v1.6.7

ftp: support filezilla mkdir
add example for webdav automount
2023-03-05 20:18:16 +00:00 · 2023-03-05 20:18:02 +00:00 · 2023-03-05 19:52:45 +00:00 · 2023-03-05 19:49:54 +00:00 · 2023-03-05 19:45:50 +00:00 · 2023-03-02 22:35:32 +00:00
79 changed files with 3603 additions and 882 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -25,7 +25,12 @@ copyparty.egg-info/
 copyparty/res/COPYING.txt
 copyparty/web/deps/
 srv/
+scripts/docker/i/
+contrib/package/arch/pkg/
+contrib/package/arch/src/

 # state/logs
 up.*.txt
-.hist/
+.hist/
+scripts/docker/*.out
+scripts/docker/*.err
--- a/README.md
+++ b/README.md
@@ -27,9 +27,8 @@ try the **[read-only demo server](https://a.ocv.me/pub/demo/)** 👀 running fro
 ## readme toc

 * top
-    * [quickstart](#quickstart) - download **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** and you're all set!
+    * [quickstart](#quickstart) - just run **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** -- that's it! 🎉
        * [on servers](#on-servers) - you may also want these, especially on servers
-        * [on debian](#on-debian) - recommended additional steps on debian
    * [features](#features)
    * [testimonials](#testimonials) - small collection of user feedback
 * [motivations](#motivations) - project goals / philosophy
@@ -57,7 +56,7 @@ try the **[read-only demo server](https://a.ocv.me/pub/demo/)** 👀 running fro
    * [other tricks](#other-tricks)
    * [searching](#searching) - search by size, date, path/name, mp3-tags, ...
 * [server config](#server-config) - using arguments or config files, or a mix of both
-    * [zeroconf](#zeroconf) - announce enabled services on the LAN
+    * [zeroconf](#zeroconf) - announce enabled services on the LAN ([pic](https://user-images.githubusercontent.com/241032/215344737-0eae8d98-9496-4256-9aa8-cd2f6971810d.png))
        * [mdns](#mdns) - LAN domain-name and feature announcer
        * [ssdp](#ssdp) - windows-explorer announcer
    * [qr-code](#qr-code) - print a qr-code [(screenshot)](https://user-images.githubusercontent.com/241032/194728533-6f00849b-c6ac-43c6-9359-83e454d11e00.png) for quick access
@@ -95,10 +94,9 @@ try the **[read-only demo server](https://a.ocv.me/pub/demo/)** 👀 running fro
 * [HTTP API](#HTTP-API) - see [devnotes](#./docs/devnotes.md#http-api)
 * [dependencies](#dependencies) - mandatory deps
    * [optional dependencies](#optional-dependencies) - install these to enable bonus features
-    * [install recommended deps](#install-recommended-deps)
    * [optional gpl stuff](#optional-gpl-stuff)
 * [sfx](#sfx) - the self-contained "binary"
-    * [copyparty.exe](#copypartyexe) - download [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) or [copyparty64.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty64.exe)
+    * [copyparty.exe](#copypartyexe) - download [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) (win8+) or [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) (win7+)
 * [install on android](#install-on-android)
 * [reporting bugs](#reporting-bugs) - ideas for context to include in bug reports
 * [devnotes](#devnotes) - for build instructions etc, see [./docs/devnotes.md](./docs/devnotes.md)
@@ -106,18 +104,34 @@ try the **[read-only demo server](https://a.ocv.me/pub/demo/)** 👀 running fro

 ## quickstart

-download **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** and you're all set!
+just run **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** -- that's it! 🎉

-if you cannot install python, you can use [copyparty.exe](#copypartyexe) instead
+* or install through pypi (python3 only): `python3 -m pip install --user -U copyparty`
+* or if you cannot install python, you can use [copyparty.exe](#copypartyexe) instead
+* or if you prefer to [use docker](./scripts/docker/) 🐋 you can do that too
+  * docker has all deps built-in, so skip this step:

-running the sfx without arguments (for example doubleclicking it on Windows) will give everyone read/write access to the current folder; you may want [accounts and volumes](#accounts-and-volumes)
+enable thumbnails (images/audio/video), media indexing, and audio transcoding by installing some recommended deps:
+
+* **Alpine:** `apk add py3-pillow ffmpeg`
+* **Debian:** `apt install python3-pil ffmpeg`
+* **Fedora:** `dnf install python3-pillow ffmpeg`
+* **FreeBSD:** `pkg install py39-sqlite3 py39-pillow ffmpeg`
+* **MacOS:** `port install py-Pillow ffmpeg`
+* **MacOS** (alternative): `brew install pillow ffmpeg`
+* **Windows:** `python -m pip install --user -U Pillow`
+  * install python and ffmpeg manually; do not use `winget` or `Microsoft Store` (it breaks $PATH)
+  * copyparty.exe comes with `Pillow` and only needs `ffmpeg`
+* see [optional dependencies](#optional-dependencies) to enable even more features
+
+running copyparty without arguments (for example doubleclicking it on Windows) will give everyone read/write access to the current folder; you may want [accounts and volumes](#accounts-and-volumes)

 some recommended options:
 * `-e2dsa` enables general [file indexing](#file-indexing)
-* `-e2ts` enables audio metadata indexing (needs either FFprobe or Mutagen), see [optional dependencies](#optional-dependencies) to enable thumbnails and more
+* `-e2ts` enables audio metadata indexing (needs either FFprobe or Mutagen)
 * `-v /mnt/music:/music:r:rw,foo -a foo:bar` shares `/mnt/music` as `/music`, `r`eadable by anyone, and read-write for user `foo`, password `bar`
  * replace `:r:rw,foo` with `:r,foo` to only make the folder readable by `foo` and nobody else
-  * see [accounts and volumes](#accounts-and-volumes) for the syntax and other permissions (`r`ead, `w`rite, `m`ove, `d`elete, `g`et, up`G`et)
+  * see [accounts and volumes](#accounts-and-volumes) (or `--help-accounts`) for the syntax and other permissions


 ### on servers
@@ -126,6 +140,7 @@ you may also want these, especially on servers:

 * [contrib/systemd/copyparty.service](contrib/systemd/copyparty.service) to run copyparty as a systemd service
 * [contrib/systemd/prisonparty.service](contrib/systemd/prisonparty.service) to run it in a chroot (for extra security)
+* [contrib/rc/copyparty](contrib/rc/copyparty) to run copyparty on FreeBSD
 * [contrib/nginx/copyparty.conf](contrib/nginx/copyparty.conf) to [reverse-proxy](#reverse-proxy) behind nginx (for better https)

