading](#uploading) for the web-client
-* [performance](#performance) - defaults are good for most cases
+    * [why chunk-hashes](#why-chunk-hashes) - a single sha512 would be better, right?
+* [performance](#performance) - defaults are usually fine - expect `8 GiB/s` download, `1 GiB/s` upload
+* [security](#security) - some notes on hardening
+    * [gotchas](#gotchas) - behavior that might be unexpected
 * [dependencies](#dependencies) - mandatory deps
    * [optional dependencies](#optional-dependencies) - install these to enable bonus features
    * [install recommended deps](#install-recommended-deps)
@@ -71,28 +75,31 @@ turn your phone or raspi into a portable file server with resumable uploads/down

 ## quickstart

-download [copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) and you're all set!
+download **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** and you're all set!

-running the sfx without arguments (for example doubleclicking it on Windows) will give everyone full access to the current folder; see `-h` for help if you want [accounts and volumes](#accounts-and-volumes) etc
+running the sfx without arguments (for example doubleclicking it on Windows) will give everyone read/write access to the current folder; see `-h` for help if you want [accounts and volumes](#accounts-and-volumes) etc

 some recommended options:
-* `-e2dsa` enables general file indexing, see [search configuration](#search-configuration)
+* `-e2dsa` enables general [file indexing](#file-indexing)
 * `-e2ts` enables audio metadata indexing (needs either FFprobe or Mutagen), see [optional dependencies](#optional-dependencies)
 * `-v /mnt/music:/music:r:rw,foo -a foo:bar` shares `/mnt/music` as `/music`, `r`eadable by anyone, and read-write for user `foo`, password `bar`
  * replace `:r:rw,foo` with `:r,foo` to only make the folder readable by `foo` and nobody else
  * see [accounts and volumes](#accounts-and-volumes) for the syntax and other access levels (`r`ead, `w`rite, `m`ove, `d`elete)
 * `--ls '**,*,ln,p,r'` to crash on startup if any of the volumes contain a symlink which point outside the volume, as that could give users unintended access

+
+### on servers
+
 you may also want these, especially on servers:
+
 * [contrib/systemd/copyparty.service](contrib/systemd/copyparty.service) to run copyparty as a systemd service
+* [contrib/systemd/prisonparty.service](contrib/systemd/prisonparty.service) to run it in a chroot (for extra security)
 * [contrib/nginx/copyparty.conf](contrib/nginx/copyparty.conf) to reverse-proxy behind nginx (for better https)


 ### on debian

-recommended additional steps on debian
-
-enable audio metadata and thumbnails (from images and videos):
+recommended additional steps on debian  which enable audio metadata and thumbnails (from images and videos):

 * as root, run the following:  
  `apt install python3 python3-pip python3-dev ffmpeg`
@@ -114,12 +121,12 @@ browser-specific:
 * Android-Chrome: increase "parallel uploads" for higher speed (android bug)
 * Android-Firefox: takes a while to select files (their fix for ☝️)
 * Desktop-Firefox: ~~may use gigabytes of RAM if your files are massive~~ *seems to be OK now*
-* Desktop-Firefox: may stop you from deleting folders you've uploaded until you visit `about:memory` and click `Minimize memory usage`
+* Desktop-Firefox: may stop you from deleting files you've uploaded until you visit `about:memory` and click `Minimize memory usage`


 ## status

-summary: all planned features work! now please enjoy the bloatening
+feature summary

 * backend stuff
  * ☑ sanic multipart parser
@@ -137,7 +144,7 @@ summary: all planned features work! now please enjoy the bloatening
  * ☑ [folders as zip / tar files](#zip-downloads)
  * ☑ FUSE client (read-only)
 * browser
-  * ☑ navpane (directory tree sidebar)
+  * ☑ [navpane](#navpane) (directory tree sidebar)
  * ☑ file manager (cut/paste, delete, [batch-rename](#batch-rename))
  * ☑ audio player (with OS media controls)
  * ☑ image gallery with webm player
@@ -168,12 +175,11 @@ small collection of user feedback
 * Windows: python 3.7 and older cannot read tags with FFprobe, so use Mutagen or upgrade
 * Windows: python 2.7 cannot index non-ascii filenames with `-e2d`
 * Windows: python 2.7 cannot handle filenames with mojibake
-* `--th-ff-jpg` may fix video thumbnails on some FFmpeg versions
+* `--th-ff-jpg` may fix video thumbnails on some FFmpeg versions (macos, some linux)

 ## general bugs

 * all volumes must exist / be available on startup; up2k (mtp especially) gets funky otherwise
-* cannot mount something at `/d1/d2/d3` unless `d2` exists inside `d1`
 * probably more, pls let me know

 ## not my bugs
@@ -194,15 +200,16 @@ per-folder, per-user permissions
 * `-a usr:pwd` adds account `usr` with password `pwd`
 * `-v .::r` adds current-folder `.` as the webroot, `r`eadable by anyone
  * the syntax is `-v src:dst:perm:perm:...` so local-path, url-path, and one or more permissions to set
-  * when granting permissions to an account, the names are comma-separated: `-v .::r,usr1,usr2:rw,usr3,usr4`
+  * granting the same permissions to multiple accounts:  
+    `-v .::r,usr1,usr2:rw,usr3,usr4` = usr1/2 read-only, 3/4 read-write

 permissions:
 * `r` (read): browse folder contents, download files, download as zip/tar
-* `w` (write): upload files, move files *into* folder
-* `m` (move): move files/folders *from* folder
+* `w` (write): upload files, move files *into* this folder
+* `m` (move): move files/folders *from* this folder
 * `d` (delete): delete files/folders

-example:
+examples:
 * add accounts named u1, u2, u3 with passwords p1, p2, p3: `-a u1:p1 -a u2:p2 -a u3:p3`
 * make folder `/srv` the root of the filesystem, read-only by anyone: `-v /srv::r`
 * make folder `/mnt/music` available at `/music`, read-only for u1 and u2, read-write for u3: `-v /mnt/music:music:r,u1,u2:rw,u3`
@@ -235,15 +242,15 @@ the main tabs in the ui

 ## hotkeys

-the browser has the following hotkeys (always qwerty)
-* `B` toggle breadcrumbs / navpane
+the browser has the following hotkeys  (always qwerty)
+* `B` toggle breadcrumbs / [navpane](#navpane)
 * `I/K` prev/next folder
 * `M` parent folder (or unexpand current)
-* `G` toggle list / grid view
+* `G` toggle list / [grid view](#thumbnails)
 * `T` toggle thumbnails / icons
 * `ctrl-X` cut selected files/folders
 * `ctrl-V` paste
-* `F2` rename selected file/folder
+* `F2` [rename](#batch-rename) selected file/folder
 * when a file/folder is selected (in not-grid-view):
  * `Up/Down` move cursor
  * shift+`Up/Down` select and move cursor
@@ -270,7 +277,7 @@ the browser has the following hotkeys (always qwerty)
    * `M` mute
 * when the navpane is open:
  * `A/D` adjust tree width
-* in the grid view:
+* in the [grid view](#thumbnails):
  * `S` toggle multiselect
  * shift+`A/D` zoom
 * in the markdown editor:
@@ -288,12 +295,14 @@ switching between breadcrumbs or navpane

 click the `🌲` or pressing the `B` hotkey to toggle between breadcrumbs path (default), or a navpane (tree-browser sidebar thing)

-click `[-]` and `[+]` (or hotkeys `A`/`D`) to adjust the size, and the `[a]` toggles if the tree should widen dynamically as you go deeper or stay fixed-size
+* `[-]` and `[+]` (or hotkeys `A`/`D`) adjust the size
+* `[v]` jumps to the currently open folder
+* `[a]` toggles automatic widening as you go deeper


 ## thumbnails

-press `g` to toggle image/video thumbnails instead of the file listing
+press `g` to toggle grid-view instead of the file listing,  and `t` toggles icons / thumbnails

 ![copyparty-thumbs-fs8](https://user-images.githubusercontent.com/241032/129636211-abd20fa2-a953-4366-9423-1c88ebb96ba9.png)

@@ -308,7 +317,7 @@ in the grid/thumbnail view, if the audio player panel is open, songs will start

 download folders (or file selections) as `zip` or `tar` files

-select which type of archive you want in the browser settings tab:
+select which type of archive you want in the `[⚙️] config` tab:

 | name | url-suffix | description |
 |--|--|--|
@@ -330,11 +339,13 @@ you can also zip a selection of files or folders by clicking them in the browser

 ## uploading

-web-browsers can upload using `bup` and `up2k`:
+drag files/folders into the web-browser to upload
+
+this initiates an upload using `up2k`; there are two uploaders available:
 * `[🎈] bup`, the basic uploader, supports almost every browser since netscape 4.0
 * `[🚀] up2k`, the fancy one

-you can undo/delete uploads using `[🧯]` [unpost](#unpost)
+you can also undo/delete uploads by using `[🧯]` [unpost](#unpost)

 up2k has several advantages:
 * you can drop folders into the browser (files are added recursively)
@@ -355,36 +366,41 @@ see [up2k](#up2k) for details on how it works
 the up2k UI is the epitome of polished inutitive experiences:
 * "parallel uploads" specifies how many chunks to upload at the same time
 * `[🏃]` analysis of other files should continue while one is uploading
-* `[💭]` ask for confirmation before files are added to the list
+* `[💭]` ask for confirmation before files are added to the queue
 * `[💤]` sync uploading between other copyparty browser-tabs so only one is active
-* `[🔎]` switch between upload and file-search mode
+* `[🔎]` switch between upload and [file-search](#file-search) mode
+  * ignore `[🔎]` if you add files by dragging them into the browser

 and then theres the tabs below it,
-* `[ok]` is uploads which completed successfully
-* `[ng]` is the uploads which failed / got rejected (already exists, ...)
+* `[ok]` is the files which completed successfully
+* `[ng]` is the ones that failed / got rejected (already exists, ...)
 * `[done]` shows a combined list of `[ok]` and `[ng]`, chronological order
 * `[busy]` files which are currently hashing, pending-upload, or uploading
  * plus up to 3 entries each from `[done]` and `[que]` for context
 * `[que]` is all the files that are still queued

+note that since up2k has to read each file twice, `[🎈 bup]` can *theoretically* be up to 2x faster in some extreme cases (files bigger than your ram, combined with an internet connection faster than the read-speed of your HDD)
+
+if you are resuming a massive upload and want to skip hashing the files which already finished, you can enable `turbo` in the `[⚙️] config` tab, but please read the tooltip on that button
+

 ### file-search

-drop files/folders into up2k to see if they exist on the server
+dropping files into the browser also lets you see if they exist on the server

 ![copyparty-fsearch-fs8](https://user-images.githubusercontent.com/241032/129635361-c79286f0-b8f1-440e-aaf4-6e929428fac9.png)

-in the `[🚀 up2k]` tab, after toggling the `[🔎]` switch green, any files/folders you drop onto the dropzone will be hashed on the client-side. Each hash is sent to the server which checks if that file exists somewhere
+when you drag/drop files into the browser, you will see two dropzones: `Upload` and `Search`
+
+> on a phone? toggle the `[🔎]` switch green before tapping the big yellow Search button to select your files
+
+the files will be hashed on the client-side, and each hash is sent to the server, which checks if that file exists somewhere

 files go into `[ok]` if they exist (and you get a link to where it is), otherwise they land in `[ng]`
 * the main reason filesearch is combined with the uploader is cause the code was too spaghetti to separate it out somewhere else, this is no longer the case but now i've warmed up to the idea too much

 adding the same file multiple times is blocked, so if you first search for a file and then decide to upload it, you have to click the `[cleanup]` button to discard `[done]` files (or just refresh the page)

-note that since up2k has to read the file twice, `[🎈 bup]` can be up to 2x faster in extreme cases (if your internet connection is faster than the read-speed of your HDD)
-
-up2k has saved a few uploads from becoming corrupted in-transfer already; caught an android phone on wifi redhanded in wireshark with a bitflip, however bup with https would *probably* have noticed as well (thanks to tls also functioning as an integrity check)
-

 ### unpost

@@ -399,12 +415,22 @@ you can unpost even if you don't have regular move/delete access, however only f

 cut/paste, rename, and delete files/folders (if you have permission)

+file selection: click somewhere on the line (not the link itsef), then:
+* `space` to toggle
+* `up/down` to move
+* `shift-up/down` to move-and-select
+* `ctrl-shift-up/down` to also scroll
+
+* cut: select some files and `ctrl-x`
+* paste: `ctrl-v` in another folder
+* rename: `F2`
+
 you can move files across browser tabs (cut in one tab, paste in another)


 ## batch rename

-select some files and press F2 to bring up the rename UI
+select some files and press `F2` to bring up the rename UI

 ![batch-rename-fs8](https://user-images.githubusercontent.com/241032/128434204-eb136680-3c07-4ec7-92e0-ae86af20c241.png)

@@ -464,6 +490,12 @@ and there are *two* editors

 * if you are using media hotkeys to switch songs and are getting tired of seeing the OSD popup which Windows doesn't let you disable, consider https://ocv.me/dev/?media-osd-bgone.ps1

+* click the bottom-left `π` to open a javascript prompt for debugging
+
+* files named `.prologue.html` / `.epilogue.html` will be rendered before/after directory listings unless `--no-logues`
+
+* files named `README.md` / `readme.md` will be rendered after directory listings unless `--no-readme` (but `.epilogue.html` takes precedence)
+

 ## searching

@@ -486,15 +518,15 @@ add the argument `-e2ts` to also scan/index tags from music files, which brings

 ## file indexing

-file indexing relies on two databases, the up2k filetree (`-e2d`) and the metadata tags (`-e2t`). Configuration can be done through arguments, volume flags, or a mix of both.
+file indexing relies on two database tables, the up2k filetree (`-e2d`) and the metadata tags (`-e2t`), stored in `.hist/up2k.db`. Configuration can be done through arguments, volume flags, or a mix of both.

 through arguments:
 * `-e2d` enables file indexing on upload
-* `-e2ds` scans writable folders for new files on startup
-* `-e2dsa` scans all mounted volumes (including readonly ones)
+* `-e2ds` also scans writable folders for new files on startup
+* `-e2dsa` also scans all mounted volumes (including readonly ones)
 * `-e2t` enables metadata indexing on upload
-* `-e2ts` scans for tags in all files that don't have tags yet
-* `-e2tsr` deletes all existing tags, does a full reindex
+* `-e2ts` also scans for tags in all files that don't have tags yet
+* `-e2tsr` also deletes all existing tags, doing a full reindex

 the same arguments can be set as volume flags, in addition to `d2d` and `d2t` for disabling:
 * `-v ~/music::r:c,e2dsa:c,e2tsr` does a full reindex of everything on startup
@@ -502,10 +534,11 @@ the same arguments can be set as volume flags, in addition to `d2d` and `d2t` fo
 * `-v ~/music::r:c,d2t` disables all `-e2t*` (tags), does not affect `-e2d*`

 note:
+* the parser currently can't handle `c,e2dsa,e2tsr` so you have to `c,e2dsa:c,e2tsr`
 * `e2tsr` is probably always overkill, since `e2ds`/`e2dsa` would pick up any file modifications and `e2ts` would then reindex those, unless there is a new copyparty version with new parsers and the release note says otherwise
 * the rescan button in the admin panel has no effect unless the volume has `-e2ds` or higher

-you can choose to only index filename/path/size/last-modified (and not the hash of the file contents) by setting `--no-hash` or the volume-flag `:c,dhash`, this has the following consequences:
+to save some time, you can choose to only index filename/path/size/last-modified (and not the hash of the file contents) by setting `--no-hash` or the volume-flag `:c,dhash`, this has the following consequences:
 * initial indexing is way faster, especially when the volume is on a network disk
 * makes it impossible to [file-search](#file-search)
 * if someone uploads the same file contents, the upload will not be detected as a dupe, so it will not get symlinked or rejected
@@ -515,7 +548,7 @@ if you set `--no-hash`, you can enable hashing for specific volumes using flag `

 ## upload rules

-set upload rules using volume flags, some examples:
+set upload rules using volume flags,  some examples:

 * `:c,sz=1k-3m` sets allowed filesize between 1 KiB and 3 MiB inclusive (suffixes: b, k, m, g)
 * `:c,nosub` disallow uploading into subdirectories; goes well with `rotn` and `rotf`:
@@ -534,9 +567,7 @@ you can also set transaction limits which apply per-IP and per-volume, but these

 ## compress uploads

-files can be autocompressed on upload
-
-compression is either on user-request (if config allows) or forced by server-config
+files can be autocompressed on upload,  either on user-request (if config allows) or forced by server-config

 * volume flag `gz` allows gz compression
 * volume flag `xz` allows lzma compression
@@ -557,7 +588,7 @@ some examples,

 ## database location

-can be stored in-volume (default) or elsewhere
+in-volume (`.hist/up2k.db`, default) or somewhere else

 copyparty creates a subfolder named `.hist` inside each volume where it stores the database, thumbnails, and some other stuff

@@ -579,13 +610,13 @@ set `-e2t` to index tags on upload

 if you add/remove a tag from `mte` you will need to run with `-e2tsr` once to rebuild the database, otherwise only new files will be affected

-but instead of using `-mte`, `-mth` is a better way to hide tags in the browser: these tags will not be displayed by default, but they still get indexed and become searchable, and users can choose to unhide them in the settings pane
+but instead of using `-mte`, `-mth` is a better way to hide tags in the browser: these tags will not be displayed by default, but they still get indexed and become searchable, and users can choose to unhide them in the `[⚙️] config` pane

 `-mtm` can be used to add or redefine a metadata mapping, say you have media files with `foo` and `bar` tags and you want them to display as `qux` in the browser (preferring `foo` if both are present), then do `-mtm qux=foo,bar` and now you can `-mte artist,title,qux`

 tags that start with a `.` such as `.bpm` and `.dur`(ation) indicate numeric value

-see the beautiful mess of a dictionary in [mtag.py](https://github.com/9001/copyparty/blob/master/copyparty/mtag.py) for the default mappings (should cover mp3,opus,flac,m4a,wav,aif,)
+see the beautiful mess of a dictionary in [mtag.py](https://github.com/9001/copyparty/blob/hovudstraum/copyparty/mtag.py) for the default mappings (should cover mp3,opus,flac,m4a,wav,aif,)

 `--no-mutagen` disables Mutagen and uses FFprobe instead, which...
 * is about 20x slower than Mutagen
@@ -647,10 +678,10 @@ TLDR: yes
 | **= feature =** | ie6 | ie9  | ie10 | ie11 | ff 52 | c 49 | iOS | Andr |

 * internet explorer 6 to 8 behave the same
-* firefox 52 and chrome 49 are the last winxp versions
-* `*1` yes, but extremely slow (ie10: 1 MiB/s, ie11: 270 KiB/s)
+* firefox 52 and chrome 49 are the final winxp versions
+* `*1` yes, but extremely slow (ie10: `1 MiB/s`, ie11: `270 KiB/s`)
 * `*2` causes a full-page refresh on each navigation
-* `*3` using a wasm decoder which can sometimes get stuck and consumes a bit more power
+* `*3` using a wasm decoder which consumes a bit more power

 quick summary of more eccentric web-browsers trying to view a directory index:

