$ show schollz/croc
croc is a secure, peer-to-peer file transfer tool that operates via a relay server for NAT traversal. It uses Password Authenticated Key Exchange (PAKE) for authentication and end-to-end encryption (AES-GCM or ChaCha20-Poly1305) to protect data in transit. The application consists of a Go CLI client, a standalone web server (croc-web), and a React/Vite web frontend that uses WebAssembly to perform crypto operations in the browser. Files are split into chunks, optionally compressed, and transferred over multiple TCP connections with resume support. The tool also supports an asynchronous 'stored transfer' mode where encrypted files are temporarily stored on the relay server and can be downloaded by recipients using access tokens. The codebase is well-structured with a custom CLI framework, modular crypto and compression packages, and a comprehensive test suite covering core transfer logic, security properties, and end-to-end browser tests. The web client includes a blog with deep technical articles about the protocol design.
The LLM identified 5 files worth highlighting for reuse:
A self-contained, forked CLI framework (originally urfave/cli) that provides command registration, flag handling, help rendering, and bash/fish completion. It is fully isolated from the rest of the codebase and could be extracted into a standalone library with minimal modification.
Implements framed TCP communication using magic bytes ('croc' header), length-prefixed messages, and configurable timeouts. This reusable module handles connection establishment, read/write synchronization, and graceful shutdown, independent of the application logic.
Provides pooled DEFLATE compression and decompression with bounded decompression limits to prevent zip bombs. Uses sync.Pool for writer/reader reuse and supports automatic compression decisions based on file size. A clean, reusable compression utility.
A lightweight terminal styling library that supports ANSI colors, NO_COLOR convention, Windows colorable console, and minimal formatting. It is fully standalone and can be reused in any Go CLI tool needing basic terminal output.
A TypeScript abstraction around a Web Worker that runs Go-compiled WASM for PAKE, encryption, and hashing. It provides a clean async API and manages worker lifecycle, isolating the browser from WASM complexity. This pattern is reusable for any project needing cryptographic operations in the browser via Go WASM.