 and remember to open the ports you want; here's a complete example including every feature copyparty has to offer:
@@ -137,18 +152,6 @@ firewall-cmd --reload
 ```
 (1900:ssdp, 3921:ftp, 3923:http/https, 3945:smb, 3990:ftps, 5353:mdns, 12000:passive-ftp)

-### on debian
-
-recommended additional steps on debian  which enable audio metadata and thumbnails (from images and videos):
-
-* as root, run the following:  
-  `apt install python3 python3-pip python3-dev ffmpeg`
-
-* then, as the user which will be running copyparty (so hopefully not root), run this:  
-  `python3 -m pip install --user -U Pillow pillow-avif-plugin`
-
-(skipped `pyheif-pillow-opener` because apparently debian is too old to build it)
-

 ## features

@@ -199,7 +202,7 @@ recommended additional steps on debian  which enable audio metadata and thumbnai

 small collection of user feedback

-`good enough`, `surprisingly correct`, `certified good software`, `just works`, `why`
+`good enough`, `surprisingly correct`, `certified good software`, `just works`, `why`, `wow this is better than nextcloud`


 # motivations
@@ -208,7 +211,7 @@ project goals / philosophy

 * inverse linux philosophy -- do all the things, and do an *okay* job
  * quick drop-in service to get a lot of features in a pinch
-  * check [the alternatives](./docs/versus.md)
+  * some of [the alternatives](./docs/versus.md) might be a better fit for you
 * run anywhere, support everything
  * as many web-browsers and python versions as possible
    * every browser should at least be able to browse, download, upload files
@@ -305,6 +308,7 @@ upgrade notes

 per-folder, per-user permissions  - if your setup is getting complex, consider making a [config file](./docs/example.conf) instead of using arguments
 * much easier to manage, and you can modify the config at runtime with `systemctl reload copyparty` or more conveniently using the `[reload cfg]` button in the control-panel (if logged in as admin)
+  * changes to the `[global]` config section requires a restart to take effect

 a quick summary can be seen using `--help-accounts`

@@ -689,6 +693,7 @@ using arguments or config files, or a mix of both:
 * config files (`-c some.conf`) can set additional commandline arguments; see [./docs/example.conf](docs/example.conf) and [./docs/example2.conf](docs/example2.conf)
 * `kill -s USR1` (same as `systemctl reload copyparty`) to reload accounts and volumes from config files without restarting
  * or click the `[reload cfg]` button in the control-panel when logged in as admin 
+  * changes to the `[global]` config section requires a restart to take effect


 ## zeroconf
@@ -760,6 +765,8 @@ general usage:
 on macos, connect from finder:
 * [Go] -> [Connect to Server...] -> http://192.168.123.1:3923/

+in order to grant full write-access to webdav clients, the volflag `daw` must be set and the account must also have delete-access (otherwise the client won't be allowed to replace the contents of existing files, which is how webdav works)
+

 ### connecting to webdav from windows

@@ -799,7 +806,7 @@ some **BIG WARNINGS** specific to SMB/CIFS, in decreasing importance:

 and some minor issues,
 * clients only see the first ~400 files in big folders; [impacket#1433](https://github.com/SecureAuthCorp/impacket/issues/1433)
-* hot-reload of server config (`/?reload=cfg`) only works for volumes, not account passwords
+* hot-reload of server config (`/?reload=cfg`) does not include the `[global]` section (commandline args)
 * listens on the first IPv4 `-i` interface only (default = :: = 0.0.0.0 = all)
 * login doesn't work on winxp, but anonymous access is ok -- remove all accounts from copyparty config for that to work
  * win10 onwards does not allow connecting anonymously / without accounts
@@ -1270,6 +1277,7 @@ other misc notes:

 * you can disable directory listings by giving permission `g` instead of `r`, only accepting direct URLs to files
  * combine this with volflag `c,fk` to generate filekeys (per-file accesskeys); users which have full read-access will then see URLs with `?k=...` appended to the end, and `g` users must provide that URL including the correct key to avoid a 404
+    * the default filekey entropy is fairly small so give `--fk-salt` around 30 characters if you want filekeys longer than 16 chars
  * permissions `wG` lets users upload files and receive their own filekeys, still without being able to see other uploads


@@ -1346,18 +1354,12 @@ enable [thumbnails](#thumbnails) of...
 * **AVIF pictures:** `pyvips` or `ffmpeg` or `pillow-avif-plugin`
 * **JPEG XL pictures:** `pyvips` or `ffmpeg`

-enable [smb](#smb-server) support:
+enable [smb](#smb-server) support (**not** recommended):
 * `impacket==0.10.0`

 `pyvips` gives higher quality thumbnails than `Pillow` and is 320% faster, using 270% more ram: `sudo apt install libvips42 && python3 -m pip install --user -U pyvips`


-## install recommended deps
-```
-python -m pip install --user -U jinja2 mutagen Pillow
-```
-
-
 ## optional gpl stuff

 some bundled tools have copyleft dependencies, see [./bin/#mtag](bin/#mtag)
@@ -1374,15 +1376,19 @@ you can reduce the sfx size by repacking it; see [./docs/devnotes.md#sfx-repack]

 ## copyparty.exe

-download [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) or [copyparty64.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty64.exe)
+download [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) (win8+) or [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) (win7+)

-![copyparty-exe-fs8](https://user-images.githubusercontent.com/241032/194707422-cb7f66c9-41a2-4cb9-8dbc-2ab866cd4338.png)
+![copyparty-exe-fs8](https://user-images.githubusercontent.com/241032/221445946-1e328e56-8c5b-44a9-8b9f-dee84d942535.png)

-can be convenient on old machines where installing python is problematic, however is **not recommended** and should be considered a last resort -- if possible, please use **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** instead
+can be convenient on machines where installing python is problematic, however is **not recommended** -- if possible, please use **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** instead

-* [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) is compatible with 32bit windows7, which means it uses an ancient copy of python (3.7.9) which cannot be upgraded and will definitely become a security hazard at some point
+* [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) runs on win8 or newer, was compiled on win10, does thumbnails + media tags, and is *currently* safe to use, but any future python/expat/pillow CVEs can only be remedied by downloading a newer version of the exe

-* [copyparty64.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty64.exe) is identical except 64bit so it [works in WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png)
+  * on win8 it needs [vc redist 2015](https://www.microsoft.com/en-us/download/details.aspx?id=48145), on win10 it just works
+
+* dangerous: [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) is compatible with [windows7](https://user-images.githubusercontent.com/241032/221445944-ae85d1f4-d351-4837-b130-82cab57d6cca.png), which means it uses an ancient copy of python (3.7.9) which cannot be upgraded and should never be exposed to the internet (LAN is fine)
+
+* dangerous and deprecated: [copyparty64.exe](https://github.com/9001/copyparty/releases/download/v1.6.5/copyparty64.exe) lets you [run copyparty in WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png) and is otherwise completely useless

 meanwhile [copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) instead relies on your system python which gives better performance and will stay safe as long as you keep your python install up-to-date

--- a/bin/hooks/README.md
+++ b/bin/hooks/README.md
@@ -2,15 +2,24 @@ standalone programs which are executed by copyparty when an event happens (uploa

 these programs either take zero arguments, or a filepath (the affected file), or a json message with filepath + additional info

+run copyparty with `--help-hooks` for usage details / hook type explanations (xbu/xau/xiu/xbr/xar/xbd/xad)
+
 > **note:** in addition to event hooks (the stuff described here), copyparty has another api to run your programs/scripts while providing way more information such as audio tags / video codecs / etc and optionally daisychaining data between scripts in a processing pipeline; if that's what you want then see [mtp plugins](../mtag/) instead


 # after upload
 * [notify.py](notify.py) shows a desktop notification ([example](https://user-images.githubusercontent.com/241032/215335767-9c91ed24-d36e-4b6b-9766-fb95d12d163f.png))
+  * [notify2.py](notify2.py) uses the json API to show more context
 * [discord-announce.py](discord-announce.py) announces new uploads on discord using webhooks ([example](https://user-images.githubusercontent.com/241032/215304439-1c1cb3c8-ec6f-4c17-9f27-81f969b1811a.png))
 * [reject-mimetype.py](reject-mimetype.py) rejects uploads unless the mimetype is acceptable


+# upload batches
+these are `--xiu` hooks; unlike `xbu` and `xau` (which get executed on every single file), `xiu` hooks are given a list of recent uploads on STDIN after the server has gone idle for N seconds, reducing server load + providing more context
+* [xiu.py](xiu.py) is a "minimal" example showing a list of filenames + total filesize
+* [xiu-sha.py](xiu-sha.py) produces a sha512 checksum list in the volume root
+
+
 # before upload
 * [reject-extension.py](reject-extension.py) rejects uploads if they match a list of file extensions

--- a/bin/hooks/notify.py
+++ b/bin/hooks/notify.py
@@ -26,9 +26,23 @@ parameters explained,
 """


+try:
+    from copyparty.util import humansize
+except:
+
+    def humansize(n):
+        return n
+
+
 def main():
-    dp, fn = os.path.split(sys.argv[1])
-    msg = "🏷️ {}\n📁 {}".format(fn, dp)
+    fp = sys.argv[1]
+    dp, fn = os.path.split(fp)
+    try:
+        sz = humansize(os.path.getsize(fp))
+    except:
+        sz = "?"
+
+    msg = "{} ({})\n📁 {}".format(fn, sz, dp)
    title = "File received"

    if "com.termux" in sys.executable:
--- a/bin/hooks/notify2.py
+++ b/bin/hooks/notify2.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+
+import json
+import os
+import sys
+import subprocess as sp
+from datetime import datetime
+from plyer import notification
+
+
+_ = r"""
+same as notify.py but with additional info (uploader, ...)
+and also supports --xm (notify on 📟 message)
+
+example usages; either as global config (all volumes) or as volflag:
+    --xm  f,j,bin/hooks/notify2.py
+    --xau f,j,bin/hooks/notify2.py
+    -v srv/inc:inc:c,xm=f,j,bin/hooks/notify2.py
+    -v srv/inc:inc:c,xau=f,j,bin/hooks/notify2.py
+                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+parameters explained,
+    xau = execute after upload
+    f   = fork so it doesn't block uploads
+    j   = provide json instead of filepath list
+"""
+
+
+try:
+    from copyparty.util import humansize
+except:
+
+    def humansize(n):
+        return n
+
+
+def main():
+    inf = json.loads(sys.argv[1])
+    fp = inf["ap"]
+    sz = humansize(inf["sz"])
+    dp, fn = os.path.split(fp)
+    mt = datetime.utcfromtimestamp(inf["mt"]).strftime("%Y-%m-%d %H:%M:%S")
+
+    msg = f"{fn} ({sz})\n📁 {dp}"
+    title = "File received"
+    icon = "emblem-documents-symbolic" if sys.platform == "linux" else ""
+
+    if inf.get("txt"):
+        msg = inf["txt"]
+        title = "Message received"
+        icon = "mail-unread-symbolic" if sys.platform == "linux" else ""
+
+    msg += f"\n👤 {inf['user']} ({inf['ip']})\n🕒 {mt}"
+
+    if "com.termux" in sys.executable:
+        sp.run(["termux-notification", "-t", title, "-c", msg])
+        return
+
+    notification.notify(
+        title=title,
+        message=msg,
+        app_icon=icon,
+        timeout=10,
+    )
+
+
+if __name__ == "__main__":
+    main()
--- a/bin/hooks/xiu-sha.py
+++ b/bin/hooks/xiu-sha.py
@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+
+import hashlib
+import json
+import sys
+from datetime import datetime
+
+
+_ = r"""
+this hook will produce a single sha512 file which
+covers all recent uploads (plus metadata comments)
+
+use this with --xiu, which makes copyparty buffer
+uploads until server is idle, providing file infos
+on stdin (filepaths or json)
+
+example usage as global config:
+    --xiu i5,j,bin/hooks/xiu-sha.py
+
+example usage as a volflag (per-volume config):
+    -v srv/inc:inc:c,xiu=i5,j,bin/hooks/xiu-sha.py
+
+parameters explained,
+    xiu = execute after uploads...
+    i5  = ...after volume has been idle for 5sec
+    j   = provide json instead of filepath list
+
+note the "f" (fork) flag is not set, so this xiu
+will block other xiu hooks while it's running
+"""
+
+
+try:
+    from copyparty.util import fsenc
+except:
+
+    def fsenc(p):
+        return p
+
+
+def humantime(ts):
+    return datetime.utcfromtimestamp(ts).strftime("%Y-%m-%d %H:%M:%S")
+
+
+def find_files_root(inf):
+    di = 9000
+    for f1, f2 in zip(inf, inf[1:]):
+        p1 = f1["ap"].replace("\\", "/").rsplit("/", 1)[0]
+        p2 = f2["ap"].replace("\\", "/").rsplit("/", 1)[0]
+        di = min(len(p1), len(p2), di)
+        di = next((i for i in range(di) if p1[i] != p2[i]), di)
+
+    return di + 1
+
+
+def find_vol_root(inf):
+    return len(inf[0]["ap"][: -len(inf[0]["vp"])])
+
+
+def main():
+    zb = sys.stdin.buffer.read()
+    zs = zb.decode("utf-8", "replace")
+    inf = json.loads(zs)
+
+    # root directory (where to put the sha512 file);
+    # di = find_files_root(inf)  # next to the file closest to volume root
+    di = find_vol_root(inf)  # top of the entire volume
+
+    ret = []
+    total_sz = 0
+    for md in inf:
+        ap = md["ap"]
+        rp = ap[di:]
+        total_sz += md["sz"]
+        fsize = "{:,}".format(md["sz"])
+        mtime = humantime(md["mt"])
+        up_ts = humantime(md["at"])
+
+        h = hashlib.sha512()
+        with open(fsenc(md["ap"]), "rb", 512 * 1024) as f:
+            while True:
+                buf = f.read(512 * 1024)
+                if not buf:
+                    break
+
+                h.update(buf)
+
+        cksum = h.hexdigest()
+        meta = " | ".join([md["wark"], up_ts, mtime, fsize, md["ip"]])
+        ret.append("# {}\n{} *{}".format(meta, cksum, rp))
+
+    ret.append("# {} files, {} bytes total".format(len(inf), total_sz))
+    ret.append("")
+    ftime = datetime.utcnow().strftime("%Y-%m%d-%H%M%S.%f")
+    fp = "{}xfer-{}.sha512".format(inf[0]["ap"][:di], ftime)
+    with open(fsenc(fp), "wb") as f:
+        f.write("\n".join(ret).encode("utf-8", "replace"))
+
+    print("wrote checksums to {}".format(fp))
+
+
+if __name__ == "__main__":
+    main()
--- a/bin/hooks/xiu.py
+++ b/bin/hooks/xiu.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+
+import json
+import sys
+
+
+_ = r"""
+this hook prints absolute filepaths + total size
+
+use this with --xiu, which makes copyparty buffer
+uploads until server is idle, providing file infos
+on stdin (filepaths or json)
+
+example usage as global config:
+    --xiu i1,j,bin/hooks/xiu.py
+
+example usage as a volflag (per-volume config):
+    -v srv/inc:inc:c,xiu=i1,j,bin/hooks/xiu.py
+
+parameters explained,
+    xiu = execute after uploads...
+    i1  = ...after volume has been idle for 1sec
+    j   = provide json instead of filepath list
+
+note the "f" (fork) flag is not set, so this xiu
+will block other xiu hooks while it's running
+"""
+
+
+def main():
+    zb = sys.stdin.buffer.read()
+    zs = zb.decode("utf-8", "replace")
+    inf = json.loads(zs)
+
+    total_sz = 0
+    for upload in inf:
+        sz = upload["sz"]
+        total_sz += sz
+        print("{:9} {}".format(sz, upload["ap"]))
+
+    print("{} files, {} bytes total".format(len(inf), total_sz))
+
+
+if __name__ == "__main__":
+    main()
--- a/bin/mtag/image-noexif.py
+++ b/bin/mtag/image-noexif.py
@@ -61,7 +61,7 @@ def main():

    os.chdir(cwd)
    f1 = fsenc(fn)
-    f2 = os.path.join(b"noexif", f1)
+    f2 = fsenc(os.path.join(b"noexif", fn))
    cmd = [
        b"exiftool",
        b"-exif:all=",
--- a/bin/mtag/install-deps.sh
+++ b/bin/mtag/install-deps.sh
@@ -57,6 +57,7 @@ hash -r
 	command -v python3 && pybin=python3 || pybin=python
 }

+$pybin -c 'import numpy' ||
 $pybin -m pip install --user numpy


@@ -224,7 +225,7 @@ install_vamp() {
 	$pybin -m pip install --user vamp

 	cd "$td"
-	echo '#include <vamp-sdk/Plugin.h>' | gcc -x c -c -o /dev/null - || [ -e ~/pe/vamp-sdk ] || {
+	echo '#include <vamp-sdk/Plugin.h>' | g++ -x c++ -c -o /dev/null - || [ -e ~/pe/vamp-sdk ] || {
 		printf '\033[33mcould not find the vamp-sdk, building from source\033[0m\n'
 		(dl_files yolo https://code.soundsoftware.ac.uk/attachments/download/2588/vamp-plugin-sdk-2.9.0.tar.gz)
 		sha512sum -c <(
--- a/bin/prisonparty.sh
+++ b/bin/prisonparty.sh
@@ -4,8 +4,9 @@ set -e
 # runs copyparty (or any other program really) in a chroot
 #
 # assumption: these directories, and everything within, are owned by root
-sysdirs=( /bin /lib /lib32 /lib64 /sbin /usr )
-
+sysdirs=(); for v in /bin /lib /lib32 /lib64 /sbin /usr /etc/alternatives ; do
+	[ -e $v ] && sysdirs+=($v)
+done

 # error-handler
 help() { cat <<'EOF'
@@ -38,7 +39,7 @@ while true; do
 	v="$1"; shift
 	[ "$v" = -- ] && break  # end of volumes
 	[ "$#" -eq 0 ] && break  # invalid usage
-	vols+=( "$(realpath "$v")" )
+	vols+=( "$(realpath "$v" || echo "$v")" )
 done
 pybin="$1"; shift
 pybin="$(command -v "$pybin")"
@@ -82,7 +83,7 @@ jail="${jail%/}"
 printf '%s\n' "${sysdirs[@]}" "${vols[@]}" | sed -r 's`/$``' | LC_ALL=C sort | uniq |
 while IFS= read -r v; do
 	[ -e "$v" ] || {
-		# printf '\033[1;31mfolder does not exist:\033[0m %s\n' "/$v"
+		printf '\033[1;31mfolder does not exist:\033[0m %s\n' "$v"
 		continue
 	}
 	i1=$(stat -c%D.%i "$v"      2>/dev/null || echo a)
@@ -97,9 +98,11 @@ done

 cln() {
 	rv=$?
-	# cleanup if not in use
-	lsof "$jail" | grep -qF "$jail" &&
-		echo "chroot is in use, will not cleanup" ||
+	wait -f -p rv $p || true
+	cd /
+	echo "stopping chroot..."
+	lsof "$jail" | grep -F "$jail" &&
+		echo "chroot is in use; will not unmount" ||
 	{
 		mount | grep -F " on $jail" |
 		awk '{sub(/ type .*/,"");sub(/.* on /,"");print}' |
@@ -124,5 +127,6 @@ export LOGNAME="$USER"
 #echo "cpp [$cpp]"
 chroot --userspec=$uid:$gid "$jail" "$pybin" $pyarg "$cpp" "$@" &
 p=$!
+trap 'kill -USR1 $p' USR1
 trap 'kill $p' INT TERM
 wait
--- a/bin/up2k.py
+++ b/bin/up2k.py
@@ -3,7 +3,7 @@ from __future__ import print_function, unicode_literals

 """
 up2k.py: upload to copyparty
-2023-01-13, v1.2, ed <irc.rizon.net>, MIT-Licensed
+2023-03-05, v1.3, ed <irc.rizon.net>, MIT-Licensed
 https://github.com/9001/copyparty/blob/hovudstraum/bin/up2k.py

 - dependencies: requests
@@ -520,7 +520,11 @@ def handshake(ar, file, search):
        except Exception as ex:
            em = str(ex).split("SSLError(")[-1].split("\nURL: ")[0].strip()

-            if sc == 422 or "<pre>partial upload exists at a different" in txt:
+            if (
+                sc == 422
+                or "<pre>partial upload exists at a different" in txt
+                or "<pre>source file busy; please try again" in txt
+            ):
                file.recheck = True
                return [], False
            elif sc == 409 or "<pre>upload rejected, file already exists" in txt:
--- a/contrib/package/arch/PKGBUILD
+++ b/contrib/package/arch/PKGBUILD
@@ -0,0 +1,57 @@
+# Maintainer: icxes <dev.null@need.moe>
+pkgname=copyparty
+pkgver="1.6.6"
+pkgrel=1
+pkgdesc="Portable file sharing hub"
+arch=("any")
+url="https://github.com/9001/${pkgname}"
+license=('MIT')
+depends=("python" "lsof")
+optdepends=("ffmpeg: thumbnails for videos, images (slower) and audio, music tags" 
+            "python-jinja: faster html generator" 
+            "python-mutagen: music tags (alternative)" 
+            "python-pillow: thumbnails for images" 
+            "python-pyvips: thumbnails for images (higher quality, faster, uses more ram)" 
+            "libkeyfinder-git: detection of musical keys" 
+            "qm-vamp-plugins: BPM detection" 
+            "python-pyopenssl: ftps functionality" 
+            "python-impacket-git: smb support (bad idea)"
+)
+source=("${url}/releases/download/v${pkgver}/${pkgname}-sfx.py" 
+        "${pkgname}.conf"
+        "${pkgname}.service"
+        "prisonparty.service"
+        "index.md"
+        "https://raw.githubusercontent.com/9001/${pkgname}/v${pkgver}/bin/prisonparty.sh"
+        "https://raw.githubusercontent.com/9001/${pkgname}/v${pkgver}/LICENSE"
+)
+backup=("etc/${pkgname}.d/init" )
+sha256sums=("bf8b8a630589db47f70391ed5bf71210bcb2d52d34a9360bd8776123854077c0"
+            "b8565eba5e64dedba1cf6c7aac7e31c5a731ed7153d6810288a28f00a36c28b2"
+            "f65c207e0670f9d78ad2e399bda18d5502ff30d2ac79e0e7fc48e7fbdc39afdc"
+            "c4f396b083c9ec02ad50b52412c84d2a82be7f079b2d016e1c9fad22d68285ff"
+            "dba701de9fd584405917e923ea1e59dbb249b96ef23bad479cf4e42740b774c8"
+            "23054bb206153a1ed34038accaf490b8068f9c856e423c2f2595b148b40c0a0c"
+            "cb2ce3d6277bf2f5a82ecf336cc44963bc6490bcf496ffbd75fc9e21abaa75f3"
+)
+
+package() {
+    cd "${srcdir}/"
+
+    install -dm755 "${pkgdir}/etc/${pkgname}.d"
+    install -Dm755 "${pkgname}-sfx.py" "${pkgdir}/usr/bin/${pkgname}"
+    install -Dm755 "prisonparty.sh" "${pkgdir}/usr/bin/prisonparty"
+    install -Dm644 "${pkgname}.conf" "${pkgdir}/etc/${pkgname}.d/init"
+    install -Dm644 "${pkgname}.service" "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
+    install -Dm644 "prisonparty.service" "${pkgdir}/usr/lib/systemd/system/prisonparty.service"
+    install -Dm644 "index.md" "${pkgdir}/var/lib/${pkgname}-jail/README.md"
+    install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+
+    find /etc/${pkgname}.d -iname '*.conf' 2>/dev/null | grep -qE . && return
+    echo "┏━━━━━━━━━━━━━━━──-"
+    echo "┃ Configure ${pkgname} by adding .conf files into /etc/${pkgname}.d/"
+    echo "┃ and maybe copy+edit one of the following to /etc/systemd/system/:"
+    echo "┣━♦ /usr/lib/systemd/system/${pkgname}.service   (standard)"
+    echo "┣━♦ /usr/lib/systemd/system/prisonparty.service (chroot)"
+    echo "┗━━━━━━━━━━━━━━━──-"
+}
--- a/contrib/package/arch/copyparty.conf
+++ b/contrib/package/arch/copyparty.conf
@@ -0,0 +1,7 @@
+## import all *.conf files from the current folder (/etc/copyparty.d)
+% ./
+
+# add additional .conf files to this folder;
+# see example config files for reference:
+# https://github.com/9001/copyparty/blob/hovudstraum/docs/example.conf
+# https://github.com/9001/copyparty/tree/hovudstraum/docs/copyparty.d
--- a/contrib/package/arch/copyparty.service
+++ b/contrib/package/arch/copyparty.service
@@ -0,0 +1,32 @@
+# this will start `/usr/bin/copyparty-sfx.py`
+# and read config from `/etc/copyparty.d/*.conf`
+#
+# you probably want to:
+#   change "User=cpp" and "/home/cpp/" to another user
+#
+# unless you add -q to disable logging, you may want to remove the
+#   following line to allow buffering (slightly better performance):
+#   Environment=PYTHONUNBUFFERED=x
+
+[Unit]
+Description=copyparty file server
+
+[Service]
+Type=notify
+SyslogIdentifier=copyparty
+Environment=PYTHONUNBUFFERED=x
+WorkingDirectory=/var/lib/copyparty-jail
+ExecReload=/bin/kill -s USR1 $MAINPID
+
+# user to run as + where the TLS certificate is (if any)
+User=cpp
+Environment=XDG_CONFIG_HOME=/home/cpp/.config
+
+# stop systemd-tmpfiles-clean.timer from deleting copyparty while it's running
+ExecStartPre=+/bin/bash -c 'mkdir -p /run/tmpfiles.d/ && echo "x /tmp/pe-copyparty*" > /run/tmpfiles.d/copyparty.conf'
+
+# run copyparty
+ExecStart=/usr/bin/python3 /usr/bin/copyparty -c /etc/copyparty.d/init
+
+[Install]
+WantedBy=multi-user.target
--- a/contrib/package/arch/index.md
+++ b/contrib/package/arch/index.md
@@ -0,0 +1,3 @@
+this is `/var/lib/copyparty-jail`, the fallback webroot when copyparty has not yet been configured
+
+please add some `*.conf` files to `/etc/copyparty.d/`
--- a/contrib/package/arch/prisonparty.service
+++ b/contrib/package/arch/prisonparty.service
@@ -0,0 +1,31 @@
+# this will start `/usr/bin/copyparty-sfx.py`
+# in a chroot, preventing accidental access elsewhere
+# and read config from `/etc/copyparty.d/*.conf`
+#
+# expose additional filesystem locations to copyparty
+#   by listing them between the last `1000` and `--`
+#
+# `1000 1000` = what user to run copyparty as
+#
+# unless you add -q to disable logging, you may want to remove the
+#   following line to allow buffering (slightly better performance):
+#   Environment=PYTHONUNBUFFERED=x
+
+[Unit]
+Description=copyparty file server
+
+[Service]
+SyslogIdentifier=prisonparty
+Environment=PYTHONUNBUFFERED=x
+WorkingDirectory=/var/lib/copyparty-jail
+ExecReload=/bin/kill -s USR1 $MAINPID
+
+# stop systemd-tmpfiles-clean.timer from deleting copyparty while it's running
+ExecStartPre=+/bin/bash -c 'mkdir -p /run/tmpfiles.d/ && echo "x /tmp/pe-copyparty*" > /run/tmpfiles.d/copyparty.conf'
+
+# run copyparty
+ExecStart=/bin/bash /usr/bin/prisonparty /var/lib/copyparty-jail 1000 1000 /etc/copyparty.d -- \
+  /usr/bin/python3 /usr/bin/copyparty -c /etc/copyparty.d/init
+
+[Install]
+WantedBy=multi-user.target
--- a/contrib/plugins/minimal-up2k.html
+++ b/contrib/plugins/minimal-up2k.html
@@ -1,4 +1,9 @@
 <!--
+  NOTE: DEPRECATED; please use the javascript version instead:
+  https://github.com/9001/copyparty/blob/hovudstraum/contrib/plugins/minimal-up2k.js
+
+  ----
+
  save this as .epilogue.html inside a write-only folder to declutter the UI,  makes it look like
  https://user-images.githubusercontent.com/241032/118311195-dd6ca380-b4ef-11eb-86f3-75a3ff2e1332.png

@@ -11,7 +16,7 @@

    /* make the up2k ui REALLY minimal by hiding a bunch of stuff: */

-    #ops, #tree, #path, #epi+h2,  /* main tabs and navigators (tree/breadcrumbs) */
+    #ops, #tree, #path, #wfp,  /* main tabs and navigators (tree/breadcrumbs) */

    #u2conf tr:first-child>td[rowspan]:not(#u2btn_cw),  /* most of the config options */

--- a/contrib/plugins/minimal-up2k.js
+++ b/contrib/plugins/minimal-up2k.js
@@ -17,7 +17,7 @@ almost the same as minimal-up2k.html except this one...:
 var u2min = `
 <style>

-#ops, #path, #tree, #files, #epi+div+h2,
+#ops, #path, #tree, #files, #wfp,
 #u2conf td.c+.c, #u2cards, #srch_dz, #srch_zd {
  display: none !important;
 }
@@ -55,5 +55,5 @@ var u2min = `
 if (!has(perms, 'read')) {
  var e2 = mknod('div');
  e2.innerHTML = u2min;
-  ebi('wrap').insertBefore(e2, QS('#epi+h2'));
+  ebi('wrap').insertBefore(e2, QS('#wfp'));
 }
--- a/contrib/systemd/prisonparty.service
+++ b/contrib/systemd/prisonparty.service
@@ -6,12 +6,17 @@
 #   1) put copyparty-sfx.py and prisonparty.sh in /usr/local/bin
 #   2) cp -pv prisonparty.service /etc/systemd/system && systemctl enable --now prisonparty
 #
+# expose additional filesystem locations to copyparty
+#   by listing them between the last `1000` and `--`
+#
+# `1000 1000` = what user to run copyparty as
+#
 # you may want to:
 #   change '/mnt::rw' to another location or permission-set
 #    (remember to change the '/mnt' chroot arg too)
 #
-# enable line-buffering for realtime logging (slight performance cost):
-#   inside the [Service] block, add the following line:
+# unless you add -q to disable logging, you may want to remove the
+#   following line to allow buffering (slightly better performance):
 #   Environment=PYTHONUNBUFFERED=x

 [Unit]
@@ -19,7 +24,14 @@ Description=copyparty file server

 [Service]
 SyslogIdentifier=prisonparty
-WorkingDirectory=/usr/local/bin
+Environment=PYTHONUNBUFFERED=x
+WorkingDirectory=/var/lib/copyparty-jail
+ExecReload=/bin/kill -s USR1 $MAINPID
+
+# stop systemd-tmpfiles-clean.timer from deleting copyparty while it's running
+ExecStartPre=+/bin/bash -c 'mkdir -p /run/tmpfiles.d/ && echo "x /tmp/pe-copyparty*" > /run/tmpfiles.d/copyparty.conf'
+
+# run copyparty
 ExecStart=/bin/bash /usr/local/bin/prisonparty.sh /var/lib/copyparty-jail 1000 1000 /mnt -- \
  /usr/bin/python3 /usr/local/bin/copyparty-sfx.py -q -v /mnt::rw

--- a/contrib/webdav-cfg.bat
+++ b/contrib/webdav-cfg.bat
@@ -3,8 +3,6 @@ rem removes the 47.6 MiB filesize limit when downloading from webdav
 rem + optionally allows/enables password-auth over plaintext http
 rem + optionally helps disable wpad, removing the 10sec latency

-setlocal enabledelayedexpansion
-
 net session >nul 2>&1
 if %errorlevel% neq 0 (
    echo sorry, you must run this as administrator
@@ -20,30 +18,26 @@ echo OK;
 echo allow webdav basic-auth over plaintext http?
 echo Y: login works, but the password will be visible in wireshark etc
 echo N: login will NOT work unless you use https and valid certificates
-set c=.
-set /p "c=(Y/N): "
-echo(
-if /i not "!c!"=="y" goto :g1
-reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters /v BasicAuthLevel /t REG_DWORD /d 0x2 /f
-rem default is 1 (require tls)
+choice
+if %errorlevel% equ 1 (
+    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WebClient\Parameters /v BasicAuthLevel /t REG_DWORD /d 0x2 /f
+    rem default is 1 (require tls)
+)

-:g1
 echo(
 echo OK;
 echo do you want to disable wpad?
 echo can give a HUGE speed boost depending on network settings
-set c=.
-set /p "c=(Y/N): "
-echo(
-if /i not "!c!"=="y" goto :g2
-echo(
-echo i'm about to open the [Connections] tab in [Internet Properties] for you;
-echo please click [LAN settings] and disable [Automatically detect settings]
-echo(
-pause
-control inetcpl.cpl,,4
+choice
+if %errorlevel% equ 1 (
+    echo(
+    echo i'm about to open the [Connections] tab in [Internet Properties] for you;
+    echo please click [LAN settings] and disable [Automatically detect settings]
+    echo(
+    pause
+    control inetcpl.cpl,,4
+)

-:g2
 net stop webclient
 net start webclient
 echo(
--- a/copyparty/init.py
+++ b/copyparty/init.py
@@ -34,6 +34,8 @@ ANYWIN = WINDOWS or sys.platform in ["msys", "cygwin"]

 MACOS = platform.system() == "Darwin"

+EXE = bool(getattr(sys, "frozen", False))
+
 try:
    CORES = len(os.sched_getaffinity(0))
 except:
--- a/copyparty/main.py
+++ b/copyparty/main.py
@@ -23,9 +23,10 @@ import traceback
 import uuid
 from textwrap import dedent

-from .__init__ import ANYWIN, CORES, PY2, VT100, WINDOWS, E, EnvParams, unicode
+from .__init__ import ANYWIN, CORES, EXE, PY2, VT100, WINDOWS, E, EnvParams, unicode
 from .__version__ import CODENAME, S_BUILD_DT, S_VERSION
-from .authsrv import expand_config_file, re_vol
+from .authsrv import expand_config_file, re_vol, split_cfg_ln, upgrade_cfg_fmt
+from .cfg import flagcats, onedash
 from .svchub import SvcHub
 from .util import (
    IMPLICATIONS,
@@ -37,6 +38,7 @@ from .util import (
    ansi_re,
    min_ex,
    py_desc,
+    pybin,
    termsize,
    wrap,
 )
@@ -53,8 +55,9 @@ try:
 except:
    HAVE_SSL = False

-printed: list[str] = []
 u = unicode
+printed: list[str] = []
+zsid = uuid.uuid4().urn[4:]


 class RiceFormatter(argparse.HelpFormatter):
@@ -354,27 +357,28 @@ def configure_ssl_ciphers(al: argparse.Namespace) -> None:
 def args_from_cfg(cfg_path: str) -> list[str]:
    lines: list[str] = []
    expand_config_file(lines, cfg_path, "")
+    lines = upgrade_cfg_fmt(None, argparse.Namespace(vc=False), lines, "")

    ret: list[str] = []
-    skip = False
+    skip = True
    for ln in lines:
-        if not ln:
+        sn = ln.split("  #")[0].strip()
+        if sn.startswith("["):
+            skip = True
+        if sn.startswith("[global]"):
            skip = False
            continue
-
-        if ln.startswith("#"):
+        if skip or not sn.split("#")[0].strip():
            continue
-
-        if not ln.startswith("-"):
-            continue
-
-        if skip:
-            continue
-
-        try:
-            ret.extend(ln.split(" ", 1))
-        except:
-            ret.append(ln)
+        for k, v in split_cfg_ln(sn).items():
+            k = k.lstrip("-")
+            if not k:
+                continue
+            prefix = "-" if k in onedash else "--"
+            if v is True:
+                ret.append(prefix + k)
+            else:
+                ret.append(prefix + k + "=" + v)

    return ret

@@ -468,7 +472,7 @@ def get_sects():
              "g" (get):    download files, but cannot see folder contents
              "G" (upget):  "get", but can see filekeys of their own uploads

-            too many volflags to list here, see the other sections
+            too many volflags to list here, see --help-flags

            example:\033[35m
              -a ed:hunter2 -v .::r:rw,ed -v ../inc:dump:w:rw,ed:c,nodupe  \033[36m
@@ -495,69 +499,9 @@ def get_sects():
                """
            volflags are appended to volume definitions, for example,
            to create a write-only volume with the \033[33mnodupe\033[0m and \033[32mnosub\033[0m flags:
-              \033[35m-v /mnt/inc:/inc:w\033[33m:c,nodupe\033[32m:c,nosub
-
-            \033[0muploads, general:
-              \033[36mnodupe\033[35m rejects existing files (instead of symlinking them)
-              \033[36mhardlink\033[35m does dedup with hardlinks instead of symlinks
-              \033[36mneversymlink\033[35m disables symlink fallback; full copy instead
-              \033[36mcopydupes\033[35m disables dedup, always saves full copies of dupes
-              \033[36mnosub\033[35m forces all uploads into the top folder of the vfs
-              \033[36mmagic$\033[35m enables filetype detection for nameless uploads
-              \033[36mgz\033[35m allows server-side gzip of uploads with ?gz (also c,xz)
-              \033[36mpk\033[35m forces server-side compression, optional arg: xz,9
-
-            \033[0mupload rules:
-              \033[36mmaxn=250,600\033[35m max 250 uploads over 15min
-              \033[36mmaxb=1g,300\033[35m max 1 GiB over 5min (suffixes: b, k, m, g)
-              \033[36msz=1k-3m\033[35m allow filesizes between 1 KiB and 3MiB
-              \033[36mdf=1g\033[35m ensure 1 GiB free disk space
-
-            \033[0mupload rotation:
-            (moves all uploads into the specified folder structure)
-              \033[36mrotn=100,3\033[35m 3 levels of subfolders with 100 entries in each
-              \033[36mrotf=%Y-%m/%d-%H\033[35m date-formatted organizing
-              \033[36mlifetime=3600\033[35m uploads are deleted after 1 hour
-
-            \033[0mdatabase, general:
-              \033[36me2d\033[35m sets -e2d (all -e2* args can be set using ce2* volflags)
-              \033[36md2ts\033[35m disables metadata collection for existing files
-              \033[36md2ds\033[35m disables onboot indexing, overrides -e2ds*
-              \033[36md2t\033[35m disables metadata collection, overrides -e2t*
-              \033[36md2v\033[35m disables file verification, overrides -e2v*
-              \033[36md2d\033[35m disables all database stuff, overrides -e2*
-              \033[36mhist=/tmp/cdb\033[35m puts thumbnails and indexes at that location
-              \033[36mscan=60\033[35m scan for new files every 60sec, same as --re-maxage
-              \033[36mnohash=\\.iso$\033[35m skips hashing file contents if path matches *.iso
-              \033[36mnoidx=\\.iso$\033[35m fully ignores the contents at paths matching *.iso
-              \033[36mnoforget$\033[35m don't forget files when deleted from disk
-              \033[36mdbd=[acid|swal|wal|yolo]\033[35m database speed-durability tradeoff
-              \033[36mxlink$\033[35m cross-volume dupe detection / linking
-              \033[36mxdev\033[35m do not descend into other filesystems
-              \033[36mxvol\033[35m skip symlinks leaving the volume root
-
-            \033[0mdatabase, audio tags:
-            "mte", "mth", "mtp", "mtm" all work the same as -mte, -mth, ...
-              \033[36mmtp=.bpm=f,audio-bpm.py\033[35m uses the "audio-bpm.py" program to
-                generate ".bpm" tags from uploads (f = overwrite tags)
-              \033[36mmtp=ahash,vhash=media-hash.py\033[35m collects two tags at once
-
-            \033[0mthumbnails:
-              \033[36mdthumb\033[35m disables all thumbnails
-              \033[36mdvthumb\033[35m disables video thumbnails
-              \033[36mdathumb\033[35m disables audio thumbnails (spectrograms)
-              \033[36mdithumb\033[35m disables image thumbnails
-
-            \033[0mclient and ux:
-              \033[36mhtml_head=TXT\033[35m includes TXT in the <head>
-              \033[36mrobots\033[35m allows indexing by search engines (default)
-              \033[36mnorobots\033[35m kindly asks search engines to leave
-
-            \033[0mothers:
-              \033[36mfk=8\033[35m generates per-file accesskeys,
-                which will then be required at the "g" permission
-            \033[0m"""
-            ),
+              \033[35m-v /mnt/inc:/inc:w\033[33m:c,nodupe\033[32m:c,nosub"""
+            )
+            + build_flags_desc(),
        ],
        [
            "hooks",
@@ -567,6 +511,7 @@ def get_sects():
            execute a command (a program or script) before or after various events;
             \033[36mxbu\033[35m executes CMD before a file upload starts
             \033[36mxau\033[35m executes CMD after  a file upload finishes
+             \033[36mxiu\033[35m executes CMD after  all uploads finish and volume is idle
             \033[36mxbr\033[35m executes CMD before a file rename/move
             \033[36mxar\033[35m executes CMD after  a file rename/move
             \033[36mxbd\033[35m executes CMD before a file delete
@@ -588,6 +533,7 @@ def get_sects():
             \033[36mj\033[35m provides json with info as 1st arg instead of filepath
             \033[36mwN\033[35m waits N sec after command has been started before continuing
             \033[36mtN\033[35m sets an N sec timeout before the command is abandoned
+             \033[36miN\033[35m xiu only: volume must be idle for N sec (default = 5)

             \033[36mkt\033[35m kills the entire process tree on timeout (default),
             \033[36mkm\033[35m kills just the main process
@@ -598,6 +544,14 @@ def get_sects():
             \033[36mc2\033[35m show only stdout
             \033[36mc3\033[35m mute all process otput
            \033[0m
+            each hook is executed once for each event, except for \033[36mxiu\033[0m
+            which builds up a backlog of uploads, running the hook just once
+            as soon as the volume has been idle for iN seconds (5 by default)
+
+            \033[36mxiu\033[0m is also unique in that it will pass the metadata to the
+            executed program on STDIN instead of as argv arguments, and
+            it also includes the wark (file-id/hash) as a json property
+
            except for \033[36mxm\033[0m, only one hook / one action can run at a time,
            so it's recommended to use the \033[36mf\033[0m flag unless you really need
            to wait for the hook to finish before continuing (without \033[36mf\033[0m
@@ -659,6 +613,17 @@ def get_sects():
    ]


+def build_flags_desc():
+    ret = ""
+    for grp, flags in flagcats.items():
+        ret += "\n\n\033[0m" + grp
+        for k, v in flags.items():
+            v = v.replace("\n", "\n    ")
+            ret += "\n  \033[36m{}\033[35m {}".format(k, v)
+
+    return ret + "\033[0m"
+
+
 # fmt: off


@@ -696,6 +661,7 @@ def add_upload(ap):
    ap2.add_argument("--dotpart", action="store_true", help="dotfile incomplete uploads, hiding them from clients unless -ed")
    ap2.add_argument("--plain-ip", action="store_true", help="when avoiding filename collisions by appending the uploader's ip to the filename: append the plaintext ip instead of salting and hashing the ip")
    ap2.add_argument("--unpost", metavar="SEC", type=int, default=3600*12, help="grace period where uploads can be deleted by the uploader, even without delete permissions; 0=disabled")
+    ap2.add_argument("--blank-wt", metavar="SEC", type=int, default=300, help="file write grace period (any client can write to a blank file last-modified more recently than SEC seconds ago)")
    ap2.add_argument("--reg-cap", metavar="N", type=int, default=38400, help="max number of uploads to keep in memory when running without -e2d; roughly 1 MiB RAM per 600")
    ap2.add_argument("--no-fpool", action="store_true", help="disable file-handle pooling -- instead, repeatedly close and reopen files during upload (very slow on windows)")
    ap2.add_argument("--use-fpool", action="store_true", help="force file-handle pooling, even when it might be dangerous (multiprocessing, filesystems lacking sparse-files support, ...)")
@@ -704,6 +670,8 @@ def add_upload(ap):
    ap2.add_argument("--no-dedup", action="store_true", help="disable symlink/hardlink creation; copy file contents instead (volflag=copydupes")
    ap2.add_argument("--no-dupe", action="store_true", help="reject duplicate files during upload; only matches within the same volume (volflag=nodupe)")
    ap2.add_argument("--no-snap", action="store_true", help="disable snapshots -- forget unfinished uploads on shutdown; don't create .hist/up2k.snap files -- abandoned/interrupted uploads must be cleaned up manually")
+    ap2.add_argument("--rand", action="store_true", help="force randomized filenames, --nrand chars long (volflag=rand)")
+    ap2.add_argument("--nrand", metavar="NUM", type=int, default=9, help="randomized filenames length (volflag=nrand)")
    ap2.add_argument("--magic", action="store_true", help="enable filetype detection on nameless uploads (volflag=magic)")
    ap2.add_argument("--df", metavar="GiB", type=float, default=0, help="ensure GiB free disk space by rejecting upload requests")
    ap2.add_argument("--sparse", metavar="MiB", type=int, default=4, help="windows-only: minimum size of incoming uploads through up2k before they are made into sparse files")
@@ -726,6 +694,7 @@ def add_network(ap):
    ap2.add_argument("--s-wr-sz", metavar="B", type=int, default=256*1024, help="socket write size in bytes")
    ap2.add_argument("--s-wr-slp", metavar="SEC", type=float, default=0, help="debug: socket write delay in seconds")
    ap2.add_argument("--rsp-slp", metavar="SEC", type=float, default=0, help="debug: response delay in seconds")
+    ap2.add_argument("--rsp-jtr", metavar="SEC", type=float, default=0, help="debug: response delay, random duration 0..SEC")


 def add_tls(ap):
@@ -774,7 +743,7 @@ def add_zc_ssdp(ap):
    ap2.add_argument("--zs-off", metavar="NETS", type=u, default="", help="disable zeroconf on the comma-separated list of subnets and/or interface names/indexes")
    ap2.add_argument("--zsv", action="store_true", help="verbose SSDP")
    ap2.add_argument("--zsl", metavar="PATH", type=u, default="/?hc", help="location to include in the url (or a complete external URL), for example [\033[32mpriv/?pw=hunter2\033[0m] (goes directly to /priv/ with password hunter2) or [\033[32m?hc=priv&pw=hunter2\033[0m] (shows mounting options for /priv/ with password)")
-    ap2.add_argument("--zsid", metavar="UUID", type=u, default=uuid.uuid4().urn[4:], help="USN (device identifier) to announce")
+    ap2.add_argument("--zsid", metavar="UUID", type=u, default=zsid, help="USN (device identifier) to announce")


 def add_ftp(ap):
@@ -808,9 +777,10 @@ def add_smb(ap):


 def add_hooks(ap):
-    ap2 = ap.add_argument_group('hooks (see --help-hooks)')
+    ap2 = ap.add_argument_group('event hooks (see --help-hooks)')
    ap2.add_argument("--xbu", metavar="CMD", type=u, action="append", help="execute CMD before a file upload starts")
    ap2.add_argument("--xau", metavar="CMD", type=u, action="append", help="execute CMD after  a file upload finishes")
+    ap2.add_argument("--xiu", metavar="CMD", type=u, action="append", help="execute CMD after  all uploads finish and volume is idle")
    ap2.add_argument("--xbr", metavar="CMD", type=u, action="append", help="execute CMD before a file move/rename")
    ap2.add_argument("--xar", metavar="CMD", type=u, action="append", help="execute CMD after  a file move/rename")
    ap2.add_argument("--xbd", metavar="CMD", type=u, action="append", help="execute CMD before a file delete")
@@ -844,7 +814,7 @@ def add_safety(ap, fk_salt):
    ap2.add_argument("-ss", action="store_true", help="further increase safety: Prevent js-injection, accidental move/delete, broken symlinks, webdav, 404 on 403, ban on excessive 404s.\n └─Alias of\033[32m -s --unpost=0 --no-del --no-mv --hardlink --vague-403 --ban-404=50,60,1440 -nih")
    ap2.add_argument("-sss", action="store_true", help="further increase safety: Enable logging to disk, scan for dangerous symlinks.\n └─Alias of\033[32m -ss --no-dav --no-logues --no-readme -lo=cpp-%%Y-%%m%%d-%%H%%M%%S.txt.xz --ls=**,*,ln,p,r")
    ap2.add_argument("--ls", metavar="U[,V[,F]]", type=u, help="do a sanity/safety check of all volumes on startup; arguments \033[33mUSER\033[0m,\033[33mVOL\033[0m,\033[33mFLAGS\033[0m; example [\033[32m**,*,ln,p,r\033[0m]")
-    ap2.add_argument("--salt", type=u, default="hunter2", help="up2k file-hash salt; used to generate unpredictable internal identifiers for uploads -- doesn't really matter")
+    ap2.add_argument("--salt", type=u, default="hunter2", help="up2k file-hash salt; serves no purpose, no reason to change this (but delete all databases if you do)")
    ap2.add_argument("--fk-salt", metavar="SALT", type=u, default=fk_salt, help="per-file accesskey salt; used to generate unpredictable URLs for hidden files -- this one DOES matter")
    ap2.add_argument("--no-dot-mv", action="store_true", help="disallow moving dotfiles; makes it impossible to move folders containing dotfiles")
    ap2.add_argument("--no-dot-ren", action="store_true", help="disallow renaming dotfiles; makes it impossible to make something a dotfile")
@@ -866,7 +836,7 @@ def add_shutdown(ap):
    ap2 = ap.add_argument_group('shutdown options')
    ap2.add_argument("--ign-ebind", action="store_true", help="continue running even if it's impossible to listen on some of the requested endpoints")
    ap2.add_argument("--ign-ebind-all", action="store_true", help="continue running even if it's impossible to receive connections at all")
-    ap2.add_argument("--exit", metavar="WHEN", type=u, default="", help="shutdown after WHEN has finished; for example [\033[32midx\033[0m] will do volume indexing + metadata analysis")
+    ap2.add_argument("--exit", metavar="WHEN", type=u, default="", help="shutdown after WHEN has finished; [\033[32mcfg\033[0m] config parsing, [\033[32midx\033[0m] volscan + multimedia indexing")


 def add_logging(ap):
@@ -908,11 +878,11 @@ def add_thumbnail(ap):
    # https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html
    # https://github.com/libvips/libvips
    # ffmpeg -hide_banner -demuxers | awk '/^ D  /{print$2}' | while IFS= read -r x; do ffmpeg -hide_banner -h demuxer=$x; done | grep -E '^Demuxer |extensions:'
-    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="bmp,dib,gif,icns,ico,jpg,jpeg,jp2,jpx,pcx,png,pbm,pgm,ppm,pnm,sgi,tga,tif,tiff,webp,xbm,dds,xpm,heif,heifs,heic,heics,avif,avifs", help="image formats to decode using pillow")
-    ap2.add_argument("--th-r-vips", metavar="T,T", type=u, default="jpg,jpeg,jp2,jpx,jxl,tif,tiff,png,webp,heic,avif,fit,fits,fts,exr,svg,hdr,ppm,pgm,pfm,gif,nii", help="image formats to decode using pyvips")
-    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,dds,dib,fit,fits,fts,gif,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
-    ap2.add_argument("--th-r-ffv", metavar="T,T", type=u, default="av1,asf,avi,flv,m4v,mkv,mjpeg,mjpg,mpg,mpeg,mpg2,mpeg2,h264,avc,mts,h265,hevc,mov,3gp,mp4,ts,mpegts,nut,ogv,ogm,rm,vob,webm,wmv", help="video formats to decode using ffmpeg")
-    ap2.add_argument("--th-r-ffa", metavar="T,T", type=u, default="aac,m4a,ogg,opus,flac,alac,mp3,mp2,ac3,dts,wma,ra,wav,aif,aiff,au,alaw,ulaw,mulaw,amr,gsm,ape,tak,tta,wv,mpc", help="audio formats to decode using ffmpeg")
+    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="avif,avifs,blp,bmp,dcx,dds,dib,emf,eps,fits,flc,fli,fpx,gif,heic,heics,heif,heifs,icns,ico,im,j2p,j2k,jp2,jpeg,jpg,jpx,pbm,pcx,pgm,png,pnm,ppm,psd,sgi,spi,tga,tif,tiff,webp,wmf,xbm,xpm", help="image formats to decode using pillow")
+    ap2.add_argument("--th-r-vips", metavar="T,T", type=u, default="avif,exr,fit,fits,fts,gif,hdr,heic,jp2,jpeg,jpg,jpx,jxl,nii,pfm,pgm,png,ppm,svg,tif,tiff,webp", help="image formats to decode using pyvips")