@@ -694,6 +725,8 @@ copyparty returns a truncated sha512sum of your PUT/POST as base64; you can gene
    b512(){ printf "$((sha512sum||shasum -a512)|sed -E 's/ .*//;s/(..)/\\x\1/g')"|base64|tr '+/' '-_'|head -c44;}
    b512 <movie.mkv

+you can provide passwords using cookie 'cppwd=hunter2', as a url query `?pw=hunter2`, or with basic-authentication (either as the username or password)
+

 # up2k

@@ -710,12 +743,25 @@ quick outline of the up2k protocol, see [uploading](#uploading) for the web-clie
  * server writes chunks into place based on the hash
 * client does another handshake with the hashlist; server replies with OK or a list of chunks to reupload

+up2k has saved a few uploads from becoming corrupted in-transfer already; caught an android phone on wifi redhanded in wireshark with a bitflip, however bup with https would *probably* have noticed as well (thanks to tls also functioning as an integrity check)
+
+
+## why chunk-hashes
+
+a single sha512 would be better, right?
+
+this is due to `crypto.subtle` not providing a streaming api (or the option to seed the sha512 hasher with a starting hash)
+
+as a result, the hashes are much less useful than they could have been (search the server by sha512, provide the sha512 in the response http headers, ...)
+
+hashwasm would solve the streaming issue but reduces hashing speed for sha512 (xxh128 does 6 GiB/s), and it would make old browsers and [iphones](https://bugs.webkit.org/show_bug.cgi?id=228552) unsupported
+

 # performance

-defaults are good for most cases
+defaults are usually fine - expect `8 GiB/s` download, `1 GiB/s` upload

-you can ignore the `cannot efficiently use multiple CPU cores` message, it's very unlikely to be a problem
+you can ignore the `cannot efficiently use multiple CPU cores` message, very unlikely to be a problem

 below are some tweaks roughly ordered by usefulness:

@@ -730,6 +776,24 @@ below are some tweaks roughly ordered by usefulness:
  ...however it adds an overhead to internal communication so it might be a net loss, see if it works 4 u


+# security
+
+some notes on hardening
+
+on public copyparty instances with anonymous upload enabled:
+
+* users can upload html/css/js which will evaluate for other visitors in a few ways,
+  * unless `--no-readme` is set: by uploading/modifying a file named `readme.md`
+  * if `move` access is granted AND none of `--no-logues`, `--no-dot-mv`, `--no-dot-ren` is set: by uploading some .html file and renaming it to `.epilogue.html` (uploading it directly is blocked)
+
+
+## gotchas
+
+behavior that might be unexpected
+
+* users without read-access to a folder can still see the `.prologue.html` / `.epilogue.html` / `README.md` contents, for the purpose of showing a description on how to use the uploader for example
+
+
 # dependencies

 mandatory deps:
@@ -744,17 +808,11 @@ enable music tags:
 * either `mutagen` (fast, pure-python, skips a few tags, makes copyparty GPL? idk)
 * or `ffprobe` (20x slower, more accurate, possibly dangerous depending on your distro and users)

-enable thumbnails of images:
-* `Pillow` (requires py2.7 or py3.5+)
-
-enable thumbnails of videos:
-* `ffmpeg` and `ffprobe` somewhere in `$PATH`
-
-enable thumbnails of HEIF pictures:
-* `pyheif-pillow-opener` (requires Linux or a C compiler)
-
-enable thumbnails of AVIF pictures:
-* `pillow-avif-plugin`
+enable [thumbnails](#thumbnails) of...
+* **images:** `Pillow` (requires py2.7 or py3.5+)
+* **videos:** `ffmpeg` and `ffprobe` somewhere in `$PATH`
+* **HEIF pictures:** `pyheif-pillow-opener` (requires Linux or a C compiler)
+* **AVIF pictures:** `pillow-avif-plugin`


 ## install recommended deps
@@ -791,8 +849,10 @@ if you don't need all the features, you can repack the sfx and save a bunch of s
 * `223k` after `./scripts/make-sfx.sh re no-ogv no-cm`

 the features you can opt to drop are
-* `ogv`.js, the opus/vorbis decoder which is needed by apple devices to play foss audio files
-* `cm`/easymde, the "fancy" markdown editor
+* `ogv`.js, the opus/vorbis decoder which is needed by apple devices to play foss audio files, saves ~192k
+* `cm`/easymde, the "fancy" markdown editor, saves ~92k
+* `fnt`, source-code-pro, the monospace font, saves ~9k
+* `dd`, the custom mouse cursor for the media player tray tab, saves ~2k

