J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity
786 Commits 3 Branches 5 Tags
49595e48d7a0821c6605348cf849963ba2a8c3f3
Commit Graph
39 Commits
Author SHA1 Message Date
J3vbandClaude Fable 5 49595e48d7 release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292) 
* fix(admin): accept same-origin first-run setup requests

A freshly generated config.yaml leaves allowed_origins commented out, so the
list is empty. The setup handler's CSRF guard assumed "no Origin header means
same-origin", but browsers send Origin on same-origin POSTs too — Chrome and
Edge always, Firefox since 70. The admin panel's own setup call is one of those
POSTs, so every new install hit "cross-origin setup request blocked" and could
never create an owner account.

The guard now accepts a request whose Origin names the same host:port as the
request's own Host header, falling back to the allowlist otherwise. That is what
the original comment intended. CSRF protection is unaffected: a cross-site
attacker cannot set Origin, the browser does, and a foreign origin still needs
an explicit allowlist entry.

Scheme is not compared. Nothing in this server derives the external scheme (no
r.TLS or X-Forwarded-Proto handling exists anywhere), so a scheme check would
reject legitimate requests behind a TLS-terminating proxy.

Tests: isSameOrigin table covering port/host/suffix/schemeless/opaque-origin
cases, plus two handler-level tests pinning both halves — same-origin succeeds
against an empty allowlist, a foreign origin still 403s and creates no user.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat(identity): implement identity keypair caching and error handling

* fix(client): use the real OS credential store, not keyring's mock (#1281)

The `keyring` crate declares no `default` feature. Every platform arm in
its lib.rs selects a backend only when that platform's feature is on and
otherwise falls through to `pub use mock as default`, so the client's
bare `keyring = "3"` compiled the in-memory mock store on Windows, macOS
and Linux alike.

The mock keeps its secret in the `Entry` object itself, and each command
built its own `Entry`:

  save_identity_key -> Entry::new(..) -> set_password -> Ok(())
  load_identity_key -> Entry::new(..) -> get_password -> NoEntry

So a save reported success, the very next read in the same process
returned nothing, `NoEntry` was mapped to `Ok(None)` so neither side
logged anything, and no entry was ever written to Credential Manager on
any machine. Downstream, the voice-E2EE identity keypair was regenerated
on reconnect, the published identity key stopped matching the key that
signed the announce, and peers correctly rejected it as a possible MITM.

Name the platform backends explicitly, and stop trusting a store that
reports a write it did not keep:

- secret_store: read every write back and compare before reporting
  success. If the store returns a value we did not write, purge it so it
  cannot shadow the fallback on the next read.
- On Windows only, fall back to a DPAPI-protected file in the app data
  dir, engaged solely after a proven round-trip failure and cleared as
  soon as the real store works again. The account name is mixed into the
  DPAPI entropy so a blob cannot be moved between entries and decrypt.
  macOS/Linux report an error instead of writing secrets to plaintext.
- Log the compiled backend at startup and add `probe_credential_store`
  so an affected machine can be diagnosed from its own log file.
- Guard the regression: `compiled_keyring_backend_is_persistent` fails
  the build if the features are ever dropped again. Verified to fail
  against `keyring = "3"`.

The E2EE fail-closed posture is unchanged: a peer whose announce
signature does not verify is still rejected.

Linux builds now need `libdbus-1-dev` for the Secret Service backend.


Claude-Session: https://claude.ai/code/session_016oUHtEUWWxC79eB88GvX58

Co-authored-by: Claude <noreply@anthropic.com>

* fix(client, admin): make the settings panel, client, and admin panel do what they say (#1282)

* fix(client): make the settings panel do what it says

Functional review of every control in the settings overlay. Each fix below
closes a gap between what a control promised and what it did.

- Appearance: picking a theme no longer drops a saved accent colour.
  applyThemeByName strips every inline custom property from <body>, which
  includes the accent override; under neon-glow (whose body class sets
  --accent) the user's colour silently reverted until restart.
- Overlay: reopening the panel rebuilds the active tab. The Voice & Audio
  mic meter and camera preview are torn down on close, so a reopened panel
  showed a dead meter and a black preview; tabs also now re-read prefs.
  The Logs tab's live listener is released when you switch away from it.
- Status: the UserBar picker always started at "online" and never persisted,
  while the Account tab read a pref nobody else wrote — the two surfaces
  disagreed. Both now go through lib/userStatus, sync live via the
  pref-change event, and the saved status is re-asserted on connect.
- Notifications: Do Not Disturb now suppresses the desktop notification and
  the chime, as its description in the panel claims. The taskbar flash, a
  passive cue, stays.
- Keybinds: Ctrl+F, Ctrl+M, Ctrl+D, Ctrl+Shift+V and Ctrl+U were listed but
  unimplemented. They are wired now (voice ones only while in voice, all of
  them suspended while the settings panel is open). "Mark as Read" had no
  feature behind it at all and is replaced by the Escape behaviour that
  actually exists.
- Account: backup codes now carry a "you won't see them again" warning and a
  copy button; the change-password form requires the current password before
  spending a server attempt and disables itself while in flight.
- Advanced: removed the Hardware Acceleration toggle. Nothing read the
  preference it wrote — the webview decides GPU compositing before any JS
  runs, so honouring it needs a Rust startup change.
- The settings sidebar name/avatar follow a rename instead of going stale,
  and settings/helpers no longer keeps a drifted copy of lib/preferences
  (the copy lacked the write guard, so a failed save could throw).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* fix(client): close silent-failure gaps in the inline admin surface

Continuation of the settings-panel review into the rest of the client.

- Member context menu had no styling at all: AdminActions renders BEM class
  names (context-menu__item and friends) that appear nowhere in the CSS, so
  the menu had no hover, no danger colour, and the "Change Role" submenu
  pushed the menu open instead of flying out. Added the missing rules.
- The submenu offered a hardcoded admin/moderator/member list. On a server
  with custom roles those roles were unreachable, and picking a name that
  didn't resolve to a role id silently did nothing. Roles now come from the
  server's ready payload (owner excluded), and an unresolvable role reports
  an error instead of dead-ending.
- Kick / ban / delete-channel now show an in-flight state, and the two-click
  confirm disarms after a few seconds so a menu left open can't turn a stray
  click into a ban (docs/architecture/ux/settings-and-admin.md §3).
- Ban collects a reason, which the server already stores and displays
  (adminBanMember has always accepted one; the menu never passed it).
- Copying an invite code was silent: no confirmation, and a clipboard
  rejection looked identical to success. It now toasts either way.
- Creating an invite double-click-minted two of them, and revoking — which
  kills a live link — had neither a confirm nor an in-flight guard.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* fix(client): restore moderator message deletion and formatting

- The delete affordance was offered only on your own messages, so a
  moderator could not moderate anything from the client. It now also
  appears when the signed-in user's role carries MANAGE_MESSAGES, derived
  from the role bitmasks the server already sends in `ready` (this is what
  docs/architecture/ux/messaging.md §4 specifies as "Delete (own /
  moderator)"). lib/permissions.ts existed for exactly this and had no
  callers at all.
- Developer-mode "Copy ID" was silent on success and swallowed clipboard
  failures; it toasts either way now.
- prettier --write on AdminActions.ts (Client Static Checks).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* fix(admin): stop the panel reporting success it didn't have

Functional review of the server admin web panel.

- An expired admin session left the panel on screen toasting "invalid or
  expired session" for every action, with no way back to the login form —
  only the log-stream code handled it. api() now handles 401 centrally:
  clear the token, return to login, and say why.
- Deleting a backup called fetch() without looking at the response, so a
  failed delete reported "Backup deleted" and left the file in place. It
  now goes through api(), and — like every other destructive action here —
  asks for confirmation first.
- A failed update check rendered as "Up to date. You're running the latest
  version", which is a lie that hides a broken update path. It now says the
  check failed and why. A failed apply no longer leaves the button stuck on
  "Applying...".
- The Edit Channel modal could only rename. PATCH /channels/{id} accepts
  topic, slow_mode, position and archived, and the channel table has an
  Archived column — which was read-only state with no control behind it.
  All four are editable now.
- Banned users showed "Yes" with no reason, even though the ban reason is
  collected on ban and returned by the API. It's now displayed.
- Login and first-run setup had no in-flight guard, so a double-click spent
  two attempts against the login lockout / setup rate limit. Settings' Save
  stayed enabled after a successful save, implying unsaved changes.
- Clipboard copies (invite code, new API token) had no rejection path: a
  refused clipboard looked exactly like a successful copy.
- Backup names in inline onclick handlers go through jsq() like every other
  interpolated string.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* feat(admin): add the plugin management UI the backend already had

/api/v1/admin/plugins has exposed list/install/enable/disable/uninstall since
Phase C Step 9 — its own header says it "exposes plugin lifecycle operations
to the admin panel", and docs/architecture/ux/settings-and-admin.md tells
operators plugin management lives in the web panel. The panel had no Plugins
section at all, so installing a plugin meant hand-crafting a multipart POST.

Panel:
- Plugins section: installed table (name, manifest description and requested
  permissions, version, enabled state, install date), zip upload with the
  16 MB server cap stated up front, enable/disable, and uninstall behind a
  confirm. One lifecycle call at a time.
- The lifecycle API sits under a different prefix than the rest of the panel
  and answers errors as plain text (http.Error), not JSON, so it gets its own
  fetch helper — sharing api() would have surfaced "unexpected token" instead
  of the server's reason. 401 still routes back to login.

