48 Commits

Include renames

Author	SHA1	Message	Date
J3vbandClaude	eb873fe7b2	B1-6: generated artifacts (RL-06 / L-06, RL-07 / L-07, RL-08 / L-08) (#1418) ... * ci: verify FINDINGS.md against the ledger it renders from (RL-07) `.superpowers/FINDINGS.md` is generated from `findings-ledger.json`, and `CLAUDE.md` forbids hand-editing it — but nothing checked. The one automated consumer, `render-ledger.mjs --check`, validates the ledger's JSON schema and `return`s at line 116, *before* the only `render()` call at line 118, and never opens `FINDINGS.md` at all. A stale 1.09 MB rendering passed it cleanly. The audit says "no workflow runs it". That was true when it was written and is not now: B1-2 (#1412) wired `--check` into the `Docs & Ledger Consistency` job. So the gate exists, reports, and is blind to the thing its name suggests it watches — which is worse than absent, because it reads as covered. The obvious fix — render to a temp file and diff, as the B1 plan suggests — is not what this repository does. It has three implementations of one idea (`Server/Makefile` sqlc-verify and protocol-verify, `.githooks/pre-commit`, `scripts/run.mjs`), and all three regenerate **in place** and let `git diff --exit-code` be the differ. That needs no temp path, no cleanup, and inherits `.gitattributes`' line-ending normalisation for free. A fourth shape would cost a reader something for nothing. Done: - The gate, in all three places the existing two gates live: the `docs-consistency` CI job, `scripts/run.mjs`'s `CHECK_DOCS`, and a new `.githooks/pre-commit` block gated on the ledger, the rendering, or the renderer being staged. `npm run check` never ran the renderer at all before this, which contradicted `run.mjs`'s own stated purpose. - `validate()` now requires `severity`. This is not a nice-to-have riding along: `render()` sorts the open section by `SEV_RANK`, and an unranked severity makes the comparator return `NaN`, which leaves the sort order implementation-defined. A gate whose expected output is implementation-defined can go red across a Node upgrade for a reason that is not drift. The validation is what makes the gate's premise — that the rendering is a pure function of the ledger — true rather than merely true today. - `--stat` on the diff. Deliberate deviation from the three precedents: a fully drifted rendering is a ~40,000-line CI log, and the exit code is what gates. Eight files, 119 insertions, 24 deletions. The gate is one render (67-170 ms) plus one `git diff`. Rendering subsumes `--check`, because `main()` validates and exits 1 before it writes — so the CI job keeps both steps only so the checks UI names which fix is needed. Verified: both directions, and the naive test would have lied. Appending to `FINDINGS.md` proves nothing — the renderer overwrites it, so the perturbation vanishes and the diff comes back clean. `git diff <path>` compares the worktree against the **index**, so the drift has to live in the index. Changing one finding's title in the ledger and staging it *without* re-rendering — exactly the mistake the gate exists to catch — makes `git diff --exit-code --stat` exit 1 with a one-line stat, and `.githooks/pre-commit` fail with `FINDINGS.md is stale`. Restoring the ledger and re-rendering returns both to exit 0, and `git status --porcelain` is clean afterwards. Severity validation both ways: setting one finding to `moderate` makes `--check` print `INVALID OC-0001: bad severity moderate` and exit 1; `git checkout` of the ledger makes it valid again. The hook's grep pattern was exercised against five paths — the three `.superpowers/` targets match, `.superpowers/sdd/notes.md` and `scripts/check-doc-counts.mjs` do not. `node scripts/run.mjs --list` resolves `check:docs` to three steps rather than one; `npm run check:docs` and `npm run check:hygiene` pass, the latter with prettier, shellcheck (the new hook block) and actionlint (the new CI step) all running for real. Not included: untracking `FINDINGS.md` — that is the next commit, and the order matters. L-07 requires the drift check to exist *before* the removal, because the check is what proves the tracked copy was current at the moment it was deleted. No `import.meta.main` guard on the renderer: no caller imports it, and `import.meta.main` landed in Node 24.2 against an `engines` floor of `>=24`, so it would silently no-op on 24.0/24.1 — `scripts/check-doc-counts.mjs` documents the workaround and stays accurate. No `existsSync` guard for a missing ledger: the unhandled rejection already exits non-zero, so CI already rejects it and only the message is ugly, which is not drift. The `docs-consistency` job is not converted to `npm run check:docs`; it is deliberately `npm ci`-free with direct `node` calls in every step, and half-converting it would be worse than being internally consistent. No `Server/Makefile` target — the ledger is root-scoped, and `make` is not on PATH on a stock Windows box (RL-20). Refs RL-07, L-07 * chore: stop tracking the rendered FINDINGS.md (RL-07) The previous commit built the drift check RL-07 asked for. This is the second half: with the check in place proving the committed rendering was current, the rendering itself comes out of the index. Untracking is strictly stronger than checking. A drift check watches for a rendering that has fallen behind its source; not tracking it removes the possibility. `findings-ledger.json` stays the only tracked copy and remains canonical — `CLAUDE.md` tells contributors to open a PR against it — and the 1.09 MB view of it is regenerated in 67-170 ms by a command that was already documented. Why the drift check still had to land first, in its own commit: it is what proved the tracked copy was current at the moment it was deleted. Deleting a generated file you have never verified against its source is how you discover, later, that the source was wrong. L-07 sequences it the same way — "remove the tracked duplicate human rendering *after* deterministic on-demand/CI rendering and a drift check exist" — and this commit is the "after". The gate transforms rather than disappears. `git diff --exit-code` cannot watch an untracked file, so what remains of L-07's "CI rejects generation failure or drift" is the generation half, plus its separate "a downloadable rendering is reproducible" clause. CI now renders **twice and compares** — which tests both: the render must succeed (it validates and exits 1 before writing) and it must be a pure function of the ledger. The severity rule added in the previous commit is what makes that second property true rather than merely true today. The rendering is then uploaded as the `findings-ledger-rendering` artifact with `if: always()`, so a reviewer reads it without a Node run — and can read it precisely when the job failed. Six coordinated edits, and the fourth is not optional: - `.gitignore` — drop the `!` negation; the `.superpowers/*` blanket takes over. - `.gitattributes` — drop `linguist-generated=true`, now dead. - `.prettierignore` — drop the entry; Prettier 3 reads the root `.gitignore`. - `scripts/check-doc-counts.mjs` — drop it from `WATCHED`. A missing watched file is pushed to `failures` and exits 1 by design, with a message telling you to fix the list. Forgetting this line reds `Docs & Ledger Consistency` and `npm run check` on every subsequent run. - `CLAUDE.md` — the command stays, the "tracked artifact" framing goes. - `.claude/skills/bughunt-run/SKILL.md` — the human gate between hunt and fix reads this file, so it now says to generate it first. That reader is already at a terminal that ran the renderer seconds earlier. 13 files, 103 insertions, 9,278 deletions. The check-doc-counts gate goes from 27 claims across 9 documents to 21 across 8; the six it loses were rendered *from* the ledger they were checked against, so they were self-consistent by construction and could only ever have failed on a stale rendering — which is the thing that can no longer exist. Verified: both directions. `git ls-files .superpowers/` returns exactly two files; `git check-ignore -v .superpowers/FINDINGS.md` names `.gitignore:87` while the ledger itself is not ignored (exit 1), so the blanket rule did not overreach. Deleting the rendering outright and running `node scripts/check-doc-counts.mjs` prints `21 claim(s) across 8 watched document(s)` and exits **0** — the proof that the `WATCHED` line was dropped, because leaving it would have failed here. `npm run check:docs` then regenerates the file (1,087,051 bytes) and passes. Rendering twice and `cmp`-ing the results reports byte-identical output. The pre-commit hook was exercised both ways with the ledger staged: a severity of `moderate` fails with `findings-ledger.json is invalid`, and a valid tree passes with exit 0. `npm run check:hygiene` passes with prettier, shellcheck and actionlint all running for real. Not included: `findings-ledger.json` is untouched by this commit — it is the canonical copy and it stays tracked, at 1,205,085 bytes, which is *larger* than the rendering just removed. Anyone reaching for the size argument should know that untracking the rendering removes 47% of the pair and leaves the bigger, less readable half; the reason to do it is that the rendering is 100% derived and would otherwise write a fresh ~1.06 MB blob into permanent history on every hunt, not that it is the heavy one. No history rewrite — the blobs already committed stay where they are, per the B1 non-goal. `Server/Makefile` gains no ledger target: root-scoped, and `make` is not on PATH on a stock Windows box. Refs RL-07, L-07 * chore: stop tracking the prebuilt hello.wasm plugin example (RL-08) `Server/plugin/examples/hello/hello.wasm` was 946,410 bytes of committed build output — 84% of that directory — for a plugin subsystem that is disabled twice over: it compiles only under `-tags wazero`, and `plugins.enabled` defaults to `false`. Nothing verified it matched the `main.go` beside it. The remedy the audit names is a compile-and-compare gate. It cannot be built, and not for cost reasons: TinyGo embeds absolute host paths from the building machine's Go SDK and module cache into its output and offers no `-trimpath` equivalent, so two machines compiling identical source produce different bytes. A byte-identity gate cannot pass in principle. What is left is a compile-only check, and that needs three pinned downloads — TinyGo, a *second* Go SDK at 1.25.x because TinyGo 0.40.1 rejects the Go 1.26 this module pins, and Binaryen 129 — on every PR, to prove something weaker than advertised about a subsystem that ships in zero release artifacts. So the artifact goes and its provenance is written down instead. BPR-080 asks that the example WASM be "reproducible **or** provenance-verified" — disjunctive — and the second branch is the one that is actually reachable here. The repository had already made this call for itself. `sandbox_wazero_test.go` uses a 41-byte inline WASM literal, with the comment "Using a literal here avoids dragging a binary asset into the repo." This extends that from the tests to the example. Done: - `git rm --cached` the artifact; a narrow `.gitignore` entry naming the exact path. Deliberately **not** a blanket `*.wasm`: `Client/public/rnnoise.wasm` is a vendored npm artifact this repository does not build and the client fetches at runtime, so ignoring it would break noise suppression. The rule that separates them — untrack build output whose source we own and whose absence breaks nothing; keep vendored third-party artifacts required at runtime — is written into the ignore comment. - `Server/.dockerignore` gains `plugin/examples/`. `Dockerfile` does `COPY . .` and the file already excluded `scripts/` and `cmd/` but not this, so a developer who still has the untracked artifact on disk was shipping it into the build context. Same omission B1-5 fixed for `cmd/`. - The README carried two false statements, both now removed: it claimed the plugin is "used by `Server/plugin/plugin_test.go`" and that that test "exercises the manifest parser and the loader against this directory". Neither is true — `plugin_test.go` builds every fixture in `t.TempDir()`. - A Provenance section: TinyGo 0.40.1 + Go 1.25.3 + Binaryen 129, why the output is not byte-reproducible, and why the compile gate is deferred rather than merely absent. - The ABI-stability sentence L-08 requires, which existed nowhere in the repository: the ABI is experimental with no compatibility promise, and both halves of "disabled" are named with the files that prove them. Verbatim identical in the example README and `docs/contributing.md`. - The TinyGo/Go/Binaryen table existed in two hand-maintained copies that had already drifted in wording. It now lives in the example README only; `docs/contributing.md` links to it, which is the pattern that page already used two lines above for the ABI itself. Five files, 87 insertions, 20 deletions, plus the 946,410-byte deletion. Verified: both directions. The inertness proof is the load-bearing one, and it is the inverse of B1-5's remove-and-watch-it-fail, because here passing is the point: with `hello.wasm` moved out of the tree entirely, `go build ./...`, `go build -tags wazero ./...`, `go vet ./...`, `go test ./plugin/...`, `go test -tags wazero -count=1 ./plugin/...` and `go test ./api/...` all pass. `go list ./plugin/...` returns a single package with and without the tag, so `//go:build tinygo` keeps the example out of the module's build graph. The narrowness proof is one pair: `git check-ignore -v` matches `Server/plugin/examples/hello/hello.wasm` at `.gitignore:59` and exits 0, and exits 1 on `Client/public/rnnoise.wasm`, which `git ls-files` confirms is still tracked. `git ls-files Server/plugin/examples/` now returns exactly the three source files. `npm run check:hygiene` and `npm run check:docs` pass. Not included: no CI compile-and-compare job, per the reasoning above — deferred to B2, which the issue register already names as L-08's second phase. **L-08 is not claimed closed**: its closure evidence reads "Deterministic source build passes", and that is precisely what TinyGo cannot deliver here; the register's B1/B2 span is what makes deferring it in-scope rather than a slip. No `tinygo.version` pin file — `Server/sqlc.version` earns its existence through four mechanical consumers, and nothing would read this one; the gap in `docs/contributing.md`'s toolchain-pinning policy is closed by recording TinyGo and Binaryen as a documented exception instead. `main.go`, `plugin.json` and the README stay tracked — L-08 says keep the source, and this commit keeps all of it. `.gitattributes` keeps `*.wasm binary`, which still covers the client's vendored module. No history rewrite: the artifact's existing blobs stay where they are, per the B1 non-goal. Refs RL-08, L-08 * docs(plans): retire the removed graphify tooling from the B1 plan (RL-06) RL-06 asked for a 20.41 MB tracked `graphify-out/` payload to stop being tracked, after a portable regeneration command and a CI artifact existed. None of that happened. Instead `a5f7d95` (#1413) deleted the tool outright, taking all 7 tracked files with it — 20,408,656 bytes, `graph.json` at 19,463,420 — before B1-6 opened. `git ls-files` matches nothing graphify-related today. So the outcome RL-06 wanted holds (no large tracked payload, history intact) and the method it prescribed was bypassed. There is nothing left to do in the repository. What was left is a documentation problem, and a live one: this plan is an active document, and it still told a reader to run a tool that does not exist. The obvious response — delete every graphify mention — is wrong twice over. The `.gitignore` rule has to stay: the local directory reached ~208 MB with cache and dated snapshots on the machine that ran the tool, and dropping the rule would flood that contributor's `git status` with untracked noise. And the "do not rewrite history to shrink graphify-out" non-goal has to stay too: the files are gone from the tree but four `graph.json` revisions remain in the pack (~71 MiB logical, ~3.2 MiB packed of 13.28 MiB), so the line is still operative. It is what keeps "closed" honest rather than overclaiming. Done — nine edits, each a dead instruction rather than a stale mention: - **B1-2 Step 7, the worst of them.