 for the `re`pack to work, first run one of the sfx'es once to unpack it

@@ -828,7 +888,7 @@ pip install black bandit pylint flake8  # vscode tooling

 ## just the sfx

-grab the web-dependencies from a previous sfx (unless you need to modify something in those):
+first grab the web-dependencies from a previous sfx (assuming you don't need to modify something in those):

 ```sh
 rm -rf copyparty/web/deps
@@ -854,8 +914,8 @@ in the `scripts` folder:

 * run `make -C deps-docker` to build all dependencies
 * `git tag v1.2.3 && git push origin --tags`
-* create github release with `make-tgz-release.sh`
 * upload to pypi with `make-pypi-release.(sh|bat)`
+* create github release with `make-tgz-release.sh`
 * create sfx with `make-sfx.sh`


@@ -863,8 +923,7 @@ in the `scripts` folder:

 roughly sorted by priority

-* hls framework for Someone Else to drop code into :^)
-* readme.md as epilogue
+* nothing! currently


 ## discarded ideas
@@ -892,3 +951,5 @@ roughly sorted by priority
 * indexedDB for hashes, cfg enable/clear/sz, 2gb avail, ~9k for 1g, ~4k for 100m, 500k items before autoeviction
  * blank hashlist when up-ok to skip handshake
    * too many confusing side-effects
+* hls framework for Someone Else to drop code into :^)
+  * probably not, too much stuff to consider -- seeking, start at offset, task stitching (probably np-hard), conditional passthru, rate-control (especially multi-consumer), session keepalive, cache mgmt...
--- a/bin/copyparty-fuse.py
+++ b/bin/copyparty-fuse.py
@@ -22,7 +22,7 @@ dependencies:

 note:
  you probably want to run this on windows clients:
-  https://github.com/9001/copyparty/blob/master/contrib/explorer-nothumbs-nofoldertypes.reg
+  https://github.com/9001/copyparty/blob/hovudstraum/contrib/explorer-nothumbs-nofoldertypes.reg

 get server cert:
  awk '/-BEGIN CERTIFICATE-/ {a=1} a; /-END CERTIFICATE-/{exit}' <(openssl s_client -connect 127.0.0.1:3923 </dev/null 2>/dev/null) >cert.pem
--- a/contrib/README.md
+++ b/contrib/README.md
@@ -29,7 +29,8 @@ however if your copyparty is behind a reverse-proxy, you may want to use [`share

 # OS integration
 init-scripts to start copyparty as a service
-* [`systemd/copyparty.service`](systemd/copyparty.service)
+* [`systemd/copyparty.service`](systemd/copyparty.service) runs the sfx normally
+* [`systemd/prisonparty.service`](systemd/prisonparty.service) runs the sfx in a chroot
 * [`openrc/copyparty`](openrc/copyparty)

 # Reverse-proxy
--- a/copyparty/main.py
+++ b/copyparty/main.py
@@ -360,6 +360,10 @@ def run_argparse(argv, formatter):
    ap2 = ap.add_argument_group('safety options')
    ap2.add_argument("--ls", metavar="U[,V[,F]]", type=u, help="scan all volumes; arguments USER,VOL,FLAGS; example [**,*,ln,p,r]")
    ap2.add_argument("--salt", type=u, default="hunter2", help="up2k file-hash salt")
+    ap2.add_argument("--no-dot-mv", action="store_true", help="disallow moving dotfiles; makes it impossible to move folders containing dotfiles")
+    ap2.add_argument("--no-dot-ren", action="store_true", help="disallow renaming dotfiles; makes it impossible to make something a dotfile")
+    ap2.add_argument("--no-logues", action="store_true", help="disable rendering .prologue/.epilogue.html into directory listings")
+    ap2.add_argument("--no-readme", action="store_true", help="disable rendering readme.md into directory listings")

    ap2 = ap.add_argument_group('logging options')
    ap2.add_argument("-q", action="store_true", help="quiet")
--- a/copyparty/version.py
+++ b/copyparty/version.py
@@ -1,8 +1,8 @@
 # coding: utf-8

-VERSION = (0, 13, 9)
-CODENAME = "future-proof"
-BUILD_DT = (2021, 8, 29)
+VERSION = (1, 0, 1)
+CODENAME = "sufficient"
+BUILD_DT = (2021, 9, 9)

 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -434,7 +434,11 @@ class VFS(object):
        f2a = os.sep + "dir.txt"
        f2b = "{0}.hist{0}".format(os.sep)

-        g = self.walk("", vrem, [], uname, [[True]], dots, scandir, False)
+        # if multiselect: add all items to archive root
+        # if single folder: the folder itself is the top-level item
+        folder = "" if flt else (vrem.split("/")[-1] or "top")
+
+        g = self.walk(folder, vrem, [], uname, [[True]], dots, scandir, False)
        for _, _, vpath, apath, files, rd, vd in g:
            if flt:
                files = [x for x in files if x[0] in flt]
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -7,6 +7,7 @@ import gzip
 import time
 import copy
 import json
+import base64
 import string
 import socket
 import ctypes
@@ -192,7 +193,21 @@ class HttpCli(object):
        self.cookies = cookies
        self.vpath = unquotep(vpath)  # not query, so + means +

-        pwd = uparam.get("pw")
+        pwd = None
+        ba = self.headers.get("authorization")
+        if ba:
+            try:
+                ba = ba.split(" ")[1].encode("ascii")
+                ba = base64.b64decode(ba).decode("utf-8")
+                # try "pwd", "x:pwd", "pwd:x"
+                for ba in [ba] + ba.split(":", 1)[::-1]:
+                    if self.asrv.iacct.get(ba):
+                        pwd = ba
+                        break
+            except:
+                pass
+
+        pwd = uparam.get("pw") or pwd
        self.uname = self.asrv.iacct.get(pwd, "*")
        self.rvol = self.asrv.vfs.aread[self.uname]
        self.wvol = self.asrv.vfs.awrite[self.uname]
@@ -490,7 +505,7 @@ class HttpCli(object):
            if "get" in opt:
                return self.handle_get()

-            raise Pebkac(405, "POST({}) is disabled".format(ctype))
+            raise Pebkac(405, "POST({}) is disabled in server config".format(ctype))

        raise Pebkac(405, "don't know how to handle POST({})".format(ctype))

@@ -873,7 +888,7 @@ class HttpCli(object):
        self.parser.drop()

        ck, msg = self.get_pwd_cookie(pwd)
-        html = self.j2("msg", h1=msg, h2='<a href="/">ack</a>', redir="/")
+        html = self.j2("msg", h1=msg, h2='<a href="/?h">ack</a>', redir="/?h")
        self.reply(html.encode("utf-8"), headers={"Set-Cookie": ck})
        return True

@@ -1599,7 +1614,7 @@ class HttpCli(object):
            raise Pebkac(403, "not allowed for user " + self.uname)

        if self.args.no_rescan:
-            raise Pebkac(403, "disabled by argv")
+            raise Pebkac(403, "the rescan feature is disabled in server config")

        vn, _ = self.asrv.vfs.get(self.vpath, self.uname, True, True)

@@ -1618,7 +1633,7 @@ class HttpCli(object):
            raise Pebkac(403, "not allowed for user " + self.uname)

        if self.args.no_stack:
-            raise Pebkac(403, "disabled by argv")
+            raise Pebkac(403, "the stackdump feature is disabled in server config")

        ret = "<pre>{}\n{}".format(time.time(), alltrace())
        self.reply(ret.encode("utf-8"))
@@ -1682,7 +1697,7 @@ class HttpCli(object):

    def tx_ups(self):
        if not self.args.unpost:
-            raise Pebkac(400, "the unpost feature was disabled by server config")
+            raise Pebkac(400, "the unpost feature is disabled in server config")

        filt = self.uparam.get("filter")
        lm = "ups [{}]".format(filt)
@@ -1720,7 +1735,7 @@ class HttpCli(object):
            raise Pebkac(403, "not allowed for user " + self.uname)

        if self.args.no_del:
-            raise Pebkac(403, "disabled by argv")
+            raise Pebkac(403, "the delete feature is disabled in server config")

        if not req:
            req = [self.vpath]
@@ -1733,7 +1748,7 @@ class HttpCli(object):
            raise Pebkac(403, "not allowed for user " + self.uname)

        if self.args.no_mv:
-            raise Pebkac(403, "disabled by argv")
+            raise Pebkac(403, "the rename/move feature is disabled in server config")

        # full path of new loc (incl filename)
        dst = self.uparam.get("move")
@@ -1853,11 +1868,21 @@ class HttpCli(object):
            tpl = "browser2"

        logues = ["", ""]
-        for n, fn in enumerate([".prologue.html", ".epilogue.html"]):
-            fn = os.path.join(abspath, fn)
-            if bos.path.exists(fn):
-                with open(fsenc(fn), "rb") as f:
-                    logues[n] = f.read().decode("utf-8")
+        if not self.args.no_logues:
+            for n, fn in enumerate([".prologue.html", ".epilogue.html"]):
+                fn = os.path.join(abspath, fn)
+                if bos.path.exists(fn):
+                    with open(fsenc(fn), "rb") as f:
+                        logues[n] = f.read().decode("utf-8")
+
+        readme = ""
+        if not self.args.no_readme and not logues[1]:
+            for fn in ["README.md", "readme.md"]:
+                fn = os.path.join(abspath, fn)
+                if bos.path.exists(fn):
+                    with open(fsenc(fn), "rb") as f:
+                        readme = f.read().decode("utf-8")
+                        break

        ls_ret = {
            "dirs": [],
@@ -1867,6 +1892,7 @@ class HttpCli(object):
            "acct": self.uname,
            "perms": perms,
            "logues": logues,
+            "readme": readme,
        }
        j2a = {
            "vdir": quotep(self.vpath),
@@ -1885,6 +1911,7 @@ class HttpCli(object):
            "have_b_u": (self.can_write and self.uparam.get("b") == "u"),
            "url_suf": url_suf,
            "logues": logues,
+            "readme": readme,
            "title": html_escape(self.vpath, crlf=True),
            "srv_info": srv_info,
        }
--- a/copyparty/stolen/surrogateescape.py
+++ b/copyparty/stolen/surrogateescape.py
@@ -1,3 +1,5 @@
+# coding: utf-8
+
 """
 This is Victor Stinner's pure-Python implementation of PEP 383: the "surrogateescape" error
 handler of Python 3.
@@ -171,7 +173,7 @@ FS_ENCODING = sys.getfilesystemencoding()

 if WINDOWS and not PY3:
    # py2 thinks win* is mbcs, probably a bug? anyways this works
-    FS_ENCODING = 'utf-8'
+    FS_ENCODING = "utf-8"


 # normalize the filesystem encoding name.
--- a/copyparty/tcpsrv.py
+++ b/copyparty/tcpsrv.py
@@ -177,7 +177,7 @@ class TcpSrv(object):
            eps = self.ips_linux()

        if "0.0.0.0" not in listen_ips:
-            eps = {k: v for k, v in eps if k in listen_ips}
+            eps = {k: v for k, v in eps.items() if k in listen_ips}

        default_route = None
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
--- a/copyparty/th_srv.py
+++ b/copyparty/th_srv.py
@@ -270,13 +270,14 @@ class ThumbSrv(object):
                fmts += ["RGBA", "LA"]
                args["method"] = 6
            else:
-                pass  # default q = 75
+                # default q = 75
+                args["progressive"] = True

            if im.mode not in fmts:
                # print("conv {}".format(im.mode))
                im = im.convert("RGB")

-            im.save(tpath, quality=40, method=6)
+            im.save(tpath, **args)

    def conv_ffmpeg(self, abspath, tpath):
        ret, _ = ffprobe(abspath)
--- a/copyparty/up2k.py
+++ b/copyparty/up2k.py
@@ -1405,7 +1405,7 @@ class Up2k(object):
        except:
            # unpost with missing permissions? try read+write and verify with db
            if not self.args.unpost:
-                raise Pebkac(400, "the unpost feature was disabled by server config")
+                raise Pebkac(400, "the unpost feature is disabled in server config")

            unpost = True
            permsets = [[True, True]]
@@ -1455,12 +1455,14 @@ class Up2k(object):
                self.log("rm {}\n  {}".format(vpath, abspath))
                _ = dbv.get(volpath, uname, *permsets[0])
                with self.mutex:
+                    cur = None
                    try:
                        ptop = dbv.realpath
                        cur, wark, _, _, _, _ = self._find_from_vpath(ptop, volpath)
                        self._forget_file(ptop, volpath, cur, wark, True)
                    finally:
-                        cur.connection.commit()
+                        if cur:
+                            cur.connection.commit()

                bos.unlink(abspath)

@@ -1520,6 +1522,14 @@ class Up2k(object):
        dabs = dvn.canonical(drem)
        drd, dfn = vsplit(drem)

+        n1 = svp.split("/")[-1]
+        n2 = dvp.split("/")[-1]
+        if n1.startswith(".") or n2.startswith("."):
+            if self.args.no_dot_mv:
+                raise Pebkac(400, "moving dotfiles is disabled in server config")
+            elif self.args.no_dot_ren and n1 != n2:
+                raise Pebkac(400, "renaming dotfiles is disabled in server config")
+
        if bos.path.exists(dabs):
            raise Pebkac(400, "mv2: target file exists")

@@ -1575,7 +1585,7 @@ class Up2k(object):
    def _find_from_vpath(self, ptop, vrem):
        cur = self.cur.get(ptop)
        if not cur:
-            return None, None
+            return [None] * 6

        rd, fn = vsplit(vrem)
        q = "select w, mt, sz, ip, at from up where rd=? and fn=? limit 1"
--- a/copyparty/util.py
+++ b/copyparty/util.py
@@ -169,7 +169,7 @@ class Cooldown(object):
            return ret


-class Unrecv(object):
+class _Unrecv(object):
    """
    undo any number of socket recv ops
    """
@@ -189,10 +189,68 @@ class Unrecv(object):
        except:
            return b""

+    def recv_ex(self, nbytes):
+        """read an exact number of bytes"""
+        ret = self.recv(nbytes)
+        while ret and len(ret) < nbytes:
+            buf = self.recv(nbytes - len(ret))
+            if not buf:
+                break
+
+            ret += buf
+
+        return ret
+
    def unrecv(self, buf):
        self.buf = buf + self.buf


+class _LUnrecv(object):
+    """
+    with expensive debug logging
+    """
+
+    def __init__(self, s):
+        self.s = s
+        self.buf = b""
+
+    def recv(self, nbytes):
+        if self.buf:
+            ret = self.buf[:nbytes]
+            self.buf = self.buf[nbytes:]
+            m = "\033[0;7mur:pop:\033[0;1;32m {}\n\033[0;7mur:rem:\033[0;1;35m {}\033[0m\n"
+            print(m.format(ret, self.buf), end="")
+            return ret
+
+        try:
+            ret = self.s.recv(nbytes)
+            m = "\033[0;7mur:recv\033[0;1;33m {}\033[0m\n"
+            print(m.format(ret), end="")
+            return ret
+        except:
+            return b""
+
+    def recv_ex(self, nbytes):
+        """read an exact number of bytes"""
+        ret = self.recv(nbytes)
+        while ret and len(ret) < nbytes:
+            buf = self.recv(nbytes - len(ret))
+            if not buf:
+                break
+
+            ret += buf
+
+        return ret
+
+    def unrecv(self, buf):
+        self.buf = buf + self.buf
+        m = "\033[0;7mur:push\033[0;1;31m {}\n\033[0;7mur:rem:\033[0;1;35m {}\033[0m\n"
+        print(m.format(buf, self.buf), end="")
+
+
+Unrecv = _Unrecv
+
+
 class ProgressPrinter(threading.Thread):
    """
    periodically print progress info without linefeeds
@@ -587,19 +645,21 @@ class MultipartParser(object):
        yields [fieldname, unsanitized_filename, fieldvalue]
        where fieldvalue yields chunks of data
        """
-        while True:
+        run = True
+        while run:
            fieldname, filename = self._read_header()
            yield [fieldname, filename, self._read_data()]

-            tail = self.sr.recv(2)
+            tail = self.sr.recv_ex(2)

            if tail == b"--":
                # EOF indicated by this immediately after final boundary
-                self.sr.recv(2)
-                return
+                tail = self.sr.recv_ex(2)
+                run = False

            if tail != b"\r\n":
-                raise Pebkac(400, "protocol error after field value")
+                m = "protocol error after field value: want b'\\r\\n', got {!r}"
+                raise Pebkac(400, m.format(tail))

    def _read_value(self, iterator, max_len):
        ret = b""
@@ -985,8 +1045,12 @@ def read_socket_chunked(sr, log=None):
            raise Pebkac(400, err)

        if chunklen == 0:
-            sr.recv(2)  # \r\n after final chunk
-            return
+            x = sr.recv_ex(2)
+            if x == b"\r\n":
+                return
+
+            m = "protocol error after final chunk: want b'\\r\\n', got {!r}"
+            raise Pebkac(400, m.format(x))

        if log:
            log("receiving {} byte chunk".format(chunklen))
@@ -994,7 +1058,10 @@ def read_socket_chunked(sr, log=None):
        for chunk in read_socket(sr, chunklen):
            yield chunk

-        sr.recv(2)  # \r\n after each chunk too
+        x = sr.recv_ex(2)
+        if x != b"\r\n":
+            m = "protocol error in chunk separator: want b'\\r\\n', got {!r}"
+            raise Pebkac(400, m.format(x))


 def yieldfile(fn):
--- a/copyparty/web/browser.css
+++ b/copyparty/web/browser.css
@@ -2,10 +2,6 @@
 	--grid-sz: 10em;
 	--grid-ln: 3;
 }
-@font-face {
-	font-family: 'scp';
-	src: local('Source Code Pro Regular'), local('SourceCodePro-Regular'), url(/.cpr/deps/scp.woff2) format('woff2');
-}
 * {
 	line-height: 1.2em;
 }
@@ -177,6 +173,10 @@ a, #files tbody div a:last-child {
 #epi.logue {
 	margin: .8em 0;
 }
+.mdo,
+.mdo * {
+	line-height: 1.4em;
+}
 #srv_info {
 	color: #a73;
 	background: #333;
@@ -204,6 +204,9 @@ a, #files tbody div a:last-child {
 	color: #f4c;
 	border-bottom: 1px solid rgba(255,68,204,0.6);
 }
+#repl {
+	padding: .33em;
+}
 #files tbody a.play {
 	color: #e70;
 	padding: .2em;
@@ -340,17 +343,19 @@ html.light #ggrid>a.sel {
 }
 #wtgrid,
 #wtico {
-	cursor: url(/.cpr/dd/4.png), pointer;
-	animation: cursor 500ms;
 	position: relative;
 	font-size: .9em;
 	top: -.04em;