Server:
- PluginRow had no JSON tags, so the list marshalled Go field names and every
  column would have rendered empty. Now snake_case like the rest of the API.
- GET /plugins returns X-Plugin-Runtime: enabled|disabled. An empty list means
  "nothing installed" on a live runtime and "you can't install anything" on a
  disabled one; the body can't tell them apart, so the panel's empty state
  had no way to be honest about it.

The plugin-store test helper now hands back the database the registry writes
to — the existing happy-path test wired a *different* in-memory DB into the
handler, which is why nothing noticed the list was always empty.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* feat(client): gate the composer on slow mode instead of failing the send

Verified the optimistic message lifecycle against docs/architecture/ux —
pending → chat_send_ok → sent, failed rows with mapped reasons, retry and
delete-draft all behave as documented. One thing did not: slow mode.

The UX spec (§5) says slow mode should "disable send with a live countdown in
the composer; do not drop the drafted message". In practice the composer knew
nothing about it: you typed, sent, and got a red failed row back — the exact
enabled-then-rejected pattern §6.2 forbids. The client never even received the
channel's slow_mode value.

- Server: channel payloads (ready, channel_create, channel_update) now carry
  slow_mode alongside can_send, for the same reason can_send is there — the
  client can express the limit as affordance. The server still enforces.
- Client: after an accepted send the composer disables itself for the channel's
  cooldown with a per-second countdown, and a SLOW_MODE refusal restarts the
  full window (the server's limiter is the authority on when the next send is
  allowed). The draft stays in the textarea. Moderators, who bypass slow mode
  server-side, are not gated.
- The MANAGE_MESSAGES lookup added for moderator deletes moves into
  lib/permissions as currentUserPermissions/currentUserHasPermission/
  canManageMessages, so the composer and the message renderer share one
  definition instead of two.
- WsErrorCode listed 9 of the server's 16 codes: SLOW_MODE, CONFLICT,
  BAD_REQUEST, INVALID_JSON, UNKNOWN_TYPE, BAD_PAYLOAD, NOT_KEY_HOLDER and
  ALREADY_JOINED were missing, so code switching on it could not name cases
  the server actually sends. Now mirrors Server/ws/errors.go.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* fix(admin): make backup restore actually restart, and fail closed without a safety copy

Verification pass over the remaining review items. Two real defects in restore,
one duplicate resolved; cert TOFU and the replay path checked out as-is.

Restore:
- The handler closed the database, swapped the file underneath it, told the
  admin "database restored — server restarting", broadcast a 5-second restart
  countdown to every client... and then kept running. Nothing restarted it, so
  the server answered every subsequent request against a closed DB until an
  operator noticed. It now respawns for real, reusing the update-apply pattern
  (SpawnDetached → SIGTERM → os.Exit backstop) behind a test seam.
- A failed pre-restore backup was a warning, and the irreversible overwrite
  went ahead anyway — removing the safety net the panel explicitly promises
  ("A pre-restore backup will be created"), precisely when it matters. It now
  aborts with the database untouched.
- The safety copy was written to a cwd-relative "data/backups" while every
  other backup handler uses the absolute backupBaseDir, so a server started
  from another directory filed it somewhere the operator would never find.

Both new tests were confirmed to fail against the previous behaviour.

Client:
- SidebarArea kept a private 140-line copy of the member-list wiring that
  SidebarMemberSection already provides (the extracted, tested one was never
  imported). Fixing the silent role-change failure earlier meant patching both;
  now there is one copy.

Verified without changes: the optimistic send lifecycle (pending →
chat_send_ok → sent, failed rows with mapped reasons, retry, delete-draft),
reconnect replay (monotonic last_seq, dedup on reconnect, replay suppression
of unread/notifications), and cert TOFU (first-use and mismatch modals, accept
re-pins and reconnects, reject disconnects back to connect).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

* fix(admin): remove the data race in the restart test hook

CI (-race) failed identically on ubuntu and windows: TestHandleRestoreBackup_
Success polled a plain bool that the restore handler's goroutine wrote, and
swapped the restartSelf package var from the test goroutine while that handler
read it.

The hook is now behind a mutex with an atomic flag in StubRestart. Production
behaviour is unchanged — the race was entirely in the test seam I added.

Verified with `go test -race -count=2 ./admin/`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm

---------

Co-authored-by: Claude <noreply@anthropic.com>

* refactor + perf: split largest source files into modules; optimize hot paths (#1283)

* refactor(updater): split updater.go into cohesive files

Split the 1070-line updater.go into four files within the same package:
updater.go (core types, release checking), download.go (download and
tarball extraction), verify.go (signatures, checksums, staged binary),
and assets.go (client assets, text-asset cache, HTTP fetching).

Pure mechanical move — no behavior or API changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* refactor(ws): split hub.go into cohesive files

Split the 1289-line hub.go into five files within the same package:
hub.go (Hub struct, lifecycle, register/unregister), hub_broadcast.go
(broadcast fan-out and per-user sends), hub_events.go (sequencing,
replay, persistence), hub_sweep.go (stale client/session/voice
sweepers), and hub_livekit.go (LiveKit accessors).

Also optimizes wrapWithSeq on the hot broadcast path: build the seq
prefix with a single preallocated append + strconv.AppendUint instead
of fmt.Sprintf, halving allocations per broadcast message.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* refactor(client): extract E2EEManager from livekitSession

Move all client-side E2EE key-exchange logic (~550 lines) out of
LiveKitSession into a new E2EEManager class in livekitE2EE.ts: ECDH
keypair management, identity signing and TOFU pin verification,
announce/offer handling, key-holder election, membership rekeying, and
periodic key rotation. Dependencies are injected following the existing
roomEventHandlers pattern.

LiveKitSession keeps thin public delegates (handleE2EEAnnounce,
handleE2EEOffer, handleParticipantLeft, rePinPeerIdentity) so the
module-level bound exports and the public API are unchanged.
livekitSession.ts shrinks from 1955 to 1409 lines.

Adds focused unit tests for E2EEManager (key-holder setup, pending
announce queue, offer resolution, clearState, rotation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* perf(server): hot-path and query optimizations

Logging (biggest win): rewrite the admin log RingBuffer as a true ring
(fixed array + head/count) instead of allocating a fresh 2000-entry
slice + full copy per log line; gate the ring handler on a configurable
level instead of unconditional DEBUG capture; move the broadcast debug
log out of the seqMu critical section; drop the per-message slog.With
clone in the WS handler.

Database: new migration 019 adds idx_attachments_message (message pages
no longer scan the attachments table), a covering role-leading index on
channel_overrides (replacing a duplicate of the UNIQUE auto-index), a
partial index for pinned messages, and narrows the FTS trigger to
content changes only; ANALYZE runs after migrations. Rewrite
GetChannelUnreadCounts and GetUserDMChannels to correlated subqueries
that range-scan idx_messages_channel — O(unread) instead of O(all
messages) per WS connect. New GetUserDMChannelIDs replaces the full DM
query where only IDs are needed. CreateMessage/EditMessageContent use
RETURNING, removing the re-read after every send/edit.

Write-path contention: TouchSession throttled to once per minute per
session (was one UPDATE per authenticated request); EventPersister
flushes its batch in a single transaction with per-row fallback;
revoked-session and stale-voice sweeps run off the hub dispatch
goroutine with an in-flight guard, and session checks are batched into
one IN query; the rate limiter is sharded into 32 buckets with
allocation-free strconv key building (auth.Key).

WS structural: voice E2EE channel fan-out goes through the existing
pubsub voice topic instead of scanning every connected client under
h.mu; channelReadAudience memoizes role lookups per call;
hasChannelAccess drops its redundant duplicate permission check;
voice_join batches SPEAK/VIDEO/SCREENSHARE checks via
HasChannelPermBatch. Also: pubsub topic builders and NewAppMetrics
stop allocating via Sprintf/global mutex.

Verified with go test -race across all packages, go vet, gofmt, and
sqlc generate idempotency.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* perf(client): render-path, logging, and bundle optimizations

Logging: the logger no longer runs permanently at debug — level is set
from the environment at startup (debug in dev, info in prod), so every
hot-path debug entry stops being serialized, buffered, consoled, and
persisted to disk; per-URL debug logs in embed rendering removed.

Render path: MessageList's store selector is scoped to the mounted
channel, so messages in other channels no longer trigger re-renders,
and a new incremental tail-append fast path appends rows instead of
tearing down the whole window; Intl.DateTimeFormat instances are cached
at module level; parseTimestamp memoizes epoch millis; media prefs
(showEmbeds/inlineMedia/showLinkPreviews/animateGifs) are cached with
pref-change invalidation; members store gains a roleRevision counter so
MessageList stops rebuilding a role map on every presence/typing event.

MemberList patches presence changes in place (status dot + offline
class) via a row map instead of rebuilding every row, with single-pass
role grouping. ChannelSidebar splits its voice subscription into a
structural selector (excluding speaking) and a speaking-only patcher
using a cached element map instead of per-user querySelector on every
speaker event.

Memory: GIF/media elements are unobserved before the message window
discards them, fixing unbounded IntersectionObserver retention of
detached DOM (including frozen-frame data URLs).

Bundle: livekit-client (1.3 MB) moves to its own chunk via dynamic
imports and manualChunks; the READY handler's stale-voice check reads
the voice store instead of requiring the module synchronously.

Adds 11 focused tests (different-channel no-rerender, append fast path,
media release, presence patch, speaking patch). Full unit suite:
3606/3606 passing; typecheck, lint, and production build clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(ci): skip alloc test under deadlock tag; cut bcrypt cost in tests (#1284)

The deadlock-tag CI pass failed on TestRingBuffer_WriteDoesNotAllocate:
under -tags deadlock, syncutil.Mutex is the go-deadlock mutex whose Lock
allocates, so the steady-state ring write measures 1 alloc/call. Extend
the build constraint to !race && !deadlock — the test's guarantee is
about the ring buffer itself, which the -race-less default pass covers.