** It told a human to `unset GRAPHIFY_SKIP_HOOK`, run `graphify update .`, and `git commit -am` a refresh. The tool is gone, and `git commit -am` with nothing to commit exits non-zero while reading like a no-op success. Replaced with a retirement note; Step 7 is the last step, so nothing renumbers. - **The "Traps carried forward" entry.** A live instruction, in a list of traps, aimed at exactly the multi-commit sequence this phase is. Deleted. - B1-1 Step 1's `export GRAPHIFY_SKIP_HOOK=1` and its four-line hook rationale, collapsed to one sentence of history. The "close any editor, cargo, vite" paragraph beside it is still true and stays. - The RL-06 verdict row, the B1-6 bullet, the flatten's "leave alone" list, the `post-commit` parenthetical, B1-3's exclusion list, and the non-goal line. - `.gitignore`'s stale "delete the dir when convenient" TODO becomes a recorded decision citing the commit that caused it. Verified: `git grep -i graphify` outside the dated audit and the issue register returns exactly five hits, and every one is intended — the `.gitignore` rule and four plan lines that are explicitly retirement or history notes ("once began", "Retired", "closed by deletion", and the non-goal). `git grep GRAPHIFY_SKIP_HOOK` returns one hit, the sentence recording that it used to be required. `node scripts/check-doc-counts.mjs` still passes — this file is one of the documents it watches — and `npx prettier --check` is clean after the verdict-row rewrite reflowed the table. Not included: `docs/audit-2026-08-23-repository-layout.md` keeps its RL-06 row — dated point-in-time snapshot, and `check-doc-counts.mjs` already classifies `docs/audit-*` as report-only. `docs/plans/repo-health-issue-register-2026-08-23.md` keeps L-06 and the R-03 row that routes to it, and the reason is *not* that it is dated: it is in the watched set, i.e. this repository treats it as active. It is that no B1 phase has updated its closure column, so L-01, L-04, L-05 and L-09 through L-13 are all closed in fact and open on paper. Changing that convention in the phase with the least to say about it would leave the register half-updated, which is worse than uniformly stale. That sweep belongs to `R-06`, or to one pass at B1's end. No history rewrite, per the non-goal this commit deliberately keeps. Refs RL-06, L-06 * docs(plans): record B1 progress through B1-6 The header still read "B1-3 are complete; B1-4 is the next step" three merged phases later — B1-3 (#1414), B1-4 (#1415) and B1-5 (#1417) have all landed, and B1-6 is this branch. B1-3 set this convention with its own `docs(plans): record B1 progress through B1-3` commit, and then B1-4 and B1-5 both skipped it. A plan that misstates where it is costs a reader the same confusion whether it is one phase stale or three; three is just harder to notice, because the header looks deliberate. Verified: `node scripts/check-doc-counts.mjs` still agrees on 21 claims across 8 watched documents — this file is one of them — and prettier reports it clean. Refs RL-06 (the phase this records), R-08 * chore(ci): pin Docs & Ledger Consistency as a required check on dev The previous commits gave `Docs & Ledger Consistency` a gate that can actually fail: it now rejects a ledger that will not render, on top of the schema check it already ran. But the job is not among `dev`'s required contexts, so it reports and cannot block. L-07's closure evidence reads "CI **rejects** generation failure or drift" — reporting is not rejecting, and the item is not closed until this lands. The script's own header already diagnosed the omission: it listed `Docs & Ledger Consistency` under "deliberately NOT pinned" with the note that it "looks like an oversight from the 2026-08-25 pass rather than a decision". That entry is now wrong in the other direction, so it moves out of the not-pinned list and into a dated note beside `Repository Hygiene`'s. The name was read off **PR #1418's live check runs** after the job reported `success` — not copied out of `ci.yml`. That order is B1-3's rule and it is not pedantry: the B0 script records that three of the pinned names exist in no workflow file at all, because CodeQL runs from GitHub default setup. Two count claims move with it. `docs/contributing.md` said "All ten required checks" and the HP-0 scorecard's table said **10**, both stale since B1-3 added `Repository Hygiene` and now doubly so. B1-5 spotted the first and deferred it to "the branch-protection item's to fix"; this is that item, and it is also the commit that changes the number, so leaving them stale here would make this commit the proximate cause of a documented inconsistency. The scorecard is in `check-doc-counts.mjs`'s watched set — the repository classifies it as active, not as a frozen snapshot — so the don't-edit-dated-docs rule does not shield it. Its pinned block gains both names and a line recording when each was added. NOT APPLIED YET. Running this script is `gh api -X PUT repos/J3vb/OwnCord/branches/dev/protection`, a repository-settings write this session cannot perform. Run `bash docs/plans/b0-dev-branch-protection.sh` after this PR merges. The pre-flight is clear, stated positively rather than assumed: a required check that never reports blocks every PR forever, which is the hazard B1-3's own NOT-APPLIED note was about. It does not apply here. `Docs & Ledger Consistency` has existed in `dev`'s `ci.yml` since #1412, so no in-flight branch predates the job, and it reported `success` on this PR in 11 seconds. Verified: `bash -n` and `shellcheck` are clean. Extracting the heredoc and parsing it with `node` reports **12** contexts including `Docs & Ledger Consistency`, spelled exactly as the live check reports it — the JSON is machine-checked rather than eyeballed, because a typo here is a branch that cannot merge. `node scripts/check-doc-counts.mjs` still agrees on 21 claims across 8 watched documents, the scorecard among them, and `npm run check:hygiene` passes with prettier, shellcheck and actionlint all running. Not included: the script is not run — that is the owner's step, above. No other context is added or removed; the four remaining "deliberately NOT pinned" entries keep their recorded reasons, including `Admin Panel E2E`, whose `continue-on-error: true` still makes requiring it theatre until `R-01` graduates it. Refs RL-07, L-07, RL-14, G-03 --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-27 11:08:07 +02:00
J3vbandClaude	9eba6969d2	B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417) ... * refactor: move the protocol schema to protocol/schema.json (RL-09) The WebSocket message-type schema is the one artifact in this repository that neither component owns: `Server/ws/message_types.go` and `Client/src/lib/protocolTypes.ts` are both generated from it, and neither may be hand-edited. It nonetheless lived at `docs/protocol-schema.json` — filed under the directory for prose, whose own README calls it "Reference" material — and its generator lived at `Server/scripts/genprotocol/`, i.e. inside one of the two consumers. Ownership was legible from neither location. The obvious fix — move the generator to the repository root alongside the schema, so the whole tool is at the cross-component boundary — is wrong here. The generator is a Go `package main`, and Go modules are directory-rooted: `Server/go.mod` roots at `Server/`, so a root-level Go program needs a second module or a `go.work`. That second module would sit outside every path filter this repository already has — `golangci-lint` runs with `working-directory: Server/` (ci.yml), `go vet ./...` runs from `Server/` (scripts/run.mjs, .githooks/pre-commit), `.githooks/pre-commit` selects Go files with `^Server/.*\.go$`, `.githooks/pre-push` sets `server_changed` on `^Server/`, setup-go caches on `Server/go.sum`, and dependabot has one gomod block for `/Server`. Six gates would silently stop covering the generator, each failing open. The schema is data and moves freely; the generator is Go and stays where the Go toolchain already runs. Done instead: - `docs/protocol-schema.json` -> `protocol/schema.json`. A new top-level `protocol/` is the cross-component boundary, with a `README.md` naming the two generated consumers, the one command, and the four gates. - `Server/scripts/genprotocol/` -> `Server/cmd/genprotocol/`, the module's conventional home for an executable. This also empties `Server/scripts/` of Go entry points except `seed.go`, which RL-10 moves next. - `Server/cmd/` added to `Server/.dockerignore` and `Server/.air.toml`, which both already excluded `Server/scripts/`. Without this the move would have silently widened the Docker build context and the air watch set. 27 files, 115 insertions, 76 deletions. Two runtime path resolvers re-pointed (`cmd/genprotocol/main.go:41` `-schema` default, `ws/protocol_contract_test.go:67` `filepath.Join`); two git-hook grep patterns (`pre-commit:53`, `pre-push:57`); eight generator call sites across five files (Makefile x2, scripts/run.mjs x2, pre-commit x2, ci-check skill, bughunt-fix.js); two broken relative markdown links (docs/README.md:47, docs/protocol.md:1497); two generated files regenerated, header lines only, zero constants changed; two ledger prose hits plus a `render-ledger.mjs` re-render. No new verify was written: the regenerate-and-diff check is already enforced three times (CI `make protocol-verify`, `.githooks/pre-commit`, `npm run check:server`) and `ws/protocol_contract_test.go` independently checks the schema against the constants a fourth time. Verified: both directions, for both resolvers. With `protocol/schema.json` removed, `go test ./ws/ -run TestProtocol` fails with `reading protocol schema at /home/user/OwnCord/protocol/schema.json: no such file or directory` (two tests) and `go run ./cmd/genprotocol` exits 1 with `read schema: open ../protocol/schema.json: no such file or directory`; with the file restored both pass. So the new path is genuinely resolved, not merely spelled in a comment. The hook patterns were exercised directly: the pre-commit pattern matches `protocol/schema.json` and `Server/cmd/genprotocol/main.go` and no longer matches `docs/protocol-schema.json`; the pre-push pattern matches `protocol/schema.json`. `go run ./cmd/genprotocol` twice in a row leaves `git diff --exit-code ws/message_types.go ../Client/src/lib/protocolTypes.ts` clean, so the committed outputs are exactly what the generator emits. `go build ./...` and `go vet ./...` pass; `npx prettier --check .`, `npm run typecheck` and `npm run lint` pass; `node .superpowers/render-ledger.mjs --check` reports 348 findings valid. Not included: the four dated `docs/audit-*.md` files, the older `docs/plans/*`, and `CHANGELOG.md` keep the old path — they are point-in-time records, and `.prettierignore` and `scripts/check-doc-counts.mjs` already treat them as deliberately unmaintained. The B1 plan itself keeps its own wording, since it states intent rather than current state. `Server/scripts/` is not deleted: it still holds `seed.go` (RL-10), `k6/`, `toxiproxy/` and two shell scripts. `Server/telemetry/metrics.go:19` declares a scope for a `Server/voice` package that does not exist — spotted here, unrelated to this move, left for RL-13's sweep to carry forward verbatim rather than fixed inside a relocation. No `seed:` Make target was added. Refs RL-09, L-09 * refactor: move the seed tool under Server/cmd/seed (RL-10) `Server/scripts/seed.go` was a `package main` sitting directly in `Server/scripts/`, which made `Server/scripts` itself one of the module's three main packages — a developer tool in the module's build graph under a directory name that says "loose scripts". It also did filesystem work in `func init()`: `os.MkdirAll("data", 0o750)` ran before `flag.Parse()`, so the directory appeared even when the tool immediately refused to run. The audit row (RL-10) claims that `init()` fires "during test discovery". It does not, and the obvious fix aimed at that claim would be aimed at nothing: `Server/scripts/` contains zero `_test.go` files, so Go never builds a test binary there and `go test ./...` never runs the `init()`. The residual defect is narrower and real — an untagged `package main` in the build graph, plus a side effect on a path (`go run ./cmd/seed -h`) that has nothing to do with tests. Done: - `Server/scripts/seed.go` -> `Server/cmd/seed/main.go`, joining `cmd/genprotocol/` from RL-09. `Server/scripts/` now holds shell and JS tooling only (docker-smoke.sh, k6/, toxiproxy/, voice-test.sh) and no Go entry point at all. - The `os.MkdirAll` moved out of `init()` to immediately before `db.Open` in `main()` — the one call that needs the directory, since `db.Open` -> `OpenWithMaxReaders` -> `openFile` creates no intermediate directories. - The package doc comment's usage lines were wrong in two ways, not one: they named `go run scripts/seed.go`, which no longer exists, and they omitted the mandatory `-confirm-dev`, so neither documented command could ever have run. Both corrected, and `seed.go is a standalone tool` became the conventional `Command seed populates ...`. - `Server/CLAUDE.md`'s Layout list now names `cmd/` and states that no Go entry point lives in `scripts/`. Two files, 20 insertions, 17 deletions. `go list` main packages go from `{server, server/cmd/genprotocol, server/scripts}` to `{server, server/cmd/genprotocol, server/cmd/seed}` — the count is unchanged at three, which is the honest framing: this relocates a main package to a conventional path, it does not remove one from the build graph. Verified: both directions, by building the pre-change file and the post-change file and running each in a fresh empty directory. Before, `seed` with no flags exits 1 *and leaves a `data/` directory behind*; `seed -h` exits 0 and also leaves `data/` behind. After, both exit the same way and create nothing — `data/ exists=NO` in each case. The happy path is unchanged: `seed -confirm-dev` in an empty directory creates `data/` at mode 0750, writes `data/chatserver.db`, and reports 4 users / 5 channels / 31 messages; a second run reports 0 new rows, so idempotence survives. The old documented invocation now fails loudly (`go run scripts/seed.go` -> `stat scripts/seed.go: no such file or directory`) and the new one is what the comment says. All four build-tag variants compile, `go vet ./...` passes, `gofmt -l` is clean outside `db/dbgen`, and `npx prettier --check .