 }
 #wtgrid {
 	font-size: .75em;
+	padding: .1em;
 	top: -.12em;
 }
-#wtgrid:hover,
+#wtico {
+	cursor: url(/.cpr/dd/4.png), pointer;
+	animation: cursor 500ms;
+}
 #wtico:hover {
 	animation: cursor 500ms infinite;
 }
@@ -378,23 +383,26 @@ html.light #ggrid>a.sel {
 	background: #3c3c3c;
 	box-shadow: 0 0 .5em #222;
 	border-radius: .3em 0 0 0;
-	padding: 0;
+	padding: 0 0 0 .1em;
 	color: #fff;
 }
-#wzip, #wnp {
+#wfm, #wzip, #wnp {
 	display: none;
-	margin-right: .3em;
-	padding-right: .3em;
-	border-right: .1em solid #555;
 }
-#wnp a {
-	position: relative;
-	font-size: .47em;
-	margin: 0 .1em;
-	top: -.4em;
+#wzip, #wnp {
+	margin-right: .2em;
+	padding-right: .2em;
+	border: 1px solid #555;
+	border-width: 0 .1em 0 0;
 }
-#wnp a+a {
-	margin-left: .33em;
+#wfm.act+#wzip,
+#wfm.act+#wzip+#wnp {
+	margin-left: .2em;
+	padding-left: .2em;
+	border-left-width: .1em;
+}
+#wfm.act {
+	display: inline-block;
 }
 #wtoggle,
 #wtoggle * {
@@ -408,6 +416,7 @@ html.light #ggrid>a.sel {
 	display: none;
 }
 #wfm a,
+#wnp a,
 #wzip a {
 	font-size: .5em;
 	padding: 0 .3em;
@@ -415,10 +424,14 @@ html.light #ggrid>a.sel {
 	position: relative;
 	display: inline-block;
 }
-#wfm span {
+#wfm span,
+#wnp span {
 	font-size: .6em;
 	display: block;
 }
+#wnp span {
+	font-size: .7em;
+}
 #wfm a:not(.en) {
 	opacity: .3;
 	color: #f6c;
@@ -803,8 +816,6 @@ input.eq_gain {
 	width: 1em;
 	border-radius: .2em;
 	margin: -1.2em auto 0 auto;
-	top: 2em;
-	position: relative;
 	background: #444;
 }
 #files th span {
@@ -1532,6 +1543,88 @@ html.light #bbox-overlay figcaption a {

 #op_up2k {
 	padding: 0 1em 1em 1em;
+	min-height: 0;
+	transition: min-height .2s;
+}
+#drops {
+	display: none;
+	z-index: 3;
+	background: rgba(48, 48, 48, 0.7);
+}
+#drops.vis,
+#drops .dropzone {
+	display: block;
+	position: fixed;
+	top: 0;
+	left: 0;
+	right: 0;
+	bottom: 0;
+}
+#drops .dropdesc {
+	position: fixed;
+	display: table;
+	left: 10%;
+	width: 78%;
+	height: 30%;
+	margin: 0;
+	font-size: 3em;
+	font-weight: bold;
+	text-shadow: .05em .05em .1em #000;
+	background: rgba(224, 224, 224, 0.2);
+	box-shadow: 0 0 0 #999;
+	border: .5em solid #999;
+	border-radius: .5em;
+	border-width: 1vw;
+	color: #fff;
+	transition: all 0.2s;
+}
+#drops .dropdesc.hl.ok {
+	border-color: #fff;
+	box-shadow: 0 0 1em #cf5;
+	background: rgba(24, 24, 24, 0.7);
+	left: 8%;
+	width: 82%;
+	height: 32%;
+	margin: -1vh 0;
+}
+#drops .dropdesc.hl.err {
+	background: rgba(224, 32, 65, 0.2);
+	box-shadow: 0 0 1em #f26;
+	border-color: #fab;
+}
+#drops .dropdesc>div {
+	display: table-cell;
+	vertical-align: middle;
+	text-align: center;
+}
+#drops .dropzone {
+	z-index: 80386;
+	height: 50%;
+}
+#drops #up_dz {
+	bottom: 50%;
+}
+#drops #srch_dz {
+	top: 50%;
+}
+#up_zd {
+	top: 12%;
+}
+#srch_zd {
+	bottom: 12%;
+}
+.dropdesc span {
+	color: #fff;
+	background: #490;
+	border-bottom: .3em solid #6d2;
+	text-shadow: 1px 1px 1px #000;
+	border-radius: .3em;
+	padding: .4em .8em;
+	font-size: .4em;
+}
+.dropdesc.err span {
+	background: #904;
+	border-color: #d26;
 }
 #u2form {
 	position: absolute;
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -113,6 +113,8 @@
 	<div id="epi" class="logue">{{ logues[1] }}</div>

 	<h2><a href="/?h">control-panel</a></h2>
+	
+	<a href="#" id="repl">π</a>

 </div>

@@ -131,7 +133,8 @@
 			have_mv = {{ have_mv|tojson }},
 			have_del = {{ have_del|tojson }},
 			have_unpost = {{ have_unpost|tojson }},
-			have_zip = {{ have_zip|tojson }};
+			have_zip = {{ have_zip|tojson }},
+			readme = {{ readme|tojson }};
 	</script>
 	<script src="/.cpr/util.js?_={{ ts }}"></script>
 	<script src="/.cpr/browser.js?_={{ ts }}"></script>
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -9,7 +9,7 @@ function dbg(msg) {

 // toolbar
 ebi('ops').innerHTML = (
-	'<a href="#" data-dest="" tt="close submenu">---</a>\n' +
+	'<a href="#" data-dest="" tt="close submenu">--</a>\n' +
 	(have_up2k_idx ? (
 		'<a href="#" data-perm="read" data-dest="search" tt="search for files by attributes, path/name, music tags, or any combination of those.$N$N&lt;code&gt;foo bar&lt;/code&gt; = must contain both foo and bar,$N&lt;code&gt;foo -bar&lt;/code&gt; = must contain foo but not bar,$N&lt;code&gt;^yana .opus$&lt;/code&gt; = must start with yana and have the opus extension">🔎</a>\n' +
 		(have_del && have_unpost ? '<a href="#" data-dest="unpost" tt="unpost: delete your recent uploads">🧯</a>\n' : '') +
@@ -40,8 +40,8 @@ ebi('widget').innerHTML = (
 	' href="#" id="selinv" tt="invert selection">sel.<br />inv.</a><a' +
 	' href="#" id="selzip" tt="download selection as archive">zip</a>' +
 	'</span><span id="wnp"><a' +
-	' href="#" id="npirc" tt="copy irc-formatted track info">📋irc</a><a' +
-	' href="#" id="nptxt" tt="copy plaintext track info">📋txt</a>' +
+	' href="#" id="npirc" tt="copy irc-formatted track info">📋<span>irc</span></a><a' +
+	' href="#" id="nptxt" tt="copy plaintext track info">📋<span>txt</span></a>' +
 	'</span><a' +
 	'	href="#" id="wtgrid" tt="toggle grid/list view$NHotkey: G">田</a><a' +
 	'	href="#" id="wtico">♫</a>' +
@@ -133,6 +133,20 @@ ebi('op_up2k').innerHTML = (
 );


+(function () {
+	var o = mknod('div');
+	o.innerHTML = (
+		'<div id="drops">\n' +
+		'	<div class="dropdesc" id="up_zd"><div>🚀 Upload<br /><span></span></div></div>\n' +
+		'	<div class="dropdesc" id="srch_zd"><div>🔎 Search<br /><span></span></div></div>\n' +
+		'	<div class="dropzone" id="up_dz" v="up_zd"></div>\n' +
+		'	<div class="dropzone" id="srch_dz" v="srch_zd"></div>\n' +
+		'</div>'
+	);
+	document.body.appendChild(o);
+})();
+
+
 // config panel
 ebi('op_cfg').innerHTML = (
 	'<div>\n' +
@@ -140,9 +154,10 @@ ebi('op_cfg').innerHTML = (
 	'	<div>\n' +
 	'		<a id="tooltips" class="tgl btn" href="#" tt="◔ ◡ ◔">ℹ️ tooltips</a>\n' +
 	'		<a id="lightmode" class="tgl btn" href="#">☀️ lightmode</a>\n' +
-	'		<a id="dotfiles" class="tgl btn" href="#" tt="show hidden files (if server permits)">dotfiles</a>\n' +
 	'		<a id="griden" class="tgl btn" href="#" tt="toggle icons or list-view$NHotkey: G">田 the grid</a>\n' +
 	'		<a id="thumbs" class="tgl btn" href="#" tt="in icon view, toggle icons or thumbnails$NHotkey: T">🖼️ thumbs</a>\n' +
+	'		<a id="dotfiles" class="tgl btn" href="#" tt="show hidden files (if server permits)">dotfiles</a>\n' +
+	'		<a id="ireadme" class="tgl btn" href="#" tt="show README.md in folder listings">📜 readme</a>\n' +
 	'	</div>\n' +
 	'</div>\n' +
 	(have_zip ? (
@@ -184,6 +199,9 @@ ebi('tree').innerHTML = (

 function opclick(e) {
 	var dest = this.getAttribute('data-dest');
+	if (QS('#op_' + dest + '.act'))
+		dest = '';
+
 	swrite('opmode', dest || null);
 	if (ctrl(e))
 		return;
@@ -284,7 +302,7 @@ var mpl = (function () {
 		r.os_ctl = !r.os_ctl && have_mctl;
 		bcfg_set('au_os_ctl', r.os_ctl);
 		if (!have_mctl)
-			toast.err(5, 'need firefox 82+ or chrome 73+');
+			toast.err(5, 'need firefox 82+ or chrome 73+\n(or iOS 15+ supposedly)');
 	};

 	ebi('au_osd_cv').onclick = function (e) {
@@ -717,6 +735,10 @@ var pbar = (function () {
 		for (var p = 1, mins = adur / 60; p <= mins; p++)
 			pctx.fillRect(Math.floor(sm * p * 60), 0, 2, pc.h);

+		pctx.fillStyle = light ? 'rgba(0,0,0,1)' : 'rgba(255,255,255,1)';
+		for (var p = 1, mins = adur / 600; p <= mins; p++)
+			pctx.fillRect(Math.floor(sm * p * 600), 0, 2, pc.h);
+
 		var w = 8,
 			x = sm * apos;

@@ -1044,6 +1066,33 @@ var audio_eq = (function () {
 		"last_au": null
 	};

+	// some browsers have insane high-frequency boost
+	// (or rather the actual problem is Q but close enough)
+	r.cali = (function () {
+		try {
+			var ac = new AudioContext(),
+				fi = ac.createBiquadFilter(),
+				freqs = new Float32Array(1),
+				mag = new Float32Array(1),
+				phase = new Float32Array(1);
+
+			freqs[0] = 14000;
+			fi.type = 'peaking';
+			fi.frequency.value = 18000;
+			fi.Q.value = 0.8;
+			fi.gain.value = 1;
+			fi.getFrequencyResponse(freqs, mag, phase);
+
+			return mag[0];  // 1.0407 good, 1.0563 bad
+		}
+		catch (ex) {
+			return 0;
+		}
+	})();
+	console.log('eq cali: ' + r.cali);
+
+	var mp = r.cali < 1.05;
+
 	var cfg = [ // hz, q, g
 		[31.25 * 0.88, 0, 1.4],  // shelf
 		[31.25 * 1.04, 0.7, 0.96],  // peak
@@ -1054,10 +1103,10 @@ var audio_eq = (function () {
 		[1000, 0.9, 1.1],
 		[2000, 0.9, 1.105],
 		[4000, 0.88, 1.05],
-		[8000 * 1.006, 0.73, 1.24],
-		[16000 * 0.89, 0.7, 1.26],  // peak
-		[16000 * 1.13, 0.82, 1.09],  // peak
-		[16000 * 1.205, 0, 1.9]  // shelf
+		[8000 * 1.006, 0.73, mp ? 1.24 : 1.2],
+		[16000 * 0.89, 0.7, mp ? 1.26 : 1.2],  // peak
+		[16000 * 1.13, 0.82, mp ? 1.09 : 0.75],  // peak
+		[16000 * 1.205, 0, mp ? 1.9 : 1.85]  // shelf
 	];

 	try {
@@ -1252,6 +1301,9 @@ function play(tid, is_ev, seek, call_depth) {
 	if (mp.order.length == 0)
 		return console.log('no audio found wait what');

+	if (crashed)
+		return;
+
 	mp.stopfade(true);

 	var tn = tid;
@@ -1293,12 +1345,21 @@ function play(tid, is_ev, seek, call_depth) {

 	var url = mp.tracks[tid];
 	if (need_ogv_for(url)) {
+		var m = /.* Version\/([0-9]+)\.[0-9\.]+ Mobile\/[^ ]+ Safari\/[0-9\.]+$/.exec(navigator.userAgent),
+			safari = m ? parseInt(m[1]) : 99;
+
 		if (mp.au_ogvjs) {
 			mp.au = mp.au_ogvjs;
 		}
 		else if (window['OGVPlayer']) {
 			mp.loading = true;
-			mp.au = mp.au_ogvjs = new OGVPlayer();
+			try {
+				mp.au = mp.au_ogvjs = new OGVPlayer();
+			}
+			catch (ex) {
+				return toast.err(30, 'your browser cannot play ogg/vorbis/opus\n\n' + ex +
+					'\n\n<a href="#" onclick="new OGVPlayer();">click here</a> for a full crash report');
+			}
 			attempt_play = is_ev;
 			mp.au.onerror = evau_error;
 			mp.au.onprogress = pbar.drawpos;
@@ -1308,6 +1369,9 @@ function play(tid, is_ev, seek, call_depth) {
 			};
 			widget.open();
 		}
+		else if (safari < 14) {
+			return toast.err(0, 'because this is an apple device,\nsafari 14 or newer is required to play ogg/vorbis/opus files\n\nyou are using safari ' + safari + '\n(every iOS browser is actually safari)');
+		}
 		else {
 			if (call_depth !== undefined)
 				return toast.err(0, 'failed to load ogv.js:\ncannot play ogg/opus in this browser\n(try a non-apple device)');
@@ -1317,10 +1381,6 @@ function play(tid, is_ev, seek, call_depth) {
 			import_js('/.cpr/deps/ogv.js', function () {
 				toast.hide();
 				play(tid, false, seek, 1);
-
-				var m = /.* Version\/([0-9]+)\.[0-9\.]+ Mobile\/[^ ]+ Safari\/[0-9\.]+$/.exec(navigator.userAgent);
-				if (m && parseInt(m[1]) < 14)
-					toast.err(0, 'because this is an apple device,\nsafari 14 or newer is required\n\nyou are using safari version ' + m[1] + ', so playback of ogg/vorbis/opus files will be buggy\n\nnote: every iOS browser is safari');
 			});

 			return;
@@ -1710,7 +1770,7 @@ var fileman = (function () {
 		bcut.style.display = have_mv && has(perms, 'move') ? '' : 'none';
 		bpst.style.display = have_mv && has(perms, 'write') ? '' : 'none';
 		bpst.setAttribute('tt', 'paste ' + r.clip.length + ' items$NHotkey: ctrl-V');
-		ebi('wfm').style.display = QS('#wfm a.en:not([display])') ? '' : 'none';
+		clmod(ebi('wfm'), 'act', QS('#wfm a.en:not([style])'));
 	};

 	r.rename = function (e) {
@@ -1777,7 +1837,7 @@ var fileman = (function () {

 		html = html.concat([
 			'<button id="rn_cancel" tt="abort and close this window">❌ cancel</button>',
-			'<button id="rn_apply">✅ apply rename</button>',
+			'<button id="rn_apply">✅ APPLY RENAME</button>',
 			'<a id="rn_adv" class="tgl btn" href="#" tt="batch / metadata / pattern renaming">advanced</a>',
 			'<a id="rn_case" class="tgl btn" href="#" tt="case-sensitive regex">case</a>',
 			'</div>',
@@ -1791,6 +1851,7 @@ var fileman = (function () {
 			'</table></div>'
 		]);

+		var cheap = f.length > 500;
 		if (sel.length == 1)
 			html.push(
 				'<div><table id="rn_f">\n' +
@@ -1803,8 +1864,9 @@ var fileman = (function () {
 			for (var a = 0; a < f.length; a++)
 				html.push(
 					'<tr><td>' +
-					'<button class="rn_dec" n="' + a + '">decode</button>',
-					'<button class="rn_reset" n="' + a + '">↺ reset</button></td>',
+					(cheap ? '</td>' :
+						'<button class="rn_dec" n="' + a + '">decode</button>' +
+						'<button class="rn_reset" n="' + a + '">↺ reset</button></td>') +
 					'<td><input type="text" id="rn_new" n="' + a + '" /></td>' +
 					'<td><input type="text" id="rn_old" n="' + a + '" readonly /></td></tr>');
 		}
@@ -1825,23 +1887,26 @@ var fileman = (function () {
 			f[a].inew = QS('#rn_new' + k);
 			f[a].inew.value = f[a].iold.value = f[a].ofn;

-			(function (a) {
-				f[a].inew.onkeydown = function (e) {
-					rn_ok(a, true);
+			if (!cheap)
+				(function (a) {
+					f[a].inew.onkeydown = function (e) {
+						rn_ok(a, true);

-					if (e.key == 'Escape')
-						return rn_cancel();
+						if (e.key == 'Escape')
+							return rn_cancel();

-					if (e.key == 'Enter')
-						return rn_apply();
-				};
-				QS('.rn_dec' + k).onclick = function () {
-					f[a].inew.value = uricom_dec(f[a].inew.value)[0];
-				};
-				QS('.rn_reset' + k).onclick = function () {
-					rn_reset(a);
-				};
-			})(a);
+						if (e.key == 'Enter')
+							return rn_apply();
+					};
+					QS('.rn_dec' + k).onclick = function (e) {
+						ev(e);
+						f[a].inew.value = uricom_dec(f[a].inew.value)[0];
+					};
+					QS('.rn_reset' + k).onclick = function (e) {
+						ev(e);
+						rn_reset(a);
+					};
+				})(a);
 		}
 		rn_reset(0);
 		tt.att(rui);
@@ -1864,18 +1929,21 @@ var fileman = (function () {
 			f[n].inew.focus();
 			f[n].inew.setSelectionRange(0, f[n].inew.value.lastIndexOf('.'), "forward");
 		}
-		function rn_cancel() {
+		function rn_cancel(e) {
+			ev(e);
 			rui.parentNode.removeChild(rui);
 		}

 		ebi('rn_cancel').onclick = rn_cancel;
 		ebi('rn_apply').onclick = rn_apply;
-		ebi('rn_adv').onclick = function () {
+		ebi('rn_adv').onclick = function (e) {
+			ev(e);
 			adv = !adv;
 			bcfg_set('rn_adv', adv);
 			sadv();
 		};
-		ebi('rn_case').onclick = function () {
+		ebi('rn_case').onclick = function (e) {
+			ev(e);
 			cs = !cs;
 			bcfg_set('rn_case', cs);
 		};
@@ -1902,7 +1970,8 @@ var fileman = (function () {
 				ipre.appendChild(o);
 			}
 		}
-		inew.onclick = function () {
+		inew.onclick = function (e) {
+			ev(e);
 			modal.prompt('provide a name for your new preset', ifmt.value, function (name) {
 				if (!name)
 					return toast.warn(3, 'aborted');
@@ -1913,7 +1982,8 @@ var fileman = (function () {
 				ipre.value = name;
 			});
 		};
-		idel.onclick = function () {
+		idel.onclick = function (e) {
+			ev(e);
 			delete presets[ipre.value];
 			jwrite('rn_pre', presets);
 			spresets();
@@ -1971,7 +2041,8 @@ var fileman = (function () {
 			}
 		};

-		function rn_apply() {
+		function rn_apply(e) {
+			ev(e);
 			while (f.length && (!f[0].ok || f[0].ofn == f[0].inew.value))
 				f.shift();

@@ -2076,9 +2147,18 @@ var fileman = (function () {
 				clmod(els[a], 'fcut', 1);
 		}, 1);

-		toast.inf(1.5, 'cut ' + sel.length + ' items');
-		jwrite('fman_clip', vps);
-		r.tx(1);
+		try {
+			vps = JSON.stringify(vps);
+			if (vps.length > 1024 * 1024)
+				throw 'a';
+
+			swrite('fman_clip', vps);
+			r.tx(1);
+			toast.inf(1.5, 'cut ' + sel.length + ' items');
+		}
+		catch (ex) {
+			toast.warn(30, 'cut ' + sel.length + ' items\n\nbut: only <b>this</b> browser-tab can paste them\n(since the selection is so absolutely massive)');
+		}
 	};

 	r.paste = function (e) {
@@ -2365,7 +2445,8 @@ var thegrid = (function () {
 		}
 		var uns = QS('#ggrid a[ref="unsearch"]');
 		if (uns)
-			uns.onclick = function () {
+			uns.onclick = function (e) {
+				ev(e);
 				ebi('unsearch').click();
 			};
 	};
@@ -2687,10 +2768,10 @@ document.onkeydown = function (e) {
 			return ebi('gridsel').click();

 		if (k == 'KeyA')
-			return QSA('#ghead>a[z]')[0].click();
+			return QSA('#ghead a[z]')[0].click();

 		if (k == 'KeyD')
-			return QSA('#ghead>a[z]')[1].click();
+			return QSA('#ghead a[z]')[1].click();
 	}
 };

@@ -2783,14 +2864,15 @@ document.onkeydown = function (e) {

 		clearTimeout(defer_timeout);
 		defer_timeout = setTimeout(try_search, 2000);
-		try_search();
+		try_search(v);
 	}

-	function try_search() {
+	function try_search(v) {
 		if (Date.now() - search_in_progress > 30 * 1000) {
 			clearTimeout(defer_timeout);
 			clearTimeout(search_timeout);
-			search_timeout = setTimeout(do_search, 200);
+			search_timeout = setTimeout(do_search,
+				v && v.length < (is_touch ? 4 : 3) ? 600 : 200);
 		}
 	}

@@ -2967,7 +3049,8 @@ var treectl = (function () {
 	var treectl = {
 		"hidden": true,
 		"ls_cb": null,
-		"dir_cb": tree_scrollto
+		"dir_cb": tree_scrollto,
+		"ireadme": bcfg_get('ireadme', true)
 	},
 		entreed = false,
 		fixedpos = false,
@@ -3288,6 +3371,12 @@ var treectl = (function () {
 		ebi('pro').innerHTML = res.logues ? res.logues[0] || "" : "";
 		ebi('epi').innerHTML = res.logues ? res.logues[1] || "" : "";

+		clmod(ebi('epi'), 'mdo');
+		if (res.readme)
+			setTimeout(function () {
+				show_readme(res.readme);
+			}, 10);
+
 		document.title = '⇆🎉 ' + uricom_dec(document.location.pathname.slice(1, -1))[0];

 		filecols.set_style();
@@ -3340,6 +3429,12 @@ var treectl = (function () {
 		treectl.goto(get_evpath());
 	}

+	function treadme(e) {
+		ev(e);
+		treectl.ireadme = !treectl.ireadme;
+		bcfg_set('ireadme', treectl.ireadme);
+	}
+
 	function dyntree(e) {
 		ev(e);
 		dyn = !dyn;
@@ -3361,6 +3456,7 @@ var treectl = (function () {
 	ebi('detree').onclick = treectl.detree;
 	ebi('visdir').onclick = tree_scrollto;
 	ebi('dotfiles').onclick = tdots;
+	ebi('ireadme').onclick = treadme;
 	ebi('dyntree').onclick = dyntree;
 	ebi('twig').onclick = scaletree;