Make bcryptCost a var with an exported SetCostForTesting hook that also
resets the dummy timing pad, and call it with bcrypt.MinCost from the
api, auth, and admin TestMains. Password hashing at production cost 12
dominated those suites (~264 hashes): with the race detector the api
package alone took ~860s; it now runs in ~33s. Nothing under test
depends on hash strength, and no test asserts the cost.

Hygiene in the same pass: migration 020 drops idx_sessions_token and
idx_invites_code (exact duplicates of their UNIQUE auto-indexes, pure
write overhead) with updated db_test assertions; remove the dead
tar.TypeRegA comparison in the updater (stdlib normalises it to TypeReg
since Go 1.11); gofmt storage/storage.go comment alignment.


Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

Co-authored-by: Claude <noreply@anthropic.com>

* perf(ws): route hot-path permission checks through the cached PermissionService (#1285)

The ws package was the only major subsystem still doing live per-check
permission queries (GetRoleForUser + GetChannelPermissions per check):
a V2 voice join cost 9+ DB reads across its four gates, and every
channel broadcast resolved one role query per connected client.

Hub now holds svc.Permissions and the voice deps carry it (nil-safe:
bare test fixtures fall back to the existing live path, fail-closed
semantics preserved everywhere). Converted sites: the voice join and
token-refresh permission gates, USE_VIDEO/SHARE_SCREEN controls,
requireChannelAccess, channelReadAudience, and RefreshChannelVisibility.

Caching these is revocation-correct: every permission-changing mutation
already invalidates synchronously before hub fan-out (InvalidateUser on
role change, InvalidateAll on override change), the 30s TTL is only a
backstop, and the service's gen-counter guard prevents a populate that
races an invalidation from caching stale data — the audience-resolution
comments now document that invariant. The stale-voice sweeper's check
deliberately stays live: it is the last-line backstop for revocations
that might bypass an invalidation hook, runs once a minute for only
in-voice clients, and its eviction test pins exactly that guarantee.

requirePerm keeps its INTERNAL-vs-FORBIDDEN distinction by using the
cache only for positive verdicts and falling through to the live path
on denial.

Adds perm_cache_test.go: role-change invalidation is immediate (no TTL
wait), and a counting-store test proving the second check is served
from cache. All pinning tests (authz, voice_perm_stale, channel
visibility agreement, sweep eviction) pass unmodified.


Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

Co-authored-by: Claude <noreply@anthropic.com>

* perf + refactor: SQLite reader pool, async audits, real lazy-livekit, test splits, eslint 10 (#1286)

* perf(db): batch audit writes through an async writer

Audit inserts ran synchronously on the request path — including one
INSERT per WebSocket connect — each an implicit transaction on the
single SQLite connection.

WriteAudit keeps its exact signature and D8 policy (never fail the
caller, never silently discard): it now upgrades to an async path when
the passed Auditor also implements AsyncAuditor. *DB implements that
via an atomic pointer that main.go populates at server startup with an
AuditWriter modeled on the event persister (bounded queue, batched
single-transaction flush with per-row fallback, drain-on-stop, atomic
counters, non-blocking enqueue that error-logs drops without leaking
the detail field). The token CLI and tests never install a writer, so
they keep today's synchronous behavior with zero call-site changes.

The writer's Stop defer registers after database.Close's so the LIFO
unwind drains the queue before the DB shuts.

Adds audit_writer_test.go: batch flush, D8 drop logging, drain-on-stop,
flush-failure accounting, poison-row fallback, concurrent enqueue, and
seam tests pinning sync-without-writer vs async-with-writer behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* perf(client): actually defer livekit-client; honor saved log level at startup

The manualChunks split was cosmetic: index.html modulepreloaded the
531 kB livekit chunk and the entry statically imported it. All four
import chains from startup are now cut — auth.store's logout leaveVoice
and ptt's setMuted go through dynamic imports, applyStoredAppearance
moved to lib/appearance.ts so main.ts and ConnectPage stop pulling the
settings tree (whose overlay now loads on first open), and MainPage
itself is a dynamic import in renderPage, guarded against the
destroy-before-mount race by a navigation-generation helper and
pre-warmed once the socket connects.

Entry chunk drops 387 kB -> 114 kB (gzip 36 kB); index.html has no
modulepreload links; livekit/MainPage/SettingsOverlay/livekitSession
load as lazy chunks.

The logger now honors the Logs tab's saved minimum level at startup
(applyStoredLogLevel with the legacy-key migration moved into
lib/preferences.ts) and re-applies it live on pref changes.

Dead code: remove unreachable VoiceChannel.ts (superseded by
ChannelSidebar's renderer) and its test, plus all knip-flagged unused
re-exports in message-list/renderers.ts and ConnectPage's unused form
types — knip is now clean apart from pre-existing config hints.

Tests: +12 (navigation guard incl. stale-mount discard; logger startup
pref, migration, and live re-apply); ptt/stored-appearance updated for
dynamic-import plumbing only. Full suite 3593 passing; typecheck, lint,
and production build clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* perf(db): split SQLite into single-writer + multi-reader connection pools

The entire server serialized on one SQLite connection: every read
queued behind every other read and every write, throwing away WAL's
concurrent-reader capability.

File-backed databases now open two pools from a DSN that carries all
seven PRAGMAs as per-connection _pragma parameters (an Exec'd PRAGMA
only configures one arbitrary pooled connection — moving them into the
DSN is what makes >1 connection safe, foreign_keys included): a
single-connection writer with _txlock=immediate, and a reader pool
sized max(4, NumCPU). In-memory databases keep the exact historical
single-connection behavior, which preserves every :memory: test site
and the connection-scoped PRAGMA-toggle tests untouched.

Routing lives in a dbtx router implementing sqlc's DBTX: statements go
to the reader only when provably read-only (leading SELECT/PRAGMA after
skipping comments — necessary because sqlc routes INSERT/UPDATE/DELETE
... RETURNING through QueryRowContext/QueryContext, which must stay on
the writer); Exec, transactions, migrations, ANALYZE, VACUUM INTO, and
the SQLDb() escape hatch all pin to the writer. Every former sqlDB
reference across the package was re-pointed deliberately.

New pool_test.go pins the properties the split must preserve on a
file-backed DB: foreign_keys=1 across many reader connections, WAL
journal mode, FK enforcement through both write paths, 8x8
concurrent reader/writer hammering with exact row counts, and a read
completing against the pre-tx snapshot while a write transaction is
open — the property this change exists to unlock.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* test(client)+chore: split the two largest test files; eslint 10; audit clean

Split tests/unit/ws.test.ts (3340 lines) into ws-cert / ws-reconnect /
ws-messaging / ws-lifecycle plus a shared helpers/ws-mocks.ts module,
and tests/unit/audio-pipeline.test.ts (2547 lines) into core / gain /
vad-worklet / vad-fallback files. Test bodies moved verbatim; the
suite count is unchanged at 3593 passing.

Upgrade eslint 9 -> 10 (with @eslint/js 10; typescript-eslint's peer
range already covers v10, flat config unchanged, zero new findings)
and pin test-exclude ^8 via the existing overrides block so the
coverage chain picks up patched glob/minimatch/brace-expansion.
npm audit: 8 high -> 0 vulnerabilities.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* refactor(server): split remaining large files; dependency hygiene notes

Split ws/coverage_boost_test.go (2856 lines) into coverage_helpers /
chat / voice / voice_lifecycle / misc test files — bodies verbatim,
746 passing tests before and after. Split service/message.go (781)
into message_crud / message_reactions / message_query / message_perms
with types and the constructor staying put, and ws/serve.go (754) into
serve / serve_pumps / serve_auth / serve_ready.

Dependency findings (no changes needed): coraza-coreruleset's stale
Feb-2024 pseudo-version is unreachable from our code — it enters the
module graph only through coraza's own internal tests, and our WAF uses
inline directives, never the CRS (fresher rules would require adopting
the /v4 module and rewiring the WAF config — deliberate follow-up, not
hygiene); gogo/protobuf is likewise graph-only via the livekit SDK and
never built into our binaries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* style: satisfy golangci-lint modernize/staticcheck in new pool and audit code

CI's golangci-lint pass (not run locally until now) flagged the
Phase 3/4 additions: range-over-int loops, interface{} -> any on the
dbtx router, WaitGroup.Go in the pool tests, and a De Morgan
simplification in isReadOnlySQL's identifier-boundary check. Pure
style — verified against the same golangci-lint v2.11.3 binary CI
uses (0 issues) and re-ran db/ws race + deadlock suites green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

---------

Co-authored-by: Claude <noreply@anthropic.com>

* feat(waf) + fix(deps) + test(ws): OWASP CRS, Dependabot fixes, sleep-free ws tests (#1287)

* fix(deps): clear quick-xml RUSTSEC advisories in Tauri lockfile

cargo-audit identified the two Dependabot alerts on the default branch:
quick-xml 0.37.5 and 0.38.4 both carry RUSTSEC-2026-0194 (quadratic
runtime on duplicate-attribute checks) and RUSTSEC-2026-0195 (unbounded
namespace allocation DoS), fixed in >=0.41. Both were transitive:
plist 1.8.0 (via tauri) and tauri-winrt-notification 0.7.2 (via
notify-rust). Semver-compatible updates fix both — plist 1.10.0 moves
to quick-xml 0.41, and tauri-winrt-notification 0.7.3 drops quick-xml
entirely. cargo-audit is now clean of vulnerabilities; the remaining
20 informational notices are the unmaintained GTK3-binding crates
inherent to Tauri v2 on Linux. Verified plist compiles against
quick-xml 0.41 (full Tauri build needs the GTK/WebKit system libs CI
installs).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* feat(waf): layer the maintained OWASP Core Rule Set onto the WAF

The WAF previously ran six inline directives only — the CRS never
loaded (the old coreruleset dep was a stale graph-only pseudo-version).
A second Coraza engine now loads the embedded CRS from
coraza-coreruleset/v4 (v4.25.0), layered on top of the inline rules,
which stay byte-identical and keep blocking exactly as before.