+    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,dds,dib,fit,fits,fts,gif,hdr,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
+    ap2.add_argument("--th-r-ffv", metavar="T,T", type=u, default="3gp,asf,av1,avc,avi,flv,h264,h265,hevc,m4v,mjpeg,mjpg,mkv,mov,mp4,mpeg,mpeg2,mpegts,mpg,mpg2,mts,nut,ogm,ogv,rm,ts,vob,webm,wmv", help="video formats to decode using ffmpeg")
+    ap2.add_argument("--th-r-ffa", metavar="T,T", type=u, default="aac,ac3,aif,aiff,alac,alaw,amr,apac,ape,au,bonk,dfpwm,dts,flac,gsm,ilbc,it,m4a,mo3,mod,mp2,mp3,mpc,mptm,mt2,mulaw,ogg,okt,opus,ra,s3m,tak,tta,ulaw,wav,wma,wv,xm,xpk", help="audio formats to decode using ffmpeg")


 def add_transcoding(ap):
@@ -923,7 +893,7 @@ def add_transcoding(ap):

 def add_db_general(ap, hcores):
    ap2 = ap.add_argument_group('general db options')
-    ap2.add_argument("-e2d", action="store_true", help="enable up2k database, making files searchable + enables upload deduplocation")
+    ap2.add_argument("-e2d", action="store_true", help="enable up2k database, making files searchable + enables upload deduplication")
    ap2.add_argument("-e2ds", action="store_true", help="scan writable folders for new files on startup; sets -e2d")
    ap2.add_argument("-e2dsa", action="store_true", help="scans all folders on startup; sets -e2ds")
    ap2.add_argument("-e2v", action="store_true", help="verify file integrity; rehash all files and compare with db")
@@ -944,6 +914,7 @@ def add_db_general(ap, hcores):
    ap2.add_argument("--db-act", metavar="SEC", type=float, default=10, help="defer any scheduled volume reindexing until SEC seconds after last db write (uploads, renames, ...)")
    ap2.add_argument("--srch-time", metavar="SEC", type=int, default=45, help="search deadline -- terminate searches running for more than SEC seconds")
    ap2.add_argument("--srch-hits", metavar="N", type=int, default=7999, help="max search results to allow clients to fetch; 125 results will be shown initially")
+    ap2.add_argument("--dotsrch", action="store_true", help="show dotfiles in search results (volflags: dotsrch | nodotsrch)")


 def add_db_metadata(ap):
@@ -979,14 +950,17 @@ def add_ui(ap, retry):
    ap2.add_argument("--txt-max", metavar="KiB", type=int, default=64, help="max size of embedded textfiles on ?doc= (anything bigger will be lazy-loaded by JS)")
    ap2.add_argument("--doctitle", metavar="TXT", type=u, default="copyparty", help="title / service-name to show in html documents")
    ap2.add_argument("--pb-url", metavar="URL", type=u, default="https://github.com/9001/copyparty", help="powered-by link; disable with -np")
-    ap2.add_argument("--md-sbf", metavar="FLAGS", type=u, default="downloads forms modals popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for README.md docs (volflag=md_sbf); see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox")
-    ap2.add_argument("--lg-sbf", metavar="FLAGS", type=u, default="downloads forms modals popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for prologue/epilogue docs  (volflag=lg_sbf)")
+    ap2.add_argument("--ver", action="store_true", help="show version on the control panel (incompatible by -np)")
+    ap2.add_argument("--md-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for README.md docs (volflag=md_sbf); see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox")
+    ap2.add_argument("--lg-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for prologue/epilogue docs  (volflag=lg_sbf)")
    ap2.add_argument("--no-sb-md", action="store_true", help="don't sandbox README.md documents (volflags: no_sb_md | sb_md)")
    ap2.add_argument("--no-sb-lg", action="store_true", help="don't sandbox prologue/epilogue docs (volflags: no_sb_lg | sb_lg); enables non-js support")


 def add_debug(ap):
    ap2 = ap.add_argument_group('debug options')
+    ap2.add_argument("--vc", action="store_true", help="verbose config file parser (explain config)")
+    ap2.add_argument("--cgen", action="store_true", help="generate config file from current config (best-effort; probably buggy)")
    ap2.add_argument("--no-sendfile", action="store_true", help="disable sendfile; instead using a traditional file read loop")
    ap2.add_argument("--no-scandir", action="store_true", help="disable scandir; instead using listdir + stat on each file")
    ap2.add_argument("--no-fastboot", action="store_true", help="wait for up2k indexing before starting the httpd")
@@ -1105,6 +1079,9 @@ def main(argv: Optional[list[str]] = None) -> None:
        showlic()
        sys.exit(0)

+    if EXE:
+        print("pybin: {}\n".format(pybin), end="")
+
    ensure_locale()
    if HAVE_SSL:
        ensure_cert()
@@ -1137,7 +1114,8 @@ def main(argv: Optional[list[str]] = None) -> None:
        if da:
            argv.extend(["--qr"])
            if ANYWIN or not os.geteuid():
-                argv.extend(["-p80,443,3923", "--ign-ebind"])
+                # win10 allows symlinks if admin; can be unexpected
+                argv.extend(["-p80,443,3923", "--ign-ebind", "--no-dedup"])
    except:
        pass

@@ -1159,6 +1137,7 @@ def main(argv: Optional[list[str]] = None) -> None:
    for fmtr in [RiceFormatter, RiceFormatter, Dodge11874, BasicDodge11874]:
        try:
            al = run_argparse(argv, fmtr, retry, nc)
+            dal = run_argparse([], fmtr, retry, nc)
            break
        except SystemExit:
            raise
@@ -1168,6 +1147,7 @@ def main(argv: Optional[list[str]] = None) -> None:

    try:
        assert al  # type: ignore
+        assert dal  # type: ignore
        al.E = E  # __init__ is not shared when oxidized
    except:
        sys.exit(1)
@@ -1273,7 +1253,7 @@ def main(argv: Optional[list[str]] = None) -> None:

    # signal.signal(signal.SIGINT, sighandler)

-    SvcHub(al, argv, "".join(printed)).run()
+    SvcHub(al, dal, argv, "".join(printed)).run()


 if __name__ == "__main__":
--- a/copyparty/version.py
+++ b/copyparty/version.py
@@ -1,8 +1,8 @@
 # coding: utf-8

-VERSION = (1, 6, 2)
+VERSION = (1, 6, 7)
 CODENAME = "cors k"
-BUILD_DT = (2023, 1, 29)
+BUILD_DT = (2023, 3, 5)

 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -14,6 +14,7 @@ from datetime import datetime

 from .__init__ import ANYWIN, TYPE_CHECKING, WINDOWS
 from .bos import bos
+from .cfg import flagdescs, permdescs, vf_bmap, vf_cmap, vf_vmap
 from .util import (
    IMPLICATIONS,
    META_NOBOTS,
@@ -21,7 +22,7 @@ from .util import (
    UNPLICATIONS,
    Pebkac,
    absreal,
-    fsenc,
+    afsenc,
    get_df,
    humansize,
    relchk,
@@ -36,7 +37,7 @@ if True:  # pylint: disable=using-constant-test

    from typing import Any, Generator, Optional, Union

-    from .util import RootLogger
+    from .util import NamedLogger, RootLogger

 if TYPE_CHECKING:
    pass
@@ -653,11 +654,15 @@ class AuthSrv(object):
        args: argparse.Namespace,
        log_func: Optional["RootLogger"],
        warn_anonwrite: bool = True,
+        dargs: Optional[argparse.Namespace] = None,
    ) -> None:
        self.args = args
+        self.dargs = dargs or args
        self.log_func = log_func
        self.warn_anonwrite = warn_anonwrite
        self.line_ctr = 0
+        self.indent = ""
+        self.desc = []

        self.mutex = threading.Lock()
        self.reload()
@@ -690,17 +695,47 @@ class AuthSrv(object):
            raise Exception("invalid config")

        if src in mount.values():
-            t = "warning: filesystem-path [{}] mounted in multiple locations:"
+            t = "filesystem-path [{}] mounted in multiple locations:"
            t = t.format(src)
            for v in [k for k, v in mount.items() if v == src] + [dst]:
                t += "\n  /{}".format(v)

            self.log(t, c=3)
+            raise Exception("invalid config")
+
+        if not bos.path.isdir(src):
+            self.log("warning: filesystem-path does not exist: {}".format(src), 3)

        mount[dst] = src
        daxs[dst] = AXS()
        mflags[dst] = {}

+    def _e(self, desc: Optional[str] = None) -> None:
+        if not self.args.vc or not self.line_ctr:
+            return
+
+        if not desc and not self.indent:
+            self.log("")
+            return
+
+        desc = desc or ""
+        desc = desc.replace("[", "[\033[0m").replace("]", "\033[90m]")
+        self.log(" >>> {}{}".format(self.indent, desc), "90")
+
+    def _l(self, ln: str, c: int, desc: str) -> None:
+        if not self.args.vc or not self.line_ctr:
+            return
+
+        if c < 10:
+            c += 30
+
+        t = "\033[97m{:4} \033[{}m{}{}"
+        if desc:
+            t += "  \033[0;90m# {}\033[0m"
+            desc = desc.replace("[", "[\033[0m").replace("]", "\033[90m]")
+
+        self.log(t.format(self.line_ctr, c, self.indent, ln, desc))
+
    def _parse_config_file(
        self,
        fp: str,
@@ -710,61 +745,140 @@ class AuthSrv(object):
        mflags: dict[str, dict[str, Any]],
        mount: dict[str, str],
    ) -> None:
-        skip = False
-        vol_src = None
-        vol_dst = None
+        self.desc = []
        self.line_ctr = 0
+
        expand_config_file(cfg_lines, fp, "")
+        if self.args.vc:
+            lns = ["{:4}: {}".format(n, s) for n, s in enumerate(cfg_lines, 1)]
+            self.log("expanded config file (unprocessed):\n" + "\n".join(lns))
+
+        cfg_lines = upgrade_cfg_fmt(self.log, self.args, cfg_lines, fp)
+
+        cat = ""
+        catg = "[global]"
+        cata = "[accounts]"
+        catx = "accs:"
+        catf = "flags:"
+        ap: Optional[str] = None
+        vp: Optional[str] = None
        for ln in cfg_lines:
            self.line_ctr += 1
-            if not ln and vol_src is not None:
-                vol_src = None
-                vol_dst = None
-
-            if skip:
-                if not ln:
-                    skip = False
+            ln = ln.split("  #")[0].strip()
+            if not ln.split("#")[0].strip():
                continue

-            if not ln or ln.startswith("#"):
-                continue
+            subsection = ln in (catx, catf)
+            if ln.startswith("[") or subsection:
+                self._e()
+                if ap is None and vp is not None:
+                    t = "the first line after [/{}] must be a filesystem path to share on that volume"
+                    raise Exception(t.format(vp))

-            if vol_src is None:
-                if ln.startswith("u "):
-                    u, p = ln[2:].split(":", 1)
-                    acct[u] = p
-                elif ln.startswith("-"):
-                    skip = True  # argv
+                cat = ln
+                if not subsection:
+                    ap = vp = None
+                    self.indent = ""
                else:
-                    vol_src = ln
+                    self.indent = "  "
+
+                if ln == catg:
+                    t = "begin commandline-arguments (anything from --help; dashes are optional)"
+                    self._l(ln, 6, t)
+                elif ln == cata:
+                    self._l(ln, 5, "begin user-accounts section")
+                elif ln.startswith("[/"):
+                    vp = ln[1:-1].strip("/")
+                    self._l(ln, 2, "define volume at URL [/{}]".format(vp))
+                elif subsection:
+                    if ln == catx:
+                        self._l(ln, 5, "volume access config:")
+                    else:
+                        t = "volume-specific config (anything from --help-flags)"
+                        self._l(ln, 6, t)
+                else:
+                    raise Exception("invalid section header")
+
+                self.indent = "    " if subsection else "  "
                continue

-            if vol_src and vol_dst is None:
-                vol_dst = ln
-                if not vol_dst.startswith("/"):
-                    raise Exception('invalid mountpoint "{}"'.format(vol_dst))
-
-                if vol_src.startswith("~"):
-                    vol_src = os.path.expanduser(vol_src)
-
-                # cfg files override arguments and previous files
-                vol_src = absreal(vol_src)
-                vol_dst = vol_dst.strip("/")
-                self._map_volume(vol_src, vol_dst, mount, daxs, mflags)
+            if cat == catg:
+                self._l(ln, 6, "")
+                zt = split_cfg_ln(ln)
+                for zs, za in zt.items():
+                    zs = zs.lstrip("-")
+                    if za is True:
+                        self._e("└─argument [{}]".format(zs))
+                    else:
+                        self._e("└─argument [{}] with value [{}]".format(zs, za))
                continue

-            try:
-                lvl, uname = ln.split(" ", 1)
-            except:
-                lvl = ln
-                uname = "*"
+            if cat == cata:
+                try:
+                    u, p = [zs.strip() for zs in ln.split(":", 1)]
+                    self._l(ln, 5, "account [{}], password [{}]".format(u, p))
+                    acct[u] = p
+                except:
+                    t = 'lines inside the [accounts] section must be "username: password"'
+                    raise Exception(t)
+                continue

-            if lvl == "a":
-                t = "WARNING (config-file): permission flag 'a' is deprecated; please use 'rw' instead"
-                self.log(t, 1)
+            if vp is not None and ap is None:
+                ap = ln
+                if ap.startswith("~"):
+                    ap = os.path.expanduser(ap)

-            assert vol_dst is not None
-            self._read_vol_str(lvl, uname, daxs[vol_dst], mflags[vol_dst])
+                ap = absreal(ap)
+                self._l(ln, 2, "bound to filesystem-path [{}]".format(ap))
+                self._map_volume(ap, vp, mount, daxs, mflags)
+                continue
+
+            if cat == catx:
+                err = ""
+                try:
+                    self._l(ln, 5, "volume access config:")
+                    sk, sv = ln.split(":")
+                    if re.sub("[rwmdgG]", "", sk) or not sk:
+                        err = "invalid accs permissions list; "
+                        raise Exception(err)
+                    if " " in re.sub(", *", "", sv).strip():
+                        err = "list of users is not comma-separated; "
+                        raise Exception(err)
+                    self._read_vol_str(sk, sv.replace(" ", ""), daxs[vp], mflags[vp])
+                    continue
+                except:
+                    err += "accs entries must be 'rwmdgG: user1, user2, ...'"
+                    raise Exception(err)
+
+            if cat == catf:
+                err = ""
+                try:
+                    self._l(ln, 6, "volume-specific config:")
+                    zd = split_cfg_ln(ln)
+                    fstr = ""
+                    for sk, sv in zd.items():
+                        bad = re.sub(r"[a-z0-9_]", "", sk)
+                        if bad:
+                            err = "bad characters [{}] in volflag name [{}]; "
+                            err = err.format(bad, sk)
+                            raise Exception(err)
+                        if sv is True:
+                            fstr += "," + sk
+                        else:
+                            fstr += ",{}={}".format(sk, sv)
+                            self._read_vol_str("c", fstr[1:], daxs[vp], mflags[vp])
+                            fstr = ""
+                    if fstr:
+                        self._read_vol_str("c", fstr[1:], daxs[vp], mflags[vp])
+                    continue
+                except:
+                    err += "flags entries (volflags) must be one of the following:\n  'flag1, flag2, ...'\n  'key: value'\n  'flag1, flag2, key: value'"
+                    raise Exception(err)
+
+            raise Exception("unprocessable line in config")
+
+        self._e()
+        self.line_ctr = 0

    def _read_vol_str(
        self, lvl: str, uname: str, axs: AXS, flags: dict[str, Any]
@@ -803,6 +917,13 @@ class AuthSrv(object):
                ("G", axs.upget),
            ]:  # b bb bbb
                if ch in lvl:
+                    if un == "*":
+                        t = "└─add permission [{0}] for [everyone] -- {2}"
+                    else:
+                        t = "└─add permission [{0}] for user [{1}] -- {2}"
+
+                    desc = permdescs.get(ch, "?")
+                    self._e(t.format(ch, un, desc))
                    al.add(un)

    def _read_volflag(
@@ -812,7 +933,13 @@ class AuthSrv(object):
        value: Union[str, bool, list[str]],
        is_list: bool,
    ) -> None:
-        if name not in ["mtp", "xbu", "xau", "xbr", "xar", "xbd", "xad", "xm"]:
+        desc = flagdescs.get(name, "?").replace("\n", " ")
+        if name not in "mtp xbu xau xiu xbr xar xbd xad xm".split():
+            if value is True:
+                t = "└─add volflag [{}] = {}  ({})"
+            else:
+                t = "└─add volflag [{}] = [{}]  ({})"
+            self._e(t.format(name, value, desc))
            flags[name] = value
            return

@@ -825,6 +952,7 @@ class AuthSrv(object):
            vals += [value]

        flags[name] = vals
+        self._e("volflag [{}] += {}  ({})".format(name, vals, desc))

    def reload(self) -> None:
        """
@@ -875,6 +1003,18 @@ class AuthSrv(object):
                lns: list[str] = []
                try:
                    self._parse_config_file(cfg_fn, lns, acct, daxs, mflags, mount)
+
+                    zs = "#\033[36m cfg files in "
+                    zst = [x[len(zs) :] for x in lns if x.startswith(zs)]
+                    for zs in list(set(zst)):
+                        self.log("discovered config files in " + zs, 6)
+
+                    zs = "#\033[36m opening cfg file"
+                    zstt = [x.split(" -> ") for x in lns if x.startswith(zs)]
+                    zst = [(max(0, len(x) - 2) * " ") + "└" + x[-1] for x in zstt]
+                    t = "loaded {} config files:\n{}"
+                    self.log(t.format(len(zst), "\n".join(zst)))
+
                except:
                    lns = lns[: self.line_ctr]
                    slns = ["{:4}: {}".format(n, s) for n, s in enumerate(lns, 1)]
@@ -955,7 +1095,7 @@ class AuthSrv(object):
        promote = []
        demote = []
        for vol in vfs.all_vols.values():
-            zb = hashlib.sha512(fsenc(vol.realpath)).digest()
+            zb = hashlib.sha512(afsenc(vol.realpath)).digest()
            hid = base64.b32encode(zb).decode("ascii").lower()
            vflag = vol.flags.get("hist")
            if vflag == "-":
@@ -974,7 +1114,7 @@ class AuthSrv(object):
                    except:
                        owner = None

-                    me = fsenc(vol.realpath).rstrip()
+                    me = afsenc(vol.realpath).rstrip()
                    if owner not in [None, me]:
                        continue

@@ -1114,38 +1254,30 @@ class AuthSrv(object):
                if ptn:
                    vol.flags[vf] = re.compile(ptn)

-            for k in ["e2t", "e2ts", "e2tsr", "e2v", "e2vu", "e2vp", "xdev", "xvol"]:
-                if getattr(self.args, k):
-                    vol.flags[k] = True
-
-            for ga, vf in (
-                ("no_sb_md", "no_sb_md"),
-                ("no_sb_lg", "no_sb_lg"),
-                ("no_forget", "noforget"),
-                ("no_dupe", "nodupe"),
-                ("hardlink", "hardlink"),
-                ("never_symlink", "neversymlink"),
-                ("no_dedup", "copydupes"),
-                ("magic", "magic"),
-                ("xlink", "xlink"),
-            ):
+            for ga, vf in vf_bmap().items():
                if getattr(self.args, ga):
                    vol.flags[vf] = True

            for ve, vd in (
-                ("sb_md", "no_sb_md"),
+                ("nodotsrch", "dotsrch"),
                ("sb_lg", "no_sb_lg"),
+                ("sb_md", "no_sb_md"),
            ):
                if ve in vol.flags:
                    vol.flags.pop(vd, None)

-            for ga, vf in (
-                ("md_sbf", "md_sbf"),
-                ("lg_sbf", "lg_sbf"),
-            ):
+            for ga, vf in vf_vmap().items():
                if vf not in vol.flags:
                    vol.flags[vf] = getattr(self.args, ga)

+            for k in ("nrand",):
+                if k not in vol.flags:
+                    vol.flags[k] = getattr(self.args, k)
+
+            for k in ("nrand",):
+                if k in vol.flags:
+                    vol.flags[k] = int(vol.flags[k])
+
            for k1, k2 in IMPLICATIONS:
                if k1 in vol.flags:
                    vol.flags[k2] = True
@@ -1171,7 +1303,7 @@ class AuthSrv(object):
                vol.flags["mth"] = self.args.mth

            # append additive args from argv to volflags
-            hooks = "xbu xau xbr xar xbd xad xm".split()
+            hooks = "xbu xau xiu xbr xar xbd xad xm".split()
            for name in ["mtp"] + hooks:
                self._read_volflag(vol.flags, name, getattr(self.args, name), True)

@@ -1231,10 +1363,19 @@ class AuthSrv(object):
                if k in ints:
                    vol.flags[k] = int(vol.flags[k])

-            if "lifetime" in vol.flags and "e2d" not in vol.flags:
-                t = 'removing lifetime config from volume "/{}" because e2d is disabled'
-                self.log(t.format(vol.vpath), 1)
-                del vol.flags["lifetime"]
+            if "e2d" not in vol.flags:
+                if "lifetime" in vol.flags:
+                    t = 'removing lifetime config from volume "/{}" because e2d is disabled'
+                    self.log(t.format(vol.vpath), 1)
+                    del vol.flags["lifetime"]
+
+                needs_e2d = [x for x in hooks if x != "xm"]
+                drop = [x for x in needs_e2d if vol.flags.get(x)]
+                if drop:
+                    t = 'removing [{}] from volume "/{}" because e2d is disabled'
+                    self.log(t.format(", ".join(drop), vol.vpath), 1)
+                    for x in drop:
+                        vol.flags.pop(x)

            if vol.flags.get("neversymlink") and not vol.flags.get("hardlink"):
                vol.flags["copydupes"] = True
@@ -1483,32 +1624,298 @@ class AuthSrv(object):
        if not flag_r:
            sys.exit(0)

+    def cgen(self) -> None:
+        ret = [
+            "## WARNING:",
+            "##  there will probably be mistakes in",
+            "##  commandline-args (and maybe volflags)",
+            "",
+        ]
+
+        csv = set("i p".split())
+        lst = set("c ihead mtm mtp xad xar xau xiu xbd xbr xbu xm".split())
+        askip = set("a v c vc cgen theme".split())
+
+        # keymap from argv to vflag
+        amap = vf_bmap()
+        amap.update(vf_vmap())
+        amap.update(vf_cmap())
+        vmap = {v: k for k, v in amap.items()}
+
+        args = {k: v for k, v in vars(self.args).items()}
+        pops = []
+        for k1, k2 in IMPLICATIONS:
+            if args.get(k1):
+                pops.append(k2)
+        for pop in pops:
+            args.pop(pop, None)
+
+        if args:
+            ret.append("[global]")
+            for k, v in args.items():
+                if k in askip:
+                    continue
+                if k in csv:
+                    v = ", ".join([str(za) for za in v])
+                try:
+                    v2 = getattr(self.dargs, k)
+                    if v == v2:
+                        continue
+                except:
+                    continue
+
+                dk = "  " + k.replace("_", "-")
+                if k in lst:
+                    for ve in v:
+                        ret.append("{}: {}".format(dk, ve))
+                else:
+                    if v is True:
+                        ret.append(dk)
+                    elif v not in (False, None, ""):
+                        ret.append("{}: {}".format(dk, v))
+            ret.append("")
+
+        if self.acct:
+            ret.append("[accounts]")
+            for u, p in self.acct.items():
+                ret.append("  {}: {}".format(u, p))
+            ret.append("")
+
+        for vol in self.vfs.all_vols.values():
+            ret.append("[/{}]".format(vol.vpath))
+            ret.append("  " + vol.realpath)
+            ret.append("  accs:")
+            perms = {
+                "r": "uread",
+                "w": "uwrite",
+                "m": "umove",
+                "d": "udel",
+                "g": "uget",
+                "G": "upget",
+            }
+            users = {}
+            for pkey in perms.values():
+                for uname in getattr(vol.axs, pkey):
+                    try:
+                        users[uname] += 1
+                    except:
+                        users[uname] = 1
+            lusers = [(v, k) for k, v in users.items()]
+            vperms = {}
+            for _, uname in sorted(lusers):
+                pstr = ""
+                for pchar, pkey in perms.items():
+                    if uname in getattr(vol.axs, pkey):
+                        pstr += pchar
+                if "g" in pstr and "G" in pstr:
+                    pstr = pstr.replace("g", "")
+                try:
+                    vperms[pstr].append(uname)
+                except:
+                    vperms[pstr] = [uname]
+            for pstr, uname in vperms.items():
+                ret.append("    {}: {}".format(pstr, ", ".join(uname)))
+            trues = []
+            vals = []
+            for k, v in sorted(vol.flags.items()):
+                try:
+                    ak = vmap[k]
+                    if getattr(self.args, ak) is v:
+                        continue
+                except:
+                    pass
+
+                if k in lst:
+                    for ve in v:
+                        vals.append("{}: {}".format(k, ve))
+                elif v is True:
+                    trues.append(k)
+                elif v is not False:
+                    try:
+                        v = v.pattern
+                    except:
+                        pass
+
+                    vals.append("{}: {}".format(k, v))
+            pops = []
+            for k1, k2 in IMPLICATIONS:
+                if k1 in trues:
+                    pops.append(k2)
+            trues = [x for x in trues if x not in pops]
+            if trues:
+                vals.append(", ".join(trues))
+            if vals:
+                ret.append("  flags:")
+                for zs in vals:
+                    ret.append("    " + zs)
+            ret.append("")
+
+        self.log("generated config:\n\n" + "\n".join(ret))
+
+
+def split_cfg_ln(ln: str) -> dict[str, Any]:
+    # "a, b, c: 3" => {a:true, b:true, c:3}
+    ret = {}
+    while True:
+        ln = ln.strip()
+        if not ln:
+            break
+        ofs_sep = ln.find(",") + 1
+        ofs_var = ln.find(":") + 1
+        if not ofs_sep and not ofs_var:
+            ret[ln] = True
+            break
+        if ofs_sep and (ofs_sep < ofs_var or not ofs_var):
+            k, ln = ln.split(",", 1)
+            ret[k.strip()] = True
+        else:
+            k, ln = ln.split(":", 1)
+            ret[k.strip()] = ln.strip()
+            break
+    return ret
+

 def expand_config_file(ret: list[str], fp: str, ipath: str) -> None:
    """expand all % file includes"""
    fp = absreal(fp)
-    ipath += " -> " + fp
-    ret.append("#\033[36m opening cfg file{}\033[0m".format(ipath))
    if len(ipath.split(" -> ")) > 64:
        raise Exception("hit max depth of 64 includes")

    if os.path.isdir(fp):
-        for fn in sorted(os.listdir(fp)):
+        names = os.listdir(fp)
+        ret.append("#\033[36m cfg files in {} => {}\033[0m".format(fp, names))
+        for fn in sorted(names):
            fp2 = os.path.join(fp, fn)
-            if not os.path.isfile(fp2):
-                continue  # dont recurse
+            if not fp2.endswith(".conf") or fp2 in ipath:
+                continue

            expand_config_file(ret, fp2, ipath)
        return

+    ipath += " -> " + fp
+    ret.append("#\033[36m opening cfg file{}\033[0m".format(ipath))
+
    with open(fp, "rb") as f:
-        for ln in [x.decode("utf-8").strip() for x in f]:
+        for oln in [x.decode("utf-8").rstrip() for x in f]:
+            ln = oln.split("  #")[0].strip()
            if ln.startswith("% "):
+                pad = " " * len(oln.split("%")[0])
                fp2 = ln[1:].strip()
                fp2 = os.path.join(os.path.dirname(fp), fp2)
+                ofs = len(ret)
                expand_config_file(ret, fp2, ipath)
+                for n in range(ofs, len(ret)):
+                    ret[n] = pad + ret[n]
                continue

-            ret.append(ln)
+            ret.append(oln)

    ret.append("#\033[36m closed{}\033[0m".format(ipath))
+
+
+def upgrade_cfg_fmt(
+    log: Optional["NamedLogger"], args: argparse.Namespace, orig: list[str], cfg_fp: str
+) -> list[str]:
+    """convert from v1 to v2 format"""
+    zst = [x.split("#")[0].strip() for x in orig]
+    zst = [x for x in zst if x]
+    if (
+        "[global]" in zst
+        or "[accounts]" in zst
+        or "accs:" in zst
+        or "flags:" in zst
+        or [x for x in zst if x.startswith("[/")]
+        or len(zst) == len([x for x in zst if x.startswith("%")])
+    ):
+        return orig
+
+    zst = [x for x in orig if "#\033[36m opening cfg file" not in x]
+    incl = len(zst) != len(orig) - 1
+
+    t = "upgrading config file [{}] from v1 to v2"
+    if not args.vc:
+        t += ". Run with argument '--vc' to see the converted config if you want to upgrade"
+    if incl:
+        t += ". Please don't include v1 configs from v2 files or vice versa! Upgrade all of them at the same time."
+    if log:
+        log(t.format(cfg_fp), 3)
+
+    ret = []
+    vp = ""
+    ap = ""
+    cat = ""
+    catg = "[global]"
+    cata = "[accounts]"
+    catx = "  accs:"
+    catf = "  flags:"
+    for ln in orig:
+        sn = ln.strip()
+        if not sn:
+            cat = vp = ap = ""
+        if not sn.split("#")[0]:
+            ret.append(ln)
+        elif sn.startswith("-") and cat in ("", catg):
+            if cat != catg:
+                cat = catg
+                ret.append(cat)
+            sn = sn.lstrip("-")
+            zst = sn.split(" ", 1)
+            if len(zst) > 1:
+                sn = "{}: {}".format(zst[0], zst[1].strip())
+            ret.append("  " + sn)
+        elif sn.startswith("u ") and cat in ("", catg, cata):
+            if cat != cata:
+                cat = cata
+                ret.append(cat)
+            s1, s2 = sn[1:].split(":", 1)
+            ret.append("  {}: {}".format(s1.strip(), s2.strip()))
+        elif not ap:
+            ap = sn
+        elif not vp:
+            vp = "/" + sn.strip("/")
+            cat = "[{}]".format(vp)
+            ret.append(cat)
+            ret.append("  " + ap)
+        elif sn.startswith("c "):
+            if cat != catf:
+                cat = catf
+                ret.append(cat)
+            sn = sn[1:].strip()
+            if "=" in sn:
+                zst = sn.split("=", 1)
+                sn = zst[0].replace(",", ", ")
+                sn += ": " + zst[1]
+            else:
+                sn = sn.replace(",", ", ")
+            ret.append("    " + sn)
+        elif sn[:1] in "rwmdgG":
+            if cat != catx:
+                cat = catx
+                ret.append(cat)
+            zst = sn.split(" ")
+            zst = [x for x in zst if x]
+            if len(zst) == 1:
+                zst.append("*")
+            ret.append("    {}: {}".format(zst[0], ", ".join(zst[1:])))
+        else:
+            t = "did not understand line {} in the config"
+            t1 = t
+            n = 0
+            for ln in orig:
+                n += 1
+                t += "\n{:4} {}".format(n, ln)
+            if log:
+                log(t, 1)
+            else:
+                print("\033[31m" + t)
+            raise Exception(t1)
+
+    if args.vc and log:
+        t = "new config syntax (copy/paste this to upgrade your config):\n"
+        t += "\n# ======================[ begin upgraded config ]======================\n\n"
+        for ln in ret:
+            t += ln + "\n"
+        t += "\n# ======================[ end of upgraded config ]======================\n"
+        log(t)
+
+    return ret
--- a/copyparty/cfg.py
+++ b/copyparty/cfg.py
@@ -0,0 +1,150 @@
+# coding: utf-8
+from __future__ import print_function, unicode_literals
+
+# awk -F\" '/add_argument\("-[^-]/{print(substr($2,2))}' copyparty/__main__.py | sort | tr '\n' ' '
+zs = "a c e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vp e2vu ed emp i j lo mcr mte mth mtm mtp nb nc nid nih nw p q s ss sss v z zv"
+onedash = set(zs.split())
+
+
+def vf_bmap() -> dict[str, str]:
+    """argv-to-volflag: simple bools"""
+    ret = {
+        "never_symlink": "neversymlink",
+        "no_dedup": "copydupes",
+        "no_dupe": "nodupe",
+        "no_forget": "noforget",
+    }
+    for k in (
+        "dotsrch",
+        "e2t",
+        "e2ts",
+        "e2tsr",
+        "e2v",
+        "e2vu",
+        "e2vp",
+        "hardlink",
+        "magic",
+        "no_sb_md",
+        "no_sb_lg",
+        "rand",
+        "xdev",
+        "xlink",
+        "xvol",
+    ):
+        ret[k] = k
+    return ret
+
+
+def vf_vmap() -> dict[str, str]:
+    """argv-to-volflag: simple values"""
+    ret = {}
+    for k in ("lg_sbf", "md_sbf"):
+        ret[k] = k
+    return ret
+
+
+def vf_cmap() -> dict[str, str]:
+    """argv-to-volflag: complex/lists"""
+    ret = {}
+    for k in ("dbd", "html_head", "mte", "mth", "nrand"):
+        ret[k] = k
+    return ret
+
+
+permdescs = {
+    "r": "read; list folder contents, download files",
+    "w": 'write; upload files; need "r" to see the uploads',
+    "m": 'move; move files and folders; need "w" at destination',
+    "d": "delete; permanently delete files and folders",
+    "g": "get; download files, but cannot see folder contents",
+    "G": 'upget; same as "g" but can see filekeys of their own uploads',
+}
+
+
+flagcats = {
+    "uploads, general": {
+        "nodupe": "rejects existing files (instead of symlinking them)",
+        "hardlink": "does dedup with hardlinks instead of symlinks",
+        "neversymlink": "disables symlink fallback; full copy instead",
+        "copydupes": "disables dedup, always saves full copies of dupes",
+        "daw": "enable full WebDAV write support (dangerous);\nPUT-operations will now \033[1;31mOVERWRITE\033[0;35m existing files",
+        "nosub": "forces all uploads into the top folder of the vfs",
+        "magic": "enables filetype detection for nameless uploads",
+        "gz": "allows server-side gzip of uploads with ?gz (also c,xz)",
+        "pk": "forces server-side compression, optional arg: xz,9",
+    },
+    "upload rules": {
+        "maxn=250,600": "max 250 uploads over 15min",
+        "maxb=1g,300": "max 1 GiB over 5min (suffixes: b, k, m, g)",
+        "rand": "force randomized filenames, 9 chars long by default",
+        "nrand=N": "randomized filenames are N chars long",
+        "sz=1k-3m": "allow filesizes between 1 KiB and 3MiB",
+        "df=1g": "ensure 1 GiB free disk space",
+    },
+    "upload rotation\n(moves all uploads into the specified folder structure)": {
+        "rotn=100,3": "3 levels of subfolders with 100 entries in each",
+        "rotf=%Y-%m/%d-%H": "date-formatted organizing",
+        "lifetime=3600": "uploads are deleted after 1 hour",
+    },
+    "database, general": {
+        "e2d": "enable database; makes files searchable + enables upload dedup",
+        "e2ds": "scan writable folders for new files on startup; also sets -e2d",
+        "e2dsa": "scans all folders for new files on startup; also sets -e2d",
+        "e2t": "enable multimedia indexing; makes it possible to search for tags",
+        "e2ts": "scan existing files for tags on startup; also sets -e2t",
+        "e2tsa": "delete all metadata from DB (full rescan); also sets -e2ts",
+        "d2ts": "disables metadata collection for existing files",
+        "d2ds": "disables onboot indexing, overrides -e2ds*",
+        "d2t": "disables metadata collection, overrides -e2t*",
+        "d2v": "disables file verification, overrides -e2v*",
+        "d2d": "disables all database stuff, overrides -e2*",
+        "hist=/tmp/cdb": "puts thumbnails and indexes at that location",
+        "scan=60": "scan for new files every 60sec, same as --re-maxage",
+        "nohash=\\.iso$": "skips hashing file contents if path matches *.iso",
+        "noidx=\\.iso$": "fully ignores the contents at paths matching *.iso",
+        "noforget": "don't forget files when deleted from disk",
+        "dbd=[acid|swal|wal|yolo]": "database speed-durability tradeoff",
+        "xlink": "cross-volume dupe detection / linking",
+        "xdev": "do not descend into other filesystems",
+        "xvol": "skip symlinks leaving the volume root",
+        "dotsrch": "show dotfiles in search results",
+        "nodotsrch": "hide dotfiles in search results (default)",
+    },
+    'database, audio tags\n"mte", "mth", "mtp", "mtm" all work the same as -mte, -mth, ...': {
+        "mtp=.bpm=f,audio-bpm.py": 'uses the "audio-bpm.py" program to\ngenerate ".bpm" tags from uploads (f = overwrite tags)',
+        "mtp=ahash,vhash=media-hash.py": "collects two tags at once",
+    },
+    "thumbnails": {
+        "dthumb": "disables all thumbnails",
+        "dvthumb": "disables video thumbnails",
+        "dathumb": "disables audio thumbnails (spectrograms)",
+        "dithumb": "disables image thumbnails",
+    },
+    "event hooks\n(better explained in --help-hooks)": {
+        "xbu=CMD": "execute CMD before a file upload starts",
+        "xau=CMD": "execute CMD after  a file upload finishes",
+        "xiu=CMD": "execute CMD after  all uploads finish and volume is idle",
+        "xbr=CMD": "execute CMD before a file rename/move",
+        "xar=CMD": "execute CMD after  a file rename/move",
+        "xbd=CMD": "execute CMD before a file delete",
+        "xad=CMD": "execute CMD after  a file delete",
+        "xm=CMD": "execute CMD on message",
+    },
+    "client and ux": {
+        "html_head=TXT": "includes TXT in the <head>",
+        "robots": "allows indexing by search engines (default)",
+        "norobots": "kindly asks search engines to leave",
+        "no_sb_md": "disable js sandbox for markdown files",
+        "no_sb_lg": "disable js sandbox for prologue/epilogue",
+        "sb_md": "enable js sandbox for markdown files (default)",
+        "sb_lg": "enable js sandbox for prologue/epilogue (default)",
+        "md_sbf": "list of markdown-sandbox safeguards to disable",
+        "lg_sbf": "list of *logue-sandbox safeguards to disable",
+    },
+    "others": {
+        "fk=8": 'generates per-file accesskeys,\nwhich will then be required at the "g" permission'
+    },
+}
+
+
+flagdescs = {k.split("=")[0]: v for tab in flagcats.values() for k, v in tab.items()}
--- a/copyparty/ftpd.py
+++ b/copyparty/ftpd.py
@@ -13,9 +13,21 @@ from pyftpdlib.filesystems import AbstractedFS, FilesystemError
 from pyftpdlib.handlers import FTPHandler
 from pyftpdlib.servers import FTPServer

-from .__init__ import PY2, TYPE_CHECKING, E
+from .__init__ import ANYWIN, PY2, TYPE_CHECKING, E
 from .bos import bos
-from .util import Daemon, Pebkac, exclude_dotfiles, fsenc, ipnorm
+from .authsrv import VFS
+from .util import (
+    Daemon,
+    Pebkac,
+    exclude_dotfiles,
+    fsenc,
+    ipnorm,
+    pybin,
+    relchk,
+    runhook,
+    sanitize_fn,
+    vjoin,
+)

 try:
    from pyftpdlib.ioloop import IOLoop
@@ -115,6 +127,9 @@ class FtpFs(AbstractedFS):
        self.listdirinfo = self.listdir
        self.chdir(".")

+    def die(self, msg):
+        self.h.die(msg)
+
    def v2a(
        self,
        vpath: str,
@@ -122,16 +137,23 @@ class FtpFs(AbstractedFS):
        w: bool = False,
        m: bool = False,
        d: bool = False,
-    ) -> str:
+    ) -> tuple[str, VFS, str]:
        try:
            vpath = vpath.replace("\\", "/").lstrip("/")
+            rd, fn = os.path.split(vpath)
+            if ANYWIN and relchk(rd):
+                logging.warning("malicious vpath: %s", vpath)
+                self.die("Unsupported characters in filepath")
+
+            fn = sanitize_fn(fn or "", "", [".prologue.html", ".epilogue.html"])
+            vpath = vjoin(rd, fn)
            vfs, rem = self.hub.asrv.vfs.get(vpath, self.uname, r, w, m, d)
            if not vfs.realpath:
-                raise FilesystemError("no filesystem mounted at this path")
+                self.die("No filesystem mounted at this path")

-            return os.path.join(vfs.realpath, rem)
+            return os.path.join(vfs.realpath, rem), vfs, rem
        except Pebkac as ex:
-            raise FilesystemError(str(ex))
+            self.die(str(ex))

    def rv2a(
        self,
@@ -140,7 +162,7 @@ class FtpFs(AbstractedFS):
        w: bool = False,
        m: bool = False,
        d: bool = False,
-    ) -> str:
+    ) -> tuple[str, VFS, str]:
        return self.v2a(os.path.join(self.cwd, vpath), r, w, m, d)

    def ftp2fs(self, ftppath: str) -> str:
@@ -154,7 +176,7 @@ class FtpFs(AbstractedFS):
    def validpath(self, path: str) -> bool:
        if "/.hist/" in path:
            if "/up2k." in path or path.endswith("/dir.txt"):
-                raise FilesystemError("access to this file is forbidden")
+                self.die("Access to this file is forbidden")

        return True

@@ -162,7 +184,7 @@ class FtpFs(AbstractedFS):
        r = "r" in mode
        w = "w" in mode or "a" in mode or "+" in mode

-        ap = self.rv2a(filename, r, w)
+        ap = self.rv2a(filename, r, w)[0]
        if w:
            try:
                st = bos.stat(ap)
@@ -171,7 +193,7 @@ class FtpFs(AbstractedFS):
                td = 0

            if td < -1 or td > self.args.ftp_wt:
-                raise FilesystemError("cannot open existing file for writing")
+                self.die("Cannot open existing file for writing")

        self.validpath(ap)
        return open(fsenc(ap), mode)
@@ -182,7 +204,7 @@ class FtpFs(AbstractedFS):
        ap = vfs.canonical(rem)
        if not bos.path.isdir(ap):
            # returning 550 is library-default and suitable
-            raise FilesystemError("Failed to change directory")
+            self.die("Failed to change directory")

        self.cwd = nwd
        (
@@ -195,8 +217,8 @@ class FtpFs(AbstractedFS):
        ) = self.hub.asrv.vfs.can_access(self.cwd.lstrip("/"), self.h.username)

    def mkdir(self, path: str) -> None:
-        ap = self.rv2a(path, w=True)
-        bos.mkdir(ap)
+        ap = self.rv2a(path, w=True)[0]
+        bos.makedirs(ap)  # filezilla expects this

    def listdir(self, path: str) -> list[str]:
        vpath = join(self.cwd, path).lstrip("/")
@@ -227,43 +249,42 @@ class FtpFs(AbstractedFS):
            return list(sorted(list(r.keys())))

    def rmdir(self, path: str) -> None:
-        ap = self.rv2a(path, d=True)
+        ap = self.rv2a(path, d=True)[0]
        bos.rmdir(ap)

    def remove(self, path: str) -> None:
        if self.args.no_del:
-            raise FilesystemError("the delete feature is disabled in server config")
+            self.die("The delete feature is disabled in server config")

        vp = join(self.cwd, path).lstrip("/")
        try:
-            self.hub.up2k.handle_rm(self.uname, self.h.remote_ip, [vp], [])
+            self.hub.up2k.handle_rm(self.uname, self.h.cli_ip, [vp], [])
        except Exception as ex:
-            raise FilesystemError(str(ex))
+            self.die(str(ex))

    def rename(self, src: str, dst: str) -> None:
        if not self.can_move:
-            raise FilesystemError("not allowed for user " + self.h.username)
+            self.die("Not allowed for user " + self.h.username)

        if self.args.no_mv:
-            t = "the rename/move feature is disabled in server config"
-            raise FilesystemError(t)
+            self.die("The rename/move feature is disabled in server config")

        svp = join(self.cwd, src).lstrip("/")
        dvp = join(self.cwd, dst).lstrip("/")
        try:
            self.hub.up2k.handle_mv(self.uname, svp, dvp)
        except Exception as ex:
-            raise FilesystemError(str(ex))
+            self.die(str(ex))

    def chmod(self, path: str, mode: str) -> None:
        pass

    def stat(self, path: str) -> os.stat_result:
        try:
-            ap = self.rv2a(path, r=True)
+            ap = self.rv2a(path, r=True)[0]
            return bos.stat(ap)
        except:
-            ap = self.rv2a(path)
+            ap = self.rv2a(path)[0]
            st = bos.stat(ap)
            if not stat.S_ISDIR(st.st_mode):
                raise
@@ -271,11 +292,11 @@ class FtpFs(AbstractedFS):
            return st

    def utime(self, path: str, timeval: float) -> None:
-        ap = self.rv2a(path, w=True)
+        ap = self.rv2a(path, w=True)[0]
        return bos.utime(ap, (timeval, timeval))

    def lstat(self, path: str) -> os.stat_result:
-        ap = self.rv2a(path)
+        ap = self.rv2a(path)[0]
        return bos.stat(ap)

    def isfile(self, path: str) -> bool:
@@ -286,7 +307,7 @@ class FtpFs(AbstractedFS):
            return False  # expected for mojibake in ftp_SIZE()

    def islink(self, path: str) -> bool:
-        ap = self.rv2a(path)
+        ap = self.rv2a(path)[0]
        return bos.path.islink(ap)

    def isdir(self, path: str) -> bool:
@@ -297,18 +318,18 @@ class FtpFs(AbstractedFS):
            return True

    def getsize(self, path: str) -> int:
-        ap = self.rv2a(path)
+        ap = self.rv2a(path)[0]
        return bos.path.getsize(ap)

    def getmtime(self, path: str) -> float:
-        ap = self.rv2a(path)
+        ap = self.rv2a(path)[0]
        return bos.path.getmtime(ap)

    def realpath(self, path: str) -> str:
        return path

    def lexists(self, path: str) -> bool:
-        ap = self.rv2a(path)
+        ap = self.rv2a(path)[0]
        return bos.path.lexists(ap)

    def get_user_by_uid(self, uid: int) -> str:
@@ -332,17 +353,40 @@ class FtpHandler(FTPHandler):
        else:
            super(FtpHandler, self).__init__(conn, server, ioloop)

+        cip = self.remote_ip
+        self.cli_ip = cip[7:] if cip.startswith("::ffff:") else cip
+
        # abspath->vpath mapping to resolve log_transfer paths
        self.vfs_map: dict[str, str] = {}

        # reduce non-debug logging
        self.log_cmds_list = [x for x in self.log_cmds_list if x not in ("CWD", "XCWD")]

+    def die(self, msg):
+        self.respond("550 {}".format(msg))
+        raise FilesystemError(msg)
+
    def ftp_STOR(self, file: str, mode: str = "w") -> Any:
        # Optional[str]
        vp = join(self.fs.cwd, file).lstrip("/")
-        ap = self.fs.v2a(vp)
+        ap, vfs, rem = self.fs.v2a(vp)
        self.vfs_map[ap] = vp
+        xbu = vfs.flags.get("xbu")
+        if xbu and not runhook(
+            None,
+            xbu,
+            ap,
+            vfs.canonical(rem),
+            "",
+            self.username,
+            0,
+            0,
+            self.cli_ip,
+            0,
+            "",
+        ):
+            self.die("Upload blocked by xbu server config")
+
        # print("ftp_STOR: {} {} => {}".format(vp, mode, ap))
        ret = FTPHandler.ftp_STOR(self, file, mode)
        # print("ftp_STOR: {} {} OK".format(vp, mode))
@@ -367,11 +411,13 @@ class FtpHandler(FTPHandler):
            vfs, rem = vfs.get_dbv(rem)
            self.hub.up2k.hash_file(
                vfs.realpath,
+                vfs.vpath,
                vfs.flags,
                rem,
                fn,
-                self.remote_ip,
+                self.cli_ip,
                time.time(),
+                self.username,
            )

        return FTPHandler.log_transfer(
@@ -402,7 +448,7 @@ class Ftpd(object):
                h1 = SftpHandler
            except:
                t = "\nftps requires pyopenssl;\nplease run the following:\n\n  {} -m pip install --user pyopenssl\n"
-                print(t.format(sys.executable))
+                print(t.format(pybin))
                sys.exit(1)

            h1.certfile = os.path.join(self.args.E.cfg, "cert.pem")