` passes. Behaviour delta, called out rather than left silent: the two cases above (`-h`, and a missing `-confirm-dev`) no longer create `./data`. That is a change, not a pure relocation. It is the change RL-10 asks for — the remedy text is "remove import/test-time filesystem side effects" — and the alternative that preserves the old behaviour exactly, making the `MkdirAll` the first statement of `main()` before `flag.Parse()`, would keep precisely the side effect the item exists to remove. Not included: `Server/scripts/genprotocol` was moved to `Server/cmd/` by the RL-09 commit rather than here, so the "executable tooling under conventional command ownership" class is closed across the two commits, not this one alone. `filepath.Dir(*dbPath)` was evaluated for the `MkdirAll` and rejected: it would fix a real gap (`-db /elsewhere/x.db` still creates a useless `./data` and does not create `/elsewhere`) but it means creating an arbitrary directory from CLI input, and that is a behaviour change past "shift it out of `init()`" — worth its own item. No `make seed` target was added, and the dated `docs/audit-*.md` rows naming `Server/scripts/seed.go` keep the old path. The findings ledger has zero references to this file, so no re-render was needed. Refs RL-10, L-10 * test: give the cross-stack contracts a named tier (RL-11) `Client/tests/unit/admin-static-channel-perms.test.ts` reads and executes `Server/admin/static/index.html`. Filed under `tests/unit`, nothing about its location or name said it locks a server-owned artifact, so a Go developer editing the admin SPA got a red check called "Client Unit Tests" with no clue why. The register describes this as one file. It is not, and the measured set does not match the description in either direction: - Client -> Server: exactly ONE test crosses by filesystem read, not two. `main-page.test.ts` was named in the plan but only carries a prose comment citing `Server/admin/update_handlers.go:181` at line 1046 — no read, no import, nothing to move. - Server -> Client: the four tests the plan named do not cross. `waf_test.go`/`waf_crs_test.go` set a `User-Agent: OwnCordClient/1.0` literal that appears nowhere under `Client/`; `ws_integration_test.go:289` and `sanitize_content_fuzz_test.go:46` are comments. The real crossing is one the register never named: `Server/updater/updater_test.go:630` does `os.ReadFile` on `Client/src-tauri/tauri.conf.json`. The obvious fixes are both wrong. Moving the invariant "to the owning server test" cannot work: `Server/go.mod` carries no JavaScript engine (no goja, otto, v8go, quickjs, rogchap, duktape), so a Go port could only assert at the text level like `admin/perm_grid_test.go` does — and that is not a substitute. Flipping the guard at `admin/static/index.html:1182` to `targetIsTouchedRole=false` reintroduces OC-0154 in full while leaving every greppable identifier intact, so a text-level test passes on a broken file. Relocating it to the e2e admin journey is worse: that job is `continue-on-error: true` and deliberately unpinned ("requiring it is theatre" — `docs/plans/b0-dev-branch-protection.sh`), so it would convert a blocking, pinned gate into one that is green regardless. And the journey does not cover the invariant today: `grep -Eic "perm|access|role|override|matrix"` over its 142 lines returns 0, so the "if e2e already covers it, delete" branch never fires. Done — one tier, applied to the whole set, defined by artifact coupling and placed by runtime capability: - New `Client/tests/contract/`, holding `server-admin-static-channel-perms.test.ts`. Same directory depth, so `../../../Server/...` still resolves; the body is byte-identical apart from a header naming the owner and the runner. - `Server/updater/tauri_key_contract_test.go` splits the one cross-component Go test out of `updater_test.go` verbatim, same `package updater`. It stays in Go — placement follows capability, and Go parses JSON fine — so only the file name has to declare the crossing. Without this the item would have been "moved one file and declared the class closed". - `npm run test:contract`, and the tier, the membership rule and a blocking/non-blocking table in `docs/contributing.md#testing`, which previously described no tiers at all. - `Client/CLAUDE.md`'s tier list was missing `tests/e2e/admin` and `tests/e2e/native` before this; it now lists all seven and states the rule. `Server/CLAUDE.md` records why the SPA's execution-level invariant is locked from the client tree, so nobody "fixes" it into a regex. - Ledger `OC-0154.fix.test` re-pointed and `FINDINGS.md` re-rendered; `.claude/workflows/bughunt.js` — the workflow that produced OC-0154 — no longer describes the TS test surface as `tests/unit/*.test.ts` only. - Three stale cross-stack pointers of exactly the class this item is about: `tests/e2e/helpers.ts:348,351` and `tests/unit/types.test.ts:13` named `docs/brain/06-Specs/PROTOCOL.md`, which does not exist (`docs/brain/` is a gitignored path); all now name `docs/protocol.md`. 15 files, 125 insertions, 33 deletions. No CI job, workflow, vitest, tsconfig, eslint, knip or stryker change, and no new pinned check — `ci.yml`'s `npx vitest run --coverage` has no path filter and `vitest.config.ts` includes `tests/**/*.test.ts`, so enforcement after the move is bit-identical to enforcement before it. That is deliberate: `dev` pins 11 contexts and a 12th is a branch-protection API write, not something a PR can do, so any new job would be advisory until someone separately changed repository settings — strictly less protection than today. Verified: both directions, and the assertion was not weakened. Flipping `admin/static/index.html:1182` to `const targetIsTouchedRole=false;` makes the moved test fail (`AssertionError: expected 'DELETE' not to be 'DELETE'`); `git checkout` of that file makes it pass again — so the invariant survived the move intact rather than becoming a test that passes anywhere. The split Go test's cross-boundary read is live too: with `Client/src-tauri/tauri.conf.json` moved away, `go test ./updater/` fails with `ReadFile(../../Client/src-tauri/tauri.conf.json): no such file or directory` from `tauri_key_contract_test.go:20`, and passes once restored. The full client suite is 192 files / 5257 tests passing, identical to the count before the move; `npm run typecheck` passes, which proves `tests/contract/` is inside the tsconfig graph and that `tests/types/jsdom.d.ts` still resolves the moved test's `import { JSDOM }`. `npm run lint`, `npx prettier --check .`, `go vet ./...` and `go test ./updater/` all pass. `git grep "tests/unit/admin-static-channel-perms"` finds no survivor outside the B1 plan itself. Not included: nothing was deleted, because no e2e sibling covers OC-0154. `Client/tests/types/jsdom.d.ts` was neither moved nor deleted — it is still the only type source for the moved test's `jsdom` import. `capabilities-scope.test.ts` and `tauri-conf-webview2-args.test.ts` read `src-tauri/` and stay in `tests/unit`: `src-tauri` is inside the `Client` component, so they are not contract tests, and the rule earns that rather than hand-waving it — moving them would have forced repoints of ledger entry OC-0089 and `docs/security.md:64` for no gain. Each gained a one-line header saying why. `Server/admin/perm_grid_test.go` and `emoji_section_test.go` read their own package's embedded asset and are unchanged; they are the text-level complement to the execution-level test, not duplicates. No JS engine was added to `go.mod`, no npm root was created under `Server/`, and no root-level `tests/` tier was created — there is no runner for one and no way to make it blocking from a PR. Separately noticed and NOT fixed here: `docs/contributing.md:221` still says "All ten required checks" while `docs/plans/b0-dev-branch-protection.sh` pins eleven since B1-3 added `Repository Hygiene`, and `docs/plans/hp-0-scorecard-2026-08-25.md:109` is stale the same way — that is the branch-protection item's to fix, not this one's, and one register item per commit. Refs RL-11, L-11 * refactor: rename the Go module to github.com/J3vb/OwnCord/Server (RL-13) `Server/go.mod` declared `github.com/owncord/server` while the public repository is `github.com/J3vb/OwnCord`. Nothing resolves that path — there is no `owncord` GitHub org and no vanity-import host serving go-import metadata for it — so every import line in the tree named a location that does not exist. It compiles because a main module's own path is never fetched, which is exactly why it went unnoticed. The obvious fix — an AST-aware import rewriter (`gomvpkg`, `go mod edit`) — is wrong here, and provably so. Six of the 722 occurrences are not imports at all: `api/main_test.go:20` (a goleak `IgnoreTopFunction` pattern), `telemetry/metrics.go:17-19` (three OTel instrumentation-scope names), `invariants/syncutil_locks.go:73` (a diagnostic message), and `invariants/syncutil_locks_test.go:56` (an import line inside a raw-string Go fixture). An import rewriter touches none of them, and the compiler cannot see any of them either. Done as one scripted substitution over `git ls-files`, anchored on the full `github.com/owncord/server` string. The anchor matters: `owncord-server` is a different identifier — the OTel `service.name` (`config/config.go`, `telemetry/telemetry_otel.go`) and the GHCR image name (`.github/workflows/release.yml`, `docker-compose.yml`) — and a looser pattern would have moved it. It is untouched: 10 occurrences across 9 files, before and after. 350 files, 728 insertions, 728 deletions. 722 occurrences in 344 Go files, plus `go.mod:1`, the `sed` at `Makefile:67`, `Server/CLAUDE.md:3`, `docs/architecture/server.md:5`, and the ledger pair (`findings-ledger.json:3758` plus a `render-ledger.mjs` re-render of `FINDINGS.md`). Zero in any workflow, zero in the Dockerfile, zero in `Server/.golangci.yml` (no `local-prefixes`, `gci`, `importas` or `depguard` rule keys on the module path, so import grouping is not configured anywhere). The plan's blast-radius estimate missed one thing, and it is the one that would have gone red: **gofmt**. `J` (0x4A) sorts before every lowercase letter, so in the 36 files where a module-local import shares a contiguous group with a third-party one, the module's imports must move above `github.com/go-chi/...`. `gofmt -l` was clean before the substitution and listed exactly 36 files after it; `gofmt -w` on those 36 restores it to clean. `gofmt` is an enforced gate — the `formatters` block in `Server/.golangci.yml`, which is S-05 — so a substitution-only commit fails Lint. Verified: both directions, and the line accounting is exact. Every added line in this diff contains the new module path (728) and every removed line contains the old one (728); the count of changed lines containing neither is **zero**, so the gofmt re-sort moved module-path lines only and touched no third-party import. The residual check (`git ls-files -z | xargs -0 grep -n 'github\.com/owncord/server'`) returns exactly two hits, both deliberately out of scope: the RL-13 row in `docs/audit-2026-08-23-repository-layout.md` and the measurement row in this phase's own plan. The compiler-invisible half was proven by reverting *only* `api/main_test.go:20` to the old path on the otherwise-renamed tree: `go build ./...` and `go vet ./api/` both still pass — they see nothing wrong — while `go test ./api/` FAILS, because the runtime function name now carries the new path and goleak stops ignoring `ws.(*Hub).Run.func1`. Restoring the line makes it pass. `go.sum` is byte-identical (no `go mod tidy` was run and none was needed). All four build-tag variants compile; `go vet ./...`, `go vet -tags otel,wazero ./...` and `go vet -tags deadlock ./...` pass; `go test -race ./...` is 16/16 packages green; `go test -tags deadlock ./...` passes; the tag-gated `./plugin/...` (wazero) and `./telemetry/...` (otel) runs pass. `golangci-lint` v2.11.3 — the pinned CI version, rebuilt locally against Go 1.26 because the packaged binary cannot load a 1.26 config — reports **0 issues**. `go run ./cmd/genprotocol` leaves `git diff --exit-code ws/message_types.go ../Client/src/lib/protocolTypes.ts` clean, so the rename does not reach the generated protocol constants. `npx prettier --check .` and `node .superpowers/render-ledger.mjs --check` pass. Not included: `docs/audit-2026-08-23-repository-layout.md` and `docs/plans/b1-repository-foundation-2026-08-25.md` keep the old path — they are the audit row and the measurement that motivated this change, and rewriting them would erase the record of what was measured. They are why the residual check needs a two-path allowance rather than being empty; that allowance is stated above rather than hidden in a pathspec. `telemetry/metrics.go:19` declares `scopeVoice` for a `Server/voice` package that does not exist; the substitution carried the dead path forward verbatim as `github.com/J3vb/OwnCord/Server/voice` rather than fixing it, because correcting a real observability bug inside a mechanical rename would hide it in a 350-file diff. It needs its own item. No `go.work`, no second module, and no vanity-import host was set up — the new path resolves against the real repository, but nothing imports this module as a library, so `go get` reachability was not exercised either way. Refs RL-13, L-12 --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-27 07:11:18 +02:00
J3vbandClaude Opus 5	2a37f386f9	B1-3: repository hygiene gates (RL-19 / L-13, S-05) (#1414) ... * chore(format): one Prettier config at the repository root Every formatting rule in this repository lived under Client/ and covered exactly two globs: Client/src/**/*.ts and Client/tests/**/*.ts. Root Markdown, all of docs/, every YAML and JSON, all CSS, the root scripts and tools/mcp-introspect were formatted by nothing. There was no .editorconfig. The obvious fix -- a second Prettier config at the root for "everything else" -- gives two configs and two ignore files that can silently disagree about the same file. So the root takes ownership instead: config, ignore file and gate move up, and Client/ folds in. Client's inline "prettier" block, its .prettierignore, its format/format:check scripts and its now-unused prettier devDependency are all deleted; knip would have failed client-check on that last one. The .prettierrc.json values are lifted byte-for-byte from Client/package.json, which is what keeps the reformat commit free of client TypeScript churn: 87 tracked files need reformatting and not one of them is under Client/src or Client/tests. .prettierignore carries only what .gitignore does not. Prettier 3 reads the root .gitignore by default, so node_modules/, dist/, coverage/, Client/src/generated/ and docs/security-findings/ need no entry. It does NOT read nested .gitignore files, which is why .remember/ is listed explicitly -- 38 untracked per-machine scratch files were otherwise able to turn a shared gate red. graphify-out/ is listed because its seven files are tracked and .graphify_labels.json is signed byte-for-byte by its .sig, so formatting it would silently invalidate the signature. check:hygiene is registered in scripts/run.mjs and folded into check and release:preflight. It deliberately contains no `gofmt -l` step: gofmt -l prints offenders and still exits 0, so it cannot fail a build. Go formatting is enforced separately. shellcheck and actionlint take their file lists from `git ls-files`, never a filesystem glob -- .claude/worktrees/ holds a gitignored pre-flatten copy of the tree with three .sh files a glob would happily lint. This commit leaves the tree non-conformant on purpose. The reformat is the next commit, so the 87-file diff is reviewable separately from the rule that caused it. Not included: editorconfig-checker. .editorconfig is the editor baseline the audit asked for; Prettier, gofmt and rustfmt already fail CI on the same indentation and newline rules, so a fourth tool checking them again is a gate with no failure mode of its own. Verified: `npx prettier --check .