CRS ships in a new server.waf_crs_mode knob (off|detect|block),
defaulting to detect: chat traffic is CRS-false-positive-prone (a new
test pins that block mode rejects benign SQL-ish chat prose at the
default threshold), so operators get rule-match visibility via
structured logs first and opt into blocking after tuning. Setup
mirrors the official connector: Host/Transfer-Encoding restored to the
transaction (else 920280 fires on everything), phase 2 always runs so
query-string attacks are scored, PUT/PATCH/DELETE added to the CRS
method policy for this REST API, body limits matched to the app's
1 MiB cap with uploads excluded from body access and the content-type
policy.

Also fixes a latent middleware bug: the body was previously swapped
for the buffered reader even when nothing was buffered, which would
have handed body-access-off routes an empty body; now pinned by a test
across all modes.

Adds waf_crs_test.go (load, mode wiring, XSS/traversal detection
without blocking, block-mode blocking + benign passthrough, upload
body preservation); waf_test.go passes unmodified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* test(ws): replace fixed sleeps with condition-based waits

The ws suite paced async hub effects with 537 fixed time.Sleep calls —
slow at best, flaky under load at worst. They are now condition-based:
a small waitFor/waitRegistered/waitClientCount/waitMsgOfType helper set
(waitRegistered exploits the hub's in-order client-event processing),
plus blocking decode-scans for the DM tests.

The bulk deletion is grounded in verified production facts, unchanged
by this commit: sendMsg is a synchronous buffered send (error replies
are already buffered when the handler returns), the voice control /
rollback / cleanup / sweep paths are synchronous, and serve.go
registers the client before writing the ready frame. Absence
assertions were deliberately NOT inverted into polling — they keep
bounded windows, each commented.

20 sleeps remain, all justified in place: poll intervals inside
condition loops, absence windows, clock-granularity pacing, and the
event-pruner's inherently time-based no-prune-after-cancel assertion.

Suite: 746 tests before and after; 62.6s -> 46.1s (30s of the
remainder is GracefulStop's hard-coded production 5s drain, out of
scope here); race flake check passes 3 consecutive iterations;
deadlock pass and golangci-lint clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix: audit-driven fixes — client leaks/lazy-load, WAF detect logging, audit shutdown race (#1288)

* fix(waf,db): aggregate CRS detect-mode logging; make audit Stop await goroutine exit

WAF detect mode wired logCRSMatch as the engine-level error callback, which
fires one slog.Warn per matched rule on the request goroutine. In the default
detect mode ordinary chat prose trips several CRS SQLi/XSS rules plus anomaly
scoring, so each request logged a burst of Warn lines in the hot path.

Aggregate per request from per-transaction state instead of the shared global
callback: in the default detect path leave the engine error callback nil and,
in the existing crsTx defer, emit at most one Warn per request that had matches
(count + highest-severity rule), demoting the full rule-id list to Debug.
Block mode keeps per-rule logging (blocked requests are rare and their detail
is wanted), and a caller-supplied onCRSMatch callback keeps per-rule delivery
so existing tests stay unmodified. Detection, interruption, and body handling
are unchanged — only the detect-path logging shape.

The audit writer's Stop selected between <-done and <-ctx.Done(); on a slow
flush the 5s ctx could win, returning while run() was still flushing. main.go's
LIFO defers then closed the DB pool under a live flusher, losing audits. Stop
now always waits on done (the goroutine has stopped touching the store) while
ctx bounds only the drain inside run() via a published stopCtxDone channel, so
a slow store delays shutdown by at most one in-flight flush and the pool is
never closed under a live writer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

* fix(client): plug listener leaks, guard lazy livekit load, honor saved log level

Follow-up audit of the recently-landed lazy-livekit and session wiring found
three real issues:

- clearAuth unconditionally dynamic-imported livekitSession to call leaveVoice
  on every logout, pulling the ~531 kB livekit chunk into the logout path even
  when no voice session was ever active. Guard the import on an active voice
  session (currentChannelId set and status not idle) and add a .catch so a
  failed teardown import can't reject unhandled.

- The onStateChange handler unsubscribed session listeners only on the ready
  transition, not on disconnected; user_update and ready listeners registered
  per session were never collected for cleanup. Collect them into a
  sessionUnsubs array cleaned up on both ready and disconnected, preventing
  duplicate handlers accumulating across reconnects.

- The Logs tab min-level select ignored the persisted log level when no
  explicit dropdown preference was saved. Add logger.getLogLevel() and default
  the select to it so the UI reflects the level actually in effect.

Also add .catch to the ptt setMuted dynamic import. New unit tests cover the
clearAuth guard, getLogLevel, and the LogsTab default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(waf): load embedded OWASP CRS ruleset correctly on Windows (#1289)

The CRS WAF engine failed to initialize on Windows, taking the whole api
package's test suite red there. coraza's seclang parser resolves Include
globs through path/filepath: for every match of `Include @owasp_crs/*.conf`
it calls filepath.Join(currentDir, match), which on Windows rewrites the
forward slashes to backslashes. It then feeds names like
`@owasp_crs\REQUEST-901-INITIALIZATION.conf` back into the root fs.FS. That FS
is the ruleset's embed.FS, which is always forward-slash and rejects a
backslash name, so newCRSWAF returned "file does not exist" and no CRS rule
under a subdirectory was ever loaded.

Wrap coreruleset.FS in a small slash-normalizing fs.FS (Open/ReadFile/ReadDir/
Glob) that converts backslashes to forward slashes before delegating. This
fixes CRS loading on Windows without patching coraza or the ruleset module and
is a no-op where the separator is already "/". The Linux-only local
verification for the CRS work missed this because coraza never emits
backslashes there.

The new test reproduces the failure mode on any OS by constructing the exact
backslash name coraza produces on Windows: the raw ruleset FS fails to read
it, the wrapper resolves it, and a forward-slash path still works.


Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

Co-authored-by: Claude <noreply@anthropic.com>

* fix(e2e): repair the Playwright suite so the CI job stops timing out (#1291)

The Client E2E CI job never completed: every run hit its 25-minute cap and
was cancelled. ~229 of the 255 web tests were failing, all cascading from
the shared login helper, and 255 tests x 3 attempts x 20-45s of timeout
burn on 1 worker deterministically exceeds the cap.

Root cause: the e2e Tauri mock predates the Rust HTTP TOFU proxy. api.ts
now awaits invoke("start_http_proxy") and builds REST URLs as
http://127.0.0.1:{port}/api/v1/..., but the mock's invoke returned null for
the unstubbed command, so every URL got a literal "null" port and Request
construction threw before the mocked plugin:http transport was consulted.
Login rejected, [data-testid='app-layout'] never mounted, and every
logged-in test burned its full timeout. Stubbing start_http_proxy with any
numeric port fixes the cascade because route matching is substring-based.

The tail of failures after that fix were tests asserting behavior the app
intentionally changed:

- The ready payload can no longer pre-connect the local user to voice: the
  dispatcher treats "self in ready.voice_states while idle" as stale state
  from a reload and immediately leaves. MOCK_VOICE_STATE now seeds remote
  users only (2, 3), and widget tests join through the real click path via
  a new joinVoiceChannelByName helper.
- The mock's voice_join reply no longer includes a voice_token: a token
  starts a real LiveKit session that deterministically self-destructs in
  the browser mock (E2EE key exchange timeout ~15s / connect-refused
  retries), tearing the widget down mid-test. These web tests validate the
  WS/UI layer only; real LiveKit is covered by the native suite. The reply
  also gained the full VoiceStatePayload shape — the sidebar renders
  user.username directly, and the omitted field broke the whole voice-user
  list render.
- Message-load failure now renders an inline region error + Retry instead
  of a toast (UX spec 2), so the toast specs assert the inline UI and get
  their auto-dismiss vehicle from the delete-confirmation toast.

CI hardening so a future systemic breakage can never burn the full cap
again: maxFailures 20 and a 20-minute globalTimeout in CI (Playwright now
self-terminates with a usable report instead of being SIGKILLed), with the
workflow's timeout-minutes 25 as the outer backstop. The job stays
continue-on-error until it has proven stably green across a few pushes;
the ci.yml comment documents that flip trigger.

Full suite: 255/255 passing locally (~7.5 min at 1 worker, ~4 min at 2).
Unit tests (3598), typecheck, and prettier all clean.


Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu

Co-authored-by: Claude <noreply@anthropic.com>

* feat(admin): first-run setup wizard with config.yaml write-back + LiveKit auto-download (#1290)

* feat(admin): first-run setup wizard with config.yaml write-back

Turn the single-screen owner-account setup into a guided multi-step wizard
so non-technical operators never have to hand-edit YAML:

- config: new comment-preserving config.Save (yaml.Node round-trip, atomic
  temp+rename write, verified loadable before replacing the file) plus a
  shared config.DefaultPath. Persists the runtime-generated LiveKit
  credentials so voice tokens survive restarts.
- admin: POST /admin/api/setup accepts an optional "wizard" object
  (server name, MOTD, registration, port, TLS mode/domain, upload limit,
  voice quality). Values are validated before the account is created; DB
  settings and config.yaml are written after; failures downgrade to
  warnings so the created owner is never orphaned behind a 5xx. When a
  startup-only value changed the server restarts itself (reusing the
  backup/update restart machinery) and returns the new admin URL.
- admin: GET /admin/api/setup/status now returns secret-free prefill
  defaults while setup is pending.
- admin panel: six-step wizard UI (welcome, account, server basics,
  uploads & voice, access, review) with plain-language explanations, a
  restart/reconnect screen, and a "skip" path that keeps the legacy
  account-only flow byte-for-byte.
- legacy payload {username,password} and all existing call sites keep
  working (SetupOptions is a trailing variadic parameter).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB

* fix(lint): satisfy modernize — any over interface{}, new(expr) over ptr helper

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB

* feat(voice): auto-download the LiveKit server binary

Voice now works with zero manual setup: when voice.auto_download_livekit
is enabled and no voice.livekit_binary is configured, the server fetches
the pinned livekit-server release (v1.13.5, overridable via
voice.livekit_version) from the official LiveKit GitHub releases in the
background at startup, verifies it against the release's checksums.txt,
extracts it into data/livekit/, and manages it as the existing companion
process (crash recovery, health checks, graceful shutdown).

- ws: new livekit_download.go — pinned version, per-platform asset
  mapping (linux/windows × amd64/arm64/armv7, matching LiveKit's
  goreleaser config), size-capped downloads, hash verification and
  extraction through one open handle (TOCTOU-safe), O_EXCL staging,
  atomic rename, stale-version cleanup. LiveKitProcess.Start resolves
  the binary asynchronously with retries so boot is never blocked.
- config: voice.auto_download_livekit + voice.livekit_version; enabled
  in the generated default config so fresh installs get working voice
  out of the box, while the compiled-in default stays off for existing
  configs. config.Load now loads the default file it just wrote, so the
  first boot runs with exactly the configuration the file documents.
- wizard: "Voice chat" toggle (on by default) in the Uploads & voice
  step; the choice is written to config.yaml and factored into the
  restart decision.
- docs: livekit-setup, server-configuration, deployment, README.

Verified end-to-end against the real v1.13.5 release: download,
checksum match, extraction, and process spawn all succeed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB

* chore: remove stray server.log, ignore local run logs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB

---------

Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-31 15:41:57 +02:00
J3vbandClaude Opus 5 4959e2fa40 chore(release): bump client version to 1.1.0-alpha.3 (#1279) 
The server takes its version from the tag via ldflags, but the client's is
pinned in package.json, tauri.conf.json and Cargo.toml. Without this bump the
v1.1.0-alpha.3 tag would build an installer still identifying as alpha.2, and
the client updater compares that string against the server's manifest — so a
stale value means clients never see the update.

Lockfiles follow (npm + cargo); README's build examples updated to match.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-30 19:33:30 +02:00
J3vbandClaude Opus 5 d2e1d2deb0 fix(ci): unbreak the Docker build and the npm audit gate (#1274) 
* fix(docker): build the server image with Go 1.26

The Docker verify job failed with "go.mod requires go >= 1.26 (running go
1.25.12; GOTOOLCHAIN=local)". The Go 1.26 upgrade bumped go.mod but left the
Dockerfile on golang:1.25-bookworm, and GOTOOLCHAIN=local in the base image
means it cannot download a newer toolchain.

golang:1.26-bookworm confirmed present upstream. Not verified locally (Docker
Desktop not running); the CI Docker job proves it on this PR.

* fix(client): override brace-expansion and qs to patched versions

npm audit --audit-level=high failed the Client Static Checks job with 10
vulnerabilities (8 high, 2 moderate). npm audit fix could not resolve any of
them.

There is really only one advisory behind the eight high findings:
brace-expansion <=5.0.7, a DoS via unbounded expansion length causing OOM.
minimatch, glob, test-exclude, @vitest/coverage-v8, eslint and @eslint/* were
all just transitive consumers of it, and those top-level dev deps are already
at their latest versions, so no bump reaches the fix. qs 6.11.1-6.15.1 is a
second, independent advisory arriving via @stryker-mutator/core ->
typed-rest-client.

No patch exists inside the brace-expansion 1.x or 2.x lines (the fix landed in
5.0.8), so overrides are the only route. Collapsing every copy to 5.0.9 risked
breaking minimatch 3.x, which requires it as CJS, so the whole client gate was
run to check: npm audit 0 vulnerabilities, tsc clean, oxlint unchanged
(pre-existing no-underscore-dangle warnings only), eslint exit 0, prettier
clean, and vitest 3572 tests across 129 files all passing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: stop running the suite twice for one push to dev

Listing dev under both push and pull_request meant a single push to dev fired
both events, running every job twice (visible as duplicated checks on #1274).
While a dev -> main PR is open, pull_request(synchronize) already covers each
push to dev, so dev only needs the pull_request trigger. workflow_dispatch
covers a dev branch with no PR open yet.

* chore(deps): roll up the seven open dependabot PRs

Consolidates #1267-#1273 onto this branch so they land as one CI run instead
of seven, each of which was triggering the full suite including tauri-build.

- google.golang.org/grpc 1.81.1 -> 1.82.1  (#1267)
- github.com/google/cel-go 0.28.1 -> 0.29.0 (#1268)
- defu 6.1.4 -> 6.1.7, root lockfile      (#1269)
- tauri 2.11.0 -> 2.11.1                   (#1270)
- @modelcontextprotocol/sdk 1.29 -> 1.30   (#1271)
- tar 0.4.45 -> 0.4.46                     (#1272)
- serde_with 3.18.0 -> 3.21.0              (#1273)

Applied by regenerating each lockfile from its manifest rather than merging
seven lockfile diffs.

Verified: go build across all four tag variants, go vet, govulncheck (0
vulnerabilities in called code), go test -race (14 packages, 0 failures),
cargo clippy --all-targets -D warnings, cargo test --lib (73 passed).

CI covers neither the root package.json nor tools/mcp-introspect, so those two
were checked by hand: changelogen still runs under defu 6.1.7 (release.yml
depends on it) and the introspect server still imports the 1.30 SDK.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ci): drop the brace-expansion override, scope the audit to shipped deps

The brace-expansion override I added to clear npm audit broke Client Unit
Tests in CI:

  TypeError: (0 , brace_expansion_1.default) is not a function
    at minimatch braceExpand -> TestExclude.glob
    -> V8CoverageProvider.getUntestedFiles

minimatch requires brace-expansion as CJS and v5 is not callable that way. It
only fires under --coverage, which is why a local `vitest run` missed it; CI
runs `vitest run --coverage`. Verified the fix with that exact command.

There is no patched brace-expansion in the 1.x/2.x lines those tools pin (the
fix landed in 5.0.8), and eslint, @vitest/coverage-v8 and stryker are already
latest, so no bump reaches it. Since the whole chain is dev tooling that never
ships, the gate is now `npm audit --omit=dev --audit-level=high`, which
reports 0 vulnerabilities. The reasoning and the revisit condition are
recorded in ci.yml next to the step.

The qs override stays: qs is CJS, the override is proven safe, and it closes a
real advisory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(client): route all cert-tofu emits through the single call site

Tauri Full Build failed on all three platforms with the generated bindings
redeclaring onCertTofu (TS2323/TS2393), which killed `tauri build` at its
beforeBuildCommand:

  src/generated/events.ts(36,23): error TS2323: Cannot redeclare exported
  variable 'onCertTofu'.

tauri-typegen emits one onCertTofu binding per `emit("cert-tofu", ..)` call
site it finds. ws_proxy.rs already funnelled its emits through a helper for
exactly this reason -- its doc comment says so -- but http_proxy.rs emitted
directly from all three TOFU outcomes, so the crate had four call sites.

Makes ws_proxy::emit_cert_tofu pub(crate) and routes http_proxy's trusted,
first_use and mismatch paths through it, leaving one call site crate-wide. The
now-unused Emitter import is dropped from http_proxy so clippy -D warnings
stays clean. Behaviour is unchanged: same event name, same payloads, same
order.