@@ -435,10 +481,18 @@ class Ftpd(object):
        lgr = logging.getLogger("pyftpdlib")
        lgr.setLevel(logging.DEBUG if self.args.ftpv else logging.INFO)

+        ips = self.args.i
+        if "::" in ips:
+            ips.append("0.0.0.0")
+
        ioloop = IOLoop()
-        for ip in self.args.i:
+        for ip in ips:
            for h, lp in hs:
-                FTPServer((ip, int(lp)), h, ioloop)
+                try:
+                    FTPServer((ip, int(lp)), h, ioloop)
+                except:
+                    if ip != "0.0.0.0" or "::" not in ips:
+                        raise

        Daemon(ioloop.loop, "ftp")

--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -10,6 +10,7 @@ import gzip
 import itertools
 import json
 import os
+import random
 import re
 import stat
 import string
@@ -28,6 +29,7 @@ except:
    pass

 from .__init__ import ANYWIN, PY2, TYPE_CHECKING, EnvParams, unicode
+from .__version__ import S_VERSION
 from .authsrv import VFS  # typechk
 from .bos import bos
 from .star import StreamTar
@@ -51,12 +53,14 @@ from .util import (
    guess_mime,
    gzip_orig_sz,
    hashcopy,
+    hidedir,
    html_bescape,
    html_escape,
    humansize,
    ipnorm,
    min_ex,
    quotep,
+    rand_name,
    read_header,
    read_socket,
    read_socket_chunked,
@@ -64,7 +68,6 @@ from .util import (
    relchk,
    ren_open,
    runhook,
-    hidedir,
    s3enc,
    sanitize_fn,
    sendfile_kern,
@@ -341,6 +344,8 @@ class HttpCli(object):

        if self.args.rsp_slp:
            time.sleep(self.args.rsp_slp)
+            if self.args.rsp_jtr:
+                time.sleep(random.random() * self.args.rsp_jtr)

        zso = self.headers.get("cookie")
        if zso:
@@ -782,8 +787,8 @@ class HttpCli(object):
            if "hc" in self.uparam:
                return self.tx_svcs()

-            if "h" in self.uparam:
-                return self.tx_mounts()
+        if "h" in self.uparam:
+            return self.tx_mounts()

        # conditional redirect to single volumes
        if self.vpath == "" and not self.ouparam:
@@ -1057,11 +1062,14 @@ class HttpCli(object):
        lk = parse_xml(txt)
        assert lk.tag == "{DAV:}lockinfo"

-        if not lk.find(r"./{DAV:}depth"):
-            lk.append(mktnod("D:depth", "infinity"))
+        token = str(uuid.uuid4())

-        lk.append(mkenod("D:timeout", mktnod("D:href", "Second-3310")))
-        lk.append(mkenod("D:locktoken", mktnod("D:href", uuid.uuid4().urn)))
+        if not lk.find(r"./{DAV:}depth"):
+            depth = self.headers.get("depth", "infinity")
+            lk.append(mktnod("D:depth", depth))
+
+        lk.append(mktnod("D:timeout", "Second-3310"))
+        lk.append(mkenod("D:locktoken", mktnod("D:href", token)))
        lk.append(
            mkenod("D:lockroot", mktnod("D:href", quotep(self.args.SRS + self.vpath)))
        )
@@ -1074,11 +1082,13 @@ class HttpCli(object):
        ret = '<?xml version="1.0" encoding="{}"?>\n'.format(uenc)
        ret += ET.tostring(xroot).decode("utf-8")

+        rc = 200
        if self.can_write and not bos.path.isfile(abspath):
            with open(fsenc(abspath), "wb") as _:
-                pass
+                rc = 201

-        self.reply(ret.encode(enc, "replace"), 200, "text/xml; charset=" + enc)
+        self.out_headers["Lock-Token"] = "<{}>".format(token)
+        self.reply(ret.encode(enc, "replace"), rc, "text/xml; charset=" + enc)
        return True

    def handle_unlock(self) -> bool:
@@ -1262,9 +1272,10 @@ class HttpCli(object):
                                    self.vpath,
                                    self.host,
                                    self.uname,
-                                    self.ip,
                                    time.time(),
                                    len(xm),
+                                    self.ip,
+                                    time.time(),
                                    plain,
                                )

@@ -1388,30 +1399,14 @@ class HttpCli(object):
        params.update(open_ka)
        assert fn

-        if rnd and not self.args.nw:
-            fn = self.rand_name(fdir, fn, rnd)
+        if not self.args.nw:
+            if rnd:
+                fn = rand_name(fdir, fn, rnd)
+
+            fn = sanitize_fn(fn or "", "", [".prologue.html", ".epilogue.html"])

        path = os.path.join(fdir, fn)

-        if is_put and not self.args.no_dav:
-            # allow overwrite if...
-            #  * volflag 'daw' is set
-            #  * and account has delete-access
-            # or...
-            #  * file exists and is empty
-            #  * and there is no .PARTIAL
-
-            tnam = fn + ".PARTIAL"
-            if self.args.dotpart:
-                tnam = "." + tnam
-
-            if (vfs.flags.get("daw") and self.can_delete) or (
-                not bos.path.exists(os.path.join(fdir, tnam))
-                and bos.path.exists(path)
-                and not bos.path.getsize(path)
-            ):
-                params["overwrite"] = "a"
-
        if xbu:
            at = time.time() - lifetime
            if not runhook(
@@ -1421,15 +1416,37 @@ class HttpCli(object):
                self.vpath,
                self.host,
                self.uname,
-                self.ip,
                at,
                remains,
+                self.ip,
+                at,
                "",
            ):
-                t = "upload denied by xbu"
+                t = "upload blocked by xbu server config"
                self.log(t, 1)
                raise Pebkac(403, t)

+        if is_put and not (self.args.no_dav or self.args.nw):
+            # allow overwrite if...
+            #  * volflag 'daw' is set
+            #  * and account has delete-access
+            # or...
+            #  * file exists, is empty, sufficiently new
+            #  * and there is no .PARTIAL
+
+            tnam = fn + ".PARTIAL"
+            if self.args.dotpart:
+                tnam = "." + tnam
+
+            if (vfs.flags.get("daw") and self.can_delete) or (
+                not bos.path.exists(os.path.join(fdir, tnam))
+                and bos.path.exists(path)
+                and not bos.path.getsize(path)
+                and bos.path.getmtime(path) >= time.time() - self.args.blank_wt
+            ):
+                # small toctou, but better than clobbering a hardlink
+                bos.unlink(path)
+
        with ren_open(fn, *open_a, **params) as zfw:
            f, fn = zfw["orz"]
            path = os.path.join(fdir, fn)
@@ -1456,7 +1473,7 @@ class HttpCli(object):

            if ext:
                if rnd:
-                    fn2 = self.rand_name(fdir, "a." + ext, rnd)
+                    fn2 = rand_name(fdir, "a." + ext, rnd)
                else:
                    fn2 = fn.rsplit(".", 1)[0] + "." + ext

@@ -1477,12 +1494,13 @@ class HttpCli(object):
            self.vpath,
            self.host,
            self.uname,
-            self.ip,
            at,
            post_sz,
+            self.ip,
+            at,
            "",
        ):
-            t = "upload denied by xau"
+            t = "upload blocked by xau server config"
            self.log(t, 1)
            os.unlink(path)
            raise Pebkac(403, t)
@@ -1491,11 +1509,14 @@ class HttpCli(object):
        self.conn.hsrv.broker.say(
            "up2k.hash_file",
            vfs.realpath,
+            vfs.vpath,
            vfs.flags,
            rem,
            fn,
            self.ip,
            at,
+            self.uname,
+            True,
        )

        vsuf = ""
@@ -1568,27 +1589,6 @@ class HttpCli(object):
        else:
            self.log("bakflip ok", 2)

-    def rand_name(self, fdir: str, fn: str, rnd: int) -> str:
-        ok = False
-        try:
-            ext = "." + fn.rsplit(".", 1)[1]
-        except:
-            ext = ""
-
-        for extra in range(16):
-            for _ in range(16):
-                if ok:
-                    break
-
-                nc = rnd + extra
-                nb = int((6 + 6 * nc) / 8)
-                zb = os.urandom(nb)
-                zb = base64.urlsafe_b64encode(zb)
-                fn = zb[:nc].decode("utf-8") + ext
-                ok = not bos.path.exists(os.path.join(fdir, fn))
-
-        return fn
-
    def _spd(self, nbytes: int, add: bool = True) -> str:
        if add:
            self.conn.nbyte += nbytes
@@ -1714,7 +1714,7 @@ class HttpCli(object):
            except:
                raise Pebkac(500, min_ex())

-        x = self.conn.hsrv.broker.ask("up2k.handle_json", body)
+        x = self.conn.hsrv.broker.ask("up2k.handle_json", body, self.u2fh.aps)
        ret = x.get()
        if self.is_vproxied:
            if "purl" in ret:
@@ -1884,17 +1884,10 @@ class HttpCli(object):
            with self.mutex:
                self.u2fh.close(path)

-        # windows cant rename open files
-        if ANYWIN and path != fin_path and not self.args.nw:
-            self.conn.hsrv.broker.ask("up2k.finish_upload", ptop, wark).get()
-
-        if not ANYWIN and not num_left:
-            times = (int(time.time()), int(lastmod))
-            self.log("no more chunks, setting times {}".format(times))
-            try:
-                bos.utime(fin_path, times)
-            except:
-                self.log("failed to utime ({}, {})".format(fin_path, times))
+        if not num_left and not self.args.nw:
+            self.conn.hsrv.broker.ask(
+                "up2k.finish_upload", ptop, wark, self.u2fh.aps
+            ).get()

        cinf = self.headers.get("x-up2k-stat", "")

@@ -2017,8 +2010,13 @@ class HttpCli(object):
        return True

    def upload_flags(self, vfs: VFS) -> tuple[int, bool, int, list[str], list[str]]:
-        srnd = self.uparam.get("rand", self.headers.get("rand", ""))
-        rnd = int(srnd) if srnd and not self.args.nw else 0
+        if self.args.nw:
+            rnd = 0
+        else:
+            rnd = int(self.uparam.get("rand") or self.headers.get("rand") or 0)
+            if vfs.flags.get("rand"):  # force-enable
+                rnd = max(rnd, vfs.flags["nrand"])
+
        ac = self.uparam.get(
            "want", self.headers.get("accept", "").lower().split(";")[-1]
        )
@@ -2073,7 +2071,7 @@ class HttpCli(object):
                )
                if p_file and not nullwrite:
                    if rnd:
-                        fname = self.rand_name(fdir, fname, rnd)
+                        fname = rand_name(fdir, fname, rnd)

                    if not bos.path.isdir(fdir):
                        raise Pebkac(404, "that folder does not exist")
@@ -2104,12 +2102,13 @@ class HttpCli(object):
                        self.vpath,
                        self.host,
                        self.uname,
-                        self.ip,
                        at,
                        0,
+                        self.ip,
+                        at,
                        "",
                    ):
-                        t = "upload denied by xbu"
+                        t = "upload blocked by xbu server config"
                        self.log(t, 1)
                        raise Pebkac(403, t)

@@ -2163,12 +2162,13 @@ class HttpCli(object):
                        self.vpath,
                        self.host,
                        self.uname,
-                        self.ip,
                        at,
                        sz,
+                        self.ip,
+                        at,
                        "",
                    ):
-                        t = "upload denied by xau"
+                        t = "upload blocked by xau server config"
                        self.log(t, 1)
                        os.unlink(abspath)
                        raise Pebkac(403, t)
@@ -2177,11 +2177,14 @@ class HttpCli(object):
                    self.conn.hsrv.broker.say(
                        "up2k.hash_file",
                        dbv.realpath,
+                        vfs.vpath,
                        dbv.flags,
                        vrem,
                        fname,
                        self.ip,
                        at,
+                        self.uname,
+                        True,
                    )
                    self.conn.nbyte += sz

@@ -2300,7 +2303,7 @@ class HttpCli(object):
            raise Pebkac(400, "could not read lastmod from request")

        nullwrite = self.args.nw
-        vfs, rem = self.asrv.vfs.get(self.vpath, self.uname, False, True)
+        vfs, rem = self.asrv.vfs.get(self.vpath, self.uname, True, True)
        self._assert_safe_rem(rem)

        clen = int(self.headers.get("content-length", -1))
@@ -2382,6 +2385,9 @@ class HttpCli(object):
        if p_field != "body":
            raise Pebkac(400, "expected body, got {}".format(p_field))

+        if bos.path.exists(fp):
+            bos.unlink(fp)
+
        with open(fsenc(fp), "wb", 512 * 1024) as f:
            sz, sha512, _ = hashcopy(p_data, f, self.args.s_wr_slp)

@@ -2835,7 +2841,7 @@ class HttpCli(object):
            }

        fmt = self.uparam.get("ls", "")
-        if not fmt and self.ua.startswith("curl/"):
+        if not fmt and (self.ua.startswith("curl/") or self.ua.startswith("fetch")):
            fmt = "v"

        if fmt in ["v", "t", "txt"]:
@@ -2878,6 +2884,8 @@ class HttpCli(object):
            dbwt=vs["dbwt"],
            url_suf=suf,
            k304=self.k304(),
+            ver=S_VERSION if self.args.ver else "",
+            ahttps="" if self.is_https else "https://" + self.host + self.req,
        )
        self.reply(html.encode("utf-8"))
        return True
@@ -2927,7 +2935,7 @@ class HttpCli(object):

        vn, _ = self.asrv.vfs.get(self.vpath, self.uname, True, True)

-        args = [self.asrv.vfs.all_vols, [vn.vpath], False]
+        args = [self.asrv.vfs.all_vols, [vn.vpath], False, True]

        x = self.conn.hsrv.broker.ask("up2k.rescan", *args)
        err = x.get()
@@ -3330,7 +3338,7 @@ class HttpCli(object):
        is_ls = "ls" in self.uparam
        is_js = self.args.force_js or self.cookies.get("js") == "y"

-        if not is_ls and self.ua.startswith("curl/"):
+        if not is_ls and (self.ua.startswith("curl/") or self.ua.startswith("fetch")):
            self.uparam["ls"] = "v"
            is_ls = True

@@ -3351,7 +3359,7 @@ class HttpCli(object):
        if not self.args.no_readme and not logues[1]:
            for fn in ["README.md", "readme.md"]:
                fn = os.path.join(abspath, fn)
-                if bos.path.exists(fn):
+                if bos.path.isfile(fn):
                    with open(fsenc(fn), "rb") as f:
                        readme = f.read().decode("utf-8")
                        break
@@ -3366,6 +3374,7 @@ class HttpCli(object):
            "idx": ("e2d" in vn.flags),
            "itag": ("e2t" in vn.flags),
            "lifetime": vn.flags.get("lifetime") or 0,
+            "frand": bool(vn.flags.get("rand")),
            "perms": perms,
            "logues": logues,
            "readme": readme,
@@ -3378,6 +3387,7 @@ class HttpCli(object):
            "acct": self.uname,
            "perms": json.dumps(perms),
            "lifetime": ls_ret["lifetime"],
+            "frand": bool(vn.flags.get("rand")),
            "taglist": [],
            "def_hcols": [],
            "have_emp": self.args.emp,
@@ -3491,7 +3501,9 @@ class HttpCli(object):
                if self.args.no_zip:
                    margin = "DIR"
                else:
-                    margin = '<a href="{}?zip">zip</a>'.format(quotep(href))
+                    margin = '<a href="{}?zip" rel="nofollow">zip</a>'.format(
+                        quotep(href)
+                    )
            elif fn in hist:
                margin = '<a href="{}.hist/{}">#{}</a>'.format(
                    base, html_escape(hist[fn][2], quot=True, crlf=True), hist[fn][0]
--- a/copyparty/httpsrv.py
+++ b/copyparty/httpsrv.py
@@ -11,9 +11,19 @@ import time

 import queue

+from .__init__ import ANYWIN, EXE, MACOS, TYPE_CHECKING, EnvParams
+
+try:
+    MNFE = ModuleNotFoundError
+except:
+    MNFE = ImportError
+
 try:
    import jinja2
-except ImportError:
+except MNFE:
+    if EXE:
+        raise
+
    print(
        """\033[1;31m
  you do not have jinja2 installed,\033[33m
@@ -28,7 +38,6 @@ except ImportError:
    )
    sys.exit(1)

-from .__init__ import ANYWIN, MACOS, TYPE_CHECKING, EnvParams
 from .bos import bos
 from .httpconn import HttpConn
 from .util import (
--- a/copyparty/mdns.py
+++ b/copyparty/mdns.py
@@ -11,6 +11,7 @@ from ipaddress import IPv4Network, IPv6Network
 from .__init__ import TYPE_CHECKING
 from .__init__ import unicode as U
 from .multicast import MC_Sck, MCast
+from .stolen.dnslib import AAAA
 from .stolen.dnslib import CLASS as DC
 from .stolen.dnslib import (
    NSEC,
@@ -20,7 +21,6 @@ from .stolen.dnslib import (
    SRV,
    TXT,
    A,
-    AAAA,
    DNSHeader,
    DNSQuestion,
    DNSRecord,
--- a/copyparty/mtag.py
+++ b/copyparty/mtag.py
@@ -8,9 +8,19 @@ import shutil
 import subprocess as sp
 import sys

-from .__init__ import PY2, WINDOWS, E, unicode
+from .__init__ import EXE, PY2, WINDOWS, E, unicode
 from .bos import bos
-from .util import REKOBO_LKEY, fsenc, min_ex, retchk, runcmd, uncyg
+from .util import (
+    FFMPEG_URL,
+    REKOBO_LKEY,
+    fsenc,
+    min_ex,
+    pybin,
+    retchk,
+    runcmd,
+    sfsenc,
+    uncyg,
+)

 if True:  # pylint: disable=using-constant-test
    from typing import Any, Union
@@ -259,7 +269,9 @@ class MTag(object):
        self.args = args
        self.usable = True
        self.prefer_mt = not args.no_mtag_ff
-        self.backend = "ffprobe" if args.no_mutagen else "mutagen"
+        self.backend = (
+            "ffprobe" if args.no_mutagen or (HAVE_FFPROBE and EXE) else "mutagen"
+        )
        self.can_ffprobe = HAVE_FFPROBE and not args.no_mtag_ff
        mappings = args.mtm
        or_ffprobe = " or FFprobe"
@@ -285,9 +297,14 @@ class MTag(object):
                self.log(msg, c=3)

        if not self.usable:
+            if EXE:
+                t = "copyparty.exe cannot use mutagen; need ffprobe.exe to read media tags: "
+                self.log(t + FFMPEG_URL)
+                return
+
            msg = "need Mutagen{} to read media tags so please run this:\n{}{} -m pip install --user mutagen\n"
-            pybin = os.path.basename(sys.executable)
-            self.log(msg.format(or_ffprobe, " " * 37, pybin), c=1)
+            pyname = os.path.basename(pybin)
+            self.log(msg.format(or_ffprobe, " " * 37, pyname), c=1)
            return

        # https://picard-docs.musicbrainz.org/downloads/MusicBrainz_Picard_Tag_Map.html
@@ -456,7 +473,10 @@ class MTag(object):
                    self.log("mutagen: {}\033[0m".format(" ".join(zl)), "90")
            if not md.info.length and not md.info.codec:
                raise Exception()
-        except:
+        except Exception as ex:
+            if self.args.mtag_v:
+                self.log("mutagen-err [{}] @ [{}]".format(ex, abspath), "90")
+
            return self.get_ffprobe(abspath) if self.can_ffprobe else {}

        sz = bos.path.getsize(abspath)
@@ -519,12 +539,15 @@ class MTag(object):

        env = os.environ.copy()
        try:
+            if EXE:
+                raise Exception()
+
            pypath = os.path.abspath(os.path.dirname(os.path.dirname(__file__)))
            zsl = [str(pypath)] + [str(x) for x in sys.path if x]
            pypath = str(os.pathsep.join(zsl))
            env["PYTHONPATH"] = pypath
        except:
-            if not E.ox:
+            if not E.ox and not EXE:
                raise

        ret: dict[str, Any] = {}
@@ -532,7 +555,7 @@ class MTag(object):
            try:
                cmd = [parser.bin, abspath]
                if parser.bin.endswith(".py"):
-                    cmd = [sys.executable] + cmd
+                    cmd = [pybin] + cmd

                args = {
                    "env": env,
@@ -551,7 +574,7 @@ class MTag(object):
                else:
                    cmd = ["nice"] + cmd

-                bcmd = [fsenc(x) for x in cmd]
+                bcmd = [sfsenc(x) for x in cmd[:-1]] + [fsenc(cmd[-1])]
                rc, v, err = runcmd(bcmd, **args)  # type: ignore
                retchk(rc, bcmd, err, self.log, 5, self.args.mtag_v)
                v = v.strip()
--- a/copyparty/smbd.py
+++ b/copyparty/smbd.py
@@ -9,13 +9,13 @@ import sys
 import time
 from types import SimpleNamespace

-from .__init__ import ANYWIN, TYPE_CHECKING
+from .__init__ import ANYWIN, EXE, TYPE_CHECKING
 from .authsrv import LEELOO_DALLAS, VFS
 from .bos import bos
-from .util import Daemon, min_ex
+from .util import Daemon, min_ex, pybin, runhook

 if True:  # pylint: disable=using-constant-test
-    from typing import Any
+    from typing import Any, Union

 if TYPE_CHECKING:
    from .svchub import SvcHub
@@ -42,8 +42,12 @@ class SMB(object):
            from impacket import smbserver
            from impacket.ntlm import compute_lmhash, compute_nthash
        except ImportError:
+            if EXE:
+                print("copyparty.exe cannot do SMB")
+                sys.exit(1)
+
            m = "\033[36m\n{}\033[31m\n\nERROR: need 'impacket'; please run this command:\033[33m\n {} -m pip install --user impacket\n\033[0m"
-            print(m.format(min_ex(), sys.executable))
+            print(m.format(min_ex(), pybin))
            sys.exit(1)

        # patch vfs into smbserver.os
@@ -109,6 +113,9 @@ class SMB(object):
        self.stop = srv.stop
        self.log("smb", "listening @ {}:{}".format(ip, port))

+    def nlog(self, msg: str, c: Union[int, str] = 0) -> None:
+        self.log("smb", msg, c)
+
    def start(self) -> None:
        Daemon(self.srv.start)

@@ -165,8 +172,15 @@ class SMB(object):
            yeet("blocked write (no --smbw): " + vpath)

        vfs, ap = self._v2a("open", vpath, *a)
-        if wr and not vfs.axs.uwrite:
-            yeet("blocked write (no-write-acc): " + vpath)
+        if wr:
+            if not vfs.axs.uwrite:
+                yeet("blocked write (no-write-acc): " + vpath)
+
+            xbu = vfs.flags.get("xbu")
+            if xbu and not runhook(
+                self.nlog, xbu, ap, vpath, "", "", 0, 0, "1.7.6.2", 0, ""
+            ):
+                yeet("blocked by xbu server config: " + vpath)

        ret = bos.open(ap, flags, *a, mode=chmod, **ka)
        if wr:
@@ -194,11 +208,13 @@ class SMB(object):
        vfs, rem = vfs.get_dbv(rem)
        self.hub.up2k.hash_file(
            vfs.realpath,
+            vfs.vpath,
            vfs.flags,
            rem,
            fn,
            "1.7.6.2",
            time.time(),
+            "",
        )

    def _rename(self, vp1: str, vp2: str) -> None:
--- a/copyparty/ssdp.py
+++ b/copyparty/ssdp.py
@@ -8,7 +8,7 @@ from email.utils import formatdate

 from .__init__ import TYPE_CHECKING
 from .multicast import MC_Sck, MCast
-from .util import CachedSet, min_ex, html_escape
+from .util import CachedSet, html_escape, min_ex

 if TYPE_CHECKING:
    from .broker_util import BrokerCli
--- a/copyparty/svchub.py
+++ b/copyparty/svchub.py
@@ -28,13 +28,14 @@ if True:  # pylint: disable=using-constant-test
    import typing
    from typing import Any, Optional, Union

-from .__init__ import ANYWIN, MACOS, TYPE_CHECKING, VT100, EnvParams, unicode
+from .__init__ import ANYWIN, EXE, MACOS, TYPE_CHECKING, VT100, EnvParams, unicode
 from .authsrv import AuthSrv
 from .mtag import HAVE_FFMPEG, HAVE_FFPROBE
 from .tcpsrv import TcpSrv
 from .th_srv import HAVE_PIL, HAVE_VIPS, HAVE_WEBP, ThumbSrv
 from .up2k import Up2k
 from .util import (
+    FFMPEG_URL,
    VERSIONS,
    Daemon,
    Garda,
@@ -44,6 +45,7 @@ from .util import (
    ansi_re,
    min_ex,
    mp,
+    pybin,
    start_log_thrs,
    start_stackmon,
 )
@@ -67,8 +69,15 @@ class SvcHub(object):
    put() can return a queue (if want_reply=True) which has a blocking get() with the response.
    """

-    def __init__(self, args: argparse.Namespace, argv: list[str], printed: str) -> None:
+    def __init__(
+        self,
+        args: argparse.Namespace,
+        dargs: argparse.Namespace,
+        argv: list[str],
+        printed: str,
+    ) -> None:
        self.args = args
+        self.dargs = dargs
        self.argv = argv
        self.E: EnvParams = args.E
        self.logf: Optional[typing.TextIO] = None
@@ -140,12 +149,9 @@ class SvcHub(object):
            self.log("root", t.format(args.j))

        if not args.no_fpool and args.j != 1:
-            t = "WARNING: --use-fpool combined with multithreading is untested and can probably cause undefined behavior"
-            if ANYWIN:
-                t = 'windows cannot do multithreading without --no-fpool, so enabling that -- note that upload performance will suffer if you have microsoft defender "real-time protection" enabled, so you probably want to use -j 1 instead'
-                args.no_fpool = True
-
-            self.log("root", t, c=3)
+            t = "WARNING: ignoring --use-fpool because multithreading (-j{}) is enabled"
+            self.log("root", t.format(args.j), c=3)
+            args.no_fpool = True

        bri = "zy"[args.theme % 2 :][:1]
        ch = "abcdefghijklmnopqrstuvwx"[int(args.theme / 2)]
@@ -155,7 +161,14 @@ class SvcHub(object):
            args.log_fk = re.compile(args.log_fk)

        # initiate all services to manage
-        self.asrv = AuthSrv(self.args, self.log)
+        self.asrv = AuthSrv(self.args, self.log, dargs=self.dargs)
+
+        if args.cgen:
+            self.asrv.cgen()
+
+        if args.exit == "cfg":
+            sys.exit(0)
+
        if args.ls:
            self.asrv.dbg_ls()

@@ -180,6 +193,7 @@ class SvcHub(object):

        self.args.th_dec = list(decs.keys())
        self.thumbsrv = None
+        want_ff = False
        if not args.no_thumb:
            t = ", ".join(self.args.th_dec) or "(None available)"
            self.log("thumb", "decoder preference: {}".format(t))
@@ -191,8 +205,12 @@ class SvcHub(object):
            if self.args.th_dec:
                self.thumbsrv = ThumbSrv(self)
            else:
+                want_ff = True
                msg = "need either Pillow, pyvips, or FFmpeg to create thumbnails; for example:\n{0}{1} -m pip install --user Pillow\n{0}{1} -m pip install --user pyvips\n{0}apt install ffmpeg"
-                msg = msg.format(" " * 37, os.path.basename(sys.executable))
+                msg = msg.format(" " * 37, os.path.basename(pybin))
+                if EXE:
+                    msg = "copyparty.exe cannot use Pillow or pyvips; need ffprobe.exe and ffmpeg.exe to create thumbnails"
+
                self.log("thumb", msg, c=3)

        if not args.no_acode and args.no_thumb:
@@ -204,6 +222,10 @@ class SvcHub(object):
            msg = "setting --no-acode because either FFmpeg or FFprobe is not available"
            self.log("thumb", msg, c=6)
            args.no_acode = True
+            want_ff = True
+
+        if want_ff and ANYWIN:
+            self.log("thumb", "download FFmpeg to fix it:\033[0m " + FFMPEG_URL, 3)

        args.th_poke = min(args.th_poke, args.th_maxage, args.ac_maxage)

@@ -323,6 +345,9 @@ class SvcHub(object):
        al.RS = R + "/" if R else ""
        al.SRS = "/" + R + "/" if R else "/"

+        if al.rsp_jtr:
+            al.rsp_slp = 0.000001
+
        return True

    def _setlimits(self) -> None:
@@ -399,7 +424,7 @@ class SvcHub(object):

            lh = codecs.open(fn, "w", encoding="utf-8", errors="replace")

-        argv = [sys.executable] + self.argv
+        argv = [pybin] + self.argv
        if hasattr(shlex, "quote"):
            argv = [shlex.quote(x) for x in argv]
        else:
--- a/copyparty/szip.py
+++ b/copyparty/szip.py
@@ -2,8 +2,8 @@
 from __future__ import print_function, unicode_literals

 import calendar
-import time
 import stat
+import time
 import zlib

 from .bos import bos
--- a/copyparty/th_srv.py
+++ b/copyparty/th_srv.py
@@ -12,14 +12,16 @@ import time

 from queue import Queue

-from .__init__ import TYPE_CHECKING
+from .__init__ import ANYWIN, TYPE_CHECKING
 from .bos import bos
 from .mtag import HAVE_FFMPEG, HAVE_FFPROBE, ffprobe
 from .util import (
    BytesIO,
    Cooldown,
    Daemon,
+    FFMPEG_URL,
    Pebkac,
+    afsenc,
    fsenc,
    min_ex,
    runcmd,
@@ -82,14 +84,14 @@ def thumb_path(histpath: str, rem: str, mtime: float, fmt: str) -> str:
    # base64 = 64 = 4096
    rd, fn = vsplit(rem)
    if rd:
-        h = hashlib.sha512(fsenc(rd)).digest()
+        h = hashlib.sha512(afsenc(rd)).digest()
        b64 = base64.urlsafe_b64encode(h).decode("ascii")[:24]
        rd = "{}/{}/".format(b64[:2], b64[2:4]).lower() + b64
    else:
        rd = "top"

    # could keep original filenames but this is safer re pathlen
-    h = hashlib.sha512(fsenc(fn)).digest()
+    h = hashlib.sha512(afsenc(fn)).digest()
    fn = base64.urlsafe_b64encode(h).decode("ascii")[:24]

    if fmt in ("opus", "caf"):
@@ -133,6 +135,8 @@ class ThumbSrv(object):
            msg = "cannot create audio/video thumbnails because some of the required programs are not available: "
            msg += ", ".join(missing)
            self.log(msg, c=3)
+            if ANYWIN and self.args.no_acode:
+                self.log("download FFmpeg to fix it:\033[0m " + FFMPEG_URL, 3)

        if self.args.th_clean:
            Daemon(self.cleaner, "thumb.cln")
@@ -196,12 +200,12 @@ class ThumbSrv(object):
                self.log("wait {}".format(tpath))
            except:
                thdir = os.path.dirname(tpath)
-                bos.makedirs(thdir)
+                bos.makedirs(os.path.join(thdir, "w"))

                inf_path = os.path.join(thdir, "dir.txt")
                if not bos.path.exists(inf_path):
                    with open(inf_path, "wb") as f:
-                        f.write(fsenc(os.path.dirname(abspath)))
+                        f.write(afsenc(os.path.dirname(abspath)))

                self.busy[tpath] = [cond]
                do_conv = True
@@ -268,9 +272,12 @@ class ThumbSrv(object):
            if not png_ok and tpath.endswith(".png"):
                raise Pebkac(400, "png only allowed for waveforms")

+            tdir, tfn = os.path.split(tpath)
+            ttpath = os.path.join(tdir, "w", tfn)
+
            for fun in funs:
                try:
-                    fun(abspath, tpath)
+                    fun(abspath, ttpath)
                    break
                except Exception as ex:
                    msg = "{} could not create thumbnail of {}\n{}"
@@ -279,15 +286,20 @@ class ThumbSrv(object):
                    self.log(msg, c)
                    if getattr(ex, "returncode", 0) != 321:
                        if fun == funs[-1]:
-                            with open(tpath, "wb") as _:
+                            with open(ttpath, "wb") as _:
                                pass
                    else:
                        # ffmpeg may spawn empty files on windows
                        try:
-                            os.unlink(tpath)
+                            os.unlink(ttpath)
                        except:
                            pass

+            try:
+                bos.rename(ttpath, tpath)
+            except:
+                pass
+
            with self.mutex:
                subs = self.busy[tpath]
                del self.busy[tpath]
--- a/copyparty/u2idx.py
+++ b/copyparty/u2idx.py
@@ -293,6 +293,7 @@ class U2idx(object):
        self.log("qs: {!r} {!r}".format(uq, uv))

        ret = []
+        seen_rps: set[str] = set()
        lim = min(lim, int(self.args.srch_hits))
        taglist = {}
        for (vtop, ptop, flags) in vols:
@@ -311,6 +312,7 @@ class U2idx(object):

            sret = []
            fk = flags.get("fk")
+            dots = flags.get("dotsrch")
            c = cur.execute(uq, tuple(vuv))
            for hit in c:
                w, ts, sz, rd, fn, ip, at = hit[:7]
@@ -321,6 +323,13 @@ class U2idx(object):
                if rd.startswith("//") or fn.startswith("//"):
                    rd, fn = s3dec(rd, fn)

+                rp = quotep("/".join([x for x in [vtop, rd, fn] if x]))
+                if not dots and "/." in ("/" + rp):
+                    continue
+
+                if rp in seen_rps:
+                    continue
+
                if not fk:
                    suf = ""
                else:
@@ -337,8 +346,8 @@ class U2idx(object):
                        )[:fk]
                    )

-                rp = quotep("/".join([x for x in [vtop, rd, fn] if x])) + suf
-                sret.append({"ts": int(ts), "sz": sz, "rp": rp, "w": w[:16]})
+                seen_rps.add(rp)
+                sret.append({"ts": int(ts), "sz": sz, "rp": rp + suf, "w": w[:16]})

            for hit in sret:
                w = hit["w"]
@@ -357,14 +366,6 @@ class U2idx(object):
        done_flag.append(True)
        self.active_id = ""

-        # undupe hits from multiple metadata keys
-        if len(ret) > 1:
-            ret = [ret[0]] + [
-                y
-                for x, y in zip(ret[:-1], ret[1:])
-                if x["rp"].split("?")[0] != y["rp"].split("?")[0]
-            ]
-
        ret.sort(key=itemgetter("rp"))

        return ret, list(taglist.keys())
--- a/copyparty/up2k.py
+++ b/copyparty/up2k.py
--- a/copyparty/util.py
+++ b/copyparty/util.py
@@ -14,6 +14,7 @@ import os
 import platform
 import re
 import select
+import shutil
 import signal
 import socket
 import stat
@@ -30,7 +31,7 @@ from email.utils import formatdate
 from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network
 from queue import Queue

-from .__init__ import ANYWIN, MACOS, PY2, TYPE_CHECKING, VT100, WINDOWS
+from .__init__ import ANYWIN, EXE, MACOS, PY2, TYPE_CHECKING, VT100, WINDOWS
 from .__version__ import S_BUILD_DT, S_VERSION
 from .stolen import surrogateescape

@@ -143,6 +144,8 @@ SYMTIME = sys.version_info > (3, 6) and os.utime in os.supports_follow_symlinks

 META_NOBOTS = '<meta name="robots" content="noindex, nofollow">'

+FFMPEG_URL = "https://www.gyan.dev/ffmpeg/builds/ffmpeg-git-full.7z"
+
 HTTPCODE = {
    200: "OK",
    201: "Created",
@@ -290,6 +293,19 @@ REKOBO_KEY = {
 REKOBO_LKEY = {k.lower(): v for k, v in REKOBO_KEY.items()}


+pybin = sys.executable or ""
+if EXE:
+    pybin = ""
+    for p in "python3 python".split():
+        try:
+            p = shutil.which(p)
+            if p:
+                pybin = p
+                break
+        except:
+            pass
+
+
 def py_desc() -> str:
    interp = platform.python_implementation()
    py_ver = ".".join([str(x) for x in sys.version_info])
@@ -652,6 +668,7 @@ class FHC(object):

    def __init__(self) -> None:
        self.cache: dict[str, FHC.CE] = {}
+        self.aps: set[str] = set()

    def close(self, path: str) -> None:
        try:
@@ -663,6 +680,7 @@ class FHC(object):
            fh.close()

        del self.cache[path]
+        self.aps.remove(path)

    def clean(self) -> None:
        if not self.cache:
@@ -683,6 +701,7 @@ class FHC(object):
        return self.cache[path].fhs.pop()

    def put(self, path: str, fh: typing.BinaryIO) -> None:
+        self.aps.add(path)
        try:
            ce = self.cache[path]
            ce.fhs.append(fh)
@@ -1153,20 +1172,12 @@ def ren_open(
    fun = kwargs.pop("fun", open)
    fdir = kwargs.pop("fdir", None)
    suffix = kwargs.pop("suffix", None)
-    overwrite = kwargs.pop("overwrite", None)

    if fname == os.devnull:
        with fun(fname, *args, **kwargs) as f:
            yield {"orz": (f, fname)}
            return

-    if overwrite:
-        assert fdir
-        fpath = os.path.join(fdir, fname)
-        with fun(fsenc(fpath), *args, **kwargs) as f:
-            yield {"orz": (f, fname)}
-            return
-
    if suffix:
        ext = fname.split(".")[-1]
        if len(ext) < 7:
@@ -1513,6 +1524,28 @@ def read_header(sr: Unrecv) -> list[str]:
        return ret[:ofs].decode("utf-8", "surrogateescape").lstrip("\r\n").split("\r\n")


+def rand_name(fdir: str, fn: str, rnd: int) -> str:
+    ok = False
+    try:
+        ext = "." + fn.rsplit(".", 1)[1]
+    except:
+        ext = ""
+
+    for extra in range(16):
+        for _ in range(16):
+            if ok:
+                break
+
+            nc = rnd + extra
+            nb = int((6 + 6 * nc) / 8)
+            zb = os.urandom(nb)
+            zb = base64.urlsafe_b64encode(zb)
+            fn = zb[:nc].decode("utf-8") + ext
+            ok = not os.path.exists(fsenc(os.path.join(fdir, fn)))
+
+    return fn
+
+
 def gen_filekey(salt: str, fspath: str, fsize: int, inode: int) -> str:
    return base64.urlsafe_b64encode(
        hashlib.sha512(
@@ -1690,7 +1723,7 @@ def relchk(rp: str) -> str:

 def absreal(fpath: str) -> str:
    try:
-        return fsdec(os.path.abspath(os.path.realpath(fsenc(fpath))))
+        return fsdec(os.path.abspath(os.path.realpath(afsenc(fpath))))
    except:
        if not WINDOWS:
            raise
@@ -1810,6 +1843,32 @@ def _w8enc3(txt: str) -> bytes:
    return txt.encode(FS_ENCODING, "surrogateescape")


+def _msdec(txt: bytes) -> str:
+    ret = txt.decode(FS_ENCODING, "surrogateescape")
+    return ret[4:] if ret.startswith("\\\\?\\") else ret
+
+
+def _msaenc(txt: str) -> bytes:
+    return txt.replace("/", "\\").encode(FS_ENCODING, "surrogateescape")
+
+
+def _uncify(txt: str) -> str:
+    txt = txt.replace("/", "\\")
+    if ":" not in txt and not txt.startswith("\\\\"):
+        txt = absreal(txt)
+
+    return txt if txt.startswith("\\\\") else "\\\\?\\" + txt
+
+
+def _msenc(txt: str) -> bytes:
+    txt = txt.replace("/", "\\")
+    if ":" not in txt and not txt.startswith("\\\\"):
+        txt = absreal(txt)
+
+    ret = txt.encode(FS_ENCODING, "surrogateescape")
+    return ret if ret.startswith(b"\\\\") else b"\\\\?\\" + ret
+
+
 w8dec = _w8dec3 if not PY2 else _w8dec2
 w8enc = _w8enc3 if not PY2 else _w8enc2

@@ -1824,9 +1883,16 @@ def w8b64enc(txt: str) -> str:
    return base64.urlsafe_b64encode(w8enc(txt)).decode("ascii")


-if not PY2 or not WINDOWS:
-    fsenc = w8enc
+if not PY2 and WINDOWS:
+    sfsenc = w8enc
+    afsenc = _msaenc
+    fsenc = _msenc
+    fsdec = _msdec
+    uncify = _uncify
+elif not PY2 or not WINDOWS:
+    fsenc = afsenc = sfsenc = w8enc
    fsdec = w8dec
+    uncify = str
 else:
    # moonrunes become \x3f with bytestrings,
    # losing mojibake support is worth
@@ -1836,8 +1902,9 @@ else:
    def _not_actually_mbcs_dec(txt: bytes) -> str:
        return txt

-    fsenc = _not_actually_mbcs_enc
+    fsenc = afsenc = sfsenc = _not_actually_mbcs_enc
    fsdec = _not_actually_mbcs_dec
+    uncify = str


 def s3enc(mem_cur: "sqlite3.Cursor", rd: str, fn: str) -> tuple[str, str]:
@@ -2214,18 +2281,21 @@ def rmdirs(
    return ok, ng


-def rmdirs_up(top: str) -> tuple[list[str], list[str]]:
+def rmdirs_up(top: str, stop: str) -> tuple[list[str], list[str]]:
    """rmdir on self, then all parents"""
+    if top == stop:
+        return [], [top]
+
    try:
        os.rmdir(fsenc(top))
    except:
        return [], [top]

    par = os.path.dirname(top)
-    if not par:
+    if not par or par == stop:
        return [top], []

-    ok, ng = rmdirs_up(par)
+    ok, ng = rmdirs_up(par, stop)
    return [top] + ok, ng


@@ -2459,23 +2529,14 @@ def retchk(
        raise Exception(t)


-def _runhook(
-    log: "NamedLogger",
-    cmd: str,
-    ap: str,
-    vp: str,
-    host: str,
-    uname: str,
-    ip: str,
-    at: float,
-    sz: int,
-    txt: str,
-) -> bool:
+def _parsehook(
+    log: Optional["NamedLogger"], cmd: str
+) -> tuple[bool, bool, bool, float, dict[str, Any], str]:
    chk = False
    fork = False
    jtxt = False
-    wait = 0
-    tout = 0
+    wait = 0.0
+    tout = 0.0
    kill = "t"
    cap = 0
    ocmd = cmd
@@ -2495,34 +2556,111 @@ def _runhook(
            cap = int(arg[1:])  # 0=none 1=stdout 2=stderr 3=both
        elif arg.startswith("k"):
            kill = arg[1:]  # [t]ree [m]ain [n]one
+        elif arg.startswith("i"):
+            pass
        else:
            t = "hook: invalid flag {} in {}"
-            log(t.format(arg, ocmd))
+            (log or print)(t.format(arg, ocmd))

    env = os.environ.copy()
-    # try:
-    pypath = os.path.abspath(os.path.dirname(os.path.dirname(__file__)))
-    zsl = [str(pypath)] + [str(x) for x in sys.path if x]
-    pypath = str(os.pathsep.join(zsl))
-    env["PYTHONPATH"] = pypath
-    # except: if not E.ox: raise
+    try:
+        if EXE:
+            raise Exception()

-    ka = {
+        pypath = os.path.abspath(os.path.dirname(os.path.dirname(__file__)))
+        zsl = [str(pypath)] + [str(x) for x in sys.path if x]
+        pypath = str(os.pathsep.join(zsl))
+        env["PYTHONPATH"] = pypath
+    except:
+        if not EXE:
+            raise
+
+    sp_ka = {
        "env": env,
        "timeout": tout,
        "kill": kill,
        "capture": cap,
    }

+    if cmd.startswith("~"):
+        cmd = os.path.expanduser(cmd)
+
+    return chk, fork, jtxt, wait, sp_ka, cmd
+
+
+def runihook(
+    log: Optional["NamedLogger"],
+    cmd: str,
+    vol: "VFS",
+    ups: list[tuple[str, int, int, str, str, str, int]],
+) -> bool:
+    ocmd = cmd
+    chk, fork, jtxt, wait, sp_ka, cmd = _parsehook(log, cmd)
+    bcmd = [sfsenc(cmd)]
+    if cmd.endswith(".py"):
+        bcmd = [sfsenc(pybin)] + bcmd
+
+    vps = [vjoin(*list(s3dec(x[3], x[4]))) for x in ups]
+    aps = [djoin(vol.realpath, x) for x in vps]
+    if jtxt:
+        # 0w 1mt 2sz 3rd 4fn 5ip 6at
+        ja = [
+            {
+                "ap": uncify(ap),  # utf8 for json
+                "vp": vp,
+                "wark": x[0][:16],
+                "mt": x[1],
+                "sz": x[2],
+                "ip": x[5],
+                "at": x[6],
+            }
+            for x, vp, ap in zip(ups, vps, aps)
+        ]
+        sp_ka["sin"] = json.dumps(ja).encode("utf-8", "replace")
+    else:
+        sp_ka["sin"] = b"\n".join(fsenc(x) for x in aps)
+
+    t0 = time.time()
+    if fork:
+        Daemon(runcmd, ocmd, [bcmd], ka=sp_ka)
+    else:
+        rc, v, err = runcmd(bcmd, **sp_ka)  # type: ignore
+        if chk and rc:
+            retchk(rc, bcmd, err, log, 5)
+            return False
+
+    wait -= time.time() - t0
+    if wait > 0:
+        time.sleep(wait)
+
+    return True
+
+
+def _runhook(
+    log: Optional["NamedLogger"],
+    cmd: str,
+    ap: str,
+    vp: str,
+    host: str,
+    uname: str,
+    mt: float,
+    sz: int,
+    ip: str,
+    at: float,
+    txt: str,
+) -> bool:
+    ocmd = cmd
+    chk, fork, jtxt, wait, sp_ka, cmd = _parsehook(log, cmd)
    if jtxt:
        ja = {
            "ap": ap,
            "vp": vp,
+            "mt": mt,
+            "sz": sz,
            "ip": ip,
+            "at": at or time.time(),
            "host": host,
            "user": uname,
-            "at": at or time.time(),
-            "sz": sz,
            "txt": txt,
        }
        arg = json.dumps(ja)
@@ -2531,15 +2669,15 @@ def _runhook(

    acmd = [cmd, arg]
    if cmd.endswith(".py"):
-        acmd = [sys.executable] + acmd
+        acmd = [pybin] + acmd

-    bcmd = [fsenc(x) for x in acmd]
+    bcmd = [fsenc(x) if x == ap else sfsenc(x) for x in acmd]

    t0 = time.time()
    if fork:
-        Daemon(runcmd, ocmd, [acmd], ka=ka)
+        Daemon(runcmd, ocmd, [bcmd], ka=sp_ka)
    else:
-        rc, v, err = runcmd(bcmd, **ka)  # type: ignore
+        rc, v, err = runcmd(bcmd, **sp_ka)  # type: ignore
        if chk and rc:
            retchk(rc, bcmd, err, log, 5)
            return False
@@ -2552,24 +2690,25 @@ def _runhook(


 def runhook(
-    log: "NamedLogger",
+    log: Optional["NamedLogger"],
    cmds: list[str],
    ap: str,
    vp: str,
    host: str,
    uname: str,
+    mt: float,
+    sz: int,
    ip: str,
    at: float,
-    sz: int,
    txt: str,
 ) -> bool:
    vp = vp.replace("\\", "/")
    for cmd in cmds:
        try:
-            if not _runhook(log, cmd, ap, vp, host, uname, ip, at, sz, txt):
+            if not _runhook(log, cmd, ap, vp, host, uname, mt, sz, ip, at, txt):
                return False
        except Exception as ex:
-            log("hook: {}".format(ex))
+            (log or print)("hook: {}".format(ex))
            if ",c," in "," + cmd:
                return False
            break
--- a/copyparty/web/browser.css
+++ b/copyparty/web/browser.css
@@ -798,17 +798,24 @@ html.y #path a:hover {
 .logue:empty {
 	display: none;
 }
+#doc>iframe,
 .logue>iframe {
 	background: var(--bgg);
-	border-radius: .3em;
+	border: 1px solid var(--bgg);
+	border-width: 0 .3em 0 .3em;
+	border-radius: .5em;
 	visibility: hidden;
-	border: none;
+	margin: 0 -.3em;
 	width: 100%;
 	height: 0;
 }
+#doc>iframe.focus,
 .logue>iframe.focus {
 	box-shadow: 0 0 .1em .1em var(--a);
 }
+#pro.logue>iframe {
+	height: 100vh;
+}
 #pro.logue {
 	margin-bottom: .8em;
 }
@@ -833,8 +840,9 @@ html.y #path a:hover {
 .mdo {
 	max-width: 52em;
 }
-.mdo.sb {
-	max-width: unset;
+.mdo.sb,
+#epi.logue.mdo>iframe {
+	max-width: 54em;
 }
 .mdo,
 .mdo * {
@@ -1313,6 +1321,10 @@ html.y #ops svg circle {
 	padding: .3em .6em;
 	white-space: nowrap;
 }
+#noie {
+	color: #b60;
+	margin: 0 0 0 .5em;
+}
 .opbox {
 	padding: .5em;
 	border-radius: 0 .3em .3em 0;
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -36,7 +36,7 @@
 			<input type="file" name="f" multiple /><br />
 			<input type="submit" value="start upload">
 		</form>
-		<a id="bbsw" href="?b=u"><br />switch to basic browser</a>
+		<a id="bbsw" href="?b=u" rel="nofollow"><br />switch to basic browser</a>
 	</div>

 	<div id="op_mkdir" class="opview opbox act">
@@ -121,7 +121,7 @@
 	
 	<div id="epi" class="logue">{{ "" if sb_lg else logues[1] }}</div>

-	<h2><a href="{{ r }}/?h" id="goh">control-panel</a></h2>
+	<h2 id="wfp"><a href="{{ r }}/?h" id="goh">control-panel</a></h2>
 	
 	<a href="#" id="repl">π</a>

@@ -135,6 +135,7 @@

 	<script>
 		var SR = {{ r|tojson }},
+			TS = "{{ ts }}",
 			acct = "{{ acct }}",
 			perms = {{ perms }},
 			themes = {{ themes }},
@@ -154,6 +155,7 @@
 			sb_lg = "{{ sb_lg }}",
 			lifetime = {{ lifetime }},
 			turbolvl = {{ turbolvl }},
+			frand = {{ frand|tojson }},
 			u2sort = "{{ u2sort }}",
 			have_emp = {{ have_emp|tojson }},
 			txt_ext = "{{ txt_ext }}",
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -108,8 +108,9 @@ var Ls = {
 		"ot_msg": "msg: send a message to the server log",
 		"ot_mp": "media player options",
 		"ot_cfg": "configuration options",
-		"ot_u2i": 'up2k: upload files (if you have write-access) or toggle into the search-mode to see if they exist somewhere on the server$N$Nuploads are resumable, multithreaded, and file timestamps are preserved, but it uses more CPU than the basic uploader<br /><br />during uploads, this icon becomes a progress indicator!',
-		"ot_u2w": 'up2k: upload files with resume support (close your browser and drop the same files in later)$N$Nmultithreaded, and file timestamps are preserved, but it uses more CPU than the basic uploader<br /><br />during uploads, this icon becomes a progress indicator!',
+		"ot_u2i": 'up2k: upload files (if you have write-access) or toggle into the search-mode to see if they exist somewhere on the server$N$Nuploads are resumable, multithreaded, and file timestamps are preserved, but it uses more CPU than [🎈]&nbsp; (the basic uploader)<br /><br />during uploads, this icon becomes a progress indicator!',
+		"ot_u2w": 'up2k: upload files with resume support (close your browser and drop the same files in later)$N$Nmultithreaded, and file timestamps are preserved, but it uses more CPU than [🎈]&nbsp; (the basic uploader)<br /><br />during uploads, this icon becomes a progress indicator!',
+		"ot_noie": 'Please use Chrome / Firefox / Edge',

 		"ab_mkdir": "make directory",
 		"ab_mkdoc": "new markdown doc",
@@ -134,6 +135,7 @@ var Ls = {
 		"wt_next": "next track$NHotkey: L",

 		"ul_par": "parallel uploads:",
+		"ut_rand": "randomize filenames",
 		"ut_mt": "continue hashing other files while uploading$N$Nmaybe disable if your CPU or HDD is a bottleneck",
 		"ut_ask": "ask for confirmation before upload starts",
 		"ut_pot": "improve upload speed on slow devices$Nby making the UI less complex",
@@ -158,6 +160,9 @@ var Ls = {
 		"uct_q": "idle, pending",

 		"utl_name": "filename",
+		"utl_ulist": "list",
+		"utl_ucopy": "copy",
+		"utl_links": "links",
 		"utl_stat": "status",
 		"utl_prog": "progress",