 	ebi('twobytwo').onclick = scaletree;
@@ -3562,6 +3658,7 @@ var filecols = (function () {
 			if (ttv) {
 				th.setAttribute("tt", ttv);
 				th.setAttribute("ttd", "u");
+				th.setAttribute("ttm", "12");
 			}
 		}
 	};
@@ -3790,6 +3887,7 @@ var light;

 	function freshen() {
 		clmod(document.documentElement, "light", light);
+		clmod(document.documentElement, "dark", !light);
 		pbar.drawbuf();
 		pbar.drawpos();
 		vbar.draw();
@@ -4003,6 +4101,51 @@ var msel = (function () {
 })();


+function show_readme(md, url, depth) {
+	if (!treectl.ireadme)
+		return;
+
+	var div = ebi('epi'),
+		errmsg = 'cannot show README.md:\n\n',
+		now = window.location.href.replace(/\/?[?#].*/, "");
+
+	url = url || now;
+	if (url != now)
+		return;
+
+	if (!window['marked']) {
+		if (depth)
+			return toast.warn(10, errmsg + 'failed to load marked.js')
+
+		return import_js('/.cpr/deps/marked.js', function () {
+			show_readme(md, url, 1);
+		});
+	}
+
+	try {
+		clmod(div, 'mdo', 1);
+		div.innerHTML = marked(md, {
+			headerPrefix: 'md-',
+			breaks: true,
+			gfm: true
+		});
+		var links = QSA('#epi a');
+		for (var a = 0, aa = links.length; a < aa; a++) {
+			var href = links[a].getAttribute('href');
+			if (!href.startsWith('#'))
+				continue;
+
+			links[a].setAttribute('href', '#md-' + href.slice(1));
+		}
+	}
+	catch (ex) {
+		toast.warn(10, errmsg + ex);
+	}
+}
+if (readme)
+	show_readme(readme);
+
+
 (function () {
 	try {
 		var tr = ebi('files').tBodies[0].rows;
@@ -4028,7 +4171,7 @@ function ev_row_tgl(e) {

 var unpost = (function () {
 	ebi('op_unpost').innerHTML = (
-		"you can delete your recent uploads below &ndash; click the fire-extinguisher icon to refresh" +
+		'you can delete your recent uploads below &ndash; <a id="unpost_refresh" href="#">refresh list</a>' +
 		'<p>optional filter:&nbsp; URL must contain <input type="text" id="unpost_filt" size="20" /><a id="unpost_nofilt" href="#">clear filter</a></p>' +
 		'<div id="unpost"></div>'
 	);
@@ -4125,6 +4268,7 @@ var unpost = (function () {
 	}

 	ct.onclick = function (e) {
+		ev(e);
 		var tgt = e.target.closest('a[me]');
 		if (!tgt)
 			return;
@@ -4166,11 +4310,17 @@ var unpost = (function () {
 		tfilt = setTimeout(r.load, 250);
 	};

-	ebi('unpost_nofilt').onclick = function () {
+	ebi('unpost_nofilt').onclick = function (e) {
+		ev(e);
 		filt.value = '';
 		r.load();
 	};

+	ebi('unpost_refresh').onclick = function (e) {
+		ev(e);
+		goto('unpost');
+	};
+
 	return r;
 })();

--- a/copyparty/web/md.css
+++ b/copyparty/web/md.css
@@ -1,13 +1,17 @@
-@font-face {
-	font-family: 'scp';
-	src: local('Source Code Pro Regular'), local('SourceCodePro-Regular'), url(/.cpr/deps/scp.woff2) format('woff2');
-}
 html, body {
 	color: #333;
 	background: #eee;
 	font-family: sans-serif;
 	line-height: 1.5em;
 }
+#repl {
+	position: absolute;
+	top: 0;
+	right: .5em;
+	border: none;
+	color: inherit;
+	background: none;
+}
 #mtw {
 	display: none;
 }
@@ -19,122 +23,8 @@ html, body {
 	bottom: auto;
 	top: 1.4em;
 }
-pre, code, a {
-	color: #480;
-	background: #f7f7f7;
-	border: .07em solid #ddd;
-	border-radius: .2em;
-	padding: .1em .3em;
-	margin: 0 .1em;
-}
-code {
-	font-size: .96em;
-}
-pre, code, tt {
-	font-family: 'scp', monospace, monospace;
-	white-space: pre-wrap;
-	word-break: break-all;
-}
-pre {
-	counter-reset: precode;
-}
-pre code {
-	counter-increment: precode;
-	display: inline-block;
-	margin: 0 -.3em;
-	padding: .4em .5em;
-	border: none;
-	border-bottom: 1px solid #cdc;
-	min-width: calc(100% - .6em);
-	line-height: 1.1em;
-}
-pre code:last-child {
-	border-bottom: none;
-}
-pre code::before {
-	content: counter(precode);
-	-webkit-user-select: none;
-	-moz-user-select: none;
-	-ms-user-select: none;
-	user-select: none;
-	display: inline-block;
-	text-align: right;
-	font-size: .75em;
-	color: #48a;
-	width: 4em;
-	padding-right: 1.5em;
-	margin-left: -5.5em;
-}
-pre code:hover {
-	background: #fec;
-	color: #360;
-}
-h1, h2 {
-	line-height: 1.5em;
-}
-h1 {
-	font-size: 1.7em;
-	text-align: center;
-	border: 1em solid #777;
-	border-width: .05em 0;
-	margin: 3em 0;
-}
-h2 {
-	font-size: 1.5em;
-	font-weight: normal;
-	background: #f7f7f7;
-	border-top: .07em solid #fff;
-	border-bottom: .07em solid #bbb;
-	border-radius: .5em .5em 0 0;
-	padding-left: .4em;
-	margin-top: 3em;
-}
-h3 {
-	border-bottom: .1em solid #999;
-}
-h1 a, h3 a, h5 a,
-h2 a, h4 a, h6 a {
-	color: inherit;
-	display: block;
-	background: none;
-	border: none;
-	padding: 0;
-	margin: 0;
-}
-#mp ul,
-#mp ol {
-	border-left: .3em solid #ddd;
-}
-#m>ul,
-#m>ol {
-	border-color: #bbb;
-}
-#mp ul>li {
-	list-style-type: disc;
-}
-#mp ul>li,
-#mp ol>li {
-	margin: .7em 0;
-}
-strong {
-	color: #000;
-}
-p>em,
-li>em,
-td>em {
-	color: #c50;
-	padding: .1em;
-	border-bottom: .1em solid #bbb;
-}
-blockquote {
-	font-family: serif;
-	background: #f7f7f7;
-	border: .07em dashed #ccc;
-	padding: 0 2em;
-	margin: 1em 0;
-}
-small {
-	opacity: .8;
+a {
+	text-decoration: none;
 }
 #toc {
 	margin: 0 1em;
@@ -182,14 +72,6 @@ small {
 	color: #6b3;
 	text-shadow: .02em 0 0 #6b3;
 }
-table {
-	border-collapse: collapse;
-	margin: 1em 0;
-}
-th, td {
-	padding: .2em .5em;
-	border: .12em solid #aaa;
-}
 blink {
 	animation: blinker .7s cubic-bezier(.9, 0, .1, 1) infinite;
 }
@@ -202,6 +84,36 @@ blink {
 	}
 }

+
+.mdo pre {
+	counter-reset: precode;
+}
+.mdo pre code {
+	counter-increment: precode;
+	display: inline-block;
+	border: none;
+	border-bottom: 1px solid #cdc;
+	min-width: calc(100% - .6em);
+}
+.mdo pre code:last-child {
+	border-bottom: none;
+}
+.mdo pre code::before {
+	content: counter(precode);
+	-webkit-user-select: none;
+	-moz-user-select: none;
+	-ms-user-select: none;
+	user-select: none;
+	display: inline-block;
+	text-align: right;
+	font-size: .75em;
+	color: #48a;
+	width: 4em;
+	padding-right: 1.5em;
+	margin-left: -5.5em;
+}
+
+
@media screen {
 	html, body {
 		margin: 0;
@@ -218,34 +130,6 @@ blink {
 	#mp {
 		max-width: 52em;
 		margin-bottom: 6em;
-		word-break: break-word;
-		overflow-wrap: break-word;
-		word-wrap: break-word; /*ie*/
-	}
-	a {
-		color: #fff;
-		background: #39b;
-		text-decoration: none;
-		padding: 0 .3em;
-		border: none;
-		border-bottom: .07em solid #079;
-	}
-	h2 {
-		color: #fff;
-		background: #555;
-		margin-top: 2em;
-		border-bottom: .22em solid #999;
-		border-top: none;
-	}
-	h1 {
-		color: #fff;
-		background: #444;
-		font-weight: normal;
-		border-top: .4em solid #fb0;
-		border-bottom: .4em solid #777;
-		border-radius: 0 1em 0 1em;
-		margin: 3em 0 1em 0;
-		padding: .5em 0;
 	}
 	#mn {
 		padding: 1.3em 0 .7em 1em;
@@ -298,6 +182,8 @@ blink {
 		color: #444;
 		background: none;
 		text-decoration: underline;
+		margin: 0 .1em;
+		padding: 0 .3em;
 		border: none;
 	}
 	#mh a:hover {
@@ -346,55 +232,6 @@ blink {
 	html.dark #toc li {
 		border-width: 0;
 	}
-	html.dark #mp a {
-		background: #057;
-	}
-	html.dark #mp h1 a, html.dark #mp h4 a,
-	html.dark #mp h2 a, html.dark #mp h5 a,
-	html.dark #mp h3 a, html.dark #mp h6 a {
-		color: inherit;
-		background: none;
-	}
-	html.dark pre,
-	html.dark code {
-		color: #8c0;
-		background: #1a1a1a;
-		border: .07em solid #333;
-	}
-	html.dark #mp ul,
-	html.dark #mp ol {
-		border-color: #444;
-	}
-	html.dark #m>ul,
-	html.dark #m>ol {
-		border-color: #555;
-	}
-	html.dark strong {
-		color: #fff;
-	}
-	html.dark p>em,
-	html.dark li>em,
-	html.dark td>em {
-		color: #f94;
-		border-color: #666;
-	}
-	html.dark h1 {
-		background: #383838;
-		border-top: .4em solid #b80;
-		border-bottom: .4em solid #4c4c4c;
-	}
-	html.dark h2 {
-		background: #444;
-		border-bottom: .22em solid #555;
-	}
-	html.dark td,
-	html.dark th {
-		border-color: #444;
-	}
-	html.dark blockquote {
-		background: #282828;
-		border: .07em dashed #444;
-	}
 	html.dark #mn a:not(:last-child)::after {
 		border-color: rgba(255,255,255,0.3);
 	}
@@ -500,12 +337,15 @@ blink {
 		mso-footer-margin: .6in;
 		mso-paper-source: 0;
 	}
-	a {
+	.mdo a {
 		color: #079;
 		text-decoration: none;
 		border-bottom: .07em solid #4ac;
 		padding: 0 .3em;
 	}
+	#repl {
+		display: none;
+	}
 	#toc>ul {
 		border-left: .1em solid #84c4dd;
 	}
@@ -530,18 +370,20 @@ blink {
 	a[ctr]::before {
 		content: attr(ctr) '. ';
 	}
-	h1 {
+	.mdo h1 {
 		margin: 2em 0;
 	}
-	h2 {
+	.mdo h2 {
 		margin: 2em 0 0 0;
 	}
-	h1, h2, h3 {
+	.mdo h1,
+	.mdo h2,
+	.mdo h3 {
 		page-break-inside: avoid;
 	}
-	h1::after,
-	h2::after,
-	h3::after {
+	.mdo h1::after,
+	.mdo h2::after,
+	.mdo h3::after {
 		content: 'orz';
 		color: transparent;
 		display: block;
@@ -549,20 +391,20 @@ blink {
 		padding: 4em 0 0 0;
 		margin: 0 0 -5em 0;
 	}
-	p {
+	.mdo p {
 		page-break-inside: avoid;
 	}
-	table {
+	.mdo table {
 		page-break-inside: auto;
 	}
-	tr {
+	.mdo tr {
 		page-break-inside: avoid;
 		page-break-after: auto;
 	}
-	thead {
+	.mdo thead {
 		display: table-header-group;
 	}
-	tfoot {
+	.mdo tfoot {
 		display: table-footer-group;
 	}
 	#mp a.vis::after {
@@ -570,31 +412,32 @@ blink {
 		border-bottom: 1px solid #bbb;
 		color: #444;
 	}
-	blockquote {
+	.mdo blockquote {
 		border-color: #555;
 	}
-	code {
+	.mdo code {
 		border-color: #bbb;
 	}
-	pre, pre code {
+	.mdo pre,
+	.mdo pre code {
 		border-color: #999;
 	}
-	pre code::before {
+	.mdo pre code::before {
 		color: #058;
 	}


 	
-	html.dark a {
+	html.dark .mdo a {
 		color: #000;
 	}
-	html.dark pre,
-	html.dark code {
+	html.dark .mdo pre,
+	html.dark .mdo code {
 		color: #240;
 	}
-	html.dark p>em,
-	html.dark li>em,
-	html.dark td>em {
+	html.dark .mdo p>em,
+	html.dark .mdo li>em,
+	html.dark .mdo td>em {
 		color: #940;
 	}
 }
--- a/copyparty/web/md.html
+++ b/copyparty/web/md.html
@@ -43,8 +43,9 @@
 				if you're still reading this, check that javascript is allowed
 			</div>
 		</div>
-		<div id="mp"></div>
+		<div id="mp" class="mdo"></div>
 	</div>
+	<a href="#" id="repl">π</a>
 	
 	{%- if edit %}
 	<div id="helpbox">
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -24,23 +24,6 @@ var dbg = function () { };
 var md_plug = {};


-function hesc(txt) {
-    return txt.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-
-
-function cls(dom, name, add) {
-    var re = new RegExp('(^| )' + name + '( |$)');
-    var lst = (dom.getAttribute('class') + '').replace(re, "$1$2").replace(/  /, "");
-    dom.setAttribute('class', lst + (add ? ' ' + name : ''));
-}
-
-
-function statify(obj) {
-    return JSON.parse(JSON.stringify(obj));
-}
-
-
 // dodge browser issues
 (function () {
    var ua = navigator.userAgent;
@@ -65,7 +48,7 @@ function statify(obj) {
        if (a > 0)
            loc.push(n[a]);

-        var dec = hesc(uricom_dec(n[a])[0]);
+        var dec = esc(uricom_dec(n[a])[0]);

        nav.push('<a href="/' + loc.join('/') + '">' + dec + '</a>');
    }
@@ -73,6 +56,26 @@ function statify(obj) {
 })();


+// image load handler
+var img_load = (function () {
+    var r = {};
+    r.callbacks = [];
+
+    function fire() {
+        for (var a = 0; a < r.callbacks.length; a++)
+            r.callbacks[a]();
+    }
+
+    var timeout = null;
+    r.done = function () {
+        clearTimeout(timeout);
+        timeout = setTimeout(fire, 500);
+    };
+
+    return r;
+})();
+
+
 // faster than replacing the entire html (chrome 1.8x, firefox 1.6x)
 function copydom(src, dst, lv) {
    var sc = src.childNodes,
@@ -356,6 +359,10 @@ function convert_markdown(md_text, dest_dom) {

    copydom(md_dom, dest_dom, 0);

+    var imgs = dest_dom.getElementsByTagName('img');
+    for (var a = 0, aa = imgs.length; a < aa; a++)
+        imgs[a].onload = img_load.done;
+
    if (ext && ext[0].render2)
        try {
            ext[0].render2(dest_dom);
@@ -490,6 +497,7 @@ function init_toc() {
 // "main" :p
 convert_markdown(dom_src.value, dom_pre);
 var toc = init_toc();
+img_load.callbacks = [toc.refresh];


 // scroll handler
--- a/copyparty/web/md2.css
+++ b/copyparty/web/md2.css
@@ -50,7 +50,7 @@
 	outline: none;
 	padding: 0;
 	margin: 0;
-	font-family: 'consolas', monospace, monospace;
+	font-family: 'scp', monospace, monospace;
 	white-space: pre-wrap;
 	word-break: break-word;
 	overflow-wrap: break-word;
--- a/copyparty/web/md2.js
+++ b/copyparty/web/md2.js
@@ -98,7 +98,7 @@ var draw_md = (function () {
        var src = dom_src.value;
        convert_markdown(src, dom_pre);

-        var lines = hesc(src).replace(/\r/g, "").split('\n');
+        var lines = esc(src).replace(/\r/g, "").split('\n');
        nlines = lines.length;
        var html = [];
        for (var a = 0; a < lines.length; a++)
@@ -108,7 +108,7 @@ var draw_md = (function () {
        map_src = genmap(dom_ref, map_src);
        map_pre = genmap(dom_pre, map_pre);

-        cls(ebi('save'), 'disabled', src == server_md);
+        clmod(ebi('save'), 'disabled', src == server_md);

        var t1 = Date.now();
        delay = t1 - t0 > 100 ? 25 : 1;
@@ -127,6 +127,12 @@ var draw_md = (function () {
 })();


+// discard TOC callback, just regen editor scroll map
+img_load.callbacks = [function () {
+    map_pre = genmap(dom_pre, map_pre);
+}];
+
+
 // resize handler
 redraw = (function () {
    function onresize() {
@@ -136,7 +142,6 @@ redraw = (function () {
        dom_ref.style.width = getComputedStyle(dom_src).offsetWidth + 'px';
        map_src = genmap(dom_ref, map_src);
        map_pre = genmap(dom_pre, map_pre);
-        dbg(document.body.clientWidth + 'x' + document.body.clientHeight);
    }
    function setsbs() {
        dom_wrap.setAttribute('class', '');
@@ -1086,9 +1091,9 @@ action_stack = (function () {
        ref = newtxt;
        dbg('undos(%d) redos(%d)', hist.un.length, hist.re.length);
        if (hist.un.length > 0)
-            dbg(statify(hist.un.slice(-1)[0]));
+            dbg(jcp(hist.un.slice(-1)[0]));
        if (hist.re.length > 0)
-            dbg(statify(hist.re.slice(-1)[0]));
+            dbg(jcp(hist.re.slice(-1)[0]));
    }

    return {
--- a/copyparty/web/mde.css
+++ b/copyparty/web/mde.css
@@ -7,6 +7,8 @@ html .editor-toolbar>button.active { border-color: rgba(0,0,0,0.4); background:
 html .editor-toolbar>i.separator { border-left: 1px solid #ccc; }
 html .editor-toolbar.disabled-for-preview>button:not(.no-disable) { opacity: .35 }

+
+
 html {
 	line-height: 1.5em;
 }
@@ -22,6 +24,18 @@ html, body {
 	bottom: auto;
 	top: 1.4em;
 }
+#repl {
+	position: absolute;
+	top: 0;
+	right: .5em;
+	border: none;
+	color: inherit;
+	background: none;
+	text-decoration: none;
+}
+
+
+
 #mn {
 	font-weight: normal;
 	margin: 1.3em 0 .7em 1em;
@@ -63,148 +77,12 @@ html .editor-toolbar>button.disabled {
 html .editor-toolbar>button.save.force-save {
 	background: #f97;
 }
-
-
-
-
-
-/* copied from md.css for now */
-.mdo pre,
-.mdo code,
-.mdo a {
-	color: #480;
-	background: #f7f7f7;
-	border: .07em solid #ddd;
-	border-radius: .2em;
-	padding: .1em .3em;
-	margin: 0 .1em;
-}
-.mdo code {
-	font-size: .96em;
-}
-.mdo pre,
-.mdo code {
-	font-family: monospace, monospace;
-	white-space: pre-wrap;
-	word-break: break-all;
-}
-.mdo pre code {
-	display: block;
-	margin: 0 -.3em;
-	padding: .4em .5em;
-	line-height: 1.1em;
-}
-.mdo a {
-	color: #fff;
-	background: #39b;
-	text-decoration: none;
-	padding: 0 .3em;
-	border: none;
-	border-bottom: .07em solid #079;
-}
-.mdo h2 {
-	color: #fff;
-	background: #555;
-	margin-top: 2em;
-	border-bottom: .22em solid #999;
-	border-top: none;
-}
-.mdo h1 {
-	color: #fff;
-	background: #444;
-	font-weight: normal;
-	border-top: .4em solid #fb0;
-	border-bottom: .4em solid #777;
-	border-radius: 0 1em 0 1em;
-	margin: 3em 0 1em 0;
-	padding: .5em 0;
-}
-h1, h2 {
-	line-height: 1.5em;
-}
-h1 {
-	font-size: 1.7em;
-	text-align: center;
-	border: 1em solid #777;
-	border-width: .05em 0;
-	margin: 3em 0;
-}
-h2 {
-	font-size: 1.5em;
-	font-weight: normal;
-	background: #f7f7f7;
-	border-top: .07em solid #fff;
-	border-bottom: .07em solid #bbb;
-	border-radius: .5em .5em 0 0;
-	padding-left: .4em;
-	margin-top: 3em;
-}
-.mdo ul,
-.mdo ol {
-	border-left: .3em solid #ddd;
-}
-.mdo>ul,
-.mdo>ol {
-	border-color: #bbb;
-}
-.mdo ul>li {
-	list-style-type: disc;
-}
-.mdo ul>li,
-.mdo ol>li {
-	margin: .7em 0;
-}
-strong {
-	color: #000;
-}
-p>em,
-li>em,
-td>em {
-	color: #c50;
-	padding: .1em;
-	border-bottom: .1em solid #bbb;
-}
-blockquote {
-	font-family: serif;
-	background: #f7f7f7;
-	border: .07em dashed #ccc;
-	padding: 0 2em;
-	margin: 1em 0;
-}
-small {
-	opacity: .8;
-}
-table {
-	border-collapse: collapse;
-}
-td {
-	padding: .2em .5em;
-	border: .12em solid #aaa;
-}
-th {
-	border: .12em solid #aaa;
-}
-
-
-
-
-
-/* mde support */
-.mdo {
-	padding: 1em;
-	background: #f7f7f7;
-}
-html.dark .mdo {
-	background: #1c1c1c;
-}
 .CodeMirror {
 	background: #f7f7f7;
 }



-
-
 /* darkmode */
 html.dark .mdo,
 html.dark .CodeMirror {
@@ -228,55 +106,6 @@ html.dark .CodeMirror-selectedtext {
 	background: #246;
 	color: #fff;
 }
-html.dark .mdo a {
-	background: #057;
-}
-html.dark .mdo h1 a, html.dark .mdo h4 a,
-html.dark .mdo h2 a, html.dark .mdo h5 a,
-html.dark .mdo h3 a, html.dark .mdo h6 a {
-	color: inherit;
-	background: none;
-}
-html.dark pre,
-html.dark code {
-	color: #8c0;
-	background: #1a1a1a;
-	border: .07em solid #333;
-}
-html.dark .mdo ul,
-html.dark .mdo ol {
-	border-color: #444;
-}
-html.dark .mdo>ul,
-html.dark .mdo>ol {
-	border-color: #555;
-}
-html.dark strong {
-	color: #fff;
-}
-html.dark p>em,
-html.dark li>em,
-html.dark td>em {
-	color: #f94;
-	border-color: #666;
-}
-html.dark h1 {
-	background: #383838;
-	border-top: .4em solid #b80;
-	border-bottom: .4em solid #4c4c4c;
-}
-html.dark h2 {
-	background: #444;