Not reproducible locally -- typegen only regenerates under CI's clean
checkout, and a full `npm run tauri build` here passes tsc either way -- so the
Tauri Full Build job on this PR is the proof. Verified locally: exactly one
emit("cert-tofu") call site remains, cargo clippy --all-targets -D warnings
clean, and the release build completes through bundling.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-30 18:41:22 +02:00
J3vbandClaude Opus 5 17b17eb1b3 fix(security): close all 13 findings from the 2026-07-28 server scan, plus dependabot rollup (#1264) 
* fix(admin): reject banned users in admin auth (F1)

adminAuthMiddleware accepted a Bearer token on session validity plus the
ADMINISTRATOR bit alone and never consulted ban state, so a ban never
revoked admin-panel access. Adds the auth.IsEffectivelyBanned guard that
api.AuthMiddleware already uses, at both admin credential-resolution points.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ws): gate the voice-channel text subscription on READ_MESSAGES (F2)

registerNow subscribed any client with voice state to that channel's
text-message topic regardless of READ_MESSAGES. The handshake's
already-computed readable-channel set is now passed into registerNow and the
subscription only happens when the voice channel is in it, preserving
authorized reconnect delivery.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(service): require READ_MESSAGES to delete messages (F4)

The non-DM delete gate checked MANAGE_MESSAGES without READ_MESSAGES, so a
role locked out of a private channel could still delete every message in it.
Requires ReadMessages alongside ManageMessages (and alongside SendMessages on
the author path) and derives the mod flag from that same gate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(service): require READ_MESSAGES alongside MANAGE_MESSAGES in SetMessagePinned (F8)

Pin/unpin checked only MANAGE_MESSAGES, so a role denied READ on a private
channel could still pin and unpin its messages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(service): enforce the DM block at every DM interaction sink (F5)

The DM block was only checked on send, leaving edit, reactions, pins and
typing as bypasses. One shared requireDMNotBlocked is now called from all of
them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ws): re-check CONNECT_VOICE when minting a refreshed LiveKit token (F6)

voice_token_refresh re-minted a LiveKit token without re-checking
CONNECT_VOICE, so a revoked permission kept working for the life of the
session. The permission is now re-checked where the token is minted, and a
60s sweep evicts participants whose permission was revoked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ws): rate-limit voice_e2ee_offer after validation, keyed on server state (F7)

The limiter key was built from unvalidated client input, letting an attacker
grow the limiter map without bound. The limiter now runs after validation and
keys on (sender, voiceChannelID), never on client input.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ws): deliver voice_state/voice_leave only to roles that may read the channel (F9)

Voice state of private channels was broadcast to every connected client,
leaking channel membership. All 11 emit sites now route through one
READ-filtered fan-out, channel-tagged so replay filters too.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(api): redact the LiveKit access token from proxy dial-failure logs (F10)

A dial failure wrote the LiveKit access-token JWT into the server log via the
URL in the error. redactKey now runs on the error before it reaches slog.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(auth): reserve the [deleted-N] username namespace (F11, F12)

The tombstone username namespace used by account deletion was freely
registrable, letting a user impersonate a deleted account. The namespace is
now reserved at validation, and DeleteAccount retries with a random suffix on
collision.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(api): strip Unicode format characters from upload filenames (F13)

The attachment filename sanitizer stripped control characters but not
unicode.Cf, allowing bidi-override extension spoofing. Cf is now stripped
alongside controls and foreign path separators are cut.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(api): reserve the login attempt before the bcrypt compare (F3)

The per-username lockout was a read-only IsLockedOut check followed by a
failure recorded only after the ~250ms bcrypt compare, so N concurrent
requests all passed the stale check before any of them recorded a failure.
The per-username cap is the only cross-IP brute-force defence (the middleware
limits per IP), so a distributed burst landed N guesses per 15-minute window
instead of 10.

Both counters are now reserved atomically with limiter.Allow before the
compare, and the lockout decision moves to the read-only limiter.Check so the
reservation is not double-counted. The limits are sized at threshold+1, which
leaves the sequential accepted-input set byte-identical to the previous
behaviour: failures 1-10 still land, the 10th still trips the lockout, and the
account owner's correct password on attempt 10 still returns 200. Sizing at
threshold instead would make 9 cheap wrong guesses convert the victim's own
correct password into a 15-minute lockout - the regression that got two
earlier attempts at this fix rejected, now pinned by a boundary test.

Deliberately scoped to handleLogin. The report also suggested widening to the
password-confirmation endpoints, but those are authenticated, share a single
pw_confirm_fail key across the TOTP endpoints, and widening there is what got
the first attempt rejected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(deps): bump five Rust dependencies in /Client/tauri-client/src-tauri

Rolls up dependabot #1259, #1260, #1261, #1262 and #1263:

  tauri-build        2.5.6 -> 2.6.3
  tauri-plugin-fs    2.4.5 -> 2.5.1
  tauri-plugin-http  2.5.7 -> 2.5.9
  tauri-plugin-store 2.4.2 -> 2.4.4
  webpki-roots       1.0.6 -> 1.0.9

All five are lockfile-only; the manifest constraints already permitted the
new versions. The five PRs each rewrote overlapping regions of the same
Cargo.lock and so could not be merged independently, so the lockfile was
regenerated with cargo update --precise for each crate instead. The combined
result is smaller than the sum of the five diffs because they share
transitive updates.

Verified with cargo check --locked --all-targets (exit 0).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(deps): bump typescript-eslint from 8.58.0 to 8.65.0 in /Client/tauri-client

Dependabot #1258.

8.65.0 improves @typescript-eslint/no-unnecessary-type-assertion, which
surfaces four assertions that were already redundant and now fail the lint
gate. They are removed here rather than in a follow-up so no commit in this
branch leaves `npm run lint` red:

  UserBar.ts / members.store.ts  "online" as UserStatus -> "online"
                                 (the receiver already accepts the literal)
  media.ts                       drops `as RequestInit` on a literal that is
                                 already assignable
  LoginForm.ts                   drops `as { message: unknown }` made
                                 redundant by the `"message" in err` narrowing

All four are the rule's own autofix. Verified: npm run typecheck, npm run
lint, npm run format:check all clean, and the unit suite is 3572/3572 green
across 129 files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-29 12:48:47 +02:00
J3vbandClaude Opus 5 c08cdcf3f0 fix(client): repair dependency resolution after dependabot merges 
@stryker-mutator/{api,core,vitest-runner} were bumped to 9.6.1 while
typescript-checker stayed at 9.6.0, which hard-pins core@9.6.0 as a peer.
npm install failed with ERESOLVE. Bump typescript-checker to match.

Also reformat two files for prettier 3.9.6, which changed how union
types are broken across lines.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-28 14:58:26 +02:00
dependabot[bot] 7df4844bfb chore(deps): bump @stryker-mutator/api in /Client/tauri-client (#1255) 
Bumps [@stryker-mutator/api](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/api) from 9.6.0 to 9.6.1.
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/api/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v9.6.1/packages/api)

---
updated-dependencies:
- dependency-name: "@stryker-mutator/api"
  dependency-version: 9.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:48:57 +02:00
dependabot[bot] e099e906bd chore(deps): bump prettier from 3.8.1 to 3.9.6 in /Client/tauri-client (#1251) 
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.1 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.1...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:48:53 +02:00
dependabot[bot] f38e6b92d5 chore(deps): bump @playwright/test in /Client/tauri-client (#1256) 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.61.1 to 1.62.0.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.61.1...v1.62.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:57 +02:00
dependabot[bot] 3bfc56c5e0 chore(deps): bump livekit-client in /Client/tauri-client (#1254) 
Bumps [livekit-client](https://github.com/livekit/client-sdk-js) from 2.18.0 to 2.21.0.
- [Release notes](https://github.com/livekit/client-sdk-js/releases)
- [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/livekit/client-sdk-js/compare/v2.18.0...v2.21.0)

---
updated-dependencies:
- dependency-name: livekit-client
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:52 +02:00
dependabot[bot] 39251a533e chore(deps): bump @stryker-mutator/vitest-runner in /Client/tauri-client (#1252) 
Bumps [@stryker-mutator/vitest-runner](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/vitest-runner) from 9.6.0 to 9.6.1.
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/vitest-runner/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v9.6.1/packages/vitest-runner)

---
updated-dependencies:
- dependency-name: "@stryker-mutator/vitest-runner"
  dependency-version: 9.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:44 +02:00
dependabot[bot] 8f2a82cd39 chore(deps): bump @tauri-apps/plugin-dialog in /Client/tauri-client (#1249) 
Bumps [@tauri-apps/plugin-dialog](https://github.com/tauri-apps/plugins-workspace) from 2.6.0 to 2.7.2.
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](https://github.com/tauri-apps/plugins-workspace/compare/log-v2.6.0...dialog-v2.7.2)

---
updated-dependencies:
- dependency-name: "@tauri-apps/plugin-dialog"
  dependency-version: 2.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:35 +02:00
dependabot[bot] d7404b8fa9 chore(deps): bump @stryker-mutator/core in /Client/tauri-client (#1246) 
Bumps [@stryker-mutator/core](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/core) from 9.6.0 to 9.6.1.
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/core/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v9.6.1/packages/core)

---
updated-dependencies:
- dependency-name: "@stryker-mutator/core"
  dependency-version: 9.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:32 +02:00
dependabot[bot] 0383221d2c chore(deps): bump @tauri-apps/cli in /Client/tauri-client (#1242) 
Bumps [@tauri-apps/cli](https://github.com/tauri-apps/tauri) from 2.10.1 to 2.11.4.
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.10.1...@tauri-apps/cli-v2.11.4)

---
updated-dependencies:
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.11.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:24 +02:00
dependabot[bot] 2704bff360 chore(deps): bump jsdom from 29.0.0 to 29.1.1 in /Client/tauri-client (#1240) 
Bumps [jsdom](https://github.com/jsdom/jsdom) from 29.0.0 to 29.1.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](https://github.com/jsdom/jsdom/compare/v29.0.0...v29.1.1)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 29.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:21 +02:00
dependabot[bot] b7945f7a02 chore(deps): bump oxlint from 1.75.0 to 1.76.0 in /Client/tauri-client (#1238) 
Bumps [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) from 1.75.0 to 1.76.0.
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.76.0/npm/oxlint)

---
updated-dependencies:
- dependency-name: oxlint
  dependency-version: 1.76.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:46:17 +02:00
J3vbandClaude Opus 4.8 f3c6745c0b feat(client): add single-instance/autostart/deep-link; move window-state to plugin 
Replace hand-rolled code with first-party Tauri v2 plugins where a plugin can
do the job, and add the genuine gaps:

- single-instance: focus the running window on a second launch instead of
  opening a duplicate (two WS connections / tray icons). Registered first;
  built with the "deep-link" feature so owncord:// links reach the running app.
- window-state: replace the hand-rolled save/restore plumbing with
  tauri-plugin-window-state. Keep only the one thing the plugin lacks — an
  off-screen re-center guard for windows restored onto a now-disconnected
  monitor (isRectOnScreen).
- autostart: "Launch on Login" toggle in Advanced settings, reading/writing
  real OS state via tauri-plugin-autostart (not a stored preference).
- deep-link: register the owncord:// scheme and route invite links into the
  register form. OwnCord invites are registration invites, so a link pre-fills
  and opens the form rather than completing a one-click join.