@@ -289,6 +294,7 @@ var Ls = {

 		"fd_ok": "delete OK",
 		"fd_err": "delete failed:\n",
+		"fd_none": "nothing was deleted; maybe blocked by server config (xbd)?",
 		"fd_busy": "deleting {0} items...\n\n{1}",
 		"fd_warn1": "DELETE these {0} items?",
 		"fd_warn2": "<b>Last chance!</b> No way to undo. Delete?",
@@ -346,6 +352,7 @@ var Ls = {
 		"s_a1": "specific metadata properties",

 		"md_eshow": "cannot show ",
+		"md_off": "[📜<em>readme</em>] disabled in [⚙️] -- document hidden",

 		"xhr403": "403: Access denied\n\ntry pressing F5, maybe you got logged out",
 		"cf_ok": "sorry about that -- DD" + wah + "oS protection kicked in\n\nthings should resume in about 30 sec\n\nif nothing happens, hit F5 to reload the page",
@@ -366,7 +373,10 @@ var Ls = {
 		"fz_zipc": "cp437 with crc32 computed early,$Nfor MS-DOS PKZIP v2.04g (october 1993)$N(takes longer to process before download can start)",

 		"un_m1": "you can delete your recent uploads below",
-		"un_upd": "refresh list",
+		"un_upd": "refresh",
+		"un_m4": "or share the files visible below:",
+		"un_ulist": "show",
+		"un_ucopy": "copy",
 		"un_flt": "optional filter:&nbsp; URL must contain",
 		"un_fclr": "clear filter",
 		"un_derr": 'unpost-delete failed:\n',
@@ -442,7 +452,7 @@ var Ls = {
 		"ur_aun": "All {0} uploads failed, sorry",
 		"ur_1sn": "File was NOT found on server",
 		"ur_asn": "The {0} files were NOT found on server",
-		"ur_um": "Finished;\n{0} uplads OK,\n{1} uploads failed, sorry",
+		"ur_um": "Finished;\n{0} uploads OK,\n{1} uploads failed, sorry",
 		"ur_sm": "Finished;\n{0} files found on server,\n{1} files NOT found on server",

 		"lang_set": "refresh to make the change take effect?",
@@ -553,8 +563,9 @@ var Ls = {
 		"ot_msg": "msg: send en beskjed til serverloggen",
 		"ot_mp": "musikkspiller-instillinger",
 		"ot_cfg": "andre innstillinger",
-		"ot_u2i": 'up2k: last opp filer (hvis du har skrivetilgang) eller bytt til søkemodus for å sjekke om filene finnes et-eller-annet sted på serveren$N$Nopplastninger kan gjenopptas etter avbrudd, skjer stykkevis for potensielt høyere ytelse, og ivaretar datostempling -- men bruker litt mer prosessorkraft enn den primitive opplasteren bup<br /><br />mens opplastninger foregår så vises fremdriften her oppe!',
-		"ot_u2w": 'up2k: filopplastning med støtte for å gjenoppta avbrutte opplastninger -- steng ned nettleseren og dra de samme filene inn i nettleseren igjen for å plukke opp igjen der du slapp$N$Nopplastninger skjer stykkevis for potensielt høyere ytelse, og ivaretar datostempling -- men bruker litt mer prosessorkraft enn den primitive opplasteren "bup"<br /><br />mens opplastninger foregår så vises fremdriften her oppe!',
+		"ot_u2i": 'up2k: last opp filer (hvis du har skrivetilgang) eller bytt til søkemodus for å sjekke om filene finnes et-eller-annet sted på serveren$N$Nopplastninger kan gjenopptas etter avbrudd, skjer stykkevis for potensielt høyere ytelse, og ivaretar datostempling -- men bruker litt mer prosessorkraft enn [🎈]&nbsp; (den primitive opplasteren "bup")<br /><br />mens opplastninger foregår så vises fremdriften her oppe!',
+		"ot_u2w": 'up2k: filopplastning med støtte for å gjenoppta avbrutte opplastninger -- steng ned nettleseren og dra de samme filene inn i nettleseren igjen for å plukke opp igjen der du slapp$N$Nopplastninger skjer stykkevis for potensielt høyere ytelse, og ivaretar datostempling -- men bruker litt mer prosessorkraft enn [🎈]&nbsp; (den primitive opplasteren "bup")<br /><br />mens opplastninger foregår så vises fremdriften her oppe!',
+		"ot_noie": 'Fungerer mye bedre i Chrome / Firefox / Edge',

 		"ab_mkdir": "lag mappe",
 		"ab_mkdoc": "nytt dokument",
@@ -571,14 +582,15 @@ var Ls = {
 		"wt_selinv": "inverter utvalg",
 		"wt_selzip": "last ned de valgte filene som et arkiv",
 		"wt_seldl": "last ned de valgte filene$NSnarvei: Y",
-		"wt_npirc": "kopier sang-info (irc-formattert)",
-		"wt_nptxt": "kopier sang-info",
+		"wt_npirc": "kopiér sang-info (irc-formattert)",
+		"wt_nptxt": "kopiér sang-info",
 		"wt_grid": "bytt mellom ikoner og listevisning$NSnarvei: G",
 		"wt_prev": "forrige sang$NSnarvei: J",
 		"wt_play": "play / pause$NSnarvei: P",
 		"wt_next": "neste sang$NSnarvei: L",

 		"ul_par": "samtidige handl.:",
+		"ut_rand": "finn opp nye tilfeldige filnavn",
 		"ut_mt": "fortsett å befare køen mens opplastning foregår$N$Nskru denne av dersom du har en$Ntreg prosessor eller harddisk",
 		"ut_ask": "bekreft filutvalg før opplastning starter",
 		"ut_pot": "forbedre ytelsen på trege enheter ved å$Nforenkle brukergrensesnittet",
@@ -603,6 +615,9 @@ var Ls = {
 		"uct_q": "køen",

 		"utl_name": "filnavn",
+		"utl_ulist": "vis",
+		"utl_ucopy": "kopiér",
+		"utl_links": "lenker",
 		"utl_stat": "status",
 		"utl_prog": "fremdrift",

@@ -734,6 +749,7 @@ var Ls = {

 		"fd_ok": "sletting OK",
 		"fd_err": "sletting feilet:\n",
+		"fd_none": "ingenting ble slettet; kanskje avvist av serverkonfigurasjon (xbd)?",
 		"fd_busy": "sletter {0} filer...\n\n{1}",
 		"fd_warn1": "SLETT disse {0} filene?",
 		"fd_warn2": "<b>Siste sjanse!</b> Dette kan ikke angres. Slett?",
@@ -791,6 +807,7 @@ var Ls = {
 		"s_a1": "konkrete egenskaper",

 		"md_eshow": "kan ikke vise ",
+		"md_off": "[📜<em>readme</em>] er avskrudd i [⚙️] -- dokument skjult",

 		"xhr403": "403: Tilgang nektet\n\nkanskje du ble logget ut? prøv å trykk F5",
 		"cf_ok": "beklager -- liten tilfeldig kontroll, alt OK\n\nting skal fortsette om ca. 30 sekunder\n\nhvis ikkeno skjer, trykk F5 for å laste siden på nytt",
@@ -811,7 +828,10 @@ var Ls = {
 		"fz_zipc": "cp437 med tidlig crc32,$Nfor MS-DOS PKZIP v2.04g (oktober 1993)$N(øker behandlingstid på server)",

 		"un_m1": "nedenfor kan du angre / slette filer som du nylig har lastet opp",
-		"un_upd": "oppdater listen",
+		"un_upd": "oppdater",
+		"un_m4": "eller hvis du vil dele nedlastnings-lenkene:",
+		"un_ulist": "vis",
+		"un_ucopy": "kopiér",
 		"un_flt": "valgfritt filter:&nbsp; filnavn / filsti må inneholde",
 		"un_fclr": "nullstill filter",
 		"un_derr": 'unpost-sletting feilet:\n',
@@ -914,6 +934,7 @@ ebi('ops').innerHTML = (
 	'<a href="#" data-perm="write" data-dest="msg" tt="' + L.ot_msg + '">📟</a>' +
 	'<a href="#" data-dest="player" tt="' + L.ot_mp + '">🎺</a>' +
 	'<a href="#" data-dest="cfg" tt="' + L.ot_cfg + '">⚙️</a>' +
+	(IE ? '<span id="noie">' + L.ot_noie + '</span>' : '') +
 	'<div id="opdesc"></div>'
 );

@@ -963,8 +984,8 @@ ebi('op_up2k').innerHTML = (
 	'			<label for="potato" tt="' + L.ut_pot + '">🥔</label>\n' +
 	'		</td>\n' +
 	'		<td class="c" rowspan="2">\n' +
-	'			<input type="checkbox" id="ask_up" />\n' +
-	'			<label for="ask_up" tt="' + L.ut_ask + '">💭</label>\n' +
+	'			<input type="checkbox" id="u2rand" />\n' +
+	'			<label for="u2rand" tt="' + L.ut_rand + '">🎲</label>\n' +
 	'		</td>\n' +
 	'		<td class="c" data-perm="read" data-dep="idx" rowspan="2">\n' +
 	'			<input type="checkbox" id="fsearch" />\n' +
@@ -1012,7 +1033,7 @@ ebi('op_up2k').innerHTML = (
 	'<div id="u2tabw" class="na"><table id="u2tab">\n' +
 	'	<thead>\n' +
 	'		<tr>\n' +
-	'			<td>' + L.utl_name + '</td>\n' +
+	'			<td>' + L.utl_name + ' &nbsp;(<a href="#" id="luplinks">' + L.utl_ulist + '</a>/<a href="#" id="cuplinks">' + L.utl_ucopy + '</a>' + L.utl_links + ')</td>\n' +
 	'			<td>' + L.utl_stat + '</td>\n' +
 	'			<td>' + L.utl_prog + '</td>\n' +
 	'		</tr>\n' +
@@ -1073,6 +1094,7 @@ ebi('op_cfg').innerHTML = (
 	'<div>\n' +
 	'	<h3>' + L.cl_uopts + '</h3>\n' +
 	'	<div>\n' +
+	'		<a id="ask_up" class="tgl btn" href="#" tt="' + L.ut_ask + '">💭</a>\n' +
 	'		<a id="hashw" class="tgl btn" href="#" tt="' + L.cut_mt + '">mt</a>\n' +
 	'		<a id="u2turbo" class="tgl btn ttb" href="#" tt="' + L.cut_turbo + '">turbo</a>\n' +
 	'		<a id="u2tdate" class="tgl btn ttb" href="#" tt="' + L.cut_datechk + '">date-chk</a>\n' +
@@ -1200,6 +1222,17 @@ function goto(dest) {
 }


+var SBW, SBH;  // scrollbar size
+(function () {
+	var el = mknod('div');
+	el.style.cssText = 'overflow:scroll;width:100px;height:100px';
+	document.body.appendChild(el);
+	SBW = el.offsetWidth - el.clientWidth;
+	SBH = el.offsetHeight - el.clientHeight;
+	document.body.removeChild(el);
+})();
+
+
 var have_webp = sread('have_webp');
 (function () {
 	if (have_webp !== null)
@@ -1451,9 +1484,9 @@ try {
 catch (ex) { }


-var re_au_native = can_ogg ? /\.(opus|ogg|m4a|aac|mp3|wav|flac)$/i :
-	have_acode ? /\.(opus|m4a|aac|mp3|wav|flac)$/i : /\.(m4a|aac|mp3|wav|flac)$/i,
-	re_au_all = /\.(aac|m4a|ogg|opus|flac|alac|mp3|mp2|ac3|dts|wma|ra|wav|aif|aiff|au|alaw|ulaw|mulaw|amr|gsm|ape|tak|tta|wv|mpc)$/i;
+var re_au_native = can_ogg ? /\.(aac|flac|m4a|mp3|ogg|opus|wav)$/i :
+	have_acode ? /\.(aac|flac|m4a|mp3|opus|wav)$/i : /\.(aac|flac|m4a|mp3|wav)$/i,
+	re_au_all = /\.(aac|ac3|aif|aiff|alac|alaw|amr|ape|au|dfpwm|dts|flac|gsm|it|m4a|mo3|mod|mp2|mp3|mpc|mptm|mt2|mulaw|ogg|okt|opus|ra|s3m|tak|tta|ulaw|wav|wma|wv|xm|xpk)$/i;


 // extract songs + add play column
@@ -1697,29 +1730,9 @@ var widget = (function () {

 		m += '[' + cv + s2ms(mp.au.currentTime) + ck + '/' + cv + s2ms(mp.au.duration) + ck + ']';

-		var o = mknod('input');
-		o.style.cssText = 'position:fixed;top:45%;left:48%;padding:1em;z-index:9';
-		o.value = m;
-		document.body.appendChild(o);
-
-		var cln = function () {
-			o.value = 'copied to clipboard ';
-			setTimeout(function () {
-				document.body.removeChild(o);
-			}, 500);
-		};
-		var fb = function () {
-			console.log('fb');
-			o.focus();
-			o.select();
-			document.execCommand("copy");
-			cln();
-		};
-		try {
-			// https only
-			navigator.clipboard.writeText(m).then(cln, fb);
-		}
-		catch (ex) { fb(); }
+		cliptxt(m, function () {
+			toast.ok(1, 'copied to clipboard', null, 'top');
+		});
 	};
 	r.set(sread('au_open') == 1);
 	setTimeout(function () {
@@ -1785,6 +1798,9 @@ var pbar = (function () {
 		r.wurl = url;
 		var img = new Image();
 		img.onload = function () {
+			if (r.wurl != url)
+				return;
+
 			r.wimg = img;
 			r.onresize();
 		};
@@ -3412,12 +3428,14 @@ var fileman = (function () {
 		if (!sel.length)
 			return toast.err(3, L.fd_emore);

-		function deleter() {
+		function deleter(err) {
 			var xhr = new XHR(),
 				vp = vps.shift();

 			if (!vp) {
-				toast.ok(2, L.fd_ok);
+				if (err !== 'xbd')
+					toast.ok(2, L.fd_ok);
+
 				treectl.goto(get_evpath());
 				return;
 			}
@@ -3433,6 +3451,10 @@ var fileman = (function () {
 				toast.err(9, L.fd_err + msg);
 				return;
 			}
+			if (this.responseText.indexOf('deleted 0 files (and 0') + 1) {
+				toast.err(9, L.fd_none);
+				return deleter('xbd');
+			}
 			deleter();
 		}

@@ -4528,7 +4550,9 @@ document.onkeydown = function (e) {
 		return seek_au_rel(n) || true;

 	if (k == 'KeyY')
-		return msel.getsel().length ? ebi('seldl').click() : dl_song();
+		return msel.getsel().length ? ebi('seldl').click() :
+			showfile.active() ? ebi('dldoc').click() :
+				dl_song();

 	n = k == 'KeyI' ? -1 : k == 'KeyK' ? 1 : 0;
 	if (n !== 0)
@@ -5529,7 +5553,7 @@ var treectl = (function () {
 				have_up2k_idx = res.idx;
 				have_tags_idx = res.itag;
 				lifetime = res.lifetime;
-				apply_perms(res.perms);
+				apply_perms(res);
 				fileman.render();
 			}
 			if (sel.length)
@@ -5726,8 +5750,40 @@ function despin(sel) {
 }


-function apply_perms(newperms) {
-	perms = newperms || [];
+var wfp_debounce = (function () {
+	var r = { 'n': 0, 't': 0 };
+
+	r.hide = function () {
+		if (!sb_lg && !sb_md)
+			return;
+
+		if (++r.n <= 1) {
+			r.n = 1;
+			clearTimeout(r.t);
+			r.t = setTimeout(r.reset, 300);
+			ebi('wfp').style.opacity = 0.1;
+		}
+	};
+	r.show = function () {
+		if (!sb_lg && !sb_md)
+			return;
+
+		if (--r.n <= 0) {
+			r.n = 0;
+			clearTimeout(r.t);
+			ebi('wfp').style.opacity = 'unset';
+		}
+	};
+	r.reset = function () {
+		r.n = 0;
+		r.show();
+	};
+	return r;
+})();
+
+
+function apply_perms(res) {
+	perms = res.perms || [];

 	var a = QS('#ops a[data-dest="up2k"]');
 	if (have_up2k_idx) {
@@ -5760,7 +5816,7 @@ function apply_perms(newperms) {
 	ebi('acc_info').innerHTML = '<span id="srv_info2"><span>' + srvinf +
 		'</span></span><span' + aclass + axs + L.access + '</span>' + (acct != '*' ?
 			'<a href="' + SR + '/?pw=x">' + L.logout + acct + '</a>' :
-			'<a href="' + SR + '/?h">Login</a>');
+			'<a href="?h">Login</a>');

 	var o = QSA('#ops>a[data-perm]');
 	for (var a = 0; a < o.length; a++) {
@@ -5801,6 +5857,8 @@ function apply_perms(newperms) {
 			(have_write || tds[a].getAttribute('data-perm') == 'read') ?
 				'table-cell' : 'none';
 	}
+	if (res.frand)
+		ebi('u2rand').parentNode.style.display = 'none';

 	if (up2k)
 		up2k.set_fsearch();
@@ -6585,6 +6643,28 @@ var globalcss = (function () {
 	};
 })();

+var sandboxjs = (function () {
+	var ret = '',
+		busy = false,
+		url = SR + '/.cpr/util.js?_=' + TS,
+		tag = '<script src="' + url + '"></script>';
+
+	return function () {
+		if (ret || busy)
+			return ret || tag;
+
+		var xhr = new XHR();
+		xhr.open('GET', url, true);
+		xhr.onload = function () {
+			if (this.status == 200)
+				ret = '<script>' + this.responseText + '</script>';
+		};
+		xhr.send();
+		busy = true;
+		return tag;
+	};
+})();
+

 function show_md(md, name, div, url, depth) {
 	var errmsg = L.md_eshow + name + ':\n\n',
@@ -6594,10 +6674,12 @@ function show_md(md, name, div, url, depth) {
 	if (url != now)
 		return;

+	wfp_debounce.hide();
 	if (!marked) {
 		if (depth)
 			return toast.warn(10, errmsg + 'failed to load marked.js')

+		wfp_debounce.n--;
 		return import_js(SR + '/.cpr/deps/marked.js', function () {
 			show_md(md, name, div, url, 1);
 		});
@@ -6653,6 +6735,7 @@ function show_md(md, name, div, url, depth) {
 	catch (ex) {
 		toast.warn(10, errmsg + ex);
 	}
+	wfp_debounce.show();
 }


@@ -6665,7 +6748,7 @@ function set_tabindex() {

 function show_readme(md) {
 	if (!treectl.ireadme)
-		return;
+		return sandbox(ebi('epi'), '', '', 'a');

 	show_md(md, 'README.md', ebi('epi'));
 }
@@ -6674,16 +6757,24 @@ if (readme)


 function sandbox(tgt, rules, cls, html) {
+	if (!treectl.ireadme) {
+		tgt.innerHTML = html ? L.md_off : '';
+		return;
+	}
 	if (!rules || (html || '').indexOf('<') == -1) {
 		tgt.innerHTML = html;
 		clmod(tgt, 'sb');
 		return false;
 	}
 	clmod(tgt, 'sb', 1);
+
 	var tid = tgt.getAttribute('id'),
 		hash = location.hash,
 		want = '';

+	if (!cls)
+		wfp_debounce.hide();
+
 	if (hash.startsWith('#md-'))
 		want = hash.slice(1);

@@ -6696,9 +6787,8 @@ function sandbox(tgt, rules, cls, html) {

 	html = '<html class="iframe ' + document.documentElement.className + '"><head><style>' + globalcss() +
 		'</style><base target="_parent"></head><body id="b" class="logue ' + cls + '">' + html +
-		'<script>' + env + '</script>' +
-		'<script src="' + SR + '/.cpr/util.js?_={{ ts }}"></script>' +
-		'<script>var ebi=document.getElementById.bind(document),d=document.documentElement,' +
+		'<script>' + env + '</script>' + sandboxjs() +
+		'<script>var d=document.documentElement,' +
 		'loc=new URL("' + location.href.split('?')[0] + '");' +
 		'function say(m){window.parent.postMessage(m,"*")};' +
 		'setTimeout(function(){var its=0,pih=-1,f=function(){' +
@@ -6729,8 +6819,9 @@ window.addEventListener("message", function (e) {
 		var t = e.data.split(/ /g);
 		if (t[0] == 'iheight') {
 			var el = QS(t[1] + '>iframe');
-			el.style.height = t[2] + 'px';
+			el.style.height = (parseInt(t[2]) + SBH) + 'px';
 			el.style.visibility = 'unset';
+			wfp_debounce.show();
 		}
 		else if (t[0] == 'iscroll') {
 			var y1 = QS(t[1]).offsetTop,
@@ -6779,6 +6870,7 @@ function ev_row_tgl(e) {
 var unpost = (function () {
 	ebi('op_unpost').innerHTML = (
 		L.un_m1 + ' &ndash; <a id="unpost_refresh" href="#">' + L.un_upd + '</a>' +
+		'<p>' + L.un_m4 + ' <a id="unpost_ulist" href="#">' + L.un_ulist + '</a> / <a id="unpost_ucopy" href="#">' + L.un_ucopy + '</a>' +
 		'<p>' + L.un_flt + ' <input type="text" id="unpost_filt" size="20" placeholder="documents/passwords" /><a id="unpost_nofilt" href="#">' + L.un_fclr + '</a></p>' +
 		'<div id="unpost"></div>'
 	);
@@ -6844,6 +6936,16 @@ var unpost = (function () {
 		ct.innerHTML = "<p><em>" + L.un_m3 + "</em></p>";
 	};

+	function linklist() {
+		var ret = [],
+			base = document.location.origin.replace(/\/$/, '');
+
+		for (var a = 0; a < r.files.length; a++)
+			ret.push(base + r.files[a].vp);
+
+		return ret.join('\r\n');
+	}
+
 	function unpost_delete_cb() {
 		if (this.status !== 200) {
 			var msg = this.responseText;
@@ -6920,6 +7022,19 @@ var unpost = (function () {
 		goto('unpost');
 	};

+	ebi('unpost_ulist').onclick = function (e) {
+		ev(e);
+		modal.alert(linklist());
+	};
+
+	ebi('unpost_ucopy').onclick = function (e) {
+		ev(e);
+		var txt = linklist();
+		cliptxt(txt + '\n', function () {
+			toast.inf(5, txt.split('\n').length + ' links copied to clipboard');
+		});
+	};
+
 	return r;
 })();

--- a/copyparty/web/splash.css
+++ b/copyparty/web/splash.css
@@ -36,6 +36,11 @@ a {
 td a {
 	margin: 0;
 }
+#w {
+	color: #fff;
+	background: #940;
+	border-color: #b70;
+}
 .af,
 .logout {
 	float: right;
@@ -175,15 +180,19 @@ html.z a.g {
 	border-color: #af4;
 	box-shadow: 0 .3em 1em #7d0;
 }
-html.z input {
-	color: #fff;
-	background: #626;
-	border: 1px solid #c2c;
-	border-width: 1px 0 0 0;
+input {
+	color: #a50;
+	background: #fff;
+	border: 1px solid #a50;
 	border-radius: .5em;
 	padding: .5em .7em;
 	margin: 0 .5em 0 0;
 }
+html.z input {
+	color: #fff;
+	background: #626;
+	border-color: #c2c;
+}
 html.z .num {
 	border-color: #777;
 }
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -89,17 +89,20 @@
 		</ul>

 		<h1 id="l">login for more:</h1>
-		<ul>
+		<div>
 			<form method="post" enctype="multipart/form-data" action="{{ r }}/{{ qvpath }}">
 				<input type="hidden" name="act" value="login" />
 				<input type="password" name="cppwd" />
 				<input type="submit" value="Login" />
+				{% if ahttps %}
+				<a id="w" href="{{ ahttps }}">switch to https</a>
+				{% endif %}
 			</form>
-		</ul>
+		</div>
 	</div>
 	<a href="#" id="repl">π</a>
 	{%- if not this.args.nb %}
-	<span id="pb"><span>powered by</span> <a href="{{ this.args.pb_url }}">copyparty</a></span>
+	<span id="pb"><span>powered by</span> <a href="{{ this.args.pb_url }}">copyparty {{ver}}</a></span>
 	{%- endif %}
 	<script>

--- a/copyparty/web/splash.js
+++ b/copyparty/web/splash.js
@@ -25,7 +25,8 @@ var Ls = {
 		"t1": "handling",
 		"u2": "tid siden noen sist skrev til serveren$N( opplastning / navneendring / ... )$N$N17d = 17 dager$N1h23 = 1 time 23 minutter$N4m56 = 4 minuter 56 sekunder",
 		"v1": "koble til",
-		"v2": "bruk denne serveren som en lokal harddisk$N$NADVARSEL: kommer til å vise passordet ditt!"
+		"v2": "bruk denne serveren som en lokal harddisk$N$NADVARSEL: kommer til å vise passordet ditt!",
+		"w1": "bytt til https",
 	},
 	"eng": {
 		"d2": "shows the state of all active threads",
--- a/copyparty/web/svcs.html
+++ b/copyparty/web/svcs.html
@@ -64,6 +64,11 @@
                yum install davfs2
                {% if accs %}printf '%s\n' <b>{{ pw }}</b> k | {% endif %}mount -t davfs -ouid=1000 http{{ s }}://{{ ep }}/{{ rvp }} <b>mp</b>
            </pre>
+            <p>make it automount on boot:</p>
+            <pre>
+                printf '%s\n' "http{{ s }}://{{ ep }}/{{ rvp }} <b>{{ pw }}</b> k" >> /etc/davfs2/secrets
+                printf '%s\n' "http{{ s }}://{{ ep }}/{{ rvp }} <b>mp</b> davfs rw,user,uid=1000,noauto 0 0" >> /etc/fstab
+            </pre>
            <p>or you can use rclone instead, which is much slower but doesn't require root:</p>
            <pre>
                rclone config create {{ aname }}-dav webdav url=http{{ s }}://{{ rip }}{{ hport }} vendor=other{% if accs %} user=k pass=<b>{{ pw }}</b>{% endif %}
--- a/copyparty/web/ui.css
+++ b/copyparty/web/ui.css
@@ -42,6 +42,10 @@ html {
 	text-shadow: 1px 1px 0 #000;
 	color: #fff;
 }
+#toast.top {
+	top: 2em;
+	bottom: unset;
+}
 #toast a {
 	color: inherit;
 	text-shadow: inherit;
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -114,10 +114,10 @@ function up2k_flagbus() {
            do_take(now);
            return;
        }
-        if (flag.owner && now - flag.owner[1] > 5000) {
+        if (flag.owner && now - flag.owner[1] > 12000) {
            flag.owner = null;
        }
-        if (flag.wants && now - flag.wants[1] > 5000) {
+        if (flag.wants && now - flag.wants[1] > 12000) {
            flag.wants = null;
        }
        if (!flag.owner && !flag.wants) {
@@ -772,6 +772,7 @@ function fsearch_explain(n) {

 function up2k_init(subtle) {
    var r = {
+        "tact": Date.now(),
        "init_deps": init_deps,
        "set_fsearch": set_fsearch,
        "gotallfiles": [gotallfiles]  // hooks
@@ -856,6 +857,7 @@ function up2k_init(subtle) {
        fdom_ctr = 0,
        biggest_file = 0;

+    bcfg_bind(uc, 'rand', 'u2rand', false, null, false);
    bcfg_bind(uc, 'multitask', 'multitask', true, null, false);
    bcfg_bind(uc, 'potato', 'potato', false, set_potato, false);
    bcfg_bind(uc, 'ask_up', 'ask_up', true, null, false);
@@ -1363,6 +1365,10 @@ function up2k_init(subtle) {

            if (uc.fsearch)
                entry.srch = 1;
+            else if (uc.rand) {
+                entry.rand = true;
+                entry.name = 'a\n' + entry.name;
+            }

            if (biggest_file < entry.size)
                biggest_file = entry.size;
@@ -1398,7 +1404,7 @@ function up2k_init(subtle) {
        ebi('u2tabw').className = 'ye';

        setTimeout(function () {
-            if (!actx || actx.state != 'suspended' || toast.tag == L.u_unpt)
+            if (!actx || actx.state != 'suspended' || toast.visible)
                return;

            toast.warn(30, "<div onclick=\"start_actx();toast.inf(3,'thanks!')\">please click this text to<br />unlock full upload speed</div>");
@@ -1418,7 +1424,36 @@ function up2k_init(subtle) {
    }
    more_one_file();

-    var etaref = 0, etaskip = 0, utw_minh = 0, utw_read = 0;
+    function linklist() {
+        var ret = [],
+            base = document.location.origin.replace(/\/$/, '');
+
+        for (var a = 0; a < st.files.length; a++) {
+            var t = st.files[a],
+                url = t.purl + uricom_enc(t.name);
+
+            if (t.fk)
+                url += '?k=' + t.fk;
+
+            ret.push(base + url);
+        }
+        return ret.join('\r\n');
+    }
+
+    ebi('luplinks').onclick = function (e) {
+        ev(e);
+        modal.alert(linklist());
+    };
+
+    ebi('cuplinks').onclick = function (e) {
+        ev(e);
+        var txt = linklist();
+        cliptxt(txt + '\n', function () {
+            toast.inf(5, txt.split('\n').length + ' links copied to clipboard');
+        });
+    };
+
+    var etaref = 0, etaskip = 0, utw_minh = 0, utw_read = 0, utw_card = 0;
    function etafun() {
        var nhash = st.busy.head.length + st.busy.hash.length + st.todo.head.length + st.todo.hash.length,
            nsend = st.busy.upload.length + st.todo.upload.length,
@@ -1431,6 +1466,12 @@ function up2k_init(subtle) {

        //ebi('acc_info').innerHTML = humantime(st.time.busy) + ' ' + f2f(now / 1000, 1);

+        if (utw_card != pvis.act) {
+            utw_card = pvis.act;
+            utw_read = 9001;
+            ebi('u2tabw').style.minHeight = '0px';
+        }
+
        if (++utw_read >= 20) {
            utw_read = 0;
            utw_minh = parseInt(ebi('u2tabw').style.minHeight || '0');
@@ -1607,8 +1648,14 @@ function up2k_init(subtle) {
            running = true;
            while (true) {
                var now = Date.now(),
+                    blocktime = now - r.tact,
                    is_busy = st.car < st.files.length;

+                if (blocktime > 2500)
+                    console.log('main thread blocked for ' + blocktime);
+
+                r.tact = now;
+
                if (was_busy && !is_busy) {
                    for (var a = 0; a < st.files.length; a++) {
                        var t = st.files[a];
@@ -1748,6 +1795,15 @@ function up2k_init(subtle) {
    })();

    function uptoast() {
+        if (st.busy.handshake.length)
+            return;
+
+        for (var a = 0; a < st.files.length; a++) {
+            var t = st.files[a];
+            if (t.want_recheck && !t.rechecks)
+                return;
+        }
+
        var sr = uc.fsearch,
            ok = pvis.ctr.ok,
            ng = pvis.ctr.ng,
@@ -2003,6 +2059,8 @@ function up2k_init(subtle) {
            nbusy++;
            reading++;
            nchunk++;
+            if (Date.now() - up2k.tact > 1500)
+                tasker();
        }

        function onmsg(d) {
@@ -2213,13 +2271,24 @@ function up2k_init(subtle) {

                t.sprs = response.sprs;

-                var rsp_purl = url_enc(response.purl);
-                if (rsp_purl !== t.purl || response.name !== t.name) {
-                    // server renamed us (file exists / path restrictions)
-                    console.log("server-rename [" + t.purl + "] [" + t.name + "] to [" + rsp_purl + "] [" + response.name + "]");
+                var fk = response.fk,
+                    rsp_purl = url_enc(response.purl),
+                    rename = rsp_purl !== t.purl || response.name !== t.name;
+
+                if (rename || fk) {
+                    if (rename)
+                        console.log("server-rename [" + t.purl + "] [" + t.name + "] to [" + rsp_purl + "] [" + response.name + "]");
+
                    t.purl = rsp_purl;
                    t.name = response.name;
-                    pvis.seth(t.n, 0, linksplit(t.purl + uricom_enc(t.name)).join(' '));
+
+                    var url = t.purl + uricom_enc(t.name);
+                    if (fk) {
+                        t.fk = fk;
+                        url += '?k=' + fk;
+                    }
+
+                    pvis.seth(t.n, 0, linksplit(url).join(' '));
                }

                var chunksize = get_chunksize(t.size),
@@ -2322,16 +2391,17 @@ function up2k_init(subtle) {
                }

                var err_pend = rsp.indexOf('partial upload exists at a different') + 1,
+                    err_srcb = rsp.indexOf('source file busy; please try again') + 1,
                    err_plug = rsp.indexOf('upload blocked by x') + 1,
                    err_dupe = rsp.indexOf('upload rejected, file already exists') + 1;

-                if (err_pend || err_plug || err_dupe) {
+                if (err_pend || err_srcb || err_plug || err_dupe) {
                    err = rsp;
                    ofs = err.indexOf('\n/');
                    if (ofs !== -1) {
                        err = err.slice(0, ofs + 1) + linksplit(err.slice(ofs + 2).trimEnd()).join(' ');
                    }
-                    if (!t.rechecks && err_pend) {
+                    if (!t.rechecks && (err_pend || err_srcb)) {
                        t.rechecks = 0;
                        t.want_recheck = true;
                    }
@@ -2368,6 +2438,8 @@ function up2k_init(subtle) {
        };
        if (t.srch)
            req.srch = 1;
+        else if (t.rand)
+            req.rand = true;

        xhr.open('POST', t.purl, true);
        xhr.responseType = 'text';
@@ -2871,7 +2943,7 @@ ebi('ico1').onclick = function () {
 if (QS('#op_up2k.act'))
    goto_up2k();

-apply_perms(perms);
+apply_perms({ "perms": perms, "frand": frand });


 (function () {
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -17,6 +17,7 @@ var wah = '',
    MOBILE = TOUCH,
    CHROME = !!window.chrome,
    VCHROME = CHROME ? 1 : 0,
+    IE = /Trident\//.test(navigator.userAgent),
    FIREFOX = ('netscape' in window) && / rv:/.test(navigator.userAgent),
    IPHONE = TOUCH && /iPhone|iPad|iPod/i.test(navigator.userAgent),
    LINUX = /Linux/.test(navigator.userAgent),
@@ -111,12 +112,13 @@ if ((document.location + '').indexOf(',rej,') + 1)

 try {
    console.hist = [];
+    var CMAXHIST = 100;
    var hook = function (t) {
        var orig = console[t].bind(console),
            cfun = function () {
                console.hist.push(Date.now() + ' ' + t + ': ' + Array.from(arguments).join(', '));
-                if (console.hist.length > 100)
-                    console.hist = console.hist.slice(50);
+                if (console.hist.length > CMAXHIST)
+                    console.hist = console.hist.slice(CMAXHIST / 2);

                orig.apply(console, arguments);
            };
@@ -331,6 +333,25 @@ if (!String.prototype.format)
        });
    };

+try {
+    new URL('/a/', 'https://a.com/');
+}
+catch (ex) {
+    console.log('ie11 shim URL()');
+    window.URL = function (url, base) {
+        if (url.indexOf('//') < 0)
+            url = base + '/' + url.replace(/^\/?/, '');
+        else if (url.indexOf('//') == 0)
+            url = 'https:' + url;
+
+        var x = url.split('?');
+        return {
+            "pathname": '/' + x[0].split('://')[1].replace(/[^/]+\//, ''),
+            "search": x.length > 1 ? x[1] : ''
+        };
+    }
+}
+
 // https://stackoverflow.com/a/950146
 function import_js(url, cb) {
    var head = document.head || document.getElementsByTagName('head')[0];
@@ -978,6 +999,7 @@ function sethash(hv) {
    }
 }

+
 function dl_file(url) {
    console.log('DL [%s]', url);
    var o = mknod('a');
@@ -987,6 +1009,25 @@ function dl_file(url) {
 }


+function cliptxt(txt, ok) {
+    var fb = function () {
+        console.log('fb');
+        var o = mknod('input');
+        o.value = txt;
+        document.body.appendChild(o);
+        o.focus();
+        o.select();
+        document.execCommand("copy");
+        document.body.removeChild(o);
+        ok();
+    };
+    try {
+        navigator.clipboard.writeText(txt).then(ok, fb);
+    }
+    catch (ex) { fb(); }
+}
+
+
 var timer = (function () {
    var r = {};
    r.q = [];
@@ -1260,17 +1301,17 @@ var toast = (function () {
        r.tag = tag;
    };

-    r.ok = function (sec, txt, tag) {
-        r.show('ok', sec, txt, tag);
+    r.ok = function (sec, txt, tag, cls) {
+        r.show('ok ' + (cls || ''), sec, txt, tag);
    };
-    r.inf = function (sec, txt, tag) {
-        r.show('inf', sec, txt, tag);
+    r.inf = function (sec, txt, tag, cls) {
+        r.show('inf ' + (cls || ''), sec, txt, tag);
    };
-    r.warn = function (sec, txt, tag) {
-        r.show('warn', sec, txt, tag);
+    r.warn = function (sec, txt, tag, cls) {
+        r.show('warn ' + (cls || ''), sec, txt, tag);
    };
-    r.err = function (sec, txt, tag) {
-        r.show('err', sec, txt, tag);
+    r.err = function (sec, txt, tag, cls) {
+        r.show('err ' + (cls || ''), sec, txt, tag);
    };

    return r;
--- a/docs/README.md
+++ b/docs/README.md
@@ -13,15 +13,21 @@

 # other stuff

+## [`example.conf`](example.conf)
+* example config file for `-c`
+
+## [`versus.md`](versus.md)
+* similar software / alternatives (with pros/cons)
+
 ## [`changelog.md`](changelog.md)
 * occasionally grabbed from github release notes

+## [`devnotes.md`](devnotes.md)
+* technical stuff
+
 ## [`rclone.md`](rclone.md)
 * notes on using rclone as a fuse client/server

-## [`example.conf`](example.conf)
-* example config file for `-c`
-


 # junk
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,211 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0226-2030  `v1.6.6`  r 2 0 0
+
+two hundred releases wow
+* read-only demo server at https://a.ocv.me/pub/demo/
+* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)
+* currently fighting a ground fault so the demo server will be unreliable for a while
+
+## new features
+* more docker containers! now runs on x64, x32, aarch64, armhf, ppc64, s390x
+  * pls let me know if you actually run copyparty on an IBM mainframe 👍
+* new [event hook](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks) type `xiu` runs just once for all recent uploads
+  * example hook [xiu-sha.py](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/xiu-sha.py) generates sha512 checksum files
+* new arg `--rsp-jtr` simulates connection jitter
+* copyparty.exe integrity selftest
+* ux:
+  * return to previous page after logging in
+  * show a warning on the login page if you're not using https
+  * freebsd: detect `fetch` and return the [colorful sortable plaintext](https://user-images.githubusercontent.com/241032/215322619-ea5fd606-3654-40ad-94ee-2bc058647bb2.png) listing
+
+## bugfixes
+* permit replacing empty files only during a `--blank-wt` grace period
+* lifetimes: keep upload-time when a size/mtime change triggers a reindex
+* during cleanup after an unlink, never rmdir the entire volume
+* rescan button in the controlpanel required volumes to be e2ds
+* dupes could get indexed with the wrong mtime
+  * only affected the search index; the filesystem got the right one
+* ux: search results could include the same hit twice in case of overlapping volumes
+* ux: upload UI would remain expanded permanently after visiting a huge tab
+* ftp: return proper error messages when client does something illegal
+* ie11: support the back button
+
+## other changes
+* [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) replaces copyparty64.exe -- now built for 64-bit windows 10
+  * **on win10 it just works** -- on win8 it needs [vc redist 2015](https://www.microsoft.com/en-us/download/details.aspx?id=48145) -- no win7 support
+  * has the latest security patches, but sfx.py is still better for long-term use
+  * has pillow and mutagen; can make thumbnails and parse/index media
+* [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) is the old win7-compatible, dangerously-insecure edition
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0212-1411  `v1.6.5`  windows smb fix + win10.exe
+
+* read-only demo server at https://a.ocv.me/pub/demo/
+* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)
+
+## bugfixes
+* **windows-only:** smb locations (network drives) could not be accessed
+  * appeared in [v1.6.4](https://github.com/9001/copyparty/releases/tag/v1.6.4) while adding support for long filepaths (260chars+)
+
+## other changes
+* removed tentative support for compressed chiptunes (xmgz, xmz, xmj, ...) since FFmpeg usually doesn't
+
+----
+
+# introducing [copyparty640.exe](https://github.com/9001/copyparty/releases/download/v1.6.5/copyparty640.exe)
+* built for win10, comes with the latest python and deps (supports win8 with [vc redist 2015](https://www.microsoft.com/en-us/download/details.aspx?id=48145))
+* __*much* safer__ than the old win7-compatible `copyparty.exe` and `copyparty64.exe`
+  * but only `copyparty-sfx.py` takes advantage of the operating system security patches
+* includes pillow for thumbnails and mutagen for media indexing
+* around 10% slower (trying to figure out what's up with that)
+
+starting from the next release,
+* `copyparty.exe` (win7 x32) will become `copyparty32.exe`
+* `copyparty640.exe` (win10) will be the new `copyparty.exe`
+* `copyparty64.exe` (win7 x64) will graduate
+
+so the [copyparty64.exe](https://github.com/9001/copyparty/releases/download/v1.6.5/copyparty64.exe) in this release will be the "final" version able to run inside a [64bit Win7-era winPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png) (all regular 32/64-bit win7 editions can just use `copyparty32.exe` instead)
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0211-1802  `v1.6.4`  🔧🎲🔗🐳🇦🎶
+
+* read-only demo server at https://a.ocv.me/pub/demo/
+* [1.6 theme song](https://a.ocv.me/pub/demo/music/.bonus/#af-134e597c) // [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md)
+
+## new features
+* 🔧 new [config syntax](https://github.com/9001/copyparty/blob/hovudstraum/docs/example.conf) (#20)
+  * the new syntax is still kinda esoteric and funky but it's an improvement
+  * old config files are still supported
+    * `--vc` prints the autoconverted config which you can copy back into the config file to upgrade
+  * `--vc` will also [annotate and explain](https://user-images.githubusercontent.com/241032/217356028-eb3e141f-80a6-4bc6-8d04-d8d1d874c3e9.png) the config files
+  * new argument `--cgen` to generate config from commandline arguments
+    * kinda buggy, especially the `[global]` section, so give it a lookover before saving it
+* 🎲 randomize filenames on upload
+  * either optionally, using the 🎲 button in the up2k ui
+  * or force-enabled; globally with `--rand` or per-volume with volflag `rand`
+  * specify filename length with `nrand` (globally or volflag), default 9
+* 🔗 export a list of links to your recent uploads
+  * `copy links` in the up2k tab (🚀) will copy links to all uploads since last page refresh,
+  * `copy` in the unpost tab (🧯) will copy links to all your recent uploads (max 2000 files / 12 hours by default)
+  * filekeys are included if that's enabled and you have access to view those (permissions `G` or `r`)
+* 🇦 [arch package](https://github.com/9001/copyparty/tree/hovudstraum/contrib/package/arch) -- added in #18, thx @icxes 
+  * maybe in aur soon!
+* 🐳 [docker containers](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) -- 5 editions,
+  * [min](https://hub.docker.com/r/copyparty/min) (57 MiB), just copyparty without thumbnails or audio transcoding
+  * [im](https://hub.docker.com/r/copyparty/im) (70 MiB), thumbnails of popular image formats + media tags with mutagen
+  * [ac (163 MiB)](https://hub.docker.com/r/copyparty/ac) 🥇 adds audio/video thumbnails + audio transcoding + better tags
+  * [iv](https://hub.docker.com/r/copyparty/iv) (211 MiB), makes heif/avic/jxl faster to thumbnail
+  * [dj](https://hub.docker.com/r/copyparty/dj) (309 MiB), adds optional detection of musical key / bpm
+* 🎶 [chiptune player](https://a.ocv.me/pub/demo/music/chiptunes/#af-f6fb2e5f)
+  * transcodes mod/xm/s3m/it/mo3/mptm/mt2/okt to opus
+  * uses FFmpeg (libopenmpt) so the accuracy is not perfect, but most files play OK enough
+  * not **yet** supported in the docker container since Alpine's FFmpeg was built without libopenmpt
+* windows: support long filepaths (over 260 chars)
+  * uses the `//?/` winapi syntax to also support windows 7
+* `--ver` shows the server version on the control panel
+
+## bugfixes
+* markdown files didn't scale properly in the document browser
+* detect and refuse multiple volume definitions sharing the same filesystem path
+* don't return incomplete transcodes if multiple clients try to play the same flac file
+* [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh): more reliable chroot cleanup, sigusr1 for config reload
+* pypi packaging: compress web resources, include webdav.bat
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0131-2103  `v1.6.3`  sandbox k
+
+* read-only demo server at https://a.ocv.me/pub/demo/
+* and since [1.6.0](https://github.com/9001/copyparty/releases/tag/v1.6.2) only got 2 days of prime time,
+  * [1.6 theme song](https://a.ocv.me/pub/demo/music/.bonus/#af-134e597c) (hosted on the demo server)
+  * [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) / feature comparison
+
+## new features
+* dotfiles are hidden from search results by default
+  * use `--dotsrch` or volflags `dotsrch` / `nodotsrch` to specify otherwise
+  * they were already being excluded from tar/zip-files if `-ed` is not set, so this makes more sense -- dotfiles *should* now be undiscoverable unless `-ed` or `--smb` is set, but please use [volumes](https://github.com/9001/copyparty#accounts-and-volumes) for isolation / access-control instead, much safer
+
+## bugfixes
+* lots of cosmetic fixes for the new readme/prologue/epilogue sandbox
+  * rushed it into the previous release when someone suggested it, bad idea
+  * still flickers a bit (especially prologues), and hotkeys are blocked while the sandboxed document has focus
+  * can be disabled with `--no-sb-md --no-sb-lg` (not recommended)
+* support webdav uploads from davfs2 (fix LOCK response)
+* always unlink files before overwriting them, in case they are hardlinks
+  * was primarily an issue with `--daw` and webdav clients
+* on windows, replace characters in PUT filenames as necessary
+* [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh): support opus transcoding on debian
+  * `rm -rf .hist/ac` to clear the transcode cache if the old version broke some songs
+
+## other changes
+* add `rel="nofollow"` to zip download links, basic-browser link
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0129-1842  `v1.6.2`  cors k
+
+[Ellie Goulding - Stay Awake (kors k Hardcore Bootleg).mp3](https://a.ocv.me/pub/demo/music/.bonus/#af-134e597c)
+* 👆 the read-only demo server at https://a.ocv.me/pub/demo/
+
+## breaking changes
+but nothing is affected (that i know of):
+* all requests must pass [cors validation](https://github.com/9001/copyparty#cors)
+  * but they almost definitely did already
+  * sharex and others are OK since they don't supply an `Origin` header
+* [API calls](https://github.com/9001/copyparty/blob/hovudstraum/docs/devnotes.md#http-api) `?delete` and `?move` are now POST instead of GET
+  * not aware of any clients using these
+
+## known issues
+* the document sandbox is a bit laggy and sometimes eats hotkeys
+  * disable it with `--no-sb-md --no-sb-lg` if you trust everyone who has write and/or move access
+
+## new features
+* [event hooks](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks) -- run programs on new [uploads](https://user-images.githubusercontent.com/241032/215304439-1c1cb3c8-ec6f-4c17-9f27-81f969b1811a.png), renames, deletes
+* [configurable cors](https://github.com/9001/copyparty#cors) (cross-origin resource sharing) behavior; defaults are mostly same as before
+  * `--allow-csrf` disables all csrf protections and makes it intentionally trivial to send authenticated requests from other domains
+* sandboxed readme.md / prologues / epilogues
+  * documents can still run scripts like before, but can no longer tamper with the web-ui / read the login session, so the old advice of `--no-readme` and `--no-logues` is mostly deprecated
+  * unfortunately disables hotkeys while the text has focus + blocks dragdropping files onto that area, oh well
+* password can be provided through http header `PW:` (instead of cookie `cppwd` or or url-param `?pw`)
+* detect network changes (new NICs, IPs) and reconfigure / reannoucne zeroconf
+  * fixes mdns when running as a systemd service and copyparty is started before networking is up
+* add `--freebind` to start listening on IPs before the NIC is up yet (linux-only)
+* per-volume deduplication-control with volflags `hardlink`, `neversymlink`, `copydupes`
+* detect curl and return a [colorful, sortable plaintext](https://user-images.githubusercontent.com/241032/215322619-ea5fd606-3654-40ad-94ee-2bc058647bb2.png) directory listing instead
+* add optional [powered-by-copyparty](https://user-images.githubusercontent.com/241032/215322626-11d1f02b-25f4-45df-a3d9-f8c51354a8eb.png) footnode on the controlpanel
+  * can be disabled with `-nb` or redirected with `--pb-url`
+
+## bugfixes
+* change some API calls (`?delete`, `?move`) from `GET` to `POST`
+  * don't panic! this was safe against authenticated csrf thanks to [SameSite=Lax](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#lax)
+  * `--getmod` restores the GETs if you need the convenience and accept the risks
+* [u2cli](https://github.com/9001/copyparty/blob/hovudstraum/bin/up2k.py) (command-line uploader):
+  * recover from network hiccups
+  * add `-ns` for slow uefi TTYs
+* separate login cookies for http / https
+  * avoids an https login from getting accidentally sent over plaintext
+  * sadly no longer possible to login with internet explorer 4.0 / windows 3.11
+* tar/zip-download of hidden folders
+* unpost filtering was buggy for non-ascii characters
+* moving a deduplicated file on a volume where deduplication was since disabled
+* improved the [linux 6.0.16](https://utcc.utoronto.ca/~cks/space/blog/linux/KernelBindBugIn6016) kernel bug [workaround](https://github.com/9001/copyparty/commit/9065226c3d634a9fc15b14a768116158bc1761ad) because there is similar funk in 5.x
+* add custom text selection colors because chrome is currently broken on fedora
+* blockdevs (`/dev/nvme0n1`) couldn't be downloaded as files
+* misc fixes for location-based reverse-proxying
+* macos dualstack thing
+
+## other changes
+* added a collection of [cursed usecases](https://github.com/9001/copyparty/tree/hovudstraum/docs/cursed-usecases)
+* and [comparisons to similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) in case you ever wanna jump ship
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2023-0112-0515  `v1.5.6`  many hands

--- a/docs/copyparty.d/foo/another.conf
+++ b/docs/copyparty.d/foo/another.conf
@@ -1,5 +1,6 @@
 # this file gets included twice from ../some.conf,
 # setting user permissions for a volume
-rw usr1
-r usr2
-% sibling.conf
+accs:
+  rw: usr1
+  r: usr2
+  % sibling.conf
--- a/docs/copyparty.d/foo/sibling.conf
+++ b/docs/copyparty.d/foo/sibling.conf
@@ -1,3 +1,3 @@
 # and this config file gets included from ./another.conf,
 # adding a final permission for each of the two volumes in ../some.conf
-m usr1 usr2
+m: usr1, usr2
--- a/docs/copyparty.d/some.conf
+++ b/docs/copyparty.d/some.conf
@@ -1,22 +1,29 @@
+# not actually YAML but lets pretend:
+# -*- mode: yaml -*-
+# vim: ft=yaml:
+
 # lets make two volumes with the same accounts/permissions for both;
 # first declare the accounts just once:
-u usr1:passw0rd
-u usr2:letmein
+[accounts]
+  usr1: passw0rd
+  usr2: letmein

-# and listen on 127.0.0.1 only, port 2434
-i 127.0.0.1
-p 2434
+[global]
+  i: 127.0.0.1  # listen on 127.0.0.1 only,
+  p: 2434       # port 2434
+  e2ds  # enable file indexing+scanning
+  e2ts  # and multimedia indexing+scanning
+  # (inline comments are OK if there is 2 spaces before the #)

 # share /usr/share/games from the server filesystem
-/usr/share/games
-/vidya
-# include config file with volume permissions
-% foo/another.conf
+[/vidya]
+  /usr/share/games
+  % foo/another.conf  # include config file with volume permissions

 # and share your ~/Music folder too
-~/Music
-/bangers
-% foo/another.conf
+[/bangers]
+  ~/Music
+  % foo/another.conf

 # which should result in each of the volumes getting the following permissions:
 # usr1 read/write/move
--- a/docs/cursed-usecases/README.md
+++ b/docs/cursed-usecases/README.md
@@ -17,6 +17,6 @@ problem: `svchost.exe` is using 100% of a cpu core, and upon further inspection
 "solution": create a virtual filesystem which is intentionally slow and trick windows into reading it from there instead

 * create a file called `AppxManifest.xml` and put something dumb in it
-* serve the file from a copyparty instance with `--rsp-slp=9` so every request will hang for 9 sec
+* serve the file from a copyparty instance with `--rsp-slp=1` so every request will hang for 1 sec
 * `net use m: http://127.0.0.1:3993/`  (mount copyparty using the windows-native webdav client)
 * `mklink /d c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\AppxManifest.xml m:\AppxManifest.xml`
--- a/docs/devnotes.md
+++ b/docs/devnotes.md
@@ -25,13 +25,15 @@

 some improvement ideas

-* the JS is a mess -- a preact rewrite would be nice
+* the JS is a mess -- a ~~preact~~ rewrite would be nice
  * preferably without build dependencies like webpack/babel/node.js, maybe a python thing to assemble js files into main.js
  * good excuse to look at using virtual lists (browsers start to struggle when folders contain over 5000 files)
+  * maybe preact / vdom isn't the best choice, could just wait for the Next Big Thing
 * the UX is a mess -- a proper design would be nice
  * very organic (much like the python/js), everything was an afterthought
  * true for both the layout and the visual flair
  * something like the tron board-room ui (or most other hollywood ones, like ironman) would be :100:
+    * would preferably keep the information density, just more organized yet [not too boring](https://blog.rachelbinx.com/2023/02/unbearable-sameness/)
 * some of the python files are way too big
  * `up2k.py` ended up doing all the file indexing / db management
  * `httpcli.py` should be separated into modules in general
@@ -229,7 +231,12 @@ rm -rf copyparty/web/deps
 curl -L https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py >x.py
 python3 x.py --version
 rm x.py
-mv /tmp/pe-copyparty/copyparty/web/deps/ copyparty/web/deps/
+cp -R /tmp/pe-copyparty.$(id -u)/copyparty/web/deps copyparty/web/
+```
+
+or you could build the web-dependencies from source instead (NB: does not include prismjs, need to grab that manually):
+```sh
+make -C scripts/deps-docker
 ```