-	border-bottom: .22em solid #555;
-}
-html.dark td,
-html.dark th {
-	border-color: #444;
-}
-html.dark blockquote {
-	background: #282828;
-	border: .07em dashed #444;
-}



@@ -312,4 +141,15 @@ html.dark .editor-toolbar>button.active {
 html.dark .editor-toolbar::after,
 html.dark .editor-toolbar::before {
 	background: none;
-}
+}
+
+
+
+/* ui.css overrides */
+.mdo {
+	padding: 1em;
+	background: #f7f7f7;
+}
+html.dark .mdo {
+	background: #1c1c1c;
+}
--- a/copyparty/web/mde.html
+++ b/copyparty/web/mde.html
@@ -21,6 +21,7 @@
 			<textarea id="mt" style="display:none" autocomplete="off">{{ md }}</textarea>
 		</div>
 	</div>
+	<a href="#" id="repl">π</a>
 	<script>

 var last_modified = {{ lastmod }};
--- a/copyparty/web/splash.css
+++ b/copyparty/web/splash.css
@@ -29,6 +29,12 @@ a {
 	border-radius: .2em;
 	padding: .2em .8em;
 }
+#repl {
+	border: none;
+	background: none;
+	color: inherit;
+	padding: 0;
+}
 table {
 	border-collapse: collapse;
 }
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -7,6 +7,7 @@
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=0.8">
    <link rel="stylesheet" media="screen" href="/.cpr/splash.css?_={{ ts }}">
+    <link rel="stylesheet" media="screen" href="/.cpr/ui.css?_={{ ts }}">
 </head>

 <body>
@@ -66,11 +67,13 @@
            </form>
        </ul>
    </div>
+	<a href="#" id="repl">π</a>
    <script>

 if (localStorage.getItem('lightmode') != 1)
    document.documentElement.setAttribute("class", "dark");

 </script>
+<script src="/.cpr/util.js?_={{ ts }}"></script>
 </body>
-</html>
+</html>
--- a/copyparty/web/ui.css
+++ b/copyparty/web/ui.css
@@ -1,3 +1,7 @@
+@font-face {
+	font-family: 'scp';
+	src: local('Source Code Pro Regular'), local('SourceCodePro-Regular'), url(/.cpr/deps/scp.woff2) format('woff2');
+}
 html {
 	touch-action: manipulation;
 }
@@ -26,7 +30,9 @@ html {
 	right: -1em;
 	line-height: 1.5em;
 	padding: 1em 1.3em;
+	margin-left: 3em;
 	border-width: .4em 0;
+	overflow-wrap: break-word;
 	transform: translateX(100%);
 	transition:
 		transform .4s cubic-bezier(.2, 1.2, .5, 1),
@@ -34,7 +40,14 @@ html {
 	text-shadow: 1px 1px 0 #000;
 	color: #fff;
 }
-#toastc {
+#toast a {
+	color: inherit;
+	text-shadow: inherit;
+	background: rgba(0, 0, 0, 0.4);
+	border-radius: .3em;
+	padding: .2em .3em;
+}
+#toast a#toastc {
 	display: inline-block;
 	position: absolute;
 	overflow: hidden;
@@ -43,7 +56,7 @@ html {
 	opacity: 0;
 	padding: .3em 0;
 	margin: -.3em 0 0 0;
-	line-height: 1.5em;
+	line-height: 1.3em;
 	color: #000;
 	border: none;
 	outline: none;
@@ -51,6 +64,15 @@ html {
 	border-radius: .5em 0 0 .5em;
 	transition: left .3s, width .3s, padding .3s, opacity .3s;
 }
+#toastb {
+	max-height: 70vh;
+	overflow-y: auto;
+}
+#toast.scroll #toastb {
+	overflow-y: scroll;
+	margin-right: -1.2em;
+	padding-right: .7em;
+}
 #toast pre {
 	margin: 0;
 }
@@ -107,6 +129,7 @@ html {
 	padding: 1.5em 2em;
 	border-width: .5em 0;
 }
+#modalc code,
 #tt code {
 	background: #3c3c3c;
 	padding: .1em .3em;
@@ -125,6 +148,7 @@ html.light #tt,
 html.light #toast {
 	box-shadow: 0 .3em 1em rgba(0,0,0,0.4);
 }
+#modalc code,
 html.light #tt code {
 	background: #060;
 	color: #fff;
@@ -207,6 +231,8 @@ html.light #tt em {
 }
 #modali {
 	display: block;
+	background: #fff;
+	color: #000;
 	width: calc(100% - 1.25em);
    margin: 1em -.1em 0 -.1em;
 	padding: .5em;
@@ -217,3 +243,200 @@ html.light #tt em {
 #modali:focus {
 	border-color: #06d;
 }
+#repl_pre {
+	max-width: 24em;
+}
+
+
+
+
+
+
+
+
+
+
+
+.mdo pre,
+.mdo code,
+.mdo a {
+	color: #480;
+	background: #f7f7f7;
+	border: .07em solid #ddd;
+	border-radius: .2em;
+	padding: .1em .3em;
+	margin: 0 .1em;
+}
+.mdo pre,
+.mdo code,
+.mdo tt {
+	font-family: 'scp', monospace, monospace;
+	white-space: pre-wrap;
+	word-break: break-all;
+}
+.mdo code {
+	font-size: .96em;
+}
+.mdo h1,
+.mdo h2 {
+	line-height: 1.5em;
+}
+.mdo h1 {
+	font-size: 1.7em;
+	text-align: center;
+	border: 1em solid #777;
+	border-width: .05em 0;
+	margin: 3em 0;
+}
+.mdo h2 {
+	font-size: 1.5em;
+	font-weight: normal;
+	background: #f7f7f7;
+	border-top: .07em solid #fff;
+	border-bottom: .07em solid #bbb;
+	border-radius: .5em .5em 0 0;
+	padding-left: .4em;
+	margin-top: 3em;
+}
+.mdo h3 {
+	border-bottom: .1em solid #999;
+}
+.mdo h1 a, .mdo h3 a, .mdo h5 a,
+.mdo h2 a, .mdo h4 a, .mdo h6 a {
+	color: inherit;
+	display: block;
+	background: none;
+	border: none;
+	padding: 0;
+	margin: 0;
+}
+.mdo ul,
+.mdo ol {
+	border-left: .3em solid #ddd;
+}
+.mdo ul>li,
+.mdo ol>li {
+	margin: .7em 0;
+	list-style-type: disc;
+}
+.mdo strong {
+	color: #000;
+}
+.mdo p>em,
+.mdo li>em,
+.mdo td>em {
+	color: #c50;
+	padding: .1em;
+	border-bottom: .1em solid #bbb;
+}
+.mdo blockquote {
+	font-family: serif;
+	background: #f7f7f7;
+	border: .07em dashed #ccc;
+	padding: 0 2em;
+	margin: 1em 0;
+}
+.mdo small {
+	opacity: .8;
+}
+.mdo pre code {
+	display: block;
+	margin: 0 -.3em;
+	padding: .4em .5em;
+	line-height: 1.1em;
+}
+.mdo pre code:hover {
+	background: #fec;
+	color: #360;
+}
+.mdo table {
+	border-collapse: collapse;
+	margin: 1em 0;
+}
+.mdo th,
+.mdo td {
+	padding: .2em .5em;
+	border: .12em solid #aaa;
+}
+
+@media screen {
+	.mdo {
+		word-break: break-word;
+		overflow-wrap: break-word;
+		word-wrap: break-word; /*ie*/
+	}
+	html.light .mdo a,
+	.mdo a {
+		color: #fff;
+		background: #39b;
+		text-decoration: none;
+		padding: 0 .3em;
+		border: none;
+		border-bottom: .07em solid #079;
+	}
+	.mdo h1 {
+		color: #fff;
+		background: #444;
+		font-weight: normal;
+		border-top: .4em solid #fb0;
+		border-bottom: .4em solid #777;
+		border-radius: 0 1em 0 1em;
+		margin: 3em 0 1em 0;
+		padding: .5em 0;
+	}
+	.mdo h2 {
+		color: #fff;
+		background: #555;
+		margin-top: 2em;
+		border-bottom: .22em solid #999;
+		border-top: none;
+	}
+
+
+
+	html.dark .mdo a {
+		background: #057;
+	}
+	html.dark .mdo h1 a, html.dark .mdo h4 a,
+	html.dark .mdo h2 a, html.dark .mdo h5 a,
+	html.dark .mdo h3 a, html.dark .mdo h6 a {
+		color: inherit;
+		background: none;
+	}
+	html.dark .mdo pre,
+	html.dark .mdo code {
+		color: #8c0;
+		background: #1a1a1a;
+		border: .07em solid #333;
+	}
+	html.dark .mdo ul,
+	html.dark .mdo ol {
+		border-color: #444;
+	}
+	html.dark .mdo strong {
+		color: #fff;
+	}
+	html.dark .mdo p>em,
+	html.dark .mdo li>em,
+	html.dark .mdo td>em {
+		color: #f94;
+		border-color: #666;
+	}
+	html.dark .mdo h1 {
+		background: #383838;
+		border-top: .4em solid #b80;
+		border-bottom: .4em solid #4c4c4c;
+	}
+	html.dark .mdo h2 {
+		background: #444;
+		border-bottom: .22em solid #555;
+	}
+	html.dark .mdo td,
+	html.dark .mdo th {
+		border-color: #444;
+	}
+	html.dark .mdo blockquote {
+		background: #282828;
+		border: .07em dashed #444;
+	}
+}
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -633,20 +633,97 @@ function up2k_init(subtle) {
    function nav() {
        ebi('file' + fdom_ctr).click();
    }
-    ebi('u2btn').addEventListener('click', nav, false);
+    ebi('u2btn').onclick = nav;

+    var nenters = 0;
    function ondrag(e) {
-        e.stopPropagation();
-        e.preventDefault();
+        if (++nenters <= 0)
+            nenters = 1;
+
+        //console.log(nenters, Date.now(), 'enter', this, e.target);
+        if (onover.bind(this)(e))
+            return true;
+
+        var mup, up = QS('#up_zd');
+        var msr, sr = QS('#srch_zd');
+        if (!has(perms, 'write'))
+            mup = 'you do not have write-access to this folder';
+        if (!has(perms, 'read'))
+            msr = 'you do not have read-access to this folder';
+        if (!have_up2k_idx)
+            msr = 'file-search is not enabled in server config';
+
+        up.querySelector('span').textContent = mup || 'drop it here';
+        sr.querySelector('span').textContent = msr || 'drop it here';
+        clmod(up, 'err', mup);
+        clmod(sr, 'err', msr);
+        clmod(up, 'ok', !mup);
+        clmod(sr, 'ok', !msr);
+        ebi('up_dz').setAttribute('err', mup || '');
+        ebi('srch_dz').setAttribute('err', msr || '');
+    }
+    function onover(e) {
+        try {
+            var ok = false, dt = e.dataTransfer.types;
+            for (var a = 0; a < dt.length; a++)
+                if (dt[a] == 'Files')
+                    ok = true;
+
+            if (!ok)
+                return true;
+        }
+        catch (ex) { }
+
+        ev(e);
        e.dataTransfer.dropEffect = 'copy';
        e.dataTransfer.effectAllowed = 'copy';
+        clmod(ebi('drops'), 'vis', 1);
+        var v = this.getAttribute('v');
+        if (v)
+            clmod(ebi(v), 'hl', 1);
    }
-    ebi('u2btn').addEventListener('dragover', ondrag, false);
-    ebi('u2btn').addEventListener('dragenter', ondrag, false);
+    function offdrag(e) {
+        ev(e);
+
+        var v = this.getAttribute('v');
+        if (v)
+            clmod(ebi(v), 'hl');
+
+        if (--nenters <= 0) {
+            clmod(ebi('drops'), 'vis');
+            clmod(ebi('up_dz'), 'hl');
+            clmod(ebi('srch_dz'), 'hl');
+        }
+
+        //console.log(nenters, Date.now(), 'leave', this, e && e.target);
+    }
+    document.body.ondragenter = ondrag;
+    document.body.ondragleave = offdrag;
+
+    var drops = [ebi('up_dz'), ebi('srch_dz')];
+    for (var a = 0; a < 2; a++) {
+        drops[a].ondragenter = ondrag;
+        drops[a].ondragover = onover;
+        drops[a].ondragleave = offdrag;
+        drops[a].ondrop = gotfile;
+    }
+    ebi('drops').onclick = offdrag;  // old ff

    function gotfile(e) {
-        e.stopPropagation();
-        e.preventDefault();
+        ev(e);
+        nenters = 0;
+        offdrag.bind(this)();
+        var dz = (this && this.getAttribute('id'));
+
+        var err = this.getAttribute('err');
+        if (err)
+            return modal.alert('sorry, ' + err);
+
+        if ((dz == 'up_dz' && fsearch) || (dz == 'srch_dz' && !fsearch))
+            tgl_fsearch();
+
+        if (!QS('#op_up2k.act'))
+            goto('up2k');

        var files,
            is_itemlist = false;
@@ -800,6 +877,12 @@ function up2k_init(subtle) {
            });
        }

+        good_files.sort(function (a, b) {
+            a = a[1];
+            b = b[1];
+            return a < b ? -1 : a > b ? 1 : 0;
+        });
+
        var msg = ['{0} these {1} files?<ul>'.format(fsearch ? 'search' : 'upload', good_files.length)];
        for (var a = 0, aa = Math.min(20, good_files.length); a < aa; a++)
            msg.push('<li>' + esc(good_files[a][1]) + '</li>');
@@ -871,14 +954,13 @@ function up2k_init(subtle) {
            pvis.changecard(pvis.act);
        }
    }
-    ebi('u2btn').addEventListener('drop', gotfile, false);

    function more_one_file() {
        fdom_ctr++;
        var elm = mknod('div');
        elm.innerHTML = '<input id="file{0}" type="file" name="file{0}[]" multiple="multiple" />'.format(fdom_ctr);
        ebi('u2form').appendChild(elm);
-        ebi('file' + fdom_ctr).addEventListener('change', gotfile, false);
+        ebi('file' + fdom_ctr).onchange = gotfile;
    }
    more_one_file();

@@ -898,7 +980,7 @@ function up2k_init(subtle) {
    }
    ebi('u2cleanup').onclick = u2cleanup;

-    var etaref = 0, etaskip = 0;
+    var etaref = 0, etaskip = 0, op_minh = 0;
    function etafun() {
        var nhash = st.busy.head.length + st.busy.hash.length + st.todo.head.length + st.todo.hash.length,
            nsend = st.busy.upload.length + st.todo.upload.length,
@@ -906,7 +988,19 @@ function up2k_init(subtle) {
            td = (now - (etaref || now)) / 1000.0;

        etaref = now;
-        //ebi('acc_info').innerHTML = f2f(st.time.busy, 1) + ' ' + f2f(now / 1000, 1);
+        if (td > 1.2)
+            td = 0.05;
+
+        //ebi('acc_info').innerHTML = humantime(st.time.busy) + ' ' + f2f(now / 1000, 1);
+
+        var op = ebi('op_up2k'),
+            uff = ebi('u2footfoot'),
+            minh = QS('#op_up2k.act') ? Math.max(op_minh, uff.offsetTop + uff.offsetHeight - op.offsetTop + 32) : 0;
+
+        if (minh > op_minh || !op_minh) {
+            op_minh = minh;
+            op.style.minHeight = op_minh + 'px';
+        }

        if (!nhash)
            ebi('u2etah').innerHTML = 'Done ({0}, {1} files)'.format(humansize(st.bytes.hashed), pvis.ctr["ok"] + pvis.ctr["ng"]);
@@ -954,14 +1048,8 @@ function up2k_init(subtle) {
            if (etaskip)
                continue;

-            if (eta < 60 * 60 * 24)
-                try {
-                    eta = /.*(..:..:..).*/.exec(new Date(eta * 1000).toUTCString())[1];
-                }
-                catch (ex) { }
-
            ebi(t[a][0]).innerHTML = '{0}, {1}/s, {2}'.format(
-                humansize(rem), humansize(bps, 1), eta);
+                humansize(rem), humansize(bps, 1), humantime(eta));
        }
        if (++etaskip > 2)
            etaskip = 0;
@@ -1075,6 +1163,7 @@ function up2k_init(subtle) {
                            toast.err(t, '{0} {1}'.format(ks, tng));

                        timer.rm(etafun);
+                        op_minh = 0;
                    }
                    else {
                        timer.add(etafun, false);
@@ -1370,8 +1459,11 @@ function up2k_init(subtle) {
                }
            }
            apop(st.busy.head, t);
-            if (!ok && !t.srch)
-                return push_t(st.todo.hash, t);
+            if (!ok && !t.srch) {
+                push_t(st.todo.hash, t);
+                tasker();
+                return;
+            }

            t.done = true;
            st.bytes.hashed += t.size;
@@ -1380,6 +1472,7 @@ function up2k_init(subtle) {
            pvis.seth(t.n, 1, ok ? 'YOLO' : '404');
            pvis.seth(t.n, 2, "turbo'd");
            pvis.move(t.n, ok ? 'ok' : 'ng');
+            tasker();
        };
        xhr.onload = function (e) {
            try { orz(e); } catch (ex) { vis_exh(ex + '', '', '', '', ex); }
@@ -1852,7 +1945,7 @@ function up2k_init(subtle) {
                flag = up2k_flagbus();
            }
            catch (ex) {
-                console.log("flag error: " + ex.toString());
+                toast.err(5, "not supported on your browser:\n" + ex);
                tgl_flag_en();
            }
        }
@@ -1880,17 +1973,18 @@ function up2k_init(subtle) {
    };

    ebi('nthread').onkeydown = bumpthread2;
-    ebi('nthread').addEventListener('input', bumpthread, false);
-    ebi('multitask').addEventListener('click', tgl_multitask, false);
-    ebi('ask_up').addEventListener('click', tgl_ask_up, false);
-    ebi('flag_en').addEventListener('click', tgl_flag_en, false);
-    ebi('u2turbo').addEventListener('click', tgl_turbo, false);
-    ebi('u2tdate').addEventListener('click', tgl_datechk, false);
+    ebi('nthread').oninput = bumpthread;
+    ebi('multitask').onclick = tgl_multitask;
+    ebi('ask_up').onclick = tgl_ask_up;
+    ebi('flag_en').onclick = tgl_flag_en;
+    ebi('u2turbo').onclick = tgl_turbo;
+    ebi('u2tdate').onclick = tgl_datechk;
    var o = ebi('fsearch');
    if (o)
-        o.addEventListener('click', tgl_fsearch, false);
+        o.onclick = tgl_fsearch;

-    ebi('u2etas').onclick = function () {
+    ebi('u2etas').onclick = function (e) {
+        ev(e);
        clmod(ebi('u2etas'), 'o', 't');
    };

@@ -1899,7 +1993,7 @@ function up2k_init(subtle) {
    if (parallel_uploads < 1)
        bumpthread(1);

-    return { "init_deps": init_deps, "set_fsearch": set_fsearch }
+    return { "init_deps": init_deps, "set_fsearch": set_fsearch, "ui": pvis }
 }


--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -8,7 +8,8 @@ if (!window['console'])

 var is_touch = 'ontouchstart' in window,
    IPHONE = /iPhone|iPad|iPod/i.test(navigator.userAgent),
-    ANDROID = /android/i.test(navigator.userAgent);
+    ANDROID = /android/i.test(navigator.userAgent),
+    WINDOWS = navigator.platform ? navigator.platform == 'Win32' : /Windows/.test(navigator.userAgent);


 var ebi = document.getElementById.bind(document),
@@ -28,6 +29,35 @@ function esc(txt) {
        }[c];
    });
 }
+window.onunhandledrejection = function (e) {
+    console.log("REJ: " + e.reason);
+};
+try {
+    console.hist = [];
+    var hook = function (t) {
+        var orig = console[t].bind(console),
+            cfun = function () {
+                console.hist.push(Date.now() + ' ' + t + ': ' + Array.from(arguments).join(', '));
+                if (console.hist.length > 100)
+                    console.hist = console.hist.slice(50);
+
+                orig.apply(console, arguments);
+            };
+
+        console['std' + t] = orig;
+        console[t] = cfun;
+    };
+    hook('log');
+    console.log('log-capture ok');
+    hook('debug');
+    hook('warn');
+    hook('error');
+}
+catch (ex) {
+    if (console.stdlog)
+        console.log = console.stdlog;
+    console.log(ex);
+}
 var crashed = false, ignexd = {};
 function vis_exh(msg, url, lineNo, columnNo, error) {
    if ((msg + '').indexOf('ResizeObserver') !== -1)
@@ -39,22 +69,59 @@ function vis_exh(msg, url, lineNo, columnNo, error) {

    crashed = true;
    window.onerror = undefined;
-    var html = ['<h1>you hit a bug!</h1><p style="font-size:1.3em;margin:0">try to <a href="#" onclick="localStorage.clear();location.reload();">reset copyparty settings</a> if you are stuck here, or <a href="#" onclick="ignex();">ignore this</a> / <a href="#" onclick="ignex(true);">ignore all</a></p><p>please send me a screenshot arigathanks gozaimuch: <code>ed/irc.rizon.net</code> or <code>ed#2644</code><br />&nbsp; (and if you can, press F12 and include the "Console" tab in the screenshot too)</p><p>',