` names 87 tracked files and zero untracked ones; the same command listed 38 .remember/ scratch files before the ignore entry and none after. `node scripts/run.mjs --list` resolves check:hygiene to 8 shell targets and 4 workflow targets. Both package.json files parse. Refs RL-19 / L-13, S-05. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(format): reformat the tree to the repository Prettier rules Mechanical. This commit is `npx prettier --write .` and nothing else -- the rule that caused it landed in the previous commit so this diff can be reviewed as a transformation rather than as 84 files of hunks. 84 tracked files: 54 Markdown, 7 .mjs, 7 JSON, 6 YAML, 4 .js, 3 CSS, 2 TypeScript (the two Playwright configs at Client's root, which the old Client/src + Client/tests globs never covered). No file under Client/src or Client/tests moves, because .prettierrc.json carries Client's former inline values byte-for-byte. Prettier rewrote 87 files, not 84. The three in .github/ISSUE_TEMPLATE/ had CRLF on disk and differ only in line endings, which .gitattributes (`* text=auto eol=lf`) already normalises, so their committed blobs are unchanged. Worth knowing before someone reconciles the two numbers. The largest single diff is .superpowers/findings-ledger.json at 7976 lines rewritten. That is safe to format: nothing writes the ledger programmatically -- render-ledger.mjs reads it and writes only FINDINGS.md -- so no tool will fight Prettier over its style on the next hunt. FINDINGS.md itself is ignored as generated. Verified: `npx prettier --check .` reports "All matched files use Prettier code style", so the pass is both complete and idempotent. All 7 reformatted JSON files were parsed before and after and compared as values: semantically identical, zero content changes. `node .superpowers/render-ledger.mjs --check` still reports 348 valid findings and leaves FINDINGS.md untouched. `node scripts/check-doc-counts.mjs` still passes its selftest and still agrees on 27 claims across 9 watched documents -- table realignment did not break the patterns it matches on. `node scripts/run.mjs --list` still parses. Refs RL-19 / L-13, S-05. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(lint): enforce Go formatting in the Server linter S-05: repository-wide Go formatting was not a required gate. The only gofmt enforcement anywhere was .githooks/pre-commit, which is opt-in per clone (`npm run hooks:install`), only sees staged files, and warns-and-skips when gofmt is off PATH. The obvious fix -- a `gofmt -l` step in CI -- does not work: `gofmt -l` prints its offenders and still exits 0, so the step passes no matter what it finds. scripts/run.mjs has the same problem, which is why check:hygiene has no Go step either. So gofmt goes where it can actually fail something: Server/.golangci.yml. The file was already `version: "2"` but had no `formatters:` block at all, so the 19 enabled linters ran with zero formatters. In v2 gofmt/gofumpt/goimports moved out of `linters.enable` into their own section with its own exclusions. Adding it there means the gate reports through the Lint step of "Server Build & Test", which is already pinned as required on dev -- no new job and no new pin. Every tracked .go file is under Server/ (551 of them, one go.mod), so Server-scoped is repository-wide here. One file was genuinely misformatted: a one-space struct field alignment in Server/admin/handlers_users_broadcast_test.go, fixed in the same commit because a single line does not need its own reformat commit. Trap worth recording: `gofmt -l .` on a Windows working tree lists every file that has CRLF on disk, because gofmt normalises line endings. That reported 18 offenders here, 17 of them ghosts. The blobs are all LF -- .gitattributes forces `eol=lf` -- so CI never saw them, and the honest test is to run gofmt over `git show HEAD:<file>` rather than the working copy. Doing that across all 551 tracked Go files found exactly the one real offender above. Verified both directions with golangci-lint v2 locally: `golangci-lint run ./...` reports 0 issues on the formatted tree; appending a misformatted function to Server/auth/constants.go produces 2 gofmt findings; appending the same misformatted function to Server/db/dbgen/admin.sql.go produces 0, so the exclusion holds. Both files restored and verified clean afterwards. Refs RL-19 / L-13, S-05. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(scripts): escape the NUL separator instead of embedding one The `tracked()` helper added earlier in this branch splits `git ls-files -z` output on NUL. The separator was written as a literal NUL byte rather than the two-character JavaScript escape, so scripts/run.mjs became a binary file: `git diff` refused to show it, `grep` reported "Binary file matches" instead of the line, and `* text=auto` in .gitattributes stops normalising line endings for a blob it detects as binary. The code worked -- splitting on a raw NUL and splitting on "\0" are the same operation -- which is exactly why this is worth fixing before it is inherited. A source file that tooling classifies as binary is a file nobody can review. Verified: zero NUL bytes remain, `grep -n "split("` now prints line 50 instead of "Binary file matches", `node scripts/run.mjs --list` still resolves the same 8 shell and 4 workflow targets, and prettier still reports the file clean. * chore(lint): enforce Rust formatting Rust had no formatting gate of any kind: no rustfmt.toml, no `cargo fmt` anywhere in CI, in scripts/run.mjs, in the Makefile or in the git hooks. Clippy was the only Rust gate, and clippy does not check layout. `cargo fmt --all -- --check` now runs in the rust-tests job, ahead of clippy: a formatting failure is cheap to produce and cheap to fix, and there is no reason to spend a clippy pass to surface one. The stable toolchain in that job requested `components: clippy` only, so rustfmt is added there. Only that job. ci.yml has a second, byte-identical `Install Rust` block in tauri-build; it stays clippy-only, because a full desktop build is the wrong place to discover a misplaced brace. No rustfmt.toml. The default profile is the point of a baseline -- a config file here would be a second opinion about style with nothing to say. Client/src-tauri is a single `[package]`, not a workspace, so `--all` is a safeguard against a future member rather than a fan-out today. Verified: `node scripts/run.mjs --list` resolves check:rust to three steps with `cargo fmt --all -- --check` first, `npm run format` now also runs `cargo fmt --all`, and prettier reports ci.yml, run.mjs and the ci-check skill clean. `cargo fmt --all -- --check` currently fails on 13 files -- that is the reformat, and it is the next commit. Refs RL-19 / L-13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(format): reformat the Rust crate to rustfmt defaults Mechanical. This commit is `cargo fmt --all` and nothing else; the gate that demands it landed in the previous commit so this diff is reviewable on its own. 13 of the 17 tracked .rs files, +343/-164. The crate had never been formatted, so the changes are the usual first-run set: aligned trailing comments collapsed to single spaces, single-element slice literals folded onto one line, long method chains broken across lines, closure bodies expanded into blocks. Verified: `cargo fmt --all -- --check` is clean, so the pass is complete and idempotent. `cargo clippy --all-targets -- -D warnings` finishes with no warnings, and `cargo test --lib` reports 115 passed / 0 failed -- identical to before the reformat, which is what "mechanical" has to mean for a commit that touches this much of the crate. Refs RL-19 / L-13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(scripts): make the root facade actually run on Windows Adding the first gate that a contributor would run from the repository root exposed two bugs in the facade, both of which made it silently wrong on the platform this project is developed on. 1. Every npm and npx step failed. bin() appends `.cmd` on Windows, but Node refuses to spawn a .cmd or .bat with shell:false -- the CVE-2024-27980 mitigation -- and fails with EINVAL and a *null* exit status. run.mjs only special-cased ENOENT, so the result was `FAILED: npx prettier --check . exited null` with nothing to explain it. check:client has three npm steps and has never been able to run here. Fixed by spawning only the npm shims through a shell. They are concatenated into a single command string rather than passed as an args array, because shell:true plus a separate array is deprecated (DEP0190) and prints a warning on every invocation; no argument in this file contains a space. 2. Every optional() step was skipped, always. onPath() shelled out to `where` on Windows, but where.exe lives in C:\WINDOWS\System32, which a Git Bash PATH does not necessarily contain -- on this machine PATH carries System32\Wbem, System32\WindowsPowerShell\v1.0 and System32\OpenSSH but not System32 itself. The probe could not start, `probe.status === 0` was false, and golangci-lint and sqlc reported as "not installed" while installed. Fixed by resolving against PATH and PATHEXT directly. No subprocess, and no dependency on which directories happen to be on PATH. A spawn error other than ENOENT now reports its code instead of surfacing as a null exit status. Verified: before, `node scripts/run.mjs check:hygiene` died with "exited null" and both optional steps printed SKIP with the tools present on PATH. After, the same command runs prettier, shellcheck and actionlint and prints "check:hygiene: passed", with no deprecation warning. `golangci-lint` is detected by the new onPath where the old one missed it. Refs RL-20 / L-14. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(format): ignore build output that nested gitignores hide Prettier honours the root .gitignore and no other. Every build and scratch directory in this repository is ignored by a *nested* one -- Client/.gitignore, .serena/.gitignore, .superpowers/sdd/.gitignore -- so none of them were excluded from the new repository-wide gate. The effect is not subtle. Running `cargo test` once drops roughly 850 formattable files into Client/src-tauri/target/, and the hygiene gate goes from clean to "Code style issues found in 939 files". CI never sees it, because a fresh checkout has no build output; every contributor sees it on their second command. Mirrors the three nested files rather than inventing a list: dist, coverage, playwright-report, test-results, .vite, src-tauri/target and src-tauri/gen from Client/.gitignore, plus .serena/ and .superpowers/sdd/. node_modules needs no entry -- Prettier ignores it by default. Verified: `npx prettier --check .` reports "All matched files use Prettier code style" with a fully populated Client/src-tauri/target/ present on disk, and still names README.md when a misformatted table is appended to it. Refs RL-19 / L-13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(ci): shellcheck, actionlint, and a repository hygiene job The last two gates RL-19 asks for. Neither existed: the shell scripts were never linted, the workflows were never syntax-checked, and .githooks/pre-commit carried hand-written `# shellcheck disable=` directives that nothing had ever read. New `hygiene` job, ubuntu-only and root-scoped, modelled on docs-consistency for the same reason: every gate in it is platform-independent text analysis, and .gitattributes pins eol=lf so a second OS would only re-prove line endings. It runs `npm run check:hygiene` -- the same entry point a contributor runs, not a parallel copy of the commands. shellcheck ships in the runner image. actionlint does not, so it is pinned by version and verified by sha256: an installer script piped from a branch would be the one unverified download in a workflow file that pins every action by commit SHA. Prettier's step moves here from client-check, where it no longer belongs. Both linters found real defects. shellcheck, 3 findings in 8 scripts. Two are SC1125 errors in .githooks/pre-commit: `# shellcheck disable=SC2086 - repo paths contain no spaces` is not a valid directive. Trailing prose makes shellcheck discard the rest of the line, so neither suppression was ever in effect -- and one of the two was written earlier in this same branch, which is a fair demonstration of why the gate is worth having. The prose moves to its own line above. The third is SC2015 in start-server.sh, rewritten as an explicit if. actionlint, 5 findings, all inside `run:` blocks it shellchecks once shellcheck is on PATH. Three SC2015 in load-baseline.yml, rewritten as explicit ifs. Two SC2035 in release.yml, where `sha256sum *` should not become `sha256sum ./*`: the comment four lines above records that ParseChecksumFile exact-matches the last field, so a "./" prefix would strand every deployed server exactly as a "windows/" prefix would. `sha256sum -- *` satisfies the linter and leaves the output bytes identical. Verified all three gates in both directions with shellcheck 0.10.0 and actionlint 1.7.7 on PATH. Passing: `node scripts/run.mjs check:hygiene` prints "check:hygiene: passed" with all three steps run, not skipped. Failing: appending `bait_fn() { cat $1; }` to Server/scripts/voice-test.sh fails on SC2086; changing a runs-on to `ubunt-latest` fails on runner-label; appending a misformatted table to README.md fails prettier. All three files restored and confirmed clean afterwards. actionlint validates the new job in ci.yml itself. Refs RL-19 / L-13, S-05. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(plans): record B1 progress through B1-3 The header still read "B1-0 is complete; B1-1 is the next step" three merged phases later. A plan that misstates where it is costs a reader the same confusion whether it is stale by one phase or three. B1-0 (#1410), B1-1 (#1411), B1-2 (#1412) and B1-3 (this branch) are done; B1-4, dependency automation, is next. Verified: `node scripts/check-doc-counts.mjs` still agrees on 27 claims across 9 watched documents -- this file is one of them -- and prettier reports it clean. * chore(ci): pin Repository Hygiene as a required check on dev The second half of S-05. Its acceptance criterion is "tree is formatted AND a fast required gate fails future drift" -- a check that runs but is not pinned lets a formatting regression merge, so the gate is not a gate until this lands. The name was read off PR #1414 with `gh pr checks` after the job reported `pass` in 26s, not copied out of ci.yml. That order matters: the B0 script records that three pinned names exist in no workflow file at all, and that a required check which never reports blocks every PR forever. Extends the existing script rather than adding a second one, per the B1 plan. Also records, in the "deliberately NOT pinned" list, that Docs & Ledger Consistency reports and passes on a dev PR yet is unpinned. That reads as an oversight from the 2026-08-25 pass rather than a decision, but it belongs to G-04, so it is documented here and not changed. NOT APPLIED YET. Running this script now would pin a check that PR #1413 cannot report -- its branch predates the hygiene job, so the job does not exist in its workflow file and the check would never arrive. Run it after #1414 merges; #1413 needs a rebase onto dev regardless. Verified: shellcheck clean, the embedded JSON parses, and `check:hygiene` passes with prettier, shellcheck and actionlint all running. Refs S-05, RL-14 / G-03. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-26 18:00:26 +00:00