 then build the sfx using any of the following examples:
--- a/docs/example.conf
+++ b/docs/example.conf
@@ -1,59 +1,69 @@
+# not actually YAML but lets pretend:
+# -*- mode: yaml -*-
+# vim: ft=yaml:
+
 # append some arguments to the commandline;
-# the first space in a line counts as a separator,
-# any additional spaces are part of the value
-e2dsa
-e2ts
-i 127.0.0.1
+# accepts anything listed in --help (leading dashes are optional)
+# and inline comments are OK if there is 2 spaces before the '#'
+[global]
+  p: 8086, 3939  # listen on ports 8086 and 3939
+  e2dsa  # enable file indexing and filesystem scanning
+  e2ts   # and enable multimedia indexing
+  z, qr  # and zeroconf and qrcode (you can comma-separate arguments)

 # create users:
-# u username:password
-u ed:123
-u k:k
+[accounts]
+  ed: 123   # username: password
+  k: k

-# leave a blank line between volumes
-# (and also between users and volumes)
+# create volumes:
+[/]         # create a volume at "/" (the webroot), which will
+  .         # share the contents of "." (the current directory)
+  accs:
+    r: *    # everyone gets read-access, but
+    rw: ed  # the user "ed" gets read-write

-# create a volume:
-# share "." (the current directory)
-# as "/" (the webroot) for the following users:
-# "r" grants read-access for anyone
-# "rw ed" grants read-write to ed
-.
-/
-r
-rw ed
-
-# custom permissions for the "priv" folder:
-# user "k" can only see/read the contents
-# user "ed" gets read-write access
-./priv
-/priv
-r k
-rw ed
-
-# this does the same thing,
-# and will cause an error on startup since /priv is already taken:
-./priv
-/priv
-r ed k
-w ed
+# let's specify different permissions for the "priv" subfolder
+# by creating another volume at that location:
+[/priv]
+  ./priv
+  accs:
+    r: k    # the user "k" can see the contents,
+    rw: ed  # while "ed" gets read-write