-        esc(url + ' @' + lineNo + ':' + columnNo), '<br />' + esc(String(msg)) + '</p>'];
+    var html = [
+        '<h1>you hit a bug!</h1>',
+        '<p style="font-size:1.3em;margin:0">try to <a href="#" onclick="localStorage.clear();location.reload();">reset copyparty settings</a> if you are stuck here, or <a href="#" onclick="ignex();">ignore this</a> / <a href="#" onclick="ignex(true);">ignore all</a></p>',
+        '<p style="color:#fff">please send me a screenshot arigathanks gozaimuch: <a href="<ghi>" target="_blank">github issue</a> or <code>ed#2644</code></p>',
+        '<p class="b">' + esc(url + ' @' + lineNo + ':' + columnNo), '<br />' + esc(String(msg)) + '</p>',
+        '<p><b>UA:</b> ' + esc(navigator.userAgent + '')
+    ];
+
+    try {
+        var ua = '',
+            ad = navigator.userAgentData,
+            adb = ad.brands;
+
+        for (var a = 0; a < adb.length; a++)
+            if (!/Not.*A.*Brand/.exec(adb[a].brand))
+                ua += adb[a].brand + '/' + adb[a].version + ', ';
+        ua += ad.platform;
+
+        html.push('<br /><b>UAD:</b> ' + esc(ua.slice(0, 100)));
+    }
+    catch (e) { }
+    html.push('</p>');

    try {
        if (error) {
            var find = ['desc', 'stack', 'trace'];
            for (var a = 0; a < find.length; a++)
                if (String(error[find[a]]) !== 'undefined')
-                    html.push('<h3>' + find[a] + '</h3>' +
-                        esc(String(error[find[a]])).replace(/\n/g, '<br />\n'));
+                    html.push('<p class="b"><b>' + find[a] + ':</b><br />' +
+                        esc(String(error[find[a]])).replace(/\n/g, '<br />\n') + '</p>');
        }
        ignexd[ekey] = true;
-        html.push('<h3>localStore</h3>' + esc(JSON.stringify(localStorage)));
+
+        var ls = jcp(localStorage);
+        if (ls.fman_clip)
+            ls.fman_clip = ls.fman_clip.length + ' items';
+
+        var lsk = Object.keys(ls);
+        lsk.sort();
+        html.push('<p class="b">');
+        for (var a = 0; a < lsk.length; a++)
+            html.push(' <b>' + esc(lsk[a]) + '</b> <code>' + esc(ls[lsk[a]]) + '</code> ');
+        html.push('</p>');
    }
    catch (e) { }

+    if (console.hist.length) {
+        html.push('<p class="b"><b>console:</b><ul><li>' + Date.now() + ' @</li>');
+        for (var a = console.hist.length - 1, aa = Math.max(0, console.hist.length - 20); a >= aa; a--)
+            html.push('<li>' + esc(console.hist[a]) + '</li>');
+        html.push('</ul>')
+    }
+
    try {
        var exbox = ebi('exbox');
        if (!exbox) {
@@ -63,10 +130,19 @@ function vis_exh(msg, url, lineNo, columnNo, error) {
            document.body.appendChild(exbox);

            var s = mknod('style');
-            s.innerHTML = '#exbox{background:#333;color:#ddd;font-family:sans-serif;font-size:0.8em;padding:0 1em 1em 1em;z-index:80386;position:fixed;top:0;left:0;right:0;bottom:0;width:100%;height:100%} #exbox h1{margin:.5em 1em 0 0;padding:0} #exbox h3{border-top:1px solid #999;margin:1em 0 0 0} #exbox a{text-decoration:underline;color:#fc0} #exbox code{color:#bf7;background:#222;padding:.1em;margin:.2em;font-size:1.1em;font-family:monospace,monospace} #exbox *{line-height:1.5em}';
+            s.innerHTML = (
+                '#exbox{background:#333;color:#ddd;font-family:sans-serif;font-size:0.8em;padding:0 1em 1em 1em;z-index:80386;position:fixed;top:0;left:0;right:0;bottom:0;width:100%;height:100%;overflow:auto;width:calc(100% - 2em)} ' +
+                '#exbox,#exbox *{line-height:1.5em;overflow-wrap:break-word} ' +
+                '#exbox code{color:#bf7;background:#222;padding:.1em;margin:.2em;font-size:1.1em;font-family:monospace,monospace} ' +
+                '#exbox a{text-decoration:underline;color:#fc0} ' +
+                '#exbox h1{margin:.5em 1em 0 0;padding:0} ' +
+                '#exbox p.b{border-top:1px solid #999;margin:1em 0 0 0;font-size:1em} ' +
+                '#exbox ul, #exbox li {margin:0 0 0 .5em;padding:0} ' +
+                '#exbox b{color:#fff}'
+            );
            document.head.appendChild(s);
        }
-        exbox.innerHTML = html.join('\n');
+        exbox.innerHTML = html.join('\n').replace(/https?:\/\/[^ \/]+\//g, '/').replace(/js\?_=[a-zA-Z]{4}/g, 'js').replace(/<ghi>/, 'https://github.com/9001/copyparty/issues/new?labels=bug&template=bug_report.md');
        exbox.style.display = 'block';
    }
    catch (e) {
@@ -429,6 +505,19 @@ function humansize(b, terse) {
 }


+function humantime(v) {
+    if (v >= 60 * 60 * 24)
+        return v;
+
+    try {
+        return /.*(..:..:..).*/.exec(new Date(v * 1000).toUTCString())[1];
+    }
+    catch (ex) {
+        return v;
+    }
+}
+
+
 function clamp(v, a, b) {
    return Math.min(Math.max(v, a), b);
 }
@@ -561,6 +650,9 @@ var timer = (function () {
    };

    function doevents() {
+        if (crashed)
+            return;
+
        if (Date.now() - r.last < 69)
            return;

@@ -606,6 +698,7 @@ var tt = (function () {
        r.el = this;
        var pos = this.getBoundingClientRect(),
            dir = this.getAttribute('ttd') || '',
+            margin = parseFloat(this.getAttribute('ttm') || 0),
            top = pos.top < window.innerHeight / 2,
            big = this.className.indexOf(' ttb') !== -1;

@@ -617,23 +710,22 @@ var tt = (function () {
        r.tt.style.top = '0';

        r.tt.innerHTML = msg.replace(/\$N/g, "<br />");
-        var tw = r.tt.offsetWidth,
-            x = pos.left + (pos.right - pos.left) / 2 - tw / 2;
-
-        if (x < 0)
-            x = 8;
-
-        if (x + tw >= window.innerWidth - 8) {
-            x = window.innerWidth - tw - 8;
-        }
-
-        r.tt.style.left = x + 'px';
-        r.tt.style.top = top ? pos.bottom + 'px' : 'auto';
-        r.tt.style.bottom = top ? 'auto' : (window.innerHeight - pos.top) + 'px';
-
        r.el.addEventListener('mouseleave', r.hide);
        window.addEventListener('scroll', r.hide);
        clmod(r.tt, 'show', 1);
+
+        var tw = r.tt.offsetWidth,
+            x = pos.left + (pos.right - pos.left) / 2 - tw / 2;
+
+        if (x + tw >= window.innerWidth - 24)
+            x = window.innerWidth - tw - 24;
+
+        if (x < 0)
+            x = 12;
+
+        r.tt.style.left = x + 'px';
+        r.tt.style.top = top ? (margin + pos.bottom) + 'px' : 'auto';
+        r.tt.style.bottom = top ? 'auto' : (margin + window.innerHeight - pos.top) + 'px';
    };

    r.hide = function (e) {
@@ -713,6 +805,7 @@ function lf2br(txt) {
 var toast = (function () {
    var r = {},
        te = null,
+        scrolling = false,
        obj = mknod('div');

    obj.setAttribute('id', 'toast');
@@ -720,38 +813,61 @@ var toast = (function () {
    r.visible = false;
    r.txt = null;

+    function scrollchk() {
+        if (scrolling)
+            return;
+
+        var tb = ebi('toastb'),
+            vis = tb.offsetHeight,
+            all = tb.scrollHeight;
+
+        if (8 + vis >= all)
+            return;
+
+        clmod(obj, 'scroll', 1);
+        scrolling = true;
+    }
+
+    function unscroll() {
+        timer.rm(scrollchk);
+        clmod(obj, 'scroll');
+        scrolling = false;
+    }
+
    r.hide = function (e) {
        ev(e);
+        unscroll();
        clearTimeout(te);
        clmod(obj, 'vis');
        r.visible = false;
    };

-    r.show = function (cl, ms, txt) {
+    r.show = function (cl, sec, txt) {
        clearTimeout(te);
-        if (ms)
-            te = setTimeout(r.hide, ms * 1000);
+        if (sec)
+            te = setTimeout(r.hide, sec * 1000);

-        obj.innerHTML = '<a href="#" id="toastc">x</a>' + lf2br(txt);
+        obj.innerHTML = '<a href="#" id="toastc">x</a><div id="toastb">' + lf2br(txt) + '</div>';
        obj.className = cl;
-        ms += obj.offsetWidth;
+        sec += obj.offsetWidth;
        obj.className += ' vis';
        ebi('toastc').onclick = r.hide;
+        timer.add(scrollchk);
        r.visible = true;
        r.txt = txt;
    };

-    r.ok = function (ms, txt) {
-        r.show('ok', ms, txt);
+    r.ok = function (sec, txt) {
+        r.show('ok', sec, txt);
    };
-    r.inf = function (ms, txt) {
-        r.show('inf', ms, txt);
+    r.inf = function (sec, txt) {
+        r.show('inf', sec, txt);
    };
-    r.warn = function (ms, txt) {
-        r.show('warn', ms, txt);
+    r.warn = function (sec, txt) {
+        r.show('warn', sec, txt);
    };
-    r.err = function (ms, txt) {
-        r.show('err', ms, txt);
+    r.err = function (sec, txt) {
+        r.show('err', sec, txt);
    };

    return r;
@@ -762,8 +878,12 @@ var modal = (function () {
    var r = {},
        q = [],
        o = null,
+        cb_up = null,
        cb_ok = null,
-        cb_ng = null;
+        cb_ng = null,
+        prim = '<a href="#" id="modal-ok">OK</a>',
+        sec = '<a href="#" id="modal-ng">Cancel</a>',
+        ok_cancel = WINDOWS ? prim + sec : sec + prim;

    r.busy = false;

@@ -782,9 +902,17 @@ var modal = (function () {
        a = ebi('modal-ok');
        a.onclick = ok;

-        (ebi('modali') || a).focus();
+        var inp = ebi('modali');
+        (inp || a).focus();
+        if (inp)
+            setTimeout(function () {
+                inp.setSelectionRange(0, inp.value.length, "forward");
+            }, 0);
+
        document.addEventListener('focus', onfocus);
        timer.add(onfocus);
+        if (cb_up)
+            setTimeout(cb_up, 1);
    };

    r.hide = function () {
@@ -839,41 +967,44 @@ var modal = (function () {
            q.shift()();
    }

-    r.alert = function (html, cb) {
+    r.alert = function (html, cb, fun) {
        q.push(function () {
-            _alert(lf2br(html), cb);
+            _alert(lf2br(html), cb, fun);
        });
        next();
    };
-    function _alert(html, cb) {
+    function _alert(html, cb, fun) {
        cb_ok = cb_ng = cb;
+        cb_up = fun;
        html += '<div id="modalb"><a href="#" id="modal-ok">OK</a></div>';
        r.show(html);
    }

-    r.confirm = function (html, cok, cng) {
+    r.confirm = function (html, cok, cng, fun) {
        q.push(function () {
-            _confirm(lf2br(html), cok, cng);
+            _confirm(lf2br(html), cok, cng, fun);
        });
        next();
    }
-    function _confirm(html, cok, cng) {
+    function _confirm(html, cok, cng, fun) {
        cb_ok = cok;
        cb_ng = cng === undefined ? cok : null;
-        html += '<div id="modalb"><a href="#" id="modal-ok">OK</a><a href="#" id="modal-ng">Cancel</a></div>';
+        cb_up = fun;
+        html += '<div id="modalb">' + ok_cancel + '</div>';
        r.show(html);
    }

-    r.prompt = function (html, v, cok, cng) {
+    r.prompt = function (html, v, cok, cng, fun) {
        q.push(function () {
-            _prompt(lf2br(html), v, cok, cng);
+            _prompt(lf2br(html), v, cok, cng, fun);
        });
        next();
    }
-    function _prompt(html, v, cok, cng) {
+    function _prompt(html, v, cok, cng, fun) {
        cb_ok = cok;
        cb_ng = cng === undefined ? cok : null;
-        html += '<input id="modali" type="text" /><div id="modalb"><a href="#" id="modal-ok">OK</a><a href="#" id="modal-ng">Cancel</a></div>';
+        cb_up = fun;
+        html += '<input id="modali" type="text" /><div id="modalb">' + ok_cancel + '</div>';
        r.show(html);

        ebi('modali').value = v || '';
@@ -892,3 +1023,84 @@ function winpopup(txt) {
        body: 'msg=' + uricom_enc(Date.now() + ', ' + txt)
    });
 }
+
+
+var last_repl = null;
+function repl_load() {
+    var ipre = ebi('repl_pre'),
+        tb = ebi('modali');
+
+    function getpres() {
+        var o, ret = jread("repl_pre", []);
+        if (!ret.length)
+            ret = [
+                'var v=Object.keys(localStorage); v.sort(); JSON.stringify(v)',
+                'console.hist.slice(-10).join("\\n")'
+            ];
+
+        ipre.innerHTML = '<option value=""></option>';
+        for (var a = 0; a < ret.length; a++) {
+            o = mknod('option');
+            o.setAttribute('value', ret[a]);
+            o.textContent = ret[a];
+            ipre.appendChild(o);
+        }
+        last_repl = ipre.value = (last_repl || (ret.length ? ret.slice(-1)[0] : ''));
+        return ret;
+    }
+    ebi('repl_pdel').onclick = function (e) {
+        var val = ipre.value,
+            pres = getpres();
+
+        apop(pres, val);
+        jwrite('repl_pre', pres);
+        getpres();
+    };
+    ebi('repl_pnew').onclick = function (e) {
+        var val = tb.value,
+            pres = getpres();
+
+        apop(pres, ipre.value);
+        pres.push(val);
+        jwrite('repl_pre', pres);
+        getpres();
+        ipre.value = val;
+    };
+    ipre.oninput = ipre.onchange = function () {
+        tb.value = last_repl = ipre.value;
+    };
+    tb.oninput = function () {
+        last_repl = this.value;
+    };
+    getpres();
+    tb.value = last_repl;
+    setTimeout(function () {
+        tb.setSelectionRange(0, tb.value.length, "forward");
+    }, 10);
+}
+function repl(e) {
+    ev(e);
+    var html = [
+        '<p>js repl (prefix with <code>,</code> to allow raise)</p>',
+        '<p><select id="repl_pre"></select>',
+        ' &nbsp; <button id="repl_pdel">❌ del</button>',
+        ' &nbsp; <button id="repl_pnew">💾 SAVE</button></p>'
+    ];
+
+    modal.prompt(html.join(''), '', function (cmd) {
+        if (!cmd)
+            return toast.inf(3, 'eval aborted');
+
+        if (cmd.startsWith(','))
+            return modal.alert(esc(eval(cmd.slice(1)) + ''))
+
+        try {
+            modal.alert(esc(eval(cmd) + ''));
+        }
+        catch (ex) {
+            modal.alert('<h6>exception</h6>' + esc(ex + ''));
+        }
+    }, undefined, repl_load);
+}
+if (ebi('repl'))
+    ebi('repl').onclick = repl;
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,11 +1,21 @@
-# example `.epilogue.html`
+**NOTE:** there's more stuff (sharex config, service scripts, nginx configs, ...) in [`/contrib/`](/contrib/)
+
+
+
+# example resource files
+
+can be provided to copyparty to tweak things
+
+
+
+## example `.epilogue.html`
 save one of these as `.epilogue.html` inside a folder to customize it:

 * [`minimal-up2k.html`](minimal-up2k.html) will [simplify the upload ui](https://user-images.githubusercontent.com/241032/118311195-dd6ca380-b4ef-11eb-86f3-75a3ff2e1332.png)



-# example browser-css
+## example browser-css
 point `--css-browser` to one of these by URL:

 * [`browser.css`](browser.css) changes the background
@@ -19,4 +29,23 @@ point `--css-browser` to one of these by URL:
 * notes on using rclone as a fuse client/server

 ## [`example.conf`](example.conf)
-* example config file for `-c` which never really happened
+* example config file for `-c` (supports accounts, volumes, and volume-flags)
+
+
+
+# junk
+
+alphabetical list of the remaining files
+
+| what | why |
+| -- | -- |
+| [biquad.html](biquad.html) | bruteforce calibrator for the audio equalizer since im not that good at maths |
+| [design.txt](design.txt) | initial brainstorming of the copyparty design, unmaintained, incorrect, sentimental value only |
+| [hls.html](hls.html) | experimenting with hls playback using `hls.js`, works p well, almost became a thing |
+| [music-analysis.sh](music-analysis.sh) | testing various bpm/key detection libraries before settling on the ones used in [`/bin/mtag/`](/bin/mtag/) |
+| [notes.sh](notes.sh) | notepad, just scraps really |
+| [nuitka.txt](nuitka.txt) | how to build a copyparty exe using nuitka (not maintained) |
+| [pretend-youre-qnap.patch](pretend-youre-qnap.patch) | simulate a NAS which keeps returning old cached data even though you just modified the file yourself |
+| [tcp-debug.sh](tcp-debug.sh) | looks like this was to debug stuck tcp connections? |
+| [unirange.py](unirange.py) | uhh |
+| [up2k.txt](up2k.txt) | initial ideas for how up2k should work, another unmaintained sentimental-value-only thing |
--- a/docs/biquad.html
+++ b/docs/biquad.html
@@ -3,6 +3,24 @@
 setTimeout(location.reload.bind(location), 700);
 document.documentElement.scrollLeft = 0;

+var cali = (function() {
+    var ac = new AudioContext(),
+        fi = ac.createBiquadFilter(),
+        freqs = new Float32Array(1),
+        mag = new Float32Array(1),
+        phase = new Float32Array(1);
+
+    freqs[0] = 14000;
+    fi.type = 'peaking';
+    fi.frequency.value = 18000;
+    fi.Q.value = 0.8;
+    fi.gain.value = 1;
+    fi.getFrequencyResponse(freqs, mag, phase);
+
+    return mag[0];  // 1.0407 good, 1.0563 bad
+})(),
+    mp = cali < 1.05;
+
 var can = document.createElement('canvas'),
    cc = can.getContext('2d'),
    w = 2048,
@@ -28,12 +46,12 @@ var cfg = [ // hz, q, g
    [1000, 0.9, 1.1],
    [2000, 0.9, 1.105],
    [4000, 0.88, 1.05],
-    [8000 * 1.006, 0.73, 1.24],
+    [8000 * 1.006, 0.73, mp ? 1.24 : 1.2],
    //[16000 * 1.00, 0.5, 1.75],  // peak.v1
    //[16000 * 1.19, 0, 1.8]  // shelf.v1
-    [16000 * 0.89, 0.7, 1.26],  // peak
-    [16000 * 1.13, 0.82, 1.09],  // peak
-    [16000 * 1.205, 0, 1.9]  // shelf
+    [16000 * 0.89, 0.7, mp ? 1.26 : 1.2],  // peak
+    [16000 * 1.13, 0.82, mp ? 1.09 : 0.75],  // peak
+    [16000 * 1.205, 0, mp ? 1.9 : 1.85]  // shelf
 ];

 var freqs = new Float32Array(22000),
--- a/docs/browser-icons.css
+++ b/docs/browser-icons.css
@@ -1,4 +1,7 @@
-/* video */
+/* video, alternative 1:
+   top-left icon, just like the other formats
+=======================================================================
+
 #ggrid>a:is(
 [href$=".mkv"i],
 [href$=".mp4"i],
@@ -6,6 +9,40 @@
 ):before {
    content: '📺';