Intentionally NOT replaced: push-to-talk (ptt.rs) stays hand-rolled —
tauri-plugin-global-shortcut registers OS hotkeys that grab the key
system-wide (RegisterHotKey / XGrabKey), which cannot express non-consuming
press-and-hold PTT. Clipboard stays on the native Web API (no custom code).

Verified: tsc, eslint, prettier, 3369 unit tests, cargo check, cargo clippy
(client code clean; one pre-existing needless-borrow lint in commands.rs is
flagged only by newer local clippy, untouched here).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-24 10:44:06 +02:00
J3vbandClaude Fable 5 e392939c52 chore(deps): batch-apply all open dependabot bumps (2026-07-23) 
Applies all 22 open dependabot PRs in one pass (CI on those PRs never
ran — Actions minutes exhausted). Verified locally via the ci-check
mirror: builds (all tag variants), vet, golangci-lint, sqlc/protocol
verify, vitest 3304/3304, npm audit clean, cargo check.

Server (Go): wazero 1.12.0, x/mod 0.38.0, chi 5.3.1, otel 1.44.0,
otel/trace 1.44.0, otel prometheus exporter 0.66.0, modernc sqlite
1.54.0, livekit/protocol 1.50.2, koanf/v2 2.3.5, x/sync 0.22.0.
Also x/text 0.39.0 (fixes GO-2026-5970, flagged by govulncheck).
livekit/protocol requires Go 1.26 → go.mod, CI pins, and docs bumped.

Client (npm, lockfile-only): playwright/test 1.61.1, oxlint 1.75.0,
eslint 9.39.5, knip 6.29.0, plugin-http 2.5.9, plugin-fs 2.5.1,
plugin-opener 2.5.4, tauri-apps/api 2.11.1 + npm audit fix
(brace-expansion, fast-uri transitive highs).

Client (cargo, lockfile-only): futures-util 0.3.33, env_logger
0.11.11, serde 1.0.229, tauri-typegen 0.5.2.

Closes #1204 #1205 #1206 #1207 #1209 #1210 #1211 #1212 #1213 #1214
Closes #1215 #1216 #1219 #1220 #1221 #1222 #1223 #1225 #1226 #1227 #1228 #1224

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-23 17:23:31 +02:00
J3vbandClaude Fable 5 f4b20726ff chore(client): remove dead files, exports, and unused dependencies 
knip findings (repo CI config), each verified including dynamic imports,
HTML refs, and the Rust side:

Files deleted: pluginBridge.ts (its documented PluginContainer.tsx
collaborator never existed in the repo; the server plugin host stays per
D11 — reinstate from git if client plugin UI work ever starts),
message-input/file-upload.ts, message-input/picker-toggle.ts (dir now
empty, removed), message-list/virtual-scroll.ts (MessageList does its
own virtualization via FenwickTree).

Dependencies removed: zod (zero imports; typegen uses
validation_library none — stale CLAUDE.md claim fixed),
@tauri-apps/plugin-store and plugin-updater npm halves (both features
are Rust-driven via StoreExt/UpdaterExt — Rust halves stay), and
tauri-plugin-global-shortcut on BOTH sides (PTT polls via device_query;
zero GlobalShortcutExt use): Cargo.toml dep, lib.rs registration, and
the 5 capability permission lines. Inert webview capability entries
store:default/updater:default also dropped. @stryker-mutator/api added
to devDependencies (stryker.config.mjs imports its types; core pins the
same version, zero install delta).

Exports removed: livekitSession clearOnError bound-const, ConnectPage/
MainPage ReturnType aliases, readAllPersistedLogs (never wired to any
UI) with its test blocks. getLogDir kept as the suite's observability
point, tagged @public for knip. protocolTypes.ts *Value types are
generated surface — knip.json now ignores that file instead.

Rust compile is CI-verified only (no MSVC toolchain here, same as the
F4/F8 TOFU work); Cargo.lock resolution pruned cleanly. Client gate
green: tsc, oxlint/eslint 0 errors, prettier, 3304/3304 vitest, knip
clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-23 15:29:01 +02:00
Claude bf508c9e6b chore(client): remove abandoned SolidJS beachhead (D6) 
The Solid.js migration was abandoned (per CHANGELOG); the 154-LOC
beachhead and its scaffolding remained in-tree, leaving two UI paradigms
for contributors. Removed:

- src/components/solid/ (Badge, ChannelListItem, PluginContainer — none
  imported by production code)
- src/lib/solidMount.ts and src/lib/solidAdapter.ts
- tests/setup-solid.ts and tests/setup-solid.test.tsx
- vite-plugin-solid from vite.config.ts and vitest.config.ts (and the
  now-unneeded tsx test include + setupFiles)
- jsx/jsxImportSource from tsconfig.json
- solid-js, @solidjs/testing-library, vite-plugin-solid from package.json

docs/client-architecture.md (which described the SolidJS design) is
retired to a pointer at docs/architecture/client.md; README links
updated. Audit A-2026-07-12 and decision D6 marked closed.

Verified: tsc --noEmit clean (previous 3 test-file errors were caused by
the Solid jsx config and are gone); oxlint/eslint error counts identical
to HEAD (pre-existing); vitest runner healthy on a sample suite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UA17KPvqGBX3XbXYnMf1rA
 2026-07-19 13:57:28 +00:00
J3vbandClaude Fable 5 66cdd2ad9f chore(release): stamp client version 1.1.0-alpha.2 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-19 10:50:37 +02:00
J3vbandClaude Fable 5 9169dc99a1 chore(release): stamp client version 1.1.0-alpha.1 
Forward-only versioning for the alpha reset: 1.1.0-alpha.N ascends
past the superseded v1.0.0 for every installed client, and the alpha
series stays below 1.1.0-beta.N and the final 1.1.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-18 15:37:01 +02:00
J3vbandClaude Fable 5 c7b49ee1fc fix(deps): patch reachable vulnerabilities blocking CI 
Server: golang.org/x/net 0.52.0->0.55.0 (GO-2026-5026, reachable via
autocert.HostWhitelist) and go-jose/v3 3.0.4->3.0.5 (GO-2026-4945,
reachable via the LiveKit SDK). govulncheck now passes clean; full
test suite and the otel/wazero build-tag matrix verified locally.

Client: npm audit fix (semver-compatible only, 44 packages) — npm audit
--audit-level=high now exits clean. vitest moved 3.2.4->3.2.7.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-18 11:45:30 +02:00
J3vb 16fbfcce87 fix(client): bump vite to patch high-severity CVEs (GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583) 
npm audit fix resolved vite <=6.4.1 → 6.4.2; 0 high/critical vulnerabilities remain.
 2026-04-07 09:10:01 +02:00
J3vb 031f20fb96 fix(phase-bc): Solid.js npm install — fix JSX import and lint error 
- npm install: pulled solid-js, vite-plugin-solid, @solidjs/testing-library
- Fix solidMount.ts: import JSX from "solid-js" not "solid-js/web"
- Fix PluginContainer.tsx: suppress no-unassigned-vars for Solid ref pattern
- Build green (tsc + vite); 111 test files / 3186 tests all pass
 2026-04-06 23:05:50 +02:00
jevb 5cec992c1f chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod 
Install and configure mutation testing (Stryker for client, go-gremlins
for server), load testing (k6), chaos testing (toxiproxy), WAF middleware
(Coraza with OWASP rules, opt-in via waf_enabled config), and Zod for
runtime schema validation. All tools verified building cleanly.
 2026-04-01 13:49:06 +02:00
jevb 87ba387623 chore: update tooling, CI workflows, and dependencies 
Update CI/release workflows, gitignore, package dependencies,
Tauri config, and add linter/formatter configs (oxlint, prettier,
knip, vitest browser config).
 2026-04-01 11:40:55 +02:00
J3vb 694007d5a4 Merge pull request #87 from J3vb/dependabot/npm_and_yarn/Client/tauri-client/livekit-client-2.18.0 
chore(deps): bump livekit-client from 2.17.3 to 2.18.0 in /Client/tauri-client
 2026-03-30 23:49:15 +02:00
dependabot[bot] d5bca972db chore(deps): bump livekit-client in /Client/tauri-client 
Bumps [livekit-client](https://github.com/livekit/client-sdk-js) from 2.17.3 to 2.18.0.
- [Release notes](https://github.com/livekit/client-sdk-js/releases)
- [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/livekit/client-sdk-js/compare/v2.17.3...v2.18.0)