 # share /home/ed/Music/ as /music and let anyone read it
 # (this will replace any folder called "music" in the webroot)
-/home/ed/Music
-/music
-r
+[/music]
+  /home/ed/Music
+  accs:
+    r: *
+
+# and a folder where anyone can upload, but nobody can see the contents
+[/dump]
+  /home/ed/inc
+  accs:
+    w: *
+  flags:
+    e2d     # the e2d volflag enables the uploads database
+    nodupe  # the nodupe volflag rejects duplicate uploads
+    # (see --help-flags for all available volflags to use)

 # and a folder where anyone can upload
-# but nobody can see the contents
-# and set the e2d flag to enable the uploads database
-# and set the nodupe flag to reject duplicate uploads
-/home/ed/inc
-/dump
-w
-c e2d
-c nodupe
+# and anyone can access their own uploads, but nothing else
+[/sharex]
+  /home/ed/inc/sharex
+  accs:
+    wG: *        # wG = write-upget = see your own uploads only
+    rwmd: ed, k  # read-write-modify-delete for users "ed" and "k"
+  flags:
+    e2d, d2t, fk: 4
+    # volflag "e2d" enables the uploads database,
+    # "d2t" disables multimedia parsers (in case the uploads are malicious),
+    # "dthumb" disables thumbnails (same reason),
+    # "fk" enables filekeys (necessary for upget permission) (4 chars long)
+    # -- note that its fine to combine all the volflags on
+    #    one line because only the last volflag has an argument

 # this entire config file can be replaced with these arguments:
-# -u ed:123 -u k:k -v .::r:a,ed -v priv:priv:r,k:rw,ed -v /home/ed/Music:music:r -v /home/ed/inc:dump:w:c,e2d,nodupe
+# -u ed:123 -u k:k -v .::r:a,ed -v priv:priv:r,k:rw,ed -v /home/ed/Music:music:r -v /home/ed/inc:dump:w:c,e2d,nodupe -v /home/ed/inc/sharex:sharex:wG:c,e2d,d2t,fk=4
 # but note that the config file always wins in case of conflicts
--- a/docs/versus.md
+++ b/docs/versus.md
@@ -7,6 +7,20 @@ there is probably some unintentional bias so please submit corrections
 currently up to date with [awesome-selfhosted](https://github.com/awesome-selfhosted/awesome-selfhosted) but that probably won't last


+## symbol legends
+
+### ...in feature matrices:
+* `█` = absolutely
+* `╱` = partially
+* `•` = maybe?
+* ` ` = nope
+
+### ...in reviews:
+* ✅ = advantages over copyparty
+* 🔵 = similarities
+* ⚠️ = disadvantages (something copyparty does "better")
+
+
 ## toc

 * top
@@ -37,6 +51,8 @@ currently up to date with [awesome-selfhosted](https://github.com/awesome-selfho
    * [gimme-that](#gimme-that)
    * [ass](#ass)
    * [linx](#linx)
+    * [h5ai](#h5ai)
+    * [autoindex](#autoindex)
 * [briefly considered](#briefly-considered)


@@ -63,8 +79,8 @@ the table headers in the matrixes below are the different softwares, with a quic

 the softwares,
 * `a` = [copyparty](https://github.com/9001/copyparty)
-* `b` = [hfs2](https://github.com/rejetto/hfs2)
-* `c` = [hfs3](https://www.rejetto.com/hfs/)
+* `b` = [hfs2](https://rejetto.com/hfs/)
+* `c` = [hfs3](https://github.com/rejetto/hfs)
 * `d` = [nextcloud](https://github.com/nextcloud/server)
 * `e` = [seafile](https://github.com/haiwen/seafile)
 * `f` = [rclone](https://github.com/rclone/rclone), specifically `rclone serve webdav .`
@@ -309,6 +325,7 @@ symbol legend,
 * `audio player » os-integration` = use the [lockscreen](https://user-images.githubusercontent.com/241032/142711926-0700be6c-3e31-47b3-9928-53722221f722.png) or [media hotkeys](https://user-images.githubusercontent.com/241032/215347492-b4250797-6c90-4e09-9a4c-721edf2fb15c.png) to play/pause, prev/next song
 * `search by custom tags` = ability to tag files through the UI and search by those
 * `find local file` = drop a file into the browser to see if it exists on the server
+* `undo recent uploads` = accounts without delete permissions have a time window where they can undo their own uploads
 * `a`/copyparty has teeny-tiny skips playing gapless albums depending on audio codec (opus best)
 * `b`/hfs2 has a very basic directory tree view, not showing sibling folders
 * `f`/rclone can do some file management (mkdir, rename, delete) when hosting througn webdav
@@ -362,7 +379,8 @@ symbol legend,
 # reviews

 * ✅ are advantages over copyparty
-* ⚠️ are disadvantages
+* 🔵 are similarities
+* ⚠️ are disadvantages (something copyparty does "better")

 ## [copyparty](https://github.com/9001/copyparty)
 * resumable uploads which are verified server-side
@@ -370,7 +388,7 @@ symbol legend,
  * both of the above are surprisingly uncommon features
 * very cross-platform (python, no dependencies)

-## [hfs2](https://github.com/rejetto/hfs2)
+## [hfs2](https://rejetto.com/hfs/)
 * the OG, the legend
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
@@ -379,7 +397,7 @@ symbol legend,
 * vfs with gui config, per-volume permissions
 * starting to show its age, hence the rewrite:

-## [hfs3](https://www.rejetto.com/hfs/)
+## [hfs3](https://github.com/rejetto/hfs)
 * nodejs; cross-platform
 * vfs with gui config, per-volume permissions
 * still early development, let's revisit later
@@ -433,12 +451,12 @@ symbol legend,
  * ⚠️ on cloudflare: max upload size 100 MiB
 * ⚠️ doesn't support crazy filenames
 * ✅ per-url access control (copyparty is per-volume)
-* basic but really snappy ui
-* upload, rename, delete, ... see feature matrix
+* 🔵 basic but really snappy ui
+* 🔵 upload, rename, delete, ... see feature matrix

 ## [chibisafe](https://github.com/chibisafe/chibisafe)
 * nodejs; recommends docker
-* *it has upload segmenting!*
+* 🔵 *it has upload segmenting!*
  * ⚠️ but uploads are still not resumable / accelerated / integrity-checked
 * ⚠️ not portable
 * ⚠️ isolated on-disk file hierarchy, incompatible with other software
@@ -455,7 +473,7 @@ symbol legend,
 ## [kodbox](https://github.com/kalcaddle/kodbox)
 * this thing is insane
 * php; [docker](https://hub.docker.com/r/kodcloud/kodbox)
-* *upload segmenting, acceleration, and integrity checking!*
+* 🔵 *upload segmenting, acceleration, and integrity checking!*
  * ⚠️ but uploads are not resumable(?)
 * ⚠️ not portable
 * ⚠️ isolated on-disk file hierarchy, incompatible with other software
@@ -482,17 +500,17 @@ symbol legend,
  * ⚠️ but no directory tree for navigation
 * ✅ user signup
 * ✅ command runner / remote shell
-* supposed to have write-only folders but couldn't get it to work
+* 🔵 supposed to have write-only folders but couldn't get it to work

 ## [filegator](https://github.com/filegator/filegator)
 * go; cross-platform (windows, linux, mac)
+* 🔵 *it has upload segmenting and acceleration*
+  * ⚠️ but uploads are still not integrity-checked
 * ⚠️ http only; no webdav / ftp / zeroconf
 * ⚠️ does not support symlinks
 * ⚠️ expensive download-as-zip feature
 * ⚠️ doesn't support crazy filenames
 * ⚠️ limited file search
-* *it has upload segmenting and acceleration*
-  * ⚠️ but uploads are still not integrity-checked

 ## [updog](https://github.com/sc0tfree/updog)
 * python; cross-platform
@@ -509,8 +527,8 @@ symbol legend,
  * ⚠️ on cloudflare: max upload size 100 MiB
 * ✅ cool clipboard widget
  * copyparty: the markdown editor is an ok substitute
-* read-only and upload-only modes (same as copyparty's write-only)
-* https, webdav
+* 🔵 read-only and upload-only modes (same as copyparty's write-only)
+* 🔵 https, webdav, but no ftp

 ## [gimme-that](https://github.com/nejdetckenobi/gimme-that)
 * python, but with c dependencies
@@ -519,7 +537,7 @@ symbol legend,
  * ⚠️ on cloudflare: max upload size 100 MiB
 * ⚠️ weird folder structure for uploads
 * ✅ clamav antivirus check on upload! neat
-* optional max-filesize, os-notification on uploads
+* 🔵 optional max-filesize, os-notification on uploads
  * copyparty: os-notification available as [a plugin](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/notify.py)

 ## [ass](https://github.com/tycrek/ass)
@@ -543,7 +561,7 @@ symbol legend,
 * originally [andreimarcu/linx-server](https://github.com/andreimarcu/linx-server) but development has ended
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
-* some of its unique features have been added to copyparty as former linx users have migrated
+* 🔵 some of its unique features have been added to copyparty as former linx users have migrated
  * file expiration timers, filename randomization
 * ✅ password-protected files
  * copyparty: password-protected folders + filekeys to skip the folder password seem to cover most usecases
@@ -553,8 +571,19 @@ symbol legend,
  * copyparty: available as [a plugin](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/wget.py)
 * ✅ can use S3 as storage backend; copyparty relies on rclone-mount for that

+## [h5ai](https://larsjung.de/h5ai/)
+* ⚠️ read only; no upload/move/delete
+* ⚠️ search hits the filesystem directly; not indexed/cached
+* ✅ slick ui
+* ✅ in-browser qr generator to share URLs
+* 🔵 directory tree, image viewer, thumbnails, download-as-tar
+
+## [autoindex](https://github.com/nielsAD/autoindex)
+* ⚠️ read only; no upload/move/delete
+* ✅ directory cache for faster browsing of cloud storage
+  * copyparty: local index/cache for recursive search (names/attrs/tags), but not for browsing
+

 # briefly considered
 * [pydio](https://github.com/pydio/cells): python/agpl3, looks great, fantastic ux -- but needs mariadb, systemwide install
 * [gossa](https://github.com/pldubouilh/gossa): go/mit, minimalistic, basic file upload, text editor, mkdir and rename (no delete/move)
-* [h5ai](https://larsjung.de/h5ai/): php/mit, slick ui, image viewer, directory tree, no upload feature
--- a/scripts/docker/Dockerfile.ac
+++ b/scripts/docker/Dockerfile.ac
@@ -0,0 +1,20 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-ac" \
+        org.opencontainers.image.description="copyparty with Pillow and FFmpeg (image/audio/video thumbnails, audio transcoding, media tags)"
+
+RUN     apk --no-cache add \
+            wget \
+            py3-pillow \
+            ffmpeg \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+COPY    i/dist/copyparty-sfx.py ./
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "/z/copyparty-sfx.py", "-c", "/z/initcfg"]
--- a/scripts/docker/Dockerfile.dj
+++ b/scripts/docker/Dockerfile.dj
@@ -0,0 +1,37 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-dj" \
+        org.opencontainers.image.description="copyparty with all optional dependencies, including musical key / bpm detection"
+
+COPY    i/bin/mtag/install-deps.sh ./
+COPY    i/bin/mtag/audio-bpm.py /mtag/
+COPY    i/bin/mtag/audio-key.py /mtag/
+RUN     apk add -U \
+            wget \
+            py3-pillow py3-pip py3-cffi \
+            ffmpeg \
+            vips-jxl vips-heif vips-poppler vips-magick \
+            py3-numpy fftw libsndfile \
+            vamp-sdk vamp-sdk-libs \
+        && python3 -m pip install pyvips \
+        && apk --no-cache add -t .bd \
+            bash wget gcc g++ make cmake patchelf \
+            python3-dev ffmpeg-dev fftw-dev libsndfile-dev \
+            py3-wheel py3-numpy-dev \
+            vamp-sdk-dev \
+        && bash install-deps.sh \
+        && apk del py3-pip .bd \
+        && rm -rf /var/cache/apk/* \
+        && chmod 777 /root \
+        && ln -s /root/vamp /root/.local / \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+COPY    i/dist/copyparty-sfx.py ./
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "/z/copyparty-sfx.py", "-c", "/z/initcfg"]
--- a/scripts/docker/Dockerfile.im
+++ b/scripts/docker/Dockerfile.im
@@ -0,0 +1,19 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-im" \
+        org.opencontainers.image.description="copyparty with Pillow and Mutagen (image thumbnails, media tags)"
+
+RUN     apk --no-cache add \
+            wget \
+            py3-pillow py3-mutagen \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+COPY    i/dist/copyparty-sfx.py ./
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "/z/copyparty-sfx.py", "-c", "/z/initcfg"]
--- a/scripts/docker/Dockerfile.iv
+++ b/scripts/docker/Dockerfile.iv
@@ -0,0 +1,23 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-iv" \
+        org.opencontainers.image.description="copyparty with Pillow, FFmpeg, libvips (image/audio/video thumbnails, audio transcoding, media tags)"
+
+RUN     apk --no-cache add \
+            wget \
+            py3-pillow py3-pip py3-cffi \
+            ffmpeg \
+            vips-jxl vips-heif vips-poppler vips-magick \
+        && python3 -m pip install pyvips \
+        && apk del py3-pip \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+COPY    i/dist/copyparty-sfx.py ./
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "/z/copyparty-sfx.py", "-c", "/z/initcfg"]
--- a/scripts/docker/Dockerfile.min
+++ b/scripts/docker/Dockerfile.min
@@ -0,0 +1,18 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-min" \
+        org.opencontainers.image.description="just copyparty, no thumbnails / media tags / audio transcoding"
+
+RUN     apk --no-cache add \
+            python3 \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+COPY    i/dist/copyparty-sfx.py ./
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "/z/copyparty-sfx.py", "-c", "/z/initcfg"]
--- a/scripts/docker/Dockerfile.min.pip
+++ b/scripts/docker/Dockerfile.min.pip
@@ -0,0 +1,18 @@
+FROM    alpine:latest
+WORKDIR /z
+LABEL   org.opencontainers.image.url="https://github.com/9001/copyparty" \
+        org.opencontainers.image.source="https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker" \
+        org.opencontainers.image.licenses="MIT" \
+        org.opencontainers.image.title="copyparty-min-pip" \
+        org.opencontainers.image.description="just copyparty, no thumbnails, no media tags, no audio transcoding"
+
+RUN     apk --no-cache add python3 py3-pip \
+        && python3 -m pip install copyparty \
+        && apk del py3-pip \
+        && mkdir /cfg /w \
+        && chmod 777 /cfg /w \
+        && echo % /cfg > initcfg
+
+WORKDIR /w
+EXPOSE  3923
+ENTRYPOINT ["python3", "-m", "copyparty", "-c", "/z/initcfg"]
--- a/scripts/docker/Makefile
+++ b/scripts/docker/Makefile
@@ -0,0 +1,65 @@
+self := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+
+all:
+	-service docker start
+	-systemctl start docker
+	
+	rm -rf i
+	mkdir i
+	tar -cC../.. dist/copyparty-sfx.py bin/mtag | tar -xvCi
+	
+	docker build -t copyparty/min:latest -f Dockerfile.min .
+	echo 'scale=1;'`docker save copyparty/min:latest | pigz -c | wc -c`/1024/1024 | bc
+
+#	docker build -t copyparty/min-pip:latest -f Dockerfile.min.pip .
+#	echo 'scale=1;'`docker save copyparty/min-pip:latest | pigz -c | wc -c`/1024/1024 | bc
+
+	docker build -t copyparty/im:latest -f Dockerfile.im .
+	echo 'scale=1;'`docker save copyparty/im:latest | pigz -c | wc -c`/1024/1024 | bc
+
+	docker build -t copyparty/iv:latest -f Dockerfile.iv .
+	echo 'scale=1;'`docker save copyparty/iv:latest | pigz -c | wc -c`/1024/1024 | bc
+
+	docker build -t copyparty/ac:latest -f Dockerfile.ac .
+	echo 'scale=1;'`docker save copyparty/ac:latest | pigz -c | wc -c`/1024/1024 | bc
+
+	docker build -t copyparty/dj:latest -f Dockerfile.dj .
+	echo 'scale=1;'`docker save copyparty/dj:latest | pigz -c | wc -c`/1024/1024 | bc
+
+	docker image ls
+
+push:
+	docker push copyparty/min
+	docker push copyparty/im
+	docker push copyparty/iv
+	docker push copyparty/ac
+	docker push copyparty/dj
+	docker image tag copyparty/min:latest ghcr.io/9001/copyparty-min:latest
+	docker image tag copyparty/im:latest ghcr.io/9001/copyparty-im:latest
+	docker image tag copyparty/iv:latest ghcr.io/9001/copyparty-iv:latest
+	docker image tag copyparty/ac:latest ghcr.io/9001/copyparty-ac:latest
+	docker image tag copyparty/dj:latest ghcr.io/9001/copyparty-dj:latest
+	docker push ghcr.io/9001/copyparty-min:latest
+	docker push ghcr.io/9001/copyparty-im:latest
+	docker push ghcr.io/9001/copyparty-iv:latest
+	docker push ghcr.io/9001/copyparty-ac:latest
+	docker push ghcr.io/9001/copyparty-dj:latest
+
+clean:
+	-docker kill `docker ps -q`
+	-docker rm   `docker ps -qa`
+	-docker rmi -f `docker images -a | awk '/<none>/{print$$3}'`
+
+hclean:
+	-docker kill `docker ps -q`
+	-docker rm   `docker ps -qa`
+	-docker rmi  `docker images -a | awk '!/^alpine/&&NR>1{print$$3}'`
+
+purge:
+	-docker kill `docker ps -q`
+	-docker rm   `docker ps -qa`
+	-docker rmi  `docker images -qa`
+
+sh:
+	@printf "\n\033[1;31mopening a shell in the most recently created docker image\033[0m\n"
+	docker run --rm -it --entrypoint /bin/ash `docker images -aq | head -n 1`
--- a/scripts/docker/README.md
+++ b/scripts/docker/README.md
@@ -0,0 +1,83 @@
+copyparty is availabe in these repos:
+* https://hub.docker.com/u/copyparty
+* https://github.com/9001?tab=packages&repo_name=copyparty
+
+
+# getting started
+
+run this command to grab the latest copyparty image and start it:
+```bash
+docker run --rm -it -u 1000 -p 3923:3923 -v /mnt/nas:/w -v $PWD/cfgdir:/cfg copyparty/ac
+```
+
+* `/w` is the path inside the container that gets shared by default, so mount one or more folders to share below there
+* `/cfg` is an optional folder with zero or more config files (*.conf) to load
+* `copyparty/ac` is the recommended [image edition](#editions)
+* you can download the image from github instead by replacing `copyparty/ac` with `ghcr.io/9001/copyparty-ac`
+
+i'm unfamiliar with docker-compose and alternatives so let me know if this section could be better 🙏
+
+
+## configuration
+
+the container has the same default config as the sfx and the pypi module, meaning it will listen on port 3923 and share the "current folder" (`/w` inside the container) as read-write for anyone
+
+the recommended way to configure copyparty inside a container is to mount a folder which has one or more [config files](https://github.com/9001/copyparty/blob/hovudstraum/docs/example.conf) inside; `-v /your/config/folder:/cfg`
+
+* but you can also provide arguments to the docker command if you prefer that
+* config files must be named `something.conf` to get picked up
+
+
+## editions
+
+with image size after installation and when gzipped
+
+* [`min`](https://hub.docker.com/r/copyparty/min) (57 MiB, 20 gz) is just copyparty itself
+* [`im`](https://hub.docker.com/r/copyparty/im) (70 MiB, 25 gz) can thumbnail images with pillow, parse media files with mutagen
+* [`ac` (163 MiB, 56 gz)](https://hub.docker.com/r/copyparty/ac) is `im` plus ffmpeg for video/audio thumbs + audio transcoding + better tags
+* [`iv`](https://hub.docker.com/r/copyparty/iv) (211 MiB, 73 gz) is `ac` plus vips for faster heif / avic / jxl thumbnails
+* [`dj`](https://hub.docker.com/r/copyparty/dj) (309 MiB, 104 gz) is `iv` plus beatroot/keyfinder to detect musical keys and bpm
+
+[`ac` is recommended](https://hub.docker.com/r/copyparty/ac) since the additional features available in `iv` and `dj` are rarely useful
+
+most editions support `x86`, `x86_64`, `armhf`, `aarch64`, `ppc64le`, `s390x`
+* `dj` doesn't run on `ppc64le`, `s390x`, `armhf`
+* `iv` doesn't run on `ppc64le`, `s390x`
+
+
+## detecting bpm and musical key
+
+the `dj` edition comes with `keyfinder` and `beatroot` which can be used to detect music bpm and musical keys
+
+enable them globally in a config file:
+```yaml
+[global]
+e2dsa, e2ts  # enable filesystem indexing and multimedia indexing
+mtp: .bpm=f,t30,/mtag/audio-bpm.py  # should take ~10sec
+mtp: key=f,t190,/mtag/audio-key.py  # should take ~50sec
+```
+
+or enable them for just one volume,
+```yaml
+[/music]  # share name / URL
+  music   # filesystem path inside the docker volume `/w`
+  flags:
+    e2dsa, e2ts
+    mtp: .bpm=f,t30,/mtag/audio-bpm.py
+    mtp: key=f,t190,/mtag/audio-key.py
+```
+
+or using commandline arguments,
+```
+-e2dsa -e2ts -mtp .bpm=f,t30,/mtag/audio-bpm.py -mtp key=f,t190,/mtag/audio-key.py
+```
+
+
+# build the images yourself
+
+basically `./make.sh hclean pull img push` but see [devnotes.md](./devnotes.md)
+
+
+# notes
+
+* currently unable to play [tracker music](https://en.wikipedia.org/wiki/Module_file) (mod/s3m/xm/it/...) -- will be fixed in june 2023 (Alpine 3.18)
--- a/scripts/docker/devnotes.md
+++ b/scripts/docker/devnotes.md
@@ -0,0 +1,19 @@
+# building the images yourself
+
+```bash
+./make.sh hclean pull img push
+```
+will download the latest copyparty-sfx.py from github unless you have [built it from scratch](../../docs/devnotes.md#just-the-sfx) and then build all the images based on that
+
+deprecated alternative: run `make` to use the makefile however that uses docker instead of podman and only builds x86_64
+
+`make.sh` is necessarily(?) overengineered because:
+* podman keeps burning dockerhub pulls by not using the cached images (`--pull=never` does not apply to manifests)
+* podman cannot build from a local manifest, only local images or remote manifests
+
+but I don't really know what i'm doing here 💩
+
+* auth for pushing images to repos;  
+  `podman login docker.io`  
+  `podman login ghcr.io -u 9001`  
+  [about gchq](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry) (takes a classic token as password)
--- a/scripts/docker/make.sh
+++ b/scripts/docker/make.sh
@@ -0,0 +1,152 @@
+#!/bin/bash
+set -e
+
+[ $(id -u) -eq 0 ] && {
+    echo dont root
+    exit 1
+}
+
+sarchs="386 amd64 arm/v7 arm64/v8 ppc64le s390x"
+archs="amd64 arm s390x 386 arm64 ppc64le"
+imgs="dj iv min im ac"
+dhub_order="iv dj min im ac"
+ghcr_order="ac im min dj iv"
+ngs=(
+    iv-{ppc64le,s390x}
+    dj-{ppc64le,s390x,arm}
+)
+
+for v in "$@"; do
+    [ "$v" = clean  ] && clean=1
+    [ "$v" = hclean ] && hclean=1
+    [ "$v" = purge  ] && purge=1
+    [ "$v" = pull   ] && pull=1
+    [ "$v" = img    ] && img=1
+    [ "$v" = push   ] && push=1
+    [ "$v" = sh     ] && sh=1
+done
+
+[ $# -gt 0 ] || {
+    echo "need list of commands, for example: hclean pull img push"
+    exit 1
+}
+
+[ $sh ] && {
+    printf "\n\033[1;31mopening a shell in the most recently created docker image\033[0m\n"
+    podman run --rm -it --entrypoint /bin/ash $(podman images -aq | head -n 1)
+    exit $?
+}
+
+filt=
+[ $clean  ] && filt='/<none>/{print$$3}'
+[ $hclean ] && filt='/localhost\/copyparty-|^<none>.*localhost\/alpine-/{print$3}'
+[ $purge  ] && filt='NR>1{print$3}'
+[ $filt ] && {
+    [ $purge ] && {
+        podman kill $(podman ps -q)  || true
+        podman rm   $(podman ps -qa) || true
+    }
+	podman rmi -f $(podman images -a --history | awk "$filt") || true
+    podman rmi $(podman images -a --history | awk '/^<none>.*<none>.*-tmp:/{print$3}') || true
+}
+
+[ $pull ] && {
+    for a in $sarchs; do  # arm/v6
+        podman pull --arch=$a alpine:latest
+    done
+    
+    podman images --format "{{.ID}} {{.History}}" |
+    awk '/library\/alpine/{print$1}' |
+    while read id; do
+        tag=alpine-$(podman inspect $id | jq -r '.[]|.Architecture' | tr / -)
+        [ -e .tag-$tag ] && continue
+        touch .tag-$tag
+        echo tagging $tag
+        podman untag $id
+        podman tag $id $tag
+    done
+    rm .tag-*
+}
+
+[ $img ] && {
+    fp=../../dist/copyparty-sfx.py
+    [ -e $fp ] || {
+        echo downloading copyparty-sfx.py ...
+        mkdir -p ../../dist
+        wget https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py -O $fp
+    }
+
+    # kill abandoned builders
+    ps aux | awk '/bin\/qemu-[^-]+-static/{print$2}' | xargs -r kill -9
+
+    # grab deps
+    rm -rf i err
+    mkdir i
+    tar -cC../.. dist/copyparty-sfx.py bin/mtag | tar -xvCi
+
+    for i in $imgs; do
+        podman rm copyparty-$i || true  # old manifest
+        for a in $archs; do
+            [[ " ${ngs[*]} " =~ " $i-$a " ]] && continue  # known incompat
+
+            # wait for a free slot
+            while true; do
+                touch .blk
+                [ $(jobs -p | wc -l) -lt $(nproc) ] && break
+                while [ -e .blk ]; do sleep 0.2; done
+            done
+            aa="$(printf '%7s' $a)"
+
+            # arm takes forever so make it top priority
+            [ ${a::3} == arm ] && nice= || nice=nice
+
+            # --pull=never does nothing at all btw
+            (set -x
+            $nice podman build \
+                --pull=never \
+                --from localhost/alpine-$a \
+                -t copyparty-$i-$a \
+                -f Dockerfile.$i . ||
+                    (echo $? $i-$a >> err)
+            rm -f .blk
+            ) 2> >(tee $a.err | sed "s/^/$aa:/" >&2) > >(tee $a.out | sed "s/^/$aa:/") &
+        done
+        [ -e err ] && {
+            echo somethign died,
+            cat err
+            pkill -P $$
+            exit 1
+        }
+        for a in $archs; do
+            rm -f $a.{out,err}
+        done
+    done
+    wait
+    [ -e err ] && {
+        echo somethign died,
+        cat err
+        pkill -P $$
+        exit 1
+    }
+    # avoid podman race-condition by creating manifest manually --
+    # Error: creating image to hold manifest list: image name "localhost/copyparty-dj:latest" is already associated with image "[0-9a-f]{64}": that name is already in use
+    for i in $imgs; do
+        variants=
+        for a in $archs; do
+            [[ " ${ngs[*]} " =~ " $i-$a " ]] && continue
+            variants="$variants containers-storage:localhost/copyparty-$i-$a"
+        done
+        podman manifest create copyparty-$i $variants
+    done
+}
+
+[ $push ] && {
+    for i in $dhub_order; do
+        podman manifest push --all copyparty-$i copyparty/$i:latest
+    done
+    for i in $ghcr_order; do
+        podman manifest push --all copyparty-$i ghcr.io/9001/copyparty-$i:latest
+    done
+}
+
+echo ok
--- a/scripts/make-pypi-release.sh
+++ b/scripts/make-pypi-release.sh
@@ -15,10 +15,12 @@ gtar=$(command -v gtar || command -v gnutar) || true
 }

 mode="$1"
+fast="$2"

 [ -z "$mode" ] &&
 {
 	echo "need argument 1:  (D)ry, (T)est, (U)pload"
+	echo " optional arg 2:  fast"
 	echo
 	exit 1
 }
@@ -90,10 +92,13 @@ load_env || {
 	load_env
 }

+# grab licenses
+scripts/genlic.sh copyparty/res/COPYING.txt
+
 # remove type hints to support python < 3.9
 rm -rf build/pypi
 mkdir -p build/pypi
-cp -pR setup.py README.md LICENSE copyparty tests bin scripts/strip_hints build/pypi/
+cp -pR setup.py README.md LICENSE copyparty contrib bin scripts/strip_hints build/pypi/
 tar -c docs/lics.txt scripts/genlic.sh build/*.txt | tar -xC build/pypi/
 cd build/pypi
 f=../strip-hints-0.1.10.tar.gz
@@ -103,6 +108,34 @@ f=../strip-hints-0.1.10.tar.gz
 tar --strip-components=2 -xf $f strip-hints-0.1.10/src/strip_hints
 python3 -c 'from strip_hints.a import uh; uh("copyparty")'

+# resolve symlinks
+find -type l |
+while IFS= read -r f1; do (
+	cd "${f1%/*}"
+	f1="./${f1##*/}"
+	f2="$(readlink "$f1")"
+	[ -e "$f2" ] || f2="../$f2"
+	[ -e "$f2" ] || {
+		echo could not resolve "$f1"
+		exit 1
+	}
+	rm "$f1"
+	cp -p "$f2" "$f1"
+); done
+
+# resolve symlinks on windows
+[ "$OSTYPE" = msys ] &&
+(cd ../..; git ls-files -s | awk '/^120000/{print$4}') |
+while IFS= read -r x; do
+	[ $(wc -l <"$x") -gt 1 ] && continue
+	(cd "${x%/*}"; cp -p "../$(cat "${x##*/}")" ${x##*/})
+done
+
+rm -rf contrib
+[ $fast ] && sed -ri s/5730/10/ copyparty/web/Makefile
+(cd copyparty/web && make -j$(nproc) && rm Makefile)
+
+# build
 ./setup.py clean2
 ./setup.py sdist bdist_wheel --universal

--- a/scripts/make-sfx.sh
+++ b/scripts/make-sfx.sh
@@ -184,9 +184,9 @@ necho() {
 	mv {markupsafe,jinja2} j2/

 	necho collecting pyftpdlib
-	f="../build/pyftpdlib-1.5.6.tar.gz"
+	f="../build/pyftpdlib-1.5.7.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://github.com/giampaolo/pyftpdlib/archive/refs/tags/release-1.5.6.tar.gz;
+		(url=https://github.com/giampaolo/pyftpdlib/archive/refs/tags/release-1.5.7.tar.gz;
 		wget -O$f "$url" || curl -L "$url" >$f)

 	tar -zxf $f
--- a/scripts/prep.sh
+++ b/scripts/prep.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+set -e
+
+# general housekeeping before a release
+
+self=$(cd -- "$(dirname "$BASH_SOURCE")"; pwd -P)
+ver=$(awk '/^VERSION/{gsub(/[^0-9]/," ");printf "%d.%d.%d\n",$1,$2,$3}' copyparty/__version__.py)
+
+update_arch_pkgbuild() {
+    cd "$self/../contrib/package/arch"
+    rm -rf x
+    mkdir x
+
+    (echo "$self/../dist/copyparty-sfx.py"
+    awk -v self="$self" '
+        /^\)/{o=0}
+        /^source=/{o=1;next}
+        {
+            sub(/..pkgname./,"copyparty");
+            sub(/.*pkgver./,self "/..");
+            sub(/^ +"/,"");sub(/"/,"")
+        }
+        o&&!/https/' PKGBUILD
+    ) |
+    xargs sha256sum > x/sums
+
+    (awk -v ver=$ver '
+        /^pkgver=/{sub(/[0-9\.]+/,ver)};
+        /^sha256sums=/{exit};
+        1' PKGBUILD
+    echo -n 'sha256sums=('
+    p=; cat x/sums | while read s _; do
+        echo "$p\"$s\""
+        p='            '
+    done
+    awk '/^sha256sums=/{o=1} o&&/^\)/{o=2} o==2' PKGBUILD
+    ) >a
+    mv a PKGBUILD
+
+    rm -rf x
+}
+
+update_arch_pkgbuild
--- a/scripts/pyinstaller/build.sh
+++ b/scripts/pyinstaller/build.sh
@@ -9,7 +9,12 @@ tee build2.sh | cmp build.sh && rm build2.sh || {
    [[ $r =~ [yY] ]] && mv build{2,}.sh && exec ./build.sh
 }

-uname -s | grep WOW64 && m=64 || m=
+uname -s | grep WOW64 && m= || m=32
+uname -s | grep NT-10 && w10=1 || w7=1
+[ $w7 ] && pyv=37 || pyv=311
+
+appd=$(cygpath.exe "$APPDATA")
+spkgs=$appd/Python/Python$pyv/site-packages

 dl() { curl -fkLO "$1"; }

@@ -25,14 +30,23 @@ python copyparty-sfx.py --version

 rm -rf mods; mkdir mods
 cp -pR $TEMP/pe-copyparty/copyparty/ $TEMP/pe-copyparty/{ftp,j2}/* mods/
+[ $w10 ] && rm -rf mods/{jinja2,markupsafe}

 af() { awk "$1" <$2 >tf; mv tf "$2"; }

 rm -rf mods/magic/

-sed -ri /pickle/d mods/jinja2/_compat.py
-sed -ri '/(bccache|PackageLoader)/d' mods/jinja2/__init__.py
-af '/^class/{s=0}/^class PackageLoader/{s=1}!s' mods/jinja2/loaders.py
+[ $w7 ] && {
+    sed -ri /pickle/d mods/jinja2/_compat.py
+    sed -ri '/(bccache|PackageLoader)/d' mods/jinja2/__init__.py
+    af '/^class/{s=0}/^class PackageLoader/{s=1}!s' mods/jinja2/loaders.py
+}
+[ $w10 ] && {
+    sed -ri '/(bccache|PackageLoader)/d' $spkgs/jinja2/__init__.py
+    for f in nodes async_utils; do
+        sed -ri 's/\binspect\b/os/' $spkgs/jinja2/$f.py
+    done
+}

 sed -ri /fork_process/d mods/pyftpdlib/servers.py
 af '/^class _Base/{s=1}!s' mods/pyftpdlib/authorizers.py
@@ -44,25 +58,47 @@ read a b c d _ < <(
 )
 sed -r 's/1,2,3,0/'$a,$b,$c,$d'/;s/1\.2\.3/'$a.$b.$c/ <loader.rc >loader.rc2

-$APPDATA/python/python37/scripts/pyinstaller \
+excl=(
+    copyparty.broker_mp
+    copyparty.broker_mpw
+    ctypes.macholib
+    curses
+    inspect
+    multiprocessing
+    pdb
+    pickle
+    pyftpdlib.prefork
+    urllib.request
+    urllib.response
+    urllib.robotparser
+    zipfile
+)
+[ $w10 ] && excl+=(
+    PIL.ImageQt
+    PIL.ImageShow
+    PIL.ImageTk
+    PIL.ImageWin
+) || excl+=(
+    PIL
+    PIL.ExifTags
+    PIL.Image
+    PIL.ImageDraw
+    PIL.ImageOps
+)
+excl=( "${excl[@]/#/--exclude-module }" )
+
+$APPDATA/python/python$pyv/scripts/pyinstaller \
    -y --clean -p mods --upx-dir=. \
-    --exclude-module copyparty.broker_mp \
-    --exclude-module copyparty.broker_mpw \
-    --exclude-module curses \
-    --exclude-module ctypes.macholib \
-    --exclude-module inspect \
-    --exclude-module multiprocessing \
-    --exclude-module pdb \
-    --exclude-module pickle \
-    --exclude-module pyftpdlib.prefork \
-    --exclude-module urllib.request \
-    --exclude-module urllib.response \
-    --exclude-module urllib.robotparser \
-    --exclude-module zipfile \
+    ${excl[*]} \
    --version-file loader.rc2 -i loader.ico -n copyparty -c -F loader.py \
    --add-data 'mods/copyparty/res;copyparty/res' \
    --add-data 'mods/copyparty/web;copyparty/web'

