altersend - Moses Yebei

The Problem

Users need to move large files between personal devices without relying on third‑party cloud services. Conventional file‑sharing services introduce storage costs, privacy concerns, and size caps, forcing users to split or compress data before transfer.

What This Does

AlterSend implements a peer‑to‑peer (P2P) file‑transfer layer wrapped in native desktop (Electron) and mobile (React Native) front‑ends. The desktop entry point is apps/desktop/src/electron/main.ts, which boots the Electron main process, creates the window, and loads the React renderer (apps/desktop/src/renderer/App.tsx). The UI components (e.g., SendPage/SelectFilesView.tsx, ReceivePage/ReceiveFileList.tsx) invoke the bridge API (apps/desktop/src/renderer/api/bridgeApi.ts). That API forwards requests over IPC to the main process (apps/desktop/src/electron/ipc.ts), where the core transfer logic lives in runtime.ts, fileScan.ts, and sendToShortcut.ts. Persistent user data (paired devices, download location, account info) is stored via the JSON store helpers in apps/desktop/src/electron/store/.

On mobile, the native side lives in apps/mobile/modules/transfer-service (Android build.gradle and package.json) and apps/mobile/modules/media-store. The React‑Native UI (apps/mobile/app/(tabs)/send/index.tsx, receive/index.tsx) calls the same logical API exposed by the native module, which ultimately uses the same transport codebase found under packages/ (not listed in detail but referenced by the desktop and mobile modules).

How It Is Wired

Startup – npm install (root) installs all workspaces. Running npm run desktop:start (script defined in apps/desktop/package.json) executes electron . which loads src/electron/main.ts.
Main Process – main.ts creates the BrowserWindow, registers IPC channels via ipc.ts, and calls runtime.start() to spin up the P2P service.
IPC Bridge – UI actions call bridgeApi.sendFiles(files) → ipcRenderer.invoke('transfer:start', …). The main process handler in ipc.ts forwards to runtime.startTransfer(files).
Transfer Engine – runtime.ts uses fileScan.ts to enumerate file metadata, then starts a local HTTP/WebRTC listener (implementation inside runtime and the native transfer-service module). It generates a short URL stored in store/accountStore.ts.
Link Distribution – The generated URL is returned via IPC, displayed in the renderer (SendPage/ShareView.tsx). The receiver opens the link in a browser or the mobile app, which contacts the sender’s listener through the signalling path (external STUN/TURN server not in repo).
Reception – ReceivePage/ReceiveFileList.tsx subscribes to the transfer session via bridgeApi.acceptTransfer(id), which routes to ipc.ts → runtime.acceptTransfer. Files are streamed directly to the download location defined in store/downloadLocation.ts.
State Persistence – All pairing and config data flow through the JSON store helpers (createJsonStore.ts, writeFileViaTemp.ts).

The most “blast‑radius” module is runtime.ts; it orchestrates network sockets, file I/O, and IPC, so any change to its public API will ripple through both desktop and mobile modules. The IPC layer (ipc.ts) is a thin, well‑bounded façade, making it the preferred extension point for new features.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/alterset.git
cd altersend

# Install all workspace dependencies
npm ci

# Desktop (macOS/Windows/Linux)
npm run desktop:start   # launches Electron with hot reload

# Mobile (iOS/Android) – Expo managed workflow
cd apps/mobile
npm run ios   # or `npm run android` for Android

Environment variables are read from the example files apps/desktop/.env.example and apps/mobile/.env.example; copy them to .env before running if you need to override defaults (e.g., custom signalling server URL).

Real‑World Use

A developer can embed AlterSend into an internal toolchain: a CI job builds a large artifact, then the engineer launches the desktop app, selects the artifact, and shares the generated link with a remote teammate. The teammate opens the link on their mobile device, and the file streams directly over the internet without ever hitting a corporate proxy or cloud bucket.

Code Health & Issues

Low – No critical structural warnings – tests (*.test.ts), CI workflows (.github/workflows/*.yml), and license (LICENSE) are present.
Medium – Monorepo complexity – packages/ holds 534 files but no explicit documentation of internal module boundaries; a newcomer must explore to locate the core transfer library.
Low – Limited automated release validation – CI runs lint and tests but does not verify that the generated installers (apps/desktop/build/*) are signed on every platform.

The Bottom Line

AlterSend provides a functional, cross‑platform P2P file‑transfer stack with a clear Electron main‑process → renderer → IPC wiring. The codebase is reasonably healthy, though the core transfer engine is concentrated in a few files, so changes there require care. It is suitable for teams that need an open‑source, no‑cloud alternative for moving large assets between devices.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,029 files

TypeScript497
TSX198
JSON166
Markdown16
YAML10
CSS7

ReactExpress

Module dependencies

The 10 most depended-upon modules of 721, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ponents_src_theme_tokens_css["tokens.css"] n1_s_components_src_theme_index["index"] n2_p_src_renderer_api_bridgeApi["bridgeApi"] n3_ore_src_worklet_rpc_protocol["protocol"] n4_s_components_src_icons_index["index"] n5_let_transfer_control_channel["control-channel"] n6_orklet_peers_remembered_peer["remembered-peer"] n7_es_domain_src_transfer_store["store"] n8__core_src_worklet_rpc_events["events"] n9_entity_device_identity_store["device-identity-store"] n1_s_components_src_theme_index --> n0_ponents_src_theme_tokens_css n8__core_src_worklet_rpc_events --> n6_orklet_peers_remembered_peer n3_ore_src_worklet_rpc_protocol --> n5_let_transfer_control_channel n3_ore_src_worklet_rpc_protocol --> n6_orklet_peers_remembered_peer n3_ore_src_worklet_rpc_protocol --> n9_entity_device_identity_store n3_ore_src_worklet_rpc_protocol --> n8__core_src_worklet_rpc_events n5_let_transfer_control_channel --> n9_entity_device_identity_store classDef cyc stroke:#ef4444,stroke-width:2px; class n5_let_transfer_control_channel cyc;

Dependencies

7 of 43 declared dependencies are a major version behind. Resolved 39 of 43 against the registry.

Package	Declared	Latest	Behind
`electron`	^40.2.1	43.4.0	3 major
`typescript`	^5.9.3	7.0.2	2 major
`@electron/notarize`	^2.2.1	3.1.1	1 major
`@types/node`	^25.4.0	26.2.0	1 major
`@vitejs/plugin-react`	^5.2.0	6.0.5	1 major
`dotenv`	^16.6.1	17.4.2	1 major
`vite`	^7.3.1	8.2.1	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium5

low1

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

cloudflare/wrangler-action@v3, softprops/action-gh-release@v2, signpath/github-action-submit-signing-request@v1

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/checks.yml

2 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

11 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium10 occurrences

assets/fonts/NotoSans-SC-Regular.ttf

10 blobs over 5MB: NotoSans-SC-Regular.ttf 10.1MB, NotoSans-SC-Bold.ttf 10.1MB, altersend-desktop-demo-v1.mov 8.3MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/checks.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/checks.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.