J3vbandClaude	463f1d546f	Fix 27 findings from 2026-08-21 bug hunt (#1400) ... * chore(findings): record 2026-08-21 bug hunt (38 findings) * fix(api): 1 defect(s) (OC-0240) * fix(client): 1 defect(s) (OC-0241) * fix(plugin): 2 defect(s) (OC-0243, OC-0265) * fix(client): 3 defect(s) (OC-0244, OC-0256, OC-0259) * fix(client): 1 defect(s) (OC-0247) * fix(client): 2 defect(s) (OC-0248, OC-0258) * fix(identity): 1 defect(s) (OC-0250) * fix(ws): 3 defect(s) (OC-0252, OC-0269, OC-0272) * fix(admin): 1 defect(s) (OC-0253) * fix(client): 1 defect(s) (OC-0254) * fix(voice): 1 defect(s) (OC-0255) * fix(ws): 1 defect(s) (OC-0260) * fix(client): 1 defect(s) (OC-0261) * fix(client): 1 defect(s) (OC-0262) * fix(client): 1 defect(s) (OC-0263) * fix(client): 1 defect(s) (OC-0264) * fix(client): 1 defect(s) (OC-0268) * fix(ws): 1 defect(s) (OC-0273) * fix(service): 1 defect(s) (OC-0275) * style: satisfy golangci-lint and prettier on 2026-08-21 fix commits - drop ineffectual backupDir reset before return (registry.go, OC-0265) - reflow long boolean expression (attachments.ts, OC-0241) * fix(client): 4 defect(s) (OC-0242, OC-0246, OC-0249, OC-0251) * fix(voice): 1 defect(s) (OC-0267) * fix(admin): 1 defect(s) (OC-0274) * fix(voice): 1 defect(s) (OC-0245) * fix(ws): 1 defect(s) (OC-0271) * fix(voice): 2 defect(s) (OC-0239, OC-0257) * fix(ws): 1 defect(s) (OC-0266) * fix(voice): 1 defect(s) (OC-0270) * style: clear golangci-lint modernize and prettier nits from 2026-08-21 fixes - range-over-int and slices.Contains modernizations in new Go test files - prettier reflow in dispatcher.ts * chore(findings): mark 2026-08-21 hunt findings fixed/declined 37 fixed across the fix waves, OC-0238 declined (LiveKit webhook TLS requires a product decision, not a mechanical patch). --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-21 12:41:56 +02:00
J3vbandClaude Opus 5	8cf019c03f	fix: 40 correctness fixes from the 2026-08-19 bug hunt (#1392) ... * fix(identity): 1 defect(s) (OC-0151) * fix(ws): 1 defect(s) (OC-0152) * fix(admin): 1 defect(s) (OC-0153) * fix(admin): 1 defect(s) (OC-0154) * fix(voice): 2 defect(s) (OC-0155, OC-0167) Replace distributeRoomKey's per-call offer counter with an instance-level sliding-window budget shared by every voice_e2ee_offer send path. - OC-0155: back-to-back rotations (the second run immediately by drainPendingRotationOrArmTimer) each got a fresh pacing budget, so their combined sends could exceed the server's single per-second cap. - OC-0167: handleAnnounceInner's drain-time offer send bypassed pacing entirely, letting a key holder joining a large ongoing call burst every queued announce's offer unpaced. The shared budget is reset in clearState() since the server's limit is scoped per (sender, channel). * fix(client): 1 defect(s) (OC-0156) createPresenceSender dropped a queued custom_status when a later plain status change superseded the pending retry. The retry now carries the last committed custom_status forward. * fix(client): 2 defect(s) (OC-0160, OC-0163) OC-0160: exempt the handshake frames (ready, auth_ok) from the ws message size limit and run the guard after parsing. A 'ready' frame grows unbounded with member/channel/DM counts and carries no seq, so dropping it left the client on empty stores with no error and no recovery path. OC-0163: bracket a bare IPv6 host when building the wss:// URL so the authority parses, and collapse bracketed/bare IPv6 literals to the same cert_store_key so one server is not pinned (and user-confirmed) twice. * fix(voice): 1 defect(s) (OC-0162) updatePttKey armed the Rust poller when a PTT key was bound mid-call but never applied the gate. The poller only emits 'ptt-state' on a press/release transition, so an idle key produced no event and the already-published mic stayed hot until the user's first physical press+release. Mirror the join-time gate computation in updatePttKey, guarded on being in a call, polling actually being live, and the mic not already being gated. * fix(client): 1 defect(s) (OC-0164) * fix(plugin): 1 defect(s) (OC-0165) scanPluginDirectory now skips a malformed plugin subdirectory and joins its error instead of aborting the whole scan, and LoadAll logs-and-continues so one bad plugin directory cannot disable every other plugin. * fix(ws): 1 defect(s) (OC-0166) Route PresenceSelfEvent onto the owner's normal-priority queue instead of letting it fall through to the UserTargetedEvent high-priority case, so a user's own presence frames all share one FIFO and cannot be delivered out of order relative to the visible presence_update path. * fix(db): 1 defect(s) (OC-0168) * fix(client): 1 defect(s) (OC-0169) * fix(client): 1 defect(s) (OC-0171) addMessage appended a broadcast at the tail even when trailing optimistic rows were still unreconciled, so a message that committed while our own send was in flight ended up ordered behind the row confirmSend later stamped with a higher server id/timestamp. Insert before the trailing unreconciled run instead. * fix(voice): 1 defect(s) (OC-0172) * fix(client): 1 defect(s) (OC-0174) * fix(ws): 1 defect(s) (OC-0175) * fix(client): 1 defect(s) (OC-0177) * fix(client): 1 defect(s) (OC-0178) * fix(voice): 1 defect(s) (OC-0179) Undeafening no longer sends a voice_mute{muted:false} the server will refuse while a moderator-imposed mute stands, matching the localServerMuted guard already present in onMuteToggle. * fix(client): 1 defect(s) (OC-0182) * fix(plugin): 1 defect(s) (OC-0183) * fix(client): 1 defect(s) (OC-0184) Treat a trailing underscore as an emphasis delimiter, not part of the URL, when scanning for the end of an autolinked URL. * fix(client): 1 defect(s) (OC-0185) Reveal .msg-actions-bar on .message:focus-within, not only on hover, so keyboard users can see the per-message action buttons they Tab into instead of activating them at opacity: 0. Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * fix(client): 1 defect(s) (OC-0186) * fix(client): 1 defect(s) (OC-0187) The Add Server modal validated addresses with its own narrower regex that never gained IPv6 support when api.ts's validator did, so an IPv6 server could be logged into but never saved as a profile. Extract the validator into src/lib/hostValidation.ts and use it from both call sites. * fix(client): 1 defect(s) (OC-0189) DM sidebar rows dropped mention counts entirely and the header total excluded muted conversations outright, so a direct mention in a muted DM was invisible. Render a mention badge that outranks the plain unread badge, and count a muted channel's mentionCount toward the header total. * fix(client): 1 defect(s) (OC-0190) * fix(client): 1 defect(s) (OC-0191) * fix(client): 2 defect(s) (OC-0157, OC-0176) * fix(client): 1 defect(s) (OC-0161) confirmTotp answers 401 for a wrong enrollment code while the session is still valid; firing the global onUnauthorized sink signed the user out and deleted their stored credential. Opt that one call out via a skipUnauthorized flag on doFetch. * fix(admin): 1 defect(s) (OC-0173) * fix(identity): 1 defect(s) (OC-0180) * fix(admin): archived channel PATCH skips voice eviction and fan-out (OC-0158) handlePatchChannel commits the AdminUpdateChannel write, then re-reads the channel to drive voice eviction and the visibility fan-out. When that post-commit re-read failed, the handler returned early: the archive was durable but connected clients were never told and voice members were never evicted, leaving users talking in a channel that no longer exists for them. Drive the post-commit work off the values already in hand rather than abandoning it when the re-read fails. Adds SetPatchChannelPostCommitHook so the test can land a cancellation in that exact window deterministically instead of racing wall-clock timing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * fix(admin): role changes commit with no client ever notified (OC-0170) broadcastRoles derived its context from the inbound *http.Request, so the roles_update fan-out was tied to the request lifetime. A role create, update, or delete could commit to the database and then broadcast nothing once that request context was done, leaving every connected client on a stale role list until the next full resync. Decouple the fan-out from the request context so the broadcast follows the commit rather than the caller. Adds BroadcastRolesForTest to reach broadcastRoles from the external test package. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * fix(client): username rename stomps the profile card header (OC-0188) The account profile card's header is a resolveDisplayName() slot, but the username-rename save path wrote the raw username straight into it. A user with a display name set would see the header switch from their display name to their new username after a rename, disagreeing with every other surface that renders the same identity. Resolve the header through the same display-name path the initial render uses, so a rename updates the username field without touching the header. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * fix(client): settings overlay never focuses when mounted already-open (OC-0181) mount() synced initial state — including the show() that calls focusDialog() — before appending root to the container. .focus() on a still-detached subtree is a silent no-op, so a caller that mounts while uiStore.settingsOpen is already true (ConnectPage's lazy first-open path) got a visible overlay whose focus trap never captured focus: keyboard users landed outside the dialog with Tab escaping to the page behind it. Attach root before syncing initial state so focusDialog() runs against a connected subtree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * chore: satisfy the CI gates for this fix batch The fix batch's own commits left three CI gates red. Nothing here changes behaviour; every edit is a lint, type, or formatting correction to code this batch introduced. golangci-lint: - OC-0153 and OC-0173 replaced the last two uses of admin's setupSanitizer, and OC-0151 the last use of api's sanitizer, leaving both package-level bluemonday vars unused. Remove them along with the now-unused imports, and reword the comments that named them so they still explain why the fixpoint sanitizer is the right one without pointing at deleted symbols. - Modernize the new handshake-deadline test's loop to range-over-int. tsc --noEmit: - jsdom ships no types and @types/jsdom is not a dependency, so declare the surface the new admin-panel test uses, following src/types/jitsi-rnnoise.d.ts. - Narrow the last-call lookup instead of indexing under noUncheckedIndexedAccess, with an explicit failure message. - membersStore.setState replaces whole state, so the presence-sender mocks must supply typingUsers. prettier: reformat the five files this batch touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * chore(ledger): record the 2026-08-19 hunt and its fixes Adds the 41 findings confirmed by the 2026-08-19 hunt and marks the 40 fixed on this branch, each with its commit, the test that pins it, and revertProof "pass". "pass" means an independent check, not the fixing agent's self-report: every commit had its source diff reverted against the working tree, its own test re-run and required to FAIL, then the source restored and the test required to PASS. Commits whose tests live inline in Rust #[cfg(test)] blocks were proven the same way at hunk level, splicing the pre-fix source onto the post-fix test module. OC-0159 is recorded as a duplicate of OC-0152: the flow-reconnect and flow-message lenses independently found the same unbounded handshake write and proposed the same helper over the same call sites. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK * test(e2e): make the voice-roster join fixture self-consistent The voice-widget join test emitted a voice_state for user_id 4 claiming username "newvoiceuser", but id 4 is "member2" in MOCK_MEMBERS_MULTI_ROLE. A real server never sends a voice_state whose username disagrees with the member record for that id, and the same file's VOICE_STATE_EVENT already pairs id 1 with "testuser" correctly — this one event was the outlier. The contradiction was invisible while the roster rendered the payload's raw username. OC-0177 makes it resolve identity through membersStore so a nickname shows the same in voice as everywhere else, at which point the fixture's own inconsistency surfaced as a failure. Send id 4's real username and assert on it. The test still covers what it did before — a genuine join by a user not previously in voice, asserted by name and by roster count. Verified against the app unchanged: with the old fixture the spec fails 1/5 (matching CI), with this one it passes 5/5. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6gVN2JM5wrduhkNaFCxdK --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-19 16:32:07 +02:00
J3vbandClaude Opus 5	39551de4a6	refactor(server): work off the complexity backlog — 62 findings to 0 (#1389) ... * refactor(ws): split handleVoiceJoin into cohesive join-stage helpers handleVoiceJoin was 130 statements / cyclomatic 59 / nestif 11, breaking all three complexity budgets at once. Split along the stage boundaries the doc comment already described: precheck, leave-current, persist, restore moderator flags, grant token, complete. The publish-permission derivation becomes its own helper because it is the one branch-heavy block inside the token grant. Pure move: every statement is preserved verbatim. The only edits are bare `return`s becoming the typed returns of their new helper, `c.userID` becoming the `userID` parameter inside voiceJoinPublishPerms, and voiceJoinComplete re-reading `ch.VoiceMaxUsers` instead of receiving it — `ch` is never mutated, so the value is identical. Verified by normalising both revisions of the region to sorted, comment- and whitespace-stripped statements and diffing: the only deltas are the ones listed above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: collapse the three duplicated sibling pairs dupl flagged three pairs of adjacent near-identical functions. Each pair is now one parameterised implementation plus two thin, still-greppable wrappers. - ws/voice_controls.go: handleVoiceMuteV2 / handleVoiceDeafenV2 share voiceSelfToggleV2; handleVoiceCameraV2 / handleVoiceScreenshareV2 share voiceStreamToggleV2. Camera and screenshare drawing from one voice_max_video budget (OC-0023) was a bug caused by exactly this duplication drifting, so one body is the point, not a side effect. - db/mention_queries.go: ListMentionTargetsByRoles / ListMentionTargetsByUserIDs share listMentionTargets. The matched column is a closed named type (mentionTargetColumn) rather than a bare string, so the value interpolated into the SELECT cannot become caller-supplied. Behaviour is unchanged: every rate-limit key, error code, error string, slog message and slog key is preserved verbatim, including the two "failed to update <kind> state" messages, which are now assembled the same way enableVideoSlot already assembled them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(api): extract readEmojiUpload from handleCreateEmoji handleCreateEmoji was 101 lines against a 100-line budget. The upload-bytes stage — pull the file out of the parsed form, cap its size, sniff its MIME type and sniff its dimensions — is the one self-contained block in it, and it already wrote its own refusals, so it moves out whole as readEmojiUpload. The permission-before-parse ordering the doc comment calls out is unchanged; so is every error string. file.Close() now runs when the helper returns rather than when the handler does, which is strictly earlier and unobservable: the bytes are already copied into raw and nothing else touches the handle. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: extract one cohesive block from three single-budget offenders Each of these was over exactly one budget, so each gets exactly one extraction rather than a restructure: - api/totp_handler.go handleVerifyTOTP (102 lines / 100): the block that resolves the user behind the partial-auth challenge and decrypts their TOTP secret becomes totpChallengeSecret. The ban-inside-the-partial-window check moves with it. - service/message_reactions.go handleReaction (cyclop 21 / 20): the whole authorisation chain — channel lookup, archived gate, DM participant and block checks, non-DM permission check — becomes reactionAudience, which also returns the DM fan-out audience it already resolved. Check order is unchanged and load-bearing. - db/admin_queries.go BackupToSafe (cyclop 21 / 20): the character allowlist loop and the SQL-comment rejection become validateBackupPathChars. That loop alone was most of the branch count. No error string, no check and no ordering changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(plugin): split InstallFromZip into staged install helpers 104 statements / cyclomatic 44 / nestif 12. Split along the stages the code already had: installZipExtract (the per-entry write loop, with installZipEntryDest holding the mode/symlink/zip-slip guard chain and installZipWriteEntry the size-capped copy), installZipStagedManifest, installZipPromote, and installZipReactivate for the :399 nested block. Every zip-slip, symlink, entry-mode and uncompressed-size check is preserved in the same order relative to the writes it guards. The 19 inline `cleanup(); return` sites collapse to 4 in the orchestrator, one per stage, because each helper now returns an error instead of unwinding itself — the staging directory is still removed on exactly the same set of failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(api): split newWAFMiddleware into engine build and per-phase helpers 184 lines / cyclomatic 38, and the request-body block at :382 was the worst nested site in the tree at nestif 17. Engine construction moves out of the closure (wafInlineEngine, wafCRSEngine — the Coraza directive string is lifted verbatim), and each request phase becomes its own helper: wafInlineRequestHeaders, wafCRSRequestHeaders (including the Host/Transfer-Encoding re-add for CRS 920280), wafFeedCRSBody and wafInspectRequestBody, which is the old :382 block. The three `handleWAFInterruption(w, it); return` sites inside the body block become one: the helper now returns the interruption and the orchestrator handles it. No statement runs between the two points on either side, so the verdict is honoured identically — in particular a CRS body interruption still returns without replacing r.Body. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(service): split SendMessage and lift EditMessage's access check SendMessage was 79 statements / cyclomatic 35 with an 11-deep nested attachment block at :101; EditMessage was one point over cyclop. SendMessage becomes sendMessagePrecheck (permission and DM-block gates, content sanitisation), sendMessageLinkAttachments (the :101 block: attachment ownership, claim and link) and sendMessageDMSideEffects. EditMessage gets editMessageCheckAccess and nothing else — one budget over earns one extraction. The sanitizeContent fixpoint and the attachment ownership check are unchanged, as is the order of every gate. The DM side effects run behind `isDM && !s.sendMessageDMSideEffects(...)`, so a non-DM never enters them; inside, only the GetDMParticipantIDs failure returns false, matching the one error the original early-returned on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(admin): split handlePatchUser into per-field apply helpers 106 lines / cyclomatic 29, with the ban block at :154 nested 9 deep. Each optional field of the partial edit becomes its own helper — patchUserPrecheck, patchUserAuthorizeRole, patchUserApplyBan (the :154 block, including the session disconnect and the broadcast) and patchUserApplyRole. Each returns a bool meaning "keep going"; none of them writes a success response, so the single response site in the orchestrator is unchanged. Field application order, the permission-cache invalidation on a role change and the disconnect-and-broadcast on a ban are all preserved, as are the three fail-closed `mod == nil` guards, which now sit at the top of their own helper and still fire on exactly the same conditions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(admin): split handleSetup into first-run setup stages 143 lines / cyclomatic 30, with the optional-wizard block at :219 sitting exactly on the nestif threshold. Split into the stages the endpoint already had: request gating (rate limit and origin check, which run before any auth exists on a fresh server), owner account creation, and the wizard application that was the :219 block. Every gate in front of the handler is a security control on an unauthenticated endpoint; none moved relative to the work it protects. setup_wizard.go is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: split run() into named bootstrap and shutdown steps 131 statements / cyclomatic 57, with the executable-path fallback at :126 nested 9 deep. The five anonymous `defer func(){...}()` blocks become named functions — telemetryStop, runClosePlugins, runStopEventPersistence, runStopAuditWriter, maintenanceStop — and the bootstrap stages move out likewise. Every defer is still registered in run() itself, at the same point in the sequence, so the LIFO teardown order is unchanged; that order is documented in the surrounding comments and is load-bearing (the audit-writer stop must follow database.Close's registration, the event-persistence stop must precede it). runStopEventPersistence is now registered unconditionally with a nil persister meaning "disabled", where the old code registered its defer inside the enabled branch — a no-op occupying that slot cannot change the relative order of the others. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(ws): split handleReconnect into resume stages 77 statements / cyclomatic 41, plus the replay block at :199 and, in handleFreshConnect, the voice-state restore at :622. handleReconnect becomes reconnectPrecheck, reconnectSelectReplay (with reconnectVetColdTail for the cold-tier gap check), reconnectRegister and reconnectWriteReplay. handleFreshConnect's stale-voice cleanup moves to its own helper, where the `if h.livekit != nil` wrapper becomes a guard clause — that block was the tail of its scope, so returning early and falling off the end are the same. The parts that carry the invariants are moved verbatim: reconnectRegister still takes h.seqMu, still calls registerNow inside that same critical section (BUG-123 / OC-0206), still unlocks on every exit, and still emits the "full" tier counter and telemetry on each of its three re-check failures. handleReconnect's two-boolean contract is unchanged — the collapsed `return false, false` sites are all fall-through-to-full-ready, and the single `return true, false` is still the handshake-write-failure path whose teardown already ran (OC-0051). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(server): fold in the adversarial review of the complexity refactors Eleven skeptic passes over the refactor commits on this branch found no blocker and no major — behaviour is preserved throughout. They did find comment and accuracy defects worth correcting: - db/mention_queries.go: the mentionTargetColumn rationale claimed the named type made the interpolated column "only ever one of the two constants". A Go named type is not closed, so that is a convention the type makes visible, not one it enforces. Reworded, gosec justification included. - ws/voice_controls.go: the dupl collapse generalised away three specifics — that a server deafen is the moderator's to lift (now on the serverDeafen field), the concrete voice_states.camera / voice_states.screenshare column names, and the half of the OC-0023 rationale about neither stream kind hiding from the other's count. All three restored. - ws/voice_join.go: `maxUsers := ch.VoiceMaxUsers` had been hoisted to the top of voiceJoinComplete, moving a read across the tail supersession guard. The read is inert, but it was the one statement in that commit whose position relative to a security guard changed; it now sits at its use, as before. - ws/*_test.go: three test comments cited voice_join.go line numbers that the split invalidated. They now cite the helper by name instead. - service/message_reactions.go: reactionAudience's doc claimed to enforce "every gate on reacting"; it enforces the channel-scoped ones, and the doc now says which gates stay with the caller. - api/emoji_handler.go: the readEmojiUpload call reused the outer `ok` from the auth check by assignment; it gets its own readOK. - admin/setup_handler.go: a moved comment kept a "the response above" deictic that no longer had a response above it. No behaviour change. Build, vet, full tests and -race on five packages green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(ws): clear the remaining complexity budgets across the hub Eight files, thirteen findings. Each function is split at the stages it already had; no branch is reordered, merged or inverted. - handlers.go handleMessage (cyclop 28, 88 stmts): session re-check, frame decode and result application become handleMessageSessionRecheck, handleMessageDecode and handleMessageApply. The V2 constructor lookup -> DispatchV2 -> Result resolution order is untouched. - serve_ready.go buildReady (cyclop 26, 61 stmts): the per-section fetches split out, readyChannelPayloads among them. Every visibility predicate is preserved verbatim — this is the payload that decides what a client may see. - serve_pumps.go writePump (cyclop 31): writePumpWrite, writePumpDeliver, writePumpDrainChannel and writePumpDrainAndClose. Every channel receive stays in the same select statement, so scheduling is unchanged. - hub_sweep.go sweepStaleVoiceStates (cyclop 22, 56 stmts): the staleness predicate, the hub-lock ordering and the position of the race hook are all as they were — handleVoiceJoin's BUG-088 ordering depends on them. - hub_broadcast.go channelReadAudienceImpl and RefreshChannelVisibility (cyclop 22 each, 57 stmts): channelReadAudienceDM and refreshChannelVisibilityCanSend. The audience predicate is the OC-0090 group-DM leak surface, so it is extracted, never simplified. - livekit_webhook.go (nestif 13 and 14): webhookJoinedEnforceVoiceState, webhookLeftCleanupClient and webhookLeftFinishLeave. DB delete still precedes broadcast on every path. - livekit_download.go EnsureLiveKitBinary (52 stmts): one extraction, ensureLiveKitStageBinary, keeping every archive path check intact. - voice_moderation.go (nestif 8): voiceModDeafenRollback. The persisted server_muted flag remains the authority. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(api): clear the remaining complexity budgets across the HTTP layer - router.go NewRouter (cyclop 28, 84 stmts): split by wiring concern into routerTOTPKey, routerHealthDeps, routerMiddleware, routerUploadRoutes, routerPluginWiring, routerVoiceRoutes and routerMetricsRoutes. Middleware ORDER is a security property (auth before handler, WAF before body parse, rate limit before work) and is unchanged; the returned cleanup func still closes over and releases everything it did before. - auth_handler.go handleRegister (133 lines) and handleLogin (cyclop 21, 152 lines): registerPolicyGate, registerReadRequest, loginReadRequest and loginAuthenticate. The always-compare posture, every rate-limit key, every counter reset and the ban-check-versus-password-compare order are all preserved — including loginUserFailureThreshold staying unscaled by scaledAuthLimit, which is deliberate and commented. - upload_handler.go handleServeFile (cyclop 31, 128 lines): serveFileResolve and serveFileAuthorize. Every header this sets — Content-Disposition included, which is what stops a stored file being served as active content — is still set with the same value in the same circumstances. - profile_handler.go handleUploadAvatar (120 lines): avatarUploadReadImage, mirroring readEmojiUpload in shape but with the avatar caps and MIME set. The two deliberately do not share a helper. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: clear the last complexity budgets in db and admin - db/account.go DeleteAccount (cyclop 28, 55 stmts): grouped by subsystem into deleteAccountAdminGuard, deleteAccountDMChannels and deleteAccountCloseDMChannels, each taking the same transaction. The transaction boundary, the delete ORDER (which foreign keys depend on) and the rollback path are unchanged. - admin/logstream.go handleLogStream (cyclop 24): logStreamAuthorize. Flush cadence, heartbeat and disconnect detection untouched. - admin/setup_wizard.go validateWizard (cyclop 23): grouped by section into wizardValidateIdentity, wizardValidateNetwork and wizardValidateMedia. Every message and bound is unchanged — this is the first input-validation boundary on a fresh server, before any auth exists. With this the tree is at zero: golangci-lint run reports 0 issues against the budgets set in #1384 (funlen 100/50, cyclop 20, nestif 8, dupl 150), with no //nolint and no exclusion added anywhere. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-18 20:39:45 +02:00
J3vb	db0275a290	fix: batch of 29 correctness fixes across server and client (#1369) ... * fix(ws): 2 defect(s) (OC-0013, OC-0140) * fix(voice): 1 defect(s) (OC-0044) * fix(ws): 1 defect(s) (OC-0024) * fix(server): 1 defect(s) (OC-0027) * fix(ws): 1 defect(s) (OC-0028) * fix(server): 7 defect(s) (OC-0033, OC-0066, OC-0067, OC-0068, OC-0074, OC-0077, OC-0106) * fix(ws): 1 defect(s) (OC-0051) * fix(client): 1 defect(s) (OC-0053) * fix(client): 1 defect(s) (OC-0055) * fix(service): 1 defect(s) (OC-0069) * fix(voice): 1 defect(s) (OC-0072) * fix(service): 1 defect(s) (OC-0082) * fix(client): 1 defect(s) (OC-0083) * fix(plugin): 1 defect(s) (OC-0088) * fix(plugin): 4 defect(s) (OC-0104, OC-0126, OC-0127, OC-0133) * fix(admin): 1 defect(s) (OC-0110) * fix(client): 1 defect(s) (OC-0114) * fix(api): 1 defect(s) (OC-0139) * fix(client): 1 defect(s) (OC-0149) * test(server): adapt existing tests to updated OpenDM and IncrementMentionCounts signatures * style(plugin): modernize loops and goroutine spawns in race test * fix(ws): mirror the focus admission gate in the post-subscribe revalidation * fix(service): detach DM post-commit side effects from the request ctx, fail delete closed, add empty-fan-out fallback * fix(plugin): preserve enabled intent when upgrade reactivation hits a runtime-less build * chore(skills): harden bughunt-fix workflow and fold review lessons into bughunt-run/db-change * Add comprehensive documentation for task-observer skill - Introduced environments.md to outline activation setup, compaction behavior, and handoff-doc mode. - Created skill-authoring.md detailing taxonomy, licensing, confidentiality, and editing rules for skill creation. - Added weekly-review.md for a structured review process of OPEN observations, including scheduled and in-session fallback modes. * chore(go): pin toolchain go1.26.6 (stdlib CVE fixes flagged by govulncheck)	2026-08-14 10:05:40 +02:00