 # ./upx.exe --best --ultra-brute --lzma -k dist/copyparty.exe

+printf $(sha512sum ~/Downloads/dist/copyparty.exe | head -c 18 | sed -r 's/(..)/\\x\1/g') |
+base64 | head -c12 >> dist/copyparty.exe
+
+dist/copyparty.exe --version
+
 curl -fkT dist/copyparty.exe -b cppwd=wark https://192.168.123.1:3923/copyparty$m.exe
--- a/scripts/pyinstaller/depchk.sh
+++ b/scripts/pyinstaller/depchk.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+set -e
+e=0
+
+cd ~/dev/pyi
+
+ckpypi() {
+	deps=(
+		altgraph
+		pefile
+		pyinstaller
+		pyinstaller-hooks-contrib
+		pywin32-ctypes
+		Jinja2
+		MarkupSafe
+		mutagen
+		Pillow
+	)
+	for dep in "${deps[@]}"; do
+		k=
+		echo -n .
+		curl -s https://pypi.org/pypi/$dep/json >h
+		ver=$(jq <h -r '.releases|keys|.[]' | sort -V | tail -n 1)
+		while IFS= read -r fn; do
+			[ -e "$fn" ] && k="$fn" && break
+		done < <(
+			jq -r '.releases["'"$ver"'"]|.[]|.filename' <h
+		)
+		[ -z "$k" ] && echo "outdated: $dep" && cp h "ng-$dep" && e=1
+	done
+	true
+}
+
+ckgh() {
+	deps=(
+		upx/upx
+	)
+	for dep in "${deps[@]}"; do
+		k=
+		echo -n .
+		while IFS= read -r fn; do
+			[ -e "$fn" ] && k="$fn" && break
+		done < <(
+			curl -s https://api.github.com/repos/$dep/releases | tee h |
+			jq -r 'first|.assets|.[]|.name'
+		)
+		[ -z "$k" ] && echo "outdated: $dep" && cp h "ng-$dep" e=1
+	done
+	true
+}
+
+ckpypi
+ckgh
+
+rm h
+exit $e
--- a/scripts/pyinstaller/deps.sha512
+++ b/scripts/pyinstaller/deps.sha512
@@ -1,17 +1,24 @@
 d5510a24cb5e15d6d30677335bbc7624c319b371c0513981843dc51d9b3a1e027661096dfcfc540634222bb2634be6db55bf95185b30133cb884f1e47652cf53  altgraph-0.17.3-py2.py3-none-any.whl
-91c025f7d94bcdf93df838fab67053165a414fc84e8496f92ecbb910dd55f6b6af5e360bbd051444066880c5a6877e75157bd95e150ead46e5c605930dfc50f2  future-0.18.2.tar.gz
-fd8ebead3572a924cd7a256efa67d9a63f49fe30a8890a82d8899c21b7b2411c6761460f334757411c9bf050d8485641e928ccb52455346bf0b5c2d5f89857bc  Git-2.38.1-32-bit.exe
-c06b3295d1d0b0f0a6f9a6cd0be861b9b643b4a5ea37857f0bd41c45deaf27bb927b71922dab74e633e43d75d04a9bd0d1c4ad875569740b0f2a98dd2bfa5113  importlib_metadata-5.0.0-py3-none-any.whl
-18f8070bfb13fe9b7005ed55c9d040465d1e4c0ddcc1e8adca9127070f8db7b32272fbe50622c1d5c937d9be3bb110167b6a55502e232e26d7da881a5342a9e3  pefile-2022.5.30.tar.gz
-4e71295da5d1a26c71a0baa8905fdccb522bb16d56bc964db636de68688c5bf703f3b2880cdeea07138789e0eb4506e06f9ccd0da906c89d2cb6d55ad64659ea  pip-22.3-py3-none-any.whl
-30aa0f3b15d17867f5d8a35e2c86462fa90cfefd3fde5733570a1f86ee75ee1b08550cce9fb34c94d9bb68efeaba26217e99b8b0769bb179c20f61c856057f07  pyinstaller-5.6.1-py3-none-win32.whl
-15319328d3ba5aee43e0b830fdf8030213622bc06e5959c0abf579a92061723b100b66325fea0b540de61b90acbbf3985c6ad6eacfc8ccd1c212d282d4e332ca  pyinstaller-5.6.1-py3-none-win_amd64.whl
-d2534bcf4b8ecc6708d02c6cc6b3c4d8dc3430db5d9a7d350b63239af097a84a325c3f9c3feddf9ebd82ceb8350d9239f79f8c9378fb5164c857f82b0fa25eb8  pyinstaller_hooks_contrib-2022.11-py2.py3-none-any.whl
-6bb73cc2db795c59c92f2115727f5c173cacc9465af7710db9ff2f2aec2d73130d0992d0f16dcb3fac222dc15c0916562d0813b2337401022020673a4461df3d  python-3.7.9-amd64.exe
-500747651c87f59f2436c5ab91207b5b657856e43d10083f3ce27efb196a2580fadd199a4209519b409920c562aaaa7dcbdfb83ed2072a43eaccae6e2d056f31  python-3.7.9.exe
+eda6c38fc4d813fee897e969ff9ecc5acc613df755ae63df0392217bbd67408b5c1f6c676f2bf5497b772a3eb4e1a360e1245e1c16ee83f0af555f1ab82c3977  Git-2.39.1-32-bit.exe
+17ce52ba50692a9d964f57a23ac163fb74c77fdeb2ca988a6d439ae1fe91955ff43730c073af97a7b3223093ffea3479a996b9b50ee7fba0869247a56f74baa6  pefile-2023.2.7-py3-none-any.whl
+85a041cc95cf493f5e2ebc2ca406d2718735e43951988810dc448d29e9ee0bcdb1ca19e0c22243441f45633969af8027469f29f6288f6830c724a3fa38886e5c  pyinstaller-5.8.0-py3-none-win32.whl
+adf0d23a98da38056de25e07e68921739173efc70fb9bf3f68d8c7c3d0d092e09efa69d35c0c9ecc990bc3c5fa62038227ef480ed06ddfaf05353f6e468f5dca  pyinstaller-5.8.0-py3-none-win_amd64.whl
+01d7f8125966ed30389a879ba69d2c1fd3212bafad3fb485317580bcb9f489e8b901c4d325f6cb8a52986838ba6d44d3852e62b27c1f1d5a576899821cc0ae02  pyinstaller_hooks_contrib-2023.0-py2.py3-none-any.whl
 132a5380f33a245f2e744413a0e1090bc42b7356376de5121397cec5976b04b79f7c9ebe28af222c9c7b01461f7d7920810d220e337694727e0d7cd9e91fa667  pywin32_ctypes-0.2.0-py2.py3-none-any.whl
 3c5adf0a36516d284a2ede363051edc1bcc9df925c5a8a9fa2e03cab579dd8d847fdad42f7fd5ba35992e08234c97d2dbfec40a9d12eec61c8dc03758f2bd88e  typing_extensions-4.4.0-py3-none-any.whl
-58d50f3639373e3e2adad3c52328a234a0ca527f8a520731c0f03911074610a9c90dbb9bfa93d1f9cbeab3245ec9e45527128f0295e4b7085b97d288a0b4a2fd  upx-4.0.0-win32.zip
+4b6e9ae967a769fe32be8cf0bc0d5a213b138d1e0344e97656d08a3d15578d81c06c45b334c872009db2db8f39db0c77c94ff6c35168d5e13801917667c08678  upx-4.0.2-win32.zip
+# win7
+91c025f7d94bcdf93df838fab67053165a414fc84e8496f92ecbb910dd55f6b6af5e360bbd051444066880c5a6877e75157bd95e150ead46e5c605930dfc50f2  future-0.18.2.tar.gz
+c06b3295d1d0b0f0a6f9a6cd0be861b9b643b4a5ea37857f0bd41c45deaf27bb927b71922dab74e633e43d75d04a9bd0d1c4ad875569740b0f2a98dd2bfa5113  importlib_metadata-5.0.0-py3-none-any.whl
+4e71295da5d1a26c71a0baa8905fdccb522bb16d56bc964db636de68688c5bf703f3b2880cdeea07138789e0eb4506e06f9ccd0da906c89d2cb6d55ad64659ea  pip-22.3-py3-none-any.whl
+6bb73cc2db795c59c92f2115727f5c173cacc9465af7710db9ff2f2aec2d73130d0992d0f16dcb3fac222dc15c0916562d0813b2337401022020673a4461df3d  python-3.7.9-amd64.exe
+500747651c87f59f2436c5ab91207b5b657856e43d10083f3ce27efb196a2580fadd199a4209519b409920c562aaaa7dcbdfb83ed2072a43eaccae6e2d056f31  python-3.7.9.exe
 68e1b618d988be56aaae4e2eb92bc0093627a00441c1074ebe680c41aa98a6161e52733ad0c59888c643a33fe56884e4f935178b2557fbbdd105e92e0d993df6  windows6.1-kb2533623-x64.msu
 479a63e14586ab2f2228208116fc149ed8ee7b1e4ff360754f5bda4bf765c61af2e04b5ef123976623d04df4976b7886e0445647269da81436bd0a7b5671d361  windows6.1-kb2533623-x86.msu
 ba91ab0518c61eff13e5612d9e6b532940813f6b56e6ed81ea6c7c4d45acee4d98136a383a25067512b8f75538c67c987cf3944bfa0229e3cb677e2fb81e763e  zipp-3.10.0-py3-none-any.whl
+# win10
+00558cca2e0ac813d404252f6e5aeacb50546822ecb5d0570228b8ddd29d94e059fbeb6b90393dee5abcddaca1370aca784dc9b095cbb74e980b3c024767fb24  Jinja2-3.1.2-py3-none-any.whl
+b1db6f5a79fc15391547643e5973cf5946c0acfa6febb68bc90fc3f66369681100cc100f32dd04256dcefa510e7864c718515a436a4af3a10fe205c413c7e693  MarkupSafe-2.1.2-cp311-cp311-win_amd64.whl
+4a20aeb52d4fde6aabcba05ee261595eeb5482c72ee27332690f34dd6e7a49c0b3ba3813202ac15c9d21e29f1cd803f2e79ccc1c45ec314fcd0a937016bcbc56  mutagen-1.46.0-py3-none-any.whl
+ea152624499966615ee74f2aefed27da528785e1215f46d61e79c5290bb8105fd98e9948938efbca9cd19e2f1dd48c9e712b4f30a4148a0ed5d1ff2dff77106e  Pillow-9.4.0-cp311-cp311-win_amd64.whl
+2b04b196f1115f42375e623a35edeb71565dfd090416b22510ec0270fefe86f7d397a98aabbe9ebfe3f6a355fe25c487a4875d4252027d0a61ccb64cacd7631d  python-3.11.2-amd64.exe
--- a/scripts/pyinstaller/deps.txt
+++ b/scripts/pyinstaller/deps.txt
@@ -1,16 +1,24 @@
 # links to download pages for each dep
 https://pypi.org/project/altgraph/#files
-https://pypi.org/project/future/#files
-https://pypi.org/project/importlib-metadata/#files
 https://pypi.org/project/pefile/#files
-https://pypi.org/project/pip/#files
 https://pypi.org/project/pyinstaller/#files
 https://pypi.org/project/pyinstaller-hooks-contrib/#files
 https://pypi.org/project/pywin32-ctypes/#files
-https://pypi.org/project/typing-extensions/#files
-https://pypi.org/project/zipp/#files
 https://github.com/git-for-windows/git/releases/latest
 https://github.com/upx/upx/releases/latest
+
+# win10 additionals
+https://pypi.org/project/Jinja2/#files
+https://pypi.org/project/MarkupSafe/#files
+https://pypi.org/project/mutagen/#files
+https://pypi.org/project/Pillow/#files
+
+# win7 additionals
+https://pypi.org/project/future/#files
+https://pypi.org/project/importlib-metadata/#files
+https://pypi.org/project/pip/#files
+https://pypi.org/project/typing-extensions/#files
+https://pypi.org/project/zipp/#files
 https://support.microsoft.com/en-us/topic/microsoft-security-advisory-insecure-library-loading-could-allow-remote-code-execution-486ea436-2d47-27e5-6cb9-26ab7230c704
  http://www.microsoft.com/download/details.aspx?familyid=c79c41b0-fbfb-4d61-b5d8-cadbe184b9fc
  http://www.microsoft.com/download/details.aspx?familyid=146ed6f7-b605-4270-8ec4-b9f0f284bb9e
--- a/scripts/pyinstaller/loader.py
+++ b/scripts/pyinstaller/loader.py
@@ -1,10 +1,30 @@
 # coding: utf-8

+import base64
+import hashlib
+import os
+import re
+import shutil
+import subprocess as sp
+import sys
+import traceback
+
 v = r"""

-this is the EXE edition of copyparty, compatible with Windows7-SP1
-and later. To make this possible, the EXE was compiled with Python
-3.7.9, which is EOL and does not receive security patches anymore.
+this 32-bit copyparty.exe is compatible with Windows7-SP1 and later.
+To make this possible, the EXE was compiled with Python 3.7.9,
+which is EOL and does not receive security patches anymore.
+
+if possible, for performance and security reasons, please use this instead:
+https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py
+"""
+
+if sys.version_info > (3, 10):
+    v = r"""
+
+this 64-bit copyparty.exe is compatible with Windows 8 and later.
+No security issues were known to affect this EXE at build time,
+however that may have changed since then.

 if possible, for performance and security reasons, please use this instead:
 https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py
@@ -16,14 +36,6 @@ except:
    print(v.replace("\n", "\n|| ")[1:] + "\n")


-import re
-import os
-import sys
-import shutil
-import traceback
-import subprocess as sp
-
-
 def confirm(rv):
    print()
    print("retcode", rv if rv else traceback.format_exc())
@@ -36,6 +48,30 @@ def confirm(rv):
    sys.exit(rv or 1)


+def ckck():
+    hs = hashlib.sha512()
+    with open(sys.executable, "rb") as f:
+        f.seek(-12, 2)
+        rem = f.tell()
+        esum = f.read().decode("ascii", "replace")
+        f.seek(0)
+        while rem:
+            buf = f.read(min(rem, 64 * 1024))
+            rem -= len(buf)
+            hs.update(buf)
+            if not buf:
+                t = "unexpected eof @ {} with {} left"
+                raise Exception(t.format(f.tell(), rem))
+
+        fsum = base64.b64encode(hs.digest()[:9]).decode("utf-8")
+        if fsum != esum:
+            t = "exe integrity check error; [{}] != [{}]"
+            raise Exception(t.format(esum, fsum))
+
+
+ckck()
+
+
 def meicln(mod):
    pdir, mine = os.path.split(mod)
    dirs = os.listdir(pdir)
--- a/scripts/pyinstaller/notes.txt
+++ b/scripts/pyinstaller/notes.txt
@@ -2,34 +2,46 @@ run ./build.sh in git-bash to build + upload the exe


 ## ============================================================
-## first-time setup on a stock win7x32sp1 vm:
+## first-time setup on a stock win7x32sp1 and/or win10x64 vm:
 ## 

 to obtain the files referenced below, see ./deps.txt

 download + install git (32bit OK on 64):
-http://192.168.123.1:3923/ro/pyi/Git-2.38.1-32-bit.exe
+http://192.168.123.1:3923/ro/pyi/Git-2.39.1-32-bit.exe

 ===[ copy-paste into git-bash ]================================
+uname -s | grep NT-10 && w10=1 || {
+  w7=1; uname -s | grep WOW64 && w7x64=1 || w7x32=1
+}
 fns=(
-  upx-4.0.0-win32.zip
-  pip-22.3-py3-none-any.whl
  altgraph-0.17.3-py2.py3-none-any.whl
+  pefile-2023.2.7-py3-none-any.whl
+  pyinstaller-5.8.0-py3-none-win_amd64.whl
+  pyinstaller_hooks_contrib-2023.0-py2.py3-none-any.whl
+  pywin32_ctypes-0.2.0-py2.py3-none-any.whl
+  upx-4.0.2-win32.zip
+)
+[ $w10 ] && fns+=(
+  mutagen-1.46.0-py3-none-any.whl
+  Pillow-9.4.0-cp311-cp311-win_amd64.whl
+  python-3.11.2-amd64.exe
+}
+[ $w7 ] && fns+=(
  future-0.18.2.tar.gz
  importlib_metadata-5.0.0-py3-none-any.whl
-  pefile-2022.5.30.tar.gz
-  pyinstaller_hooks_contrib-2022.11-py2.py3-none-any.whl
-  pywin32_ctypes-0.2.0-py2.py3-none-any.whl
+  pip-22.3-py3-none-any.whl
  typing_extensions-4.4.0-py3-none-any.whl
  zipp-3.10.0-py3-none-any.whl
 )
-uname -s | grep WOW64 && fns+=(
+[ $w7x64 ] && fns+=(
  windows6.1-kb2533623-x64.msu
-  pyinstaller-5.6.1-py3-none-win_amd64.whl
+  pyinstaller-5.8.0-py3-none-win_amd64.whl
  python-3.7.9-amd64.exe
-) || fns+=(
+)
+[ $w7x32 ] && fns+=(
  windows6.1-kb2533623-x86.msu
-  pyinstaller-5.6.1-py3-none-win32.whl
+  pyinstaller-5.8.0-py3-none-win32.whl
  python-3.7.9.exe
 )
 dl() { curl -fkLOC- "$1" && return 0; echo "$1"; return 1; }
@@ -45,12 +57,15 @@ manually install:
  python-3.7.9

 ===[ copy-paste into git-bash ]================================
+uname -s | grep NT-10 && w10=1 || w7=1
 cd ~/Downloads &&
 unzip upx-*-win32.zip &&
 mv upx-*/upx.exe . &&
 python -m ensurepip &&
 python -m pip install --user -U pip-*.whl &&
-python -m pip install --user -U pyinstaller-*.whl pefile-*.tar.gz pywin32_ctypes-*.whl pyinstaller_hooks_contrib-*.whl altgraph-*.whl future-*.tar.gz importlib_metadata-*.whl typing_extensions-*.whl zipp-*.whl &&
+{ [ $w7 ] || python -m pip install --user -U mutagen-*.whl Pillow-*.whl; } &&
+{ [ $w10 ] || python -m pip install --user -U future-*.tar.gz importlib_metadata-*.whl typing_extensions-*.whl zipp-*.whl; } &&
+python -m pip install --user -U pyinstaller-*.whl pefile-*.whl pywin32_ctypes-*.whl pyinstaller_hooks_contrib-*.whl altgraph-*.whl &&
 cd &&
 rm -f build.sh &&
 curl -fkLO https://192.168.123.1:3923/cpp/scripts/pyinstaller/build.sh &&
@@ -59,6 +74,14 @@ echo ok
 # sed -ri 's/, bestopt, /]+bestopt+[/' $APPDATA/Python/Python37/site-packages/pyinstaller/building/utils.py
 # sed -ri 's/(^\s+bestopt = ).*/\1["--best","--lzma","--ultra-brute"]/' $APPDATA/Python/Python37/site-packages/pyinstaller/building/utils.py

+===[ win10: copy-paste into git-bash ]=========================
+appd=$(cygpath.exe "$APPDATA")
+curl -fkLO https://192.168.123.1:3923/cpp/scripts/uncomment.py &&
+#for f in $appd/Python/Python311/site-packages/mutagen/*.py; do awk -i inplace '/^\s*def _?(save|write)/{sub(/d.*/,"    ");s=$0;ns=length(s)} ns&&/[^ ]/&&substr($0,0,ns)!=s{ns=0} !ns' "$f"; done &&
+python uncomment.py $appd/Python/Python311/site-packages/{mutagen,PIL,jinja2,markupsafe}/*.py &&
+sed -ri 's/--lzma/--best/' $APPDATA/Python/Python311/site-packages/pyinstaller/building/utils.py &&
+echo ok
+

 ## ============================================================
 ## notes
--- a/scripts/sfx.ls
+++ b/scripts/sfx.ls
@@ -11,6 +11,7 @@ copyparty/broker_mp.py,
 copyparty/broker_mpw.py,
 copyparty/broker_thr.py,
 copyparty/broker_util.py,
+copyparty/cfg.py,
 copyparty/dxml.py,
 copyparty/fsutil.py,
 copyparty/ftpd.py,
--- a/setup.py
+++ b/setup.py
@@ -4,7 +4,6 @@ from __future__ import print_function

 import os
 import sys
-import subprocess as sp
 from shutil import rmtree
 from setuptools import setup, Command

@@ -29,12 +28,6 @@ with open(here + "/README.md", "rb") as f:
    txt = f.read().decode("utf-8")
    long_description = txt

-try:
-    cmd = "bash scripts/genlic.sh copyparty/res/COPYING.txt"
-    sp.Popen(cmd.split()).wait()
-except:
-    pass
-
 about = {}
 if not VERSION:
    with open(os.path.join(here, NAME, "__version__.py"), "rb") as f:
@@ -84,7 +77,11 @@ class clean2(Command):
 args = {
    "name": NAME,
    "version": about["__version__"],
-    "description": "http file sharing hub",
+    "description": (
+        "Portable file server with accelerated resumable uploads, "
+        + "deduplication, WebDAV, FTP, zeroconf, media indexer, "
+        + "video thumbnails, audio transcoding, and write-only folders"
+    ),
    "long_description": long_description,
    "long_description_content_type": "text/markdown",
    "author": "ed",
@@ -95,8 +92,6 @@ args = {
        "Development Status :: 5 - Production/Stable",
        "License :: OSI Approved :: MIT License",
        "Programming Language :: Python",
-        "Programming Language :: Python :: 2",
-        "Programming Language :: Python :: 2.7",
        "Programming Language :: Python :: 3",
        "Programming Language :: Python :: 3.3",
        "Programming Language :: Python :: 3.4",
@@ -146,4 +141,7 @@ args = {
    "cmdclass": {"clean2": clean2},
 }

+if sys.version_info < (3, 8):
+    args["install_requires"].append("ipaddress")
+
 setup(**args)
--- a/tests/util.py
+++ b/tests/util.py
@@ -98,7 +98,7 @@ class Cfg(Namespace):
    def __init__(self, a=None, v=None, c=None):
        ka = {}

-        ex = "daw dav_inf dav_mac e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp ed emp force_js getmod hardlink ihead magic never_symlink nid nih no_acode no_athumb no_dav no_dedup no_del no_dupe no_logues no_mv no_readme no_robots no_sb_md no_sb_lg no_scandir no_thumb no_vthumb no_zip nw xdev xlink xvol"
+        ex = "daw dav_inf dav_mac dotsrch e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp ed emp force_js getmod hardlink ihead magic never_symlink nid nih no_acode no_athumb no_dav no_dedup no_del no_dupe no_logues no_mv no_readme no_robots no_sb_md no_sb_lg no_scandir no_thumb no_vthumb no_zip nrand nw rand vc xdev xlink xvol"
        ka.update(**{k: False for k in ex.split()})

        ex = "dotpart no_rescan no_sendfile no_voldump plain_ip"
@@ -107,13 +107,13 @@ class Cfg(Namespace):
        ex = "css_browser hist js_browser no_forget no_hash no_idx"
        ka.update(**{k: None for k in ex.split()})

-        ex = "df loris re_maxage rproxy rsp_slp s_wr_slp theme themes turbo"
+        ex = "df loris re_maxage rproxy rsp_jtr rsp_slp s_wr_slp theme themes turbo"
        ka.update(**{k: 0 for k in ex.split()})

        ex = "doctitle favico html_head lg_sbf log_fk md_sbf mth textfiles R RS SR"
        ka.update(**{k: "" for k in ex.split()})

-        ex = "xad xar xau xbd xbr xbu xm"
+        ex = "xad xar xau xbd xbr xbu xiu xm"
        ka.update(**{k: [] for k in ex.split()})

        super(Cfg, self).__init__(
Author	SHA1	Message	Date
ed	c39c93725f	v1.6.7	2023-03-05 20:18:16 +00:00
ed	d00f0b9fa7	ftp: support filezilla mkdir	2023-03-05 20:18:02 +00:00
ed	01cfc70982	add example for webdav automount	2023-03-05 19:52:45 +00:00
ed	e6aec189bd	fix flickering toast on upload finish	2023-03-05 19:49:54 +00:00
ed	c98fff1647	fix chunkpost-handshake race (affects --no-dedup only); a handshake arriving in the middle of the final chunk could cause dupes to become empty -- worst case leading to loss of data	2023-03-05 19:45:50 +00:00
ed	0009e31bd3	heavy webworker load can park the main thread of a background chrome tab for 10sec; piggyback some pokes off postmessage	2023-03-02 22:35:32 +00:00
ed	db95e880b2	thats not how it works	2023-02-28 22:19:06 +00:00
ed	e69fea4a59	exe: update screenshots	2023-02-26 22:26:40 +00:00
ed	4360800a6e	update archpkg to 1.6.6	2023-02-26 22:11:56 +00:00
ed	b179e2b031	prisonparty: ignore unresolvable mount paths; allows startup even if some locations are missing, for example if a server rebooted and some disks aren't up yet	2023-02-26 22:11:15 +00:00
ed	ecdec75b4e	v1.6.6	2023-02-26 20:30:17 +00:00
ed	5cb2e33353	update readmes + fix typo	2023-02-26 19:22:54 +00:00
ed	43ff2e531a	add deadline for filling data into a reserved filename	2023-02-26 19:13:35 +00:00
ed	1c2c9db8f0	retain upload time (but not ip) on file reindex	2023-02-26 19:09:24 +00:00
ed	7ea183baef	let http thread handle upload verification plugins	2023-02-26 19:07:49 +00:00
ed	ab87fac6d8	db got the wrong lastmod when linking dupes	2023-02-26 18:52:04 +00:00
ed	1e3b7eee3b	dont rmdir volume top on cleanup	2023-02-26 18:28:37 +00:00
ed	4de028fc3b	let controlpanel rescan button override lack of e2dsa	2023-02-26 18:27:10 +00:00
ed	604e5dfaaf	improve error handling / messages	2023-02-26 18:26:13 +00:00
ed	05e0c2ec9e	add xiu (batching hook; runs on idle after uploads) + bunch of tweaks/fixes for hooks	2023-02-26 18:23:32 +00:00
ed	76bd005bdc	cgen fixes	2023-02-21 19:42:08 +00:00
ed	5effaed352	add reminder that SSDP launches IE by default	2023-02-21 19:38:35 +00:00
ed	cedaf4809f	add exe integrity selfcheck	2023-02-21 19:18:10 +00:00
ed	6deaf5c268	add jitter simlation	2023-02-20 21:34:30 +00:00
ed	9dc6a26472	webdav.bat and readme tweaks	2023-02-20 21:00:04 +00:00
ed	14ad5916fc	freebsd: fancy console listing for fetch	2023-02-19 22:14:21 +00:00
ed	1a46738649	raise edgecases (broken envs on windows)	2023-02-19 22:13:33 +00:00
ed	9e5e3b099a	add optional deps to quickstart section	2023-02-19 22:13:02 +00:00
ed	292ce75cc2	return to previous url after login	2023-02-19 19:58:15 +00:00
ed	ce7df7afd4	update platform support listing	2023-02-19 15:16:50 +00:00
ed	e28e793f81	whoops	2023-02-19 15:11:04 +00:00
ed	3e561976db	optimize docker build times (884 to 379 sec)	2023-02-19 14:19:35 +00:00
ed	273a4eb7d0	list supported platforms	2023-02-19 01:00:37 +00:00
ed	6175f85bb6	more docker images for arm, arm64, s390x	2023-02-19 00:50:07 +00:00
ed	a80579f63a	build docker for x32 aarch64 armhf ppc64 s390x	2023-02-18 23:04:55 +00:00
ed	96d6bcf26e	if non-TLS, show warning in the login form	2023-02-17 22:49:03 +00:00
ed	49e8df25ac	ie11: support back button	2023-02-17 22:21:13 +00:00
ed	6a05850f21	also undupe search hits from overlapping volumes	2023-02-17 20:48:57 +00:00
ed	5e7c3defe3	update pypi description + docker links	2023-02-16 19:56:57 +00:00
ed	6c0987d4d0	mention --daw	2023-02-15 17:51:20 +00:00
ed	6eba9feffe	condense uploads listing on view change	2023-02-14 21:58:15 +00:00
ed	8adfcf5950	win10-based copyparty64.exe	2023-02-14 21:50:14 +00:00
ed	36d6fa512a	mention upcoming libopenmpt availability	2023-02-13 06:57:47 +00:00
ed	79b6e9b393	update archpkg to 1.6.5	2023-02-12 15:38:03 +00:00
ed	dc2e2cbd4b	v1.6.5	2023-02-12 14:11:45 +00:00
ed	5c12dac30f	most ffmpeg builds dont support compressed modules	2023-02-12 14:02:43 +00:00
ed	641929191e	fix reading smb shares on windows	2023-02-12 13:59:34 +00:00
ed	617321631a	docker: add annotations	2023-02-11 21:10:28 +00:00
ed	ddc0c899f8	update archpkg to 1.6.4	2023-02-11 21:01:45 +00:00
ed	cdec42c1ae	v1.6.4	2023-02-11 18:02:05 +00:00
ed	c48f469e39	park all clients waiting for a transcode	2023-02-11 17:23:29 +00:00
ed	44909cc7b8	print ffmpeg download url on windows	2023-02-11 17:22:24 +00:00
ed	8f61e1568c	transcode chiptunes to opus; * new audio/MPT formats: apac bonk dfpwm ilbc it itgz itr itz mo3 mod mptm mt2 okt s3gz s3m s3r s3z xm xmgz xmr xmz xpk * new image/PIL formats: blp dcx emf eps fits flc fli fpx im j2k j2p psd spi wmf	2023-02-11 11:17:37 +00:00
ed	b7be7a0fd8	mirror docker images to ghcr	2023-02-10 23:40:30 +00:00
ed	1526a4e084	add docker packaging	2023-02-10 23:02:01 +00:00
ed	dbdb9574b1	doc-browser: fix md scaling + download hotkey	2023-02-10 21:33:48 +00:00
ed	853ae6386c	config load summary + safer windows defaults	2023-02-10 21:32:42 +00:00
ed	a4b56c74c7	support long filepaths on win7 + misc windows fixes	2023-02-10 18:37:37 +00:00
ed	d7f1951e44	fix --cgen for 'g' perms	2023-02-08 22:38:21 +00:00
ed	7e2ff9825e	ensure -e2tsr takes effect by ignoring dhash	2023-02-08 22:33:02 +00:00
ed	9b423396ec	better description for anonymous permissions	2023-02-07 20:12:45 +00:00
ed	781146b2fb	describe all database volflags in --help-flags	2023-02-07 20:07:06 +00:00
ed	84937d1ce0	add v2 config syntax (#20 )	2023-02-07 19:54:08 +00:00
ed	98cce66aa4	cgen: update set of multivalue keys	2023-02-06 07:26:23 +00:00
ed	043c2d4858	cgen: fix permissions listing	2023-02-06 07:23:35 +00:00
ed	99cc434779	add config explainer + generator (#20 )	2023-02-05 22:09:17 +00:00
ed	5095d17e81	more interesting config example	2023-02-05 21:32:20 +00:00
ed	87d835ae37	dont allow multiple volumes at the same fs-path	2023-02-05 21:16:36 +00:00
ed	6939ca768b	pkg/arch: add prisonparty	2023-02-05 00:07:04 +00:00
ed	e3957e8239	systemd: prisonparty improvements	2023-02-05 00:03:40 +00:00
ed	4ad6e45216	only load *.conf files when including a folder	2023-02-05 00:01:10 +00:00
ed	76e5eeea3f	prisonparty: fix reload signal	2023-02-05 00:00:18 +00:00
ed	eb17f57761	pypi fixes	2023-02-04 17:35:20 +00:00
ed	b0db14d8b0	indicate forced-randomized filenames	2023-02-04 15:18:09 +00:00
ed	2b644fa81b	don't alias randomized filenames	2023-02-04 13:41:43 +00:00
ed	190ccee820	add optional version number on controlpanel	2023-02-04 13:41:34 +00:00
JeremyStarTM	4e7dd32e78	Added "wow this is better than nextcloud" (#19 ) * Added "wow this is better than nextcloud"	2023-02-04 13:00:16 +00:00
john smith	5817fb66ae	goddamn tabs	2023-02-03 12:50:17 +01:00
john smith	9cb04eef93	misc PKGBUILD fixes	2023-02-03 12:50:17 +01:00
john smith	0019fe7f04	indent PKGBUILD with spaces instead of tabs	2023-02-03 12:50:17 +01:00
john smith	852c6f2de1	remove unnecessary dependencies from PKGBUILD	2023-02-03 12:50:17 +01:00
john smith	c4191de2e7	improve PKGBUILD based on stuff in https://github.com/9001/copyparty/issues/17	2023-02-03 12:50:17 +01:00
ed	4de61defc9	add a link exporter to the unpost ui too	2023-02-02 22:57:59 +00:00
ed	0aa88590d0	should generalize this somehow	2023-02-02 22:35:13 +00:00
ed	405f3ee5fe	adjustable toast position	2023-02-02 22:28:31 +00:00
ed	bc339f774a	button to show/copy links for all recent uploads	2023-02-02 22:27:53 +00:00
ed	e67b695b23	show filekeys in recent-uploads ui	2023-02-02 21:22:51 +00:00
ed	4a7633ab99	fix outdated docs mentioned in #17 sry	2023-02-02 20:12:32 +00:00
john smith	c58f2ef61f	fix PKGBUILD more	2023-02-02 20:48:20 +01:00
john smith	3866e6a3f2	fix PKGBUILD indentation	2023-02-02 20:30:48 +01:00
john smith	381686fc66	add PKGBUILD	2023-02-02 20:30:48 +01:00
ed	a918c285bf	up2k-ui: button to randomize upload filenames	2023-02-01 22:26:18 +00:00
ed	1e20eafbe0	volflag to randomize all upload filenames	2023-02-01 21:58:01 +00:00
ed	39399934ee	v1.6.3	2023-01-31 21:03:43 +00:00
ed	b47635150a	shove #files aside while prologue sandbox is loading	2023-01-31 21:02:58 +00:00
ed	78d2f69ed5	prisonparty: support opus transcoding on debian libblas.so and liblapack.so are symlinks into /etc/alternatives	2023-01-31 20:50:59 +00:00
ed	7a98dc669e	block alerts in sandbox by default + add translation	2023-01-31 19:16:28 +00:00
ed	2f15bb5085	include filesize in notification	2023-01-31 19:03:13 +00:00
ed	712a578e6c	indicate when a readme/logue was hidden	2023-01-31 19:01:24 +00:00
ed	d8dfc4ccb2	support davfs2 LOCK (uploads) + misc windows support + logue filtering	2023-01-31 18:53:38 +00:00
ed	e413007eb0	hide dotfiles from search results by default	2023-01-31 18:13:33 +00:00
ed	6d1d3e48d8	sandbox height didnt account for scrollbars	2023-01-31 17:54:04 +00:00
ed	04966164ce	more iframe-resize-concealing tricks	2023-01-31 17:43:21 +00:00
ed	8b62aa7cc7	unlink files before replacing them to avoid hardlink-related surprises	2023-01-31 17:17:18 +00:00
ed	1088e8c6a5	optimize	2023-01-30 22:53:27 +00:00
ed	8c54c2226f	cover up most of the layout jank	2023-01-30 22:52:16 +00:00
ed	f74ac1f18b	fix sandbox lag by helping the iframe cache js	2023-01-30 22:36:05 +00:00
ed	25931e62fd	and nofollow the basic-browser link too	2023-01-29 22:15:22 +00:00
ed	707a940399	add nofollow to zip links	2023-01-29 22:10:03 +00:00
ed	87ef50d384	doc	2023-01-29 21:23:48 +00:00