---
updated-dependencies:
- dependency-name: livekit-client
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-30 21:32:42 +00:00
dependabot[bot] 5045346c1a chore(deps): bump typescript-eslint in /Client/tauri-client 
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.57.2 to 8.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: typescript-eslint
  dependency-version: 8.58.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-30 21:32:33 +00:00
jevb 0e29d98d9d fix: resolve CI failures — eslint peer dep conflict and errcheck lint errors 
Downgrade @eslint/js to ^9.39.4 to match eslint ^9 peer requirement.
Fix 7 unchecked .Close() return values flagged by errcheck linter.
 2026-03-30 21:54:24 +02:00
jevb 795ed48ec9 docs: v1.0.0 release prep — version bump, license, README overhaul 
- Bump version to 1.0.0 across package.json, Cargo.toml, tauri.conf.json
- Add AGPL-3.0 LICENSE file
- Update README with missing features (2FA, DMs, video grid, stream preview,
  theming, auto-login, account deletion, observability)
- Remove internal Copilot Assets section from README
- Remove soundboard reference (not implemented)
- Add account deletion and video grid docs to CLAUDE.md
 2026-03-30 20:54:05 +02:00
jevb cdb56f1619 chore: ESLint config, 61 lint fixes across 22 client files, CLAUDE.md update 
- Add ESLint v9 flat config with typescript-eslint
- Fix no-floating-promises, no-unused-vars, consistent-return across client
- Refactor livekitSession: delegate entirely to AudioPipeline (1438→1171 lines)
- Add 7 delete-account UI tests in settings-overlay.test.ts
- Update CLAUDE.md with latest features and project structure
- Update .gitignore
 2026-03-29 19:40:11 +02:00
jevb aa162d88c5 feat: replace client WebRTC with LiveKit SDK (Phase 2) 
Client changes:
- Create livekitSession.ts (~400 lines, replaces 1105-line
  voiceSession.ts): Room lifecycle, device switching via
  switchActiveDevice, RNNoise pre-processing for enhanced NS
- types.ts: add VoiceTokenPayload, remove VoiceOffer/Answer/Ice
  payloads, remove ThresholdMode
- dispatcher.ts: replace voice_offer/answer/ice handlers with
  single voice_token handler
- VoiceCallbacks.ts: swap imports to livekitSession
- VoiceAudioTab.ts: remove silence suppression toggle, inline
  threshold math (removed vad.ts dependency)
- Update all files importing from deleted modules

Deleted files (11 source + 5 test):
- webrtc.ts, vad.ts, voiceSession.ts, audio.ts, video.ts,
  Soundboard.ts + their test files

Kept: noise-suppression.ts + @jitsi/rnnoise-wasm (Krisp is
LiveKit Cloud only, not available for self-hosted)

Added: livekit-client@^2.17.3

TypeScript compiles with zero errors (tsc --noEmit).
 2026-03-20 05:46:19 +01:00
jevb 5311d0a7e3 feat: fix voice chat over NAT, audio pipeline, and add comprehensive debugging 
Voice was broken over NAT due to multiple issues across the audio pipeline:

- Fix GainNode silence: WebView2 silences remote WebRTC streams routed through
  Web Audio createMediaStreamSource→GainNode→createMediaStreamDestination.
  Replaced with direct HTMLAudioElement playback for remote audio.
- Fix NAT traversal: Add Google public STUN server (stun.l.google.com:19302)
  so remote clients can discover their public IP for ICE connectivity.
- Fix signaling race: Catch createOffer InvalidStateError when server
  renegotiation offer arrives before client's initial offer is sent.
- Fix device switch: Use replaceTrack() instead of removeTrack+addTrack
  to avoid SDP renegotiation. Safe rollback on failure (stop old last).
- Fix speaking flicker: setSpeakers skips local user (VAD is sole authority).
- Fix VAD sample rate: Force 48kHz AudioContext instead of system default
  (192kHz) which spread FFT bins too wide for voice frequency detection.
- Fix CSP for WASM: Add wasm-unsafe-eval to script-src for RNNoise.
- Fix clearAuth leak: leaveVoice() called before resetVoiceStore().
- Fix ICE rate limit: Separate limit for ICE candidates (50/s vs 20/s).
- Fix stale ICE errors: Silently drop voice_ice with no PeerConnection.
- Fix audio play() race: Deferred to queueMicrotask after DOM attachment.

Debugging infrastructure:
- Logs tab: Copy All button, Voice Diagnostics panel with live session
  state, Probe Audio Levels (measures actual signal at 3 pipeline points),
  Test Direct Playback button, Copy Diagnostics button.
- Client logging: WebRTC (PeerConnection lifecycle, ICE candidates with
  type/address, track events, negotiation), VAD (start/threshold/destroy),
  Audio (device acquisition with settings, device changes), noise suppression
  (WASM load timing, worklet vs fallback path), voiceSession (remote stream
  parsing failures, deafen state, audio element playback events).
- Server logging: SFU init config, voice room mode transitions/track
  lifecycle/close, RTP forwarding with packet counts and first-packet
  detection, 5s no-packet warning, track fan-out counts, subscriber
  transceiver state, ICE candidate details, voice credentials issued.
- Logger: Error objects now serialize .message and .stack instead of {}.

Per-user volume right-click now works on voice user rows in sidebar.
RNNoise ML noise suppression with AudioWorklet + ScriptProcessor fallback.
Tests: 7 new test cases (replaceTrack, setSpeakers skip-local, clearAuth).
 2026-03-18 23:02:06 +01:00
jevb 01e4d4bec3 feat: client auto-update with Ed25519 signing and dynamic server URL 
- Add tauri-plugin-updater and tauri-plugin-process for in-app updates
- Rust commands (check_client_update, download_and_install_update) build
  updater with dynamic endpoint at runtime for self-hosted compatibility
- Server endpoint GET /api/v1/client-update/{target}/{version} translates
  GitHub Releases into Tauri updater JSON format with .sig content
- UpdateNotifier banner component with install/dismiss controls
- CI workflow produces signed .nsis.zip + .sig updater artifacts
- Self-signed TLS support via dangerousAcceptInvalidCerts config
 2026-03-18 17:47:59 +01:00
jevb 750a7af052 feat: native file downloads, upload size fix, native E2E tests 
- Add file download with native save dialog (Tauri dialog + fs plugins)
- Make attachment filename clickable as additional download trigger
- Add download button with hover styling to file attachments
- Exempt /api/v1/uploads from global 1MB body size limit (MaxBodySizeUnless)
- Add native E2E test suite (8 specs) with Playwright CDP fixture
 2026-03-18 17:10:16 +01:00
jevb 13be0fd6d3 feat: file uploads, URL previews, emoji search, voice mute fixes, UX improvements 
Server:
- Add POST /api/v1/uploads and GET /api/v1/files/{id} endpoints
- Add CreateAttachment DB method for file upload records
- Allow empty message content when attachments are present
- CORS headers on file serving for WebView2 compatibility

Client — File uploads & attachments:
- Clipboard paste (Ctrl+V) and attach button (+) for file uploads
- Preview bar above input with thumbnail, spinner, and remove button
- Images fetched via Tauri HTTP plugin as base64 data URIs (bypasses
  self-signed cert rejection in WebView2)
- Three-layer image cache: memory → IndexedDB → network
- In-flight deduplication prevents duplicate concurrent fetches
- Image lightbox with click-to-zoom, scroll wheel zoom, pan, keyboard shortcuts

Client — URL previews & embeds:
- URLs in messages rendered as clickable links
- YouTube embeds with thumbnail, play button, video title via oEmbed API
- Generic link previews with OG metadata (title, description, image)
- Fetched via Tauri HTTP plugin with Facebook crawler User-Agent
- YouTube title cache and OG metadata cache prevent re-fetch on re-render
- Links open in default browser via tauri-plugin-opener

Client — Voice & audio fixes:
- Mute uses replaceTrack(null) for reliable RTP-level muting in WebView2
- Deafen also mutes mic; undeafen/unmute unmutes both
- Muted users show crossed mic icon, deafened show crossed mic + headphone
- Re-apply mute state after input device switch

Client — UX improvements:
- Disable browser context menu globally (only custom menus show)
- Emoji search now matches by keyword names (smile, heart, fire, etc.)
- Emoji picker closes on click outside
- User bar status text moved below username
- Messages sorted chronologically (oldest first, newest at bottom)
- Scroll to bottom on initial load with deferred retries for layout shifts
- Image attachments constrained to 400x350px with click-to-lightbox
 2026-03-18 14:13:52 +01:00
jevb 01387dc033 feat: fix all E2E failures, add credentials/window-state, wire QuickSwitcher + SettingsOverlay 
- Fix 80 E2E test failures across 6 root causes (channel auto-select,
  settings overlay wiring, QuickSwitcher Ctrl+K, voice widget visibility,
  member list rendering, status dot positioning)
- Add Tauri credential storage (Rust + TS bridge) and window-state persistence
- Add ConnectedOverlay component and settings-overlay/window-state unit tests
- Expand profiles and rate-limiter with comprehensive test coverage
- Add CODE_REVIEW.md documenting 4 Critical + 3 High server-side issues
- Add Playwright E2E suite (135 tests across 14 spec files)
- All 586 tests passing (451 unit/integration + 135 E2E)
 2026-03-16 16:43:46 +01:00
jevb 77626e136b feat: add Tauri v2 desktop client with full chat UI and security hardening 
Complete Tauri v2 client implementation migrated from WPF/.NET 8:
- Rust backend: WS proxy with TLS cert bypass for self-signed servers,
  settings storage, system tray, global hotkeys
- TypeScript frontend: login/register, chat messaging, channel sidebar,
  member list, voice channel UI, settings overlay with log viewer,
  server profiles, quick switcher, emoji picker, file uploads
- 21 test suites (364 tests) covering stores, services, and components
- Security: bounded WS channel, wss:// URL validation, TLS signature
  verification, profile import validation, token redaction, HTTPS-only
  HTTP scope

Also updates CLAUDE.md to correct API path rule (/api/v1/) and adds
Tauri client CI workflow.
 2026-03-15 19:44:02 +01:00