 }
+*/
+
+
+
+/* video, alternative 2:
+   play-icon in the middle of the thumbnail
+=======================================================================
+*/
+#ggrid>a:is(
+[href$=".mkv"i],
+[href$=".mp4"i],
+[href$=".webm"i],
+) {
+	position: relative;
+	overflow: hidden;
+}
+#ggrid>a:is(
+[href$=".mkv"i],
+[href$=".mp4"i],
+[href$=".webm"i],
+):before {
+    content: '▶';
+	opacity: .8;
+	margin: 0;
+	padding: 1em .5em 1em .7em;
+	border-radius: 9em;
+	line-height: 0;
+	color: #fff;
+	text-shadow: none;
+	background: rgba(0, 0, 0, 0.7);
+	left: calc(50% - 1em);
+	top: calc(50% - 1.4em);
+}
+


 /* audio */
@@ -21,6 +58,7 @@
 }


+
 /* image */
 #ggrid>a:is(
 [href$=".jpg"i],
--- a/docs/minimal-up2k.html
+++ b/docs/minimal-up2k.html
@@ -11,6 +11,8 @@

    #u2cleanup, #u2conf tr:first-child>td[rowspan]:not(#u2btn_cw),  /* most of the config options */

+    #srch_dz, #srch_zd,  /* the filesearch dropzone */
+
    #u2cards, #u2etaw  /* and the upload progress tabs */

    {display: none !important}  /* do it! */
@@ -27,6 +29,9 @@
    /* adjust the button area a bit */
    #u2conf.has_btn {width: 35em !important; margin: 5em auto}

+    /* a */
+    #op_up2k {min-height: 0}
+
 </style>

 <a href="#" onclick="this.parentNode.innerHTML='';">show advanced options</a>
--- a/docs/mistakes.py
+++ b/docs/mistakes.py
@@ -1,26 +0,0 @@
-
-                method = self.s.recv(4)
-                self.s.unrecv(method)
-                print("xxx unrecv'd [{}]".format(method))
-
-                # jython used to do this, they stopped since it's broken
-                # but reimplementing sendall is out of scope for now
-                if not getattr(self.s.s, "sendall", None):
-                    self.s.s.sendall = self.s.s.send
-
-                # TODO this is also pretty bad
-                have = dir(self.s)
-                for k in self.s.s.__dict__:
-                    if k not in have and not k.startswith("__"):
-                        if k == "recv":
-                            raise Exception("wait what")
-
-                        self.s.__dict__[k] = self.s.s.__dict__[k]
-
-                have = dir(self.s)
-                for k in dir(self.s.s):
-                    if k not in have and not k.startswith("__"):
-                        if k == "recv":
-                            raise Exception("wait what")
-
-                        setattr(self.s, k, getattr(self.s.s, k))
--- a/docs/notes.sh
+++ b/docs/notes.sh
@@ -130,6 +130,9 @@ sqlite3 .hist/up2k.db 'select * from mt where k="fgsfds" or k="t:mtp"' | tee /de
 for ((f=420;f<1200;f++)); do sz=$(ffmpeg -y -f lavfi -i sine=frequency=$f:duration=2 -vf volume=0.1 -ac 1 -ar 44100 -f s16le /dev/shm/a.wav 2>/dev/null; base64 -w0 </dev/shm/a.wav | gzip -c | wc -c); printf '%d %d\n' $f $sz; done | tee /dev/stderr | sort -nrk2,2
 ffmpeg -y -f lavfi -i sine=frequency=1050:duration=2 -vf volume=0.1 -ac 1 -ar 44100 /dev/shm/a.wav

+# play icon calibration pics
+for w in 150 170 190 210 230 250; do for h in 130 150 170 190 210; do /c/Program\ Files/ImageMagick-7.0.11-Q16-HDRI/magick.exe convert -size ${w}x${h} xc:brown -fill orange -draw "circle $((w/2)),$((h/2)) $((w/2)),$((h/3))" $w-$h.png; done; done
+

 ##
 ## vscode
@@ -161,7 +164,7 @@ brew install python@2
 pip install virtualenv

 # readme toc
-cat README.md | awk 'function pr() { if (!h) {return}; if (/^ *[*!#]/||!s) {printf "%s\n",h;h=0;return}; if (/.../) {printf "%s - %s\n",h,$0;h=0}; };    /^#/{s=1;pr()} /^#* *(file indexing|install on android|dev env setup|just the sfx|complete release|optional gpl stuff)|`$/{s=0} /^#/{lv=length($1);sub(/[^ ]+ /,"");bab=$0;gsub(/ /,"-",bab); h=sprintf("%" ((lv-1)*4+1) "s [%s](#%s)", "*",$0,bab);next} !h{next} {sub(/:$/,"")} {pr()}' > toc; grep -E '^## readme toc' -B1000 -A2 <README.md >p1; grep -E '^## quickstart' -B2 -A999999 <README.md >p2; (cat p1; grep quickstart -A1000 <toc; cat p2) >README.md
+cat README.md | awk 'function pr() { if (!h) {return}; if (/^ *[*!#]/||!s) {printf "%s\n",h;h=0;return}; if (/.../) {printf "%s - %s\n",h,$0;h=0}; };    /^#/{s=1;pr()} /^#* *(file indexing|install on android|dev env setup|just the sfx|complete release|optional gpl stuff)|`$/{s=0} /^#/{lv=length($1);sub(/[^ ]+ /,"");bab=$0;gsub(/ /,"-",bab); h=sprintf("%" ((lv-1)*4+1) "s [%s](#%s)", "*",$0,bab);next} !h{next} {sub(/  .*/,"");sub(/[:,]$/,"")} {pr()}' > toc; grep -E '^## readme toc' -B1000 -A2 <README.md >p1; grep -E '^## quickstart' -B2 -A999999 <README.md >p2; (cat p1; grep quickstart -A1000 <toc; cat p2) >README.md

 # fix firefox phantom breakpoints,
 # suggestions from bugtracker, doesnt work (debugger is not attachable)
--- a/scripts/make-sfx.sh
+++ b/scripts/make-sfx.sh
@@ -16,14 +16,14 @@ help() { exec cat <<'EOF'
 #
 # `no-sh` makes just the python sfx, skips the sh/unix sfx
 #
-# `no-ogv` saves ~500k by removing the opus/vorbis audio codecs
+# `no-ogv` saves ~192k by removing the opus/vorbis audio codecs
 #   (only affects apple devices; everything else has native support)
 #
-# `no-cm` saves ~90k by removing easymde/codemirror
+# `no-cm` saves ~92k by removing easymde/codemirror
 #   (the fancy markdown editor)
 #
 # `no-fnt` saves ~9k by removing the source-code-pro font
-#   (mainly used my the markdown viewer/editor)
+#   (browsers will try to use 'Consolas' instead)
 #
 # `no-dd` saves ~2k by removing the mouse cursor

@@ -37,6 +37,8 @@ gtar=$(command -v gtar || command -v gnutar) || true
 	sed()  { gsed  "$@"; }
 	find() { gfind "$@"; }
 	sort() { gsort "$@"; }
+	shuf() { gshuf "$@"; }
+	nproc() { gnproc; }
 	sha1sum() { shasum "$@"; }
 	unexpand() { gunexpand "$@"; }
 	command -v grealpath >/dev/null &&
@@ -65,6 +67,7 @@ pybin=$(command -v python3 || command -v python) || {
 use_gz=
 do_sh=1
 do_py=1
+zopf=2560
 while [ ! -z "$1" ]; do
 	case $1 in
 		clean)  clean=1  ; ;;
@@ -76,6 +79,7 @@ while [ ! -z "$1" ]; do
 		no-cm)  no_cm=1  ; ;;
 		no-sh)  do_sh=   ; ;;
 		no-py)  do_py=   ; ;;
+		fast)   zopf=100 ; ;;
 		*)      help     ; ;;
 	esac
 	shift
@@ -134,7 +138,7 @@ tmpdir="$(
 	# msys2 tar is bad, make the best of it
 	echo collecting source
 	[ $clean ] && {
-		(cd .. && git archive master >tar) && tar -xf ../tar copyparty
+		(cd .. && git archive hovudstraum >tar) && tar -xf ../tar copyparty
 		(cd .. && tar -cf tar copyparty/web/deps) && tar -xf ../tar
 	}
 	[ $clean ] || {
@@ -144,6 +148,7 @@ tmpdir="$(
 }

 ver=
+[ -z "$repack" ] &&
 git describe --tags >/dev/null 2>/dev/null && {
 	git_ver="$(git describe --tags)";  # v0.5.5-2-gb164aa0
 	ver="$(printf '%s\n' "$git_ver" | sed -r 's/^v//')";
@@ -175,7 +180,7 @@ git describe --tags >/dev/null 2>/dev/null && {

 [ -z "$ver" ] && 
 	ver="$(awk '/^VERSION *= \(/ {
-		gsub(/[^0-9,]/,""); gsub(/,/,"."); print; exit}' < copyparty/__version__.py)"
+		gsub(/[^0-9,a-g-]/,""); gsub(/,/,"."); print; exit}' < copyparty/__version__.py)"

 ts=$(date -u +%s)
 hts=$(date -u +%Y-%m%d-%H%M%S) # --date=@$ts (thx osx)
@@ -214,17 +219,17 @@ done

 [ $no_fnt ] && {
 	rm -f copyparty/web/deps/scp.woff2
-	f=copyparty/web/md.css
-	gzip -d "$f"
-	sed -r '/scp\.woff2/d' <$f >t
+	f=copyparty/web/ui.css
+	gzip -d "$f.gz" || true
+	sed -r "s/src:.*scp.*\)/src:local('Consolas')/" <$f >t
 	tmv "$f"
 }

 [ $no_dd ] && {
 	rm -rf copyparty/web/dd
 	f=copyparty/web/browser.css
-	gzip -d "$f"
-	sed -r 's/(cursor: )url\([^)]+\), (pointer)/\1\2/; /[0-9]+% \{cursor:/d; /animation: cursor/d' <$f >t
+	gzip -d "$f.gz" || true
+	sed -r 's/(cursor: ?)url\([^)]+\), ?(pointer)/\1\2/; /[0-9]+% \{cursor:/d; /animation: ?cursor/d' <$f >t
 	tmv "$f"
 }

@@ -238,6 +243,12 @@ f=dep-j2/jinja2/constants.py
 awk '/^LOREM_IPSUM_WORDS/{o=1;print "LOREM_IPSUM_WORDS = u\"a\"";next} !o; /"""/{o=0}' <$f >t
 tmv "$f"

+grep -rLE '^#[^a-z]*coding: utf-8' dep-j2 |
+while IFS= read -r f; do
+	(echo "# coding: utf-8"; cat "$f") >t
+	tmv "$f"
+done
+
 # up2k goes from 28k to 22k laff
 awk 'BEGIN{gensub(//,"",1)}' </dev/null &&
 echo entabbening &&
@@ -262,14 +273,27 @@ done

 gzres() {
 	command -v pigz &&
-		pk='pigz -11 -I 256' ||
+		pk="pigz -11 -I $zopf" ||
 		pk='gzip'

-	echo "$pk"
-	find | grep -E '\.(js|css)$' | grep -vF /deps/ | while IFS= read -r f; do
+	np=$(nproc)
+	echo "$pk #$np"
+
+	while IFS=' ' read -r _ f; do
+		while true; do
+			na=$(ps auxwww | grep -F "$pk" | wc -l)
+			[ $na -le $np ] && break
+			sleep 0.2
+		done
 		echo -n .
-		$pk "$f"
-	done
+		$pk "$f" &
+	done < <(
+		find -printf '%s %p\n' |
+		grep -E '\.(js|css)$' |
+		grep -vF /deps/ |
+		sort -nr
+	)
+	wait
 	echo
 }

@@ -303,7 +327,7 @@ for d in copyparty dep-j2; do find $d -type f; done |
 sed -r 's/(.*)\.(.*)/\2 \1/' | LC_ALL=C sort |
 sed -r 's/([^ ]*) (.*)/\2.\1/' | grep -vE '/list1?$' > list1

-(grep -vE '\.(gz|br)$' list1; grep -E '\.(gz|br)$' list1) >list || true
+(grep -vE '\.(gz|br)$' list1; grep -E '\.(gz|br)$' list1 | shuf) >list || true

 echo creating tar
 args=(--owner=1000 --group=1000)
--- a/scripts/make-tgz-release.sh
+++ b/scripts/make-tgz-release.sh
@@ -61,7 +61,7 @@ rls_dir="$tmp/copyparty-$ver"
 mkdir "$rls_dir"

 echo ">>> export from git"
-git archive master | tar -xC "$rls_dir"
+git archive hovudstraum | tar -xC "$rls_dir"

 echo ">>> export untracked deps"
 tar -c copyparty/web/deps | tar -xC "$rls_dir"
@@ -122,5 +122,5 @@ echo "  $zip_path"
 echo "  $tgz_path"
 echo

-# function alr() { ls -alR copyparty-$1 | sed -r "s/copyparty-$1/copyparty/" | sed -r 's/[A-Z][a-z]{2} [0-9 ]{2} [0-9]{2}:[0-9]{2}//' > $1; }; for x in master rls src ; do alr $x; done
+# function alr() { ls -alR copyparty-$1 | sed -r "s/copyparty-$1/copyparty/" | sed -r 's/[A-Z][a-z]{2} [0-9 ]{2} [0-9]{2}:[0-9]{2}//' > $1; }; for x in hovudstraum rls src ; do alr $x; done

--- a/setup.py
+++ b/setup.py
@@ -61,7 +61,7 @@ class clean2(Command):
            pass

        nuke = []
-        for (dirpath, dirnames, filenames) in os.walk("."):
+        for (dirpath, _, filenames) in os.walk("."):
            for fn in filenames:
                if (
                    fn.startswith("MANIFEST")
@@ -86,7 +86,7 @@ args = {
    "url": "https://github.com/9001/copyparty",
    "license": "MIT",
    "classifiers": [
-        "Development Status :: 4 - Beta",
+        "Development Status :: 5 - Production/Stable",
        "License :: OSI Approved :: MIT License",
        "Programming Language :: Python",
        "Programming Language :: Python :: 2",
@@ -101,6 +101,7 @@ args = {
        "Programming Language :: Python :: 3.9",
        "Programming Language :: Python :: 3.10",
        "Programming Language :: Python :: Implementation :: CPython",
+        "Programming Language :: Python :: Implementation :: Jython",
        "Programming Language :: Python :: Implementation :: PyPy",
        "Environment :: Console",
        "Environment :: No Input/Output (Daemon)",
--- a/tests/test_httpcli.py
+++ b/tests/test_httpcli.py
@@ -39,6 +39,8 @@ class Cfg(Namespace):
            no_scandir=False,
            no_sendfile=True,
            no_rescan=True,
+            no_logues=False,
+            no_readme=False,
            re_maxage=0,
            ihead=False,
            nih=True,
@@ -151,6 +153,7 @@ class TestHttpCli(unittest.TestCase):
                    tar = tarfile.open(fileobj=io.BytesIO(b)).getnames()
                except:
                    tar = []
+                tar = [x[4:] if x.startswith("top/") else x for x in tar]
                tar = ["/".join([y for y in [top, durl, x] if y]) for x in tar]
                tar = [[x] + self.can_rw(x) for x in tar]
                tar_ok = [x[0] for x in tar if x[1]]
--- a/tests/test_vfs.py
+++ b/tests/test_vfs.py
@@ -26,6 +26,8 @@ class Cfg(Namespace):
            "no_hash": False,
            "css_browser": None,
            "no_voldump": True,
+            "no_logues": False,
+            "no_readme": False,
            "re_maxage": 0,
            "rproxy": 0,
        }
Author	SHA1	Message	Date
ed	633b1f0a78	v1.0.1	2021-09-09 00:59:55 +02:00
ed	6136b9bf9c	don't double-eof	2021-09-09 00:54:09 +02:00
ed	524a3ba566	actually this is better	2021-09-09 00:41:23 +02:00
ed	58580320f9	make the primary tabs toggle-buttons	2021-09-09 00:35:07 +02:00
ed	759b0a994d	alternative equalizer tuning	2021-09-09 00:27:18 +02:00
ed	d2800473e4	less aggressive searching, especially on phones	2021-09-08 23:24:32 +02:00
ed	f5b1a2065e	multipart-parser needs exact reads	2021-09-08 21:07:34 +00:00
ed	5e62532295	minimal-up2k: remove filesearch dropzone	2021-09-08 09:16:02 +02:00
ed	c1bee96c40	fix filedrop trying to upload without write access	2021-09-08 00:19:48 +02:00
ed	f273253a2b	( ´ w `)	2021-09-08 00:16:08 +02:00
ed	012bbcf770	v1.0.0	2021-09-07 23:18:54 +02:00
ed	b54cb47b2e	listen for filedrops in all tabs/modes	2021-09-07 22:44:48 +02:00
ed	1b15f43745	crashpage: add github-issue link	2021-09-07 22:30:50 +02:00
ed	96771bf1bd	linken	2021-09-07 22:12:28 +02:00
ed	580078bddb	more readme stuff	2021-09-07 22:10:59 +02:00
ed	c5c7080ec6	more readme fixup	2021-09-07 21:57:33 +02:00
ed	408339b51d	mention the new dropzones	2021-09-07 21:49:00 +02:00
ed	02e3d44998	fix move/delete without -e2d (thx exci)	2021-09-07 21:20:34 +02:00
ed	156f13ded1	add 10-minute indicators to seekbar	2021-09-07 21:10:50 +02:00
ed	d288467cb7	separate dropzones for upload/search	2021-09-07 20:52:06 +02:00
ed	21662c9f3f	error-message cleanup	2021-09-07 20:51:07 +02:00
ed	9149fe6cdd	lightmode fix	2021-09-07 00:44:09 +02:00
ed	9a146192b7	don't unwrap single folders in zip/tar downloads	2021-09-07 00:43:51 +02:00
ed	3a9d3b7b61	rip hls	2021-09-07 00:05:51 +02:00
ed	f03f0973ab	Create branch-rename.md	2021-09-06 23:42:42 +02:00
ed	7ec0881e8c	Create CODE_OF_CONDUCT.md	2021-09-06 23:31:57 +02:00
ed	59e1ab42ff	Create CONTRIBUTING.md	2021-09-06 22:18:41 +02:00
ed	722216b901	Update issue templates	2021-09-06 22:11:06 +02:00
ed	bd8f3dc368	Update issue templates	2021-09-06 22:09:10 +02:00
ed	33cd94a141	update TOC	2021-09-06 08:36:18 +02:00
ed	053ac74734	v0.13.14	2021-09-06 01:06:16 +02:00
ed	cced99fafa	replace SCP with Consolas on no-fnt repack	2021-09-06 01:04:12 +02:00
ed	a009ff53f7	show README.md in directory listings	2021-09-06 00:23:35 +02:00
ed	ca16c4108d	add options to disallow renaming/moving dotfiles	2021-09-06 00:17:35 +02:00
ed	d1b6c67dc3	fix misnomer	2021-09-06 00:13:52 +02:00
ed	a61f8133d5	add option to disable logues	2021-09-05 22:33:42 +02:00
ed	38d797a544	remove duplicate code	2021-09-05 22:32:34 +02:00
ed	16c1877f50	fix markdown scrollmap desync on offsite images	2021-09-05 21:44:17 +02:00
ed	da5f15a778	move general markdown to ui.css	2021-09-05 21:42:41 +02:00
ed	396c64ecf7	move sourcecodepro to ui.css	2021-09-05 18:55:28 +02:00
ed	252c3a7985	faster turbo	2021-09-05 18:51:01 +02:00
ed	a3ecbf0ae7	better fix for the up2k bounce	2021-09-05 18:50:24 +02:00
ed	314327d8f2	support alternative python impls	2021-09-05 18:48:58 +02:00
ed	bfacd06929	mention some more features	2021-09-04 21:40:22 +02:00
ed	4f5e8f8cf5	toc tweaks	2021-09-04 21:21:18 +02:00
ed	1fbb4c09cc	readme/doc cleanup	2021-09-04 21:07:45 +02:00
ed	b332e1992b	sfx-repack: fix git version numbers	2021-09-04 17:43:49 +02:00
ed	5955940b82	fix upload eta going bad after inactivity	2021-09-04 03:10:54 +02:00
ed	231a03bcfd	v0.13.13	2021-09-03 21:21:17 +02:00
ed	bc85723657	more intense compressino	2021-09-03 21:20:40 +02:00
ed	be32b743c6	repl: select default text on load	2021-09-03 20:48:41 +02:00
ed	83c9843059	make-sfx: correct version number on repack	2021-09-03 20:38:41 +02:00
ed	11cf43626d	make-sfx: fix no-dd css modifier	2021-09-03 20:38:14 +02:00
ed	a6dc5e2ce3	add some missing preventdefaults	2021-09-03 20:37:30 +02:00
ed	38593a0394	move column hider buttons above the header	2021-09-03 20:19:17 +02:00
ed	95309afeea	fix file-list jumping around during uploads	2021-09-03 20:17:44 +02:00
ed	c2bf6fe2a3	add basic authentication	2021-09-03 20:15:24 +02:00
ed	99ac324fbd	tweaks	2021-09-02 19:06:08 +02:00
ed	5562de330f	slightly smaller jpeg thumbnails	2021-09-02 18:51:15 +02:00
ed	95014236ac	js-repl presets	2021-09-02 18:50:47 +02:00
ed	6aa7386138	modals: onDisplay callback	2021-09-02 18:46:51 +02:00
ed	3226a1f588	crashpage: show recent console messages	2021-09-02 18:45:42 +02:00
ed	b4cf890cd8	emphasis	2021-09-02 18:42:53 +02:00
ed	ce09e323af	ok/cancel buttons in platform-defined order	2021-09-02 18:42:12 +02:00
ed	941aedb177	v0.13.12	2021-09-01 23:48:01 +02:00
ed	87a0d502a3	crashpage: add useragent	2021-09-01 23:32:27 +02:00
ed	cab7c1b0b8	browser-icons: centered play button	2021-09-01 22:35:27 +02:00
ed	d5892341b6	prevent vertical toast overflow	2021-09-01 22:34:48 +02:00
ed	646557a43e	crashpage: better localstore dump	2021-09-01 22:34:04 +02:00
ed	ed8d34ab43	dont try to play audio if js crashed	2021-09-01 22:28:15 +02:00
ed	5e34463c77	support massive cut/paste ops	2021-09-01 22:27:39 +02:00
ed	1b14eb7959	fix thumbnail-zoom hotkeys	2021-09-01 22:26:18 +02:00
ed	ed48c2d0ed	v0.13.11	2021-08-30 22:32:16 +02:00
ed	26fe84b660	smaller sfx	2021-08-30 22:27:10 +02:00
ed	5938230270	more tray ui nitpicks	2021-08-30 22:25:07 +02:00
ed	1a33a047fa	fix listening on single interface	2021-08-30 21:39:44 +02:00
ed	43a8bcefb9	v0.13.10	2021-08-30 03:02:11 +02:00
ed	2e740e513f	cheap performance fix	2021-08-30 02:38:48 +02:00
ed	8a21a86b61	better iOS error-handling	2021-08-30 02:29:38 +02:00
ed	f600116205	login returns to volume listing	2021-08-30 01:55:24 +02:00
ed	1c03705de8	upload filedrops in alphabetical order	2021-08-30 01:50:12 +02:00
ed	f7e461fac6	add humantime	2021-08-30 01:16:20 +02:00
ed	03ce6c97ff	better crash-handler ui	2021-08-30 01:15:37 +02:00
ed	ffd9e76e07	select all text in modal.prompt	2021-08-30 01:11:00 +02:00
ed	fc49cb1e67	add js repl	2021-08-30 01:09:27 +02:00