J3vbandClaude Opus 5	4ff199e14f	fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331) ... * fix(client): style the user profile popup The popup rendered unstyled: it appeared at the bottom of the page and pushed the rest of the app up, with the avatar drawn as a full-width bar. app.css carried a complete Discord-shaped card under `.user-popup` / `.up-*`, but nothing in the codebase renders those classes — the component emits `.upp-*`. The component had been rewritten with a new prefix and the stylesheet was left pointing at a DOM that no longer existed. With no rule matching, the card stayed `position: static`, so the left/top it computes were discarded and both it and its overlay laid out as ordinary blocks at the end of <body>. Replace the orphaned block with rules for the classes actually rendered, following the same anatomy: banner strip, avatar straddling the banner/body seam inside a ring punched from the card background, panel sections, action row. Everything routes through existing tokens, so the card follows the theme contract. Two latent bugs fixed while there: - Placement guessed a 300px card height and clamped only the top edge, so a member clicked low in the list opened a card that ran off the bottom of the window. Measure the card and clamp both edges. - The avatar has to hang off the body's top edge, but the body scrolls, and `overflow-y: auto` clips horizontally too. Make it a child of the card rather than the body. The fade+scale moves from inline styles into CSS so a `prefers-reduced-motion` override can drop it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(client): stop vite watching src-tauri `npm run tauri dev` died on Windows partway through the cargo build: Error: EBUSY: resource busy or locked, watch 'src-tauri\target\debug\deps\owncord_client_lib.dll' Error The "beforeDevCommand" terminated with a non-zero status code. Vite's watcher recursed into `src-tauri/target/`, and the moment cargo wrote the output DLL, node's FSWatcher raised EBUSY as an unhandled error event and killed the vite process. Vite is tauri's `beforeDevCommand`, so its death aborted the whole dev session. The config matched the upstream Tauri vite template in every respect except the `server.watch.ignored` block that template ships with. Add it. Tauri already watches `src-tauri` itself for rebuilds, so nothing is lost. Windows-specific — EBUSY on an open handle is a Windows filesystem semantic, and CI only ever runs `tauri build`, never `tauri dev`, so neither caught it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(security): add 2026-08-04 whole-codebase security review (#1326) Read-only security review of the full tree (Go server, admin panel, WASM plugin host, LiveKit voice, Tauri client). No code changes. Three findings, all the same defect class — a security predicate enforced at some members of a handler family but not all: - A-2026-08-01 (HIGH) handleDeleteChannelPermission omits the hierarchy and grantability guards its PUT twin carries, so a MANAGE_CHANNELS holder can clear their own role's channel deny and read private channels. - A-2026-08-02 (HIGH) the admin channel list/patch/delete handlers omit the type == "dm" guard their sibling getPermChannel carries, so the same role can enumerate and irreversibly cascade-delete arbitrary DMs and group DMs. - A-2026-08-03 (MEDIUM) DMService.RingTargets omits the block check the five other DM interaction sinks perform, so a blocked user can ring the person who blocked them. Also records one non-vulnerability observation (backup restore writes to a hardcoded database path, silently no-opping when database.path is customised), the candidates rejected during verification, the areas verified clean, and the areas not examined. Claude-Session: https://claude.ai/code/session_01Q7GUJtdsHHHGs4pSiLn6LJ Co-authored-by: Claude <noreply@anthropic.com> * Full audit: docs/spec refresh + remediation (security fixes, dead-code removal, test & CI gaps) (#1327) * docs: fix server reference docs (api, protocol, server-configuration, deployment) api.md: - Correct the login rate limit: 5/min per IP (was documented as 60/min); document the per-username lockout and lockout persistence (Server/api/constants.go, Server/api/auth_handler.go) - Complete the middleware list to the real 9-entry chain incl. the opt-in Coraza WAF (Server/api/router.go) - Add voice_sessions and broadcast_drops to the metrics sample (Server/api/metrics_handler.go) and document the otel-only Prometheus /metrics mount - Add reference sections for the previously undocumented /admin/api endpoints: setup, stats, users, audit-log, settings, tokens, backups, updates, and the SSE log stream (Server/admin/api.go) protocol.md: - Fix type counts (client->server 26, server->client 37) and add the missing rows: call_ring, call_decline, emoji_update, call_incoming, call_declined - Correct rate limits: voice join/leave 5/1s (was "None"), E2EE offer 64/1s (was 5/1s), and add the call-ring limit (1/3s) - Document the plugin command wire types (chat_command, command_reply, plugin_broadcast) and flag that they sit outside protocol-schema.json server-configuration.md: - Add missing keys: server.waf_* (3), database.type, telemetry.otlp_insecure, and the whole logging section + OWNCORD_LOGGING_LEVEL - Correct plugin-disabled status code to 503 (was 501) deployment.md: - Drop the removed "version" field from the /health sample; add broadcast_drops to the metrics sample; note the distroless non-root image; refresh build version strings Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(architecture): rewrite stale architecture pages against 5630aa1 All six pages carried "Verified against ddc49f0 (2026-07-19)" stamps and had drifted: - websocket.md: delete the false claim that docs/protocol-schema.json does not exist — it is the codegen source of truth (Server/scripts/genprotocol, CI-gated by make protocol-verify); note the hand-declared plugin command family as the one exception; refresh LOC - server.md: fix the websocket dependency (github.com/coder/websocket, not nhooyr.io), refresh LOC (42k/71k), migrations 016 -> 028 - data-model.md: migrations 001-028, 23 -> 26 tables, add api_tokens and channel_user_overrides to the ER diagram, channels.type now includes announcement, note 017/024/027/028 columns; drop the claim that schema.md is 6 migrations behind (it is current) - voice-e2ee.md: drop the stale claim that the E2EE flow is absent from protocol.md (it has a full section); document livekitE2EE.ts/identity.ts and identity-key pinning - client.md: rewrite — Solid beachhead is gone; the HTTP path is now TOFU-pinned through http_proxy.rs (the doc claimed the opposite); shared tofu.rs core with explicit-consent pinning; 9 stores (roles store deleted, blocks + emoji added); refreshed LOC and tooling figures - README.md: 26 tables/001-028; client-architecture.md described as the redirect stub it is; companion-audit links refreshed Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(architecture/ux): align UI flow specs with current client behavior - Cert first-use is a blocking trust modal on status "first_use" — the Rust proxy rejects the first connection until the user confirms (main.ts:146-176, tofu.rs); the specs described the pre-F4/F8 behavior (an 8s banner on "trusted_first_use"). Fixed in README.md and connection-and-auth.md. - Dispatcher event table: add the five missing types (chat_bulk_deleted, roles_update, emoji_update, voice_moved, voice_disconnected) and note that call_incoming/call_declined are page-scoped listeners in MainPage.ts. - channels-members-dms.md: the "no in-client block button" gap is closed (AdminActions.ts context-menu item -> SidebarMemberSection.ts:177-186); document group DMs (MemberPickerModal, 10-participant cap, rename/leave) and per-channel notification mutes (lib/channel-mutes.ts); refresh stale line anchors. - voice-and-e2ee.md: document the actual E2EE verification surface (roster shield badge -> identity-mismatch modal -> rePinPeerIdentity with TOCTOU- safe key capture), noise suppression + fallback, device hot-swap, stream preview, and DM ring/incoming-call flow; drop the nonexistent VoiceChannel.ts reference. - settings-and-admin.md: the "ban should collect a reason" gap is closed (appendBanFlow with reason + duration); document the admin-panel deep-link (lib/admin-panel.ts) and the tray status menu. - messaging.md: correct the pinned-messages empty-state copy and drop the nonexistent components/message-input/ directory reference. - Re-stamp all six specs "Verified against 5630aa1 (2026-08-04)". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs: refresh client-facing and top-level docs - security.md: drop the stale "hardcoded Tenor API key" limitation (the GIF provider is Klipy, proxied server-side with an operator-supplied key — nothing ships in the client bundle); describe credential storage accurately (OS keyring primary, verified writes, DPAPI/ChaCha20 file fallback); complete the audit-log action list against the actual WriteAudit call sites and note that backup restore is not audit-logged; fix the firewall checklist to include the LiveKit media ports (7880-7881/TCP, 50000-60000/UDP) and ACME port 80 - credential-storage.md: probe_credential_store sample now shows the real serialized backend value ("Keyring") and the full variant union - quick-start.md + README.md: refresh build version strings to 1.2.0-alpha.1; README "audits" section now points at the current audit documents - contributing.md: sqlc rows no longer claim a PostgreSQL engine/pgdbgen (removed with the store layer); add the protocol-generate/verify targets Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(plans): add verified status headers and fix stale references Every plan under docs/plans/ now carries a dated status verified against 5630aa1: - Shipped: audit-2026-07-19-decisions (all 13 rows), channel-visibility- unification, http-tofu-proxy, permission-middleware-consolidation (the disclosed ws.channelCanSend copy is still open, now at serve_ready.go:119), security-hardening-remediation, sqlc-adoption, v2-dispatch-migration, tauri-capability-narrowing (DNS-rebinding follow-up still open) - Shipped with corrections: discord-parity — Phase 1's gap table was never re-marked; all six rows have since shipped, including archived channels, which are filtered by permissions.VisibleChannelIDs (checker.go:116-121); named leftovers (role hoist/mentionable, @RoleName mentions, categories as entities, dead-code list) stay open. security-scan-2026-07-22 — all 8 findings closed; two of the four F3 follow-ups have since shipped (safety number rendered in the roster badge; rePinPeerIdentity wired to the identity-mismatch modal), getIdentityPin fail-open remains open; noted the scan artifact directory is not in the repo - Design-only: slash-commands — added staleness notes (migration number 016 now taken, Server/store/ deleted, src/state/ never existed) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audits): reconcile prior audit statuses with current CI and code - audit-test-coverage-2026-07-25: T-2026-07-25-21 (HIGH, 229/255 web e2e failing) was fixed by the mock repair but the audit was never updated — now RESOLVED, re-verified by a local 270/270 run at 5630aa1; the CI gate table row updated to match - audit-2026-07-19: carried-over item 11 ("no Playwright job in ci.yml") is resolved — client-e2e (non-blocking, every PR) and the blocking client-e2e-parity job both exist; backlog item 10 marked DONE (client-tests is blocking, Playwright wired) Only status/closure cells were edited; original finding text is untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(changelog): add Unreleased section for post-v1.2.0-alpha.1 fixes Three fixes landed after the release with no changelog home (the file had no Unreleased section at all): the profile-popup styling fix (a308f81), the vite/src-tauri watch fix (cdcfc03), and the AppImage env-key signing fix (9d75890). Also corrects the Deferred-work note that still described the Solid.js removal in the present progressive — it completed 2026-07-19. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(tests): rewrite the e2e issues log against a real suite run The old file was dated 2026-03-18, claimed 209/209 passing (the suite is now 270 tests), and pointed at a plan document that does not exist in the repo. Rewritten from an actual run at 5630aa1: 270/270 web tests green (8.6 min), 15/15 @parity subset green (the blocking CI job), with the suite inventory, CI wiring, the two real open issues (three native specs matched by no playwright.config.native.ts project; client-e2e still non-blocking), and dispositions for every claim the old file carried. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audit): add 2026-08-04 docs-and-coverage audit report Companion to the same-day security review (disjoint scope). Contains: the verified architecture summary; real test-run results for every runnable suite at 5630aa1 (Go race+deadlock, 4394 client unit tests at 94.66% stmt coverage, 83 Rust tests + clippy, 270/270 web e2e, 15/15 parity, browser smoke — with env-blocked suites named and their compensating CI evidence cited); a 52-row UI/UX flow coverage matrix (30 covered / 21 partial / 1 untested / 0 broken, headline gaps: TOFU flow, E2EE verification, admin panel, updater — all unit-only); per-doc drift findings with the commit that fixed each; reconciliation of all four prior audits and eleven plans (including the orphaned 2026-04-07 #8 resurfaced as DC-11); the dead-code and TODO inventories; and a prioritized DC-01..DC-15 gap list with ordered next steps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(admin): add hierarchy guard to channel role-override delete (A-2026-08-01) Deleting an override is a permission mutation: removing a deny row restores exactly the access the PUT path refuses to grant, so a MANAGE_CHANNELS holder could unlock a private channel their own role was locked out of. Gate DELETE identically to handlePutChannelPermission: resolve the role (404 when missing), fail closed without an actor role, and refuse targets at or above the actor's position. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(admin): exclude DM channels from the admin channel surface (A-2026-08-02) DMs and group DMs share the channels table and id space with guild channels, but they belong to their participants, not to MANAGE_CHANNELS holders: listing exposed ids and group names of every private conversation, PATCH could silently rename one, and DELETE cascade-destroyed one irreversibly. List now filters type=dm; PATCH and DELETE resolve through getAdminChannel, which answers 404 for DM ids so the surface does not confirm which ids are private conversations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(service): enforce blocks on DM call rings (A-2026-08-03) RingTargets checked participation but not blocks, so a blocked user could still make the blocker's client ring. Route rings through requireDMNotBlocked like every other DM sink; group DMs stay exempt inside it, matching the send path (blocks are enforced at group creation instead). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * chore(client): delete dead modules (DC audit remediation) All verified unreferenced by any import before deletion: - ServerStrip.ts: removed from the layout when the unified sidebar header landed (SidebarArea.ts); only its own orphaned unit test still used it. The e2e spec already asserted .unified-sidebar-header, so it is renamed to sidebar-header.spec.ts and retitled honestly. - FileUpload.ts: uploads go through api.uploadFile from MessageInput. - lib/reconcile.ts: nothing imports it; the messages store carries its own pending-send reconciliation. - public/rnnoise-worklet.ts: unreferenced duplicate of the .js worklet the runtime actually loads, and public/ ships verbatim into the bundle. - api.getSounds/deleteSound + SoundResponse: the server has no /sounds routes; these called endpoints that do not exist (pairs with the sounds-table drop on the server side). - dm.store incrementDmMention: zero callers; DM mention counts flow from the server mention_count via the dispatcher. This was the one live knip error the CI '|| true' was masking. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * chore(client): retire the tauri-typegen ritual (DC-05) src/generated/ was tauri-typegen output frozen on 2026-04-03: it covered 21 of the 29 IPC commands lib.rs registers, nothing ever imported it (0% coverage), and CI carried a bespoke patch step solely to keep the unused file lint-clean. Delete the directory and every part of the pipeline that existed to feed it: the client-check patch step, the tauri-build generate/patch steps, the tauri.conf.json plugin block, and the inert Cargo.toml build-dependency (build.rs is bare tauri_build::build(); no Rust source references the crate). Cargo.lock shrinks by exactly the typegen subtree — no other resolution changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * ci: make knip blocking (DC-06 follow-through) Pre-verified green locally after the dead-module deletions; the config hints knip still prints do not affect its exit code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * chore(server): drop the dead sounds table (A-2026-07-13) The table shipped in 001 for a soundboard that was never built: no query, model, sqlc definition, route or handler ever referenced it. Migration 029 drops it; the sqlc model regenerates without the Sound struct (sqlc emits a struct per schema table even with zero queries). schema.md, the data-model blueprint, and the 2026-07-19 audit closure table are updated in the same change per the docs maintenance rule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * chore(server): remove dead WAF wrapper, use protocol constants, fix stale comments - NewWAFMiddleware had no production caller (the router mounts the CRS variant); its doc text folds into NewWAFMiddlewareCRS and the tests call the survivor directly. - serve_auth compares against MsgTypeAuth and the DM-close REST path builds its WS notification from MsgTypeDMChannelClose instead of restating the wire strings, so the generated constants are load-bearing again. - Comment fixes: DatabaseConfig no longer claims Postgres scaffolding that main.go removed; host_ui.go no longer advertises a route that is not mounted (DC-09's sibling); buildReady cites docs/protocol.md, the file PROTOCOL.md was renamed to (DC-09). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(protocol): add the plugin command family to protocol-schema.json (DC-01) chat_command, command_reply and plugin_broadcast were the only wire types outside the schema: the first declared by hand in handlers_command.go, the other two raw string literals, all bypassing the protocol-verify codegen gate. Add the three schema entries (27 c2s / 39 s2c), regenerate both constant files, and swap the hand-rolled declarations for the generated constants. The ws protocol-contract test's exception list is empty now — and stays that way. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(client): wire orphaned native specs and typecheck the Playwright layer - dm-system, reconnection and theme-persistence (14 tests) matched no project's testMatch in playwright.config.native.ts, so they had never executed (E2E-ISSUES open issue #1 / DC-03). All three use the persistent fixture + ensureLoggedIn, so they join native-authenticated. - tests/e2e was excluded from tsconfig, leaving 47 spec files with no typechecking anywhere. New tsconfig.e2e.json project (+@types/node for the node-API fixtures), a typecheck:e2e script, and a CI step. The one real error it surfaced is fixed: mockTotpFailure omitted the required simulateWsFlow flag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(client): cover createPromptModal and the external-abort close path modalFactory.ts was the least-covered file in the repo (57.6%): createPromptModal had no tests at all and createModal's external-abort branch never ran with an onClose. Now 100% statements/branches/functions, including the trimmed-submit, legitimate-empty-submit, Enter-preventDefault and no-double-close contracts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(client): e2e-cover the TOFU certificate ceremony (DC-04 slice) The first-use confirmation and mismatch warning are the client's core security ceremony and had no e2e coverage. Six tests drive them through the mocked Tauri event layer: first-use modal content, trust, cancel, modal non-stacking, mismatch fingerprint rows, and disconnect-to-connect- page. The mock now exposes its listener registry so tests can wait for the async cert-tofu registration instead of racing it (validated with --repeat-each=3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs: fix the inaccuracies the 2026-08-04 refresh missed - contributing.md: drop the '-tags postgres' build row (no such tag exists anywhere in Server/), add the four Make targets the 07-25 audit created (test/test-deadlock/cover/cover-all), align the coverage statement with the real gates (client 70%, no Go floor by T-2026-07-25-19), point TS style at architecture/client.md instead of the tombstone, and describe the real dev-branch PR flow. - docs/security.md: reporting section now defers to root SECURITY.md as the canonical policy (it said 48h where SECURITY.md promises 7 days, and described the maintainer's advisory path rather than the reporter's); fixed the updater-key link that resolved to docs/Server/... on GitHub. - audit-2026-04-07.md closure table: #10 and #11 were long-resolved (#10 verified in db/audit.go, #11 exceeded by per-PR e2e jobs), #6 written in future tense for work done 2026-07-19, #7 citing a 113-file count from months ago. - README: Contributing section matched neither ci.yml nor contributing.md (branch from dev, not main); Docs Index gains the six missing live docs; the plugin system joins the feature list; the security row no longer anchors to an aging version string. - server-configuration.md: the env-var table is explicitly a subset — the OWNCORD_<SECTION>_<KEY> scheme covers every key. - mcp-introspect.md: index.mjs is 266 lines, not ~230. - types.ts header cited PROTOCOL.md/API.md/SCHEMA.md, filenames that no longer exist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * ci: pin claude.yml actions by SHA; add docs checkbox to the PR template claude.yml was the only workflow with unpinned third-party actions — checkout now uses the same v4.2.2 SHA the other workflows pin, and claude-code-action pins the commit the v1 tag resolves to (Dependabot's github-actions ecosystem keeps both fresh). The PR template gains the docs checkbox A-2026-07-03 recommended: the architecture/UX maintenance rule ('a PR changing a diagram's source-of- truth files updates the diagram in the same PR') existed only as prose no process step ever surfaced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * style(client): prettier-format the cert-tofu spec Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audit): record the remediation pass and close finding statuses - Security review: A-2026-08-01/02/03 -> RESOLVED with their pinning tests named. - Docs-and-coverage audit: DC statuses updated in place (01/02/03/05 resolved, 04/09 partial with the remainder named, 14's keep-decision recorded) and a remediation addendum added: what shipped, the decisions taken (plugin host API kept, reserved protocol entries kept, e2e soak not shortcut, the 404-on-missing-role semantics note), and the full verification table from real runs — Go race + deadlock suites green, 4 tag builds, client 4360/4360 units at 95.35% coverage, Playwright 276/276 in 8.9 min, parity 15/15. - CHANGELOG Unreleased: security fixes, migration 029, protocol additions, dead-code retirement, CI gates. - E2E-ISSUES: rewritten against the remediation HEAD (276/276), native orphan issue moved to resolved, mock listener-registry note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(admin): index the channel slice in the DM filter (gocritic rangeValCopy) golangci-lint (CI-only gate) flags the range-value copy of the 152-byte db.Channel struct in the admin list filter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * chore(client): add .nvmrc pinning Node 20 to match CI (DC-10) Also re-triggers CI: the previous run's windows server job died to a Go runtime unwinder fatal ('traceback did not unwind completely') with no test failure — toolchain flake, and the integration lacks permission to rerun failed jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx --------- Co-authored-by: Claude <noreply@anthropic.com> * fix: 26 bug-hunt findings across WS hub, voice/E2EE, admin, roles, and client (runs 1-3) (#1328) * fix(ws): keep pubsub subscriptions when a replaced client is unsubscribed Both pubsub indexes are keyed by userID, but a reconnect registers a new *Client under that same userID. UnsubscribeAll and Unsubscribe deleted by userID alone, so a kick of the already-replaced connection stripped the live one's topics. The live client stays in h.clients and keeps answering ping/pong, so it never reconnects -- it just silently stops receiving every global, user, and channel broadcast. Guard the forward-index delete in unsubscribeLocked with an identity check and route UnsubscribeAll through it, so the four Unsubscribe call sites (voice_leave, hub_broadcast x2, handlers) and the three UnsubscribeAll ones (kickClient, unregisterNow, registerNow) all share one rule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): mark kicked clients offline instead of reporting them replaced Every kick path deletes the hub entry via kickClient, so the readPump defer's unregisterNow finds nothing and fell through to "return true", conflating absent with replaced. serve_pumps.go then skipped MarkUserDisconnected, the offline presence broadcast, and handleVoiceLeave -- already-connected peers rendered every kicked user as online until that user reconnected and disconnected cleanly. Return exists instead: a different client in the slot is a genuine replacement, an absent entry is a real disconnect. Only serve_pumps.go reads the return value; the five serve.go/hub.go call sites discard it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): force a full ready when cold-tier replay hits the row cap GetEventsSinceForChannels is "ORDER BY seq ASC LIMIT n", so a reconnect gap larger than maxColdReplay returned the oldest 5000 rows and dropped the newest. handleReconnect accepted any non-empty result as a successful resume, and the client only tracks max(seq) with no gap detection -- so it accepted the next live event and silently lost the range in between, including state events (channel/role/member changes) that REST history fetches never repair. Treat a result at the cap as overflow and fall through to the full ready re-sync. An exactly-cap-remaining gap pays one unnecessary full ready. maxColdReplay is hoisted to the package const block so the test can seed exactly enough events to hit it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): re-elect the voice E2EE key holder on the two paths that skipped it updateKeyHolder had only two callers (voice_join, voice_leave), so two paths that remove a participant from voice left voiceKeyHolders naming someone who is gone. IsVoiceKeyHolder then rejects the real lowest-uid participant's rekey offers with NOT_KEY_HOLDER -- which the client does not handle -- after it has already applied its rotated key locally, splitting keys across the room. 1. The LiveKit participant_left webhook (media-only loss, WS stays up) cleared voice state and broadcast voice_leave with no re-election. 2. registerNow's fresh-connect replacement (F5 reload) drops the old connection's voice state without transferring it. handleVoiceLeave never runs there: readPump skips it when replaced, and it early-returns on already-cleared state. Both call updateKeyHolder outside h.mu, since it takes keyHolderMu then h.mu.RLock. The recompute reads live client voice state, so it is idempotent and stays correct when a network reconnect transfers voice state -- locked by TestRegisterNow_KeepsKeyHolderWhenVoiceStateTransfers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): stand down as E2EE key holder on offer, keep peer keys on reconnect Two independent key-holder desync bugs in E2EEManager: 1. _isKeyHolder had no demotion path -- set at join, promoted on participant leave, cleared only on voice leave. The server re-elects the lowest userID on every join, so a lower-ID joiner left the incumbent still believing it held the key with an armed 5-minute timer. Its rotations applied the new key locally before the server rejected the offers with NOT_KEY_HOLDER (which the client does not handle), so it went deaf and mute every rotation cycle. Accepting an offer proves the sender is the server-authoritative holder, so treat it as the demotion signal and clear the timer. 2. reannounceForReconnect cleared _peerPublicKeys and peer verifications with nothing able to refill them: handleAnnounce replies with an offer rather than a counter-announce, and the server relays stored peer keys only on voice_join, which an SFU-level reconnect never runs. handleOffer's unknown-peer guard then dropped every later rotation, stranding the reconnector on the pre-reconnect key. The clear was also unnecessary -- peers' keys stay valid when we regenerate our own pair. vitest 4396/4396; typecheck and prettier clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(tauri): give the ws sender slot connection ownership, bound livekit TLS ws_proxy: state.tx is one slot shared by every ws_connect, and both the install and the teardown clear were unconditional while the mutex was only held in short scoped blocks. A handshake pends up to CONNECT_TIMEOUT and a profile switch starts a second ws_connect without awaiting or cancelling the first, so a stale connect could complete after a newer one was live, emit an untagged "open", and install its sender over the live one -- routing the next auth send to the previously-trusted host, then tearing down the live socket and emitting "closed" while JS believed it was connected. Add a generation counter claimed at ws_connect entry and checked under the slot lock before install, plus same_channel ownership on the teardown clear, mirroring the Arc::ptr_eq guard ptt.rs already uses for ATOMICRACE-001. livekit_proxy: the outbound TcpStream::connect and TLS handshake were bare awaits, while the sibling http_proxy.rs bounds both at 10s. TCP connect is OS-bounded, but a peer that accepts TCP and never answers the ClientHello blocked the task forever. The task holds `local` without polling it, so the SDK closing its side never cancels it, and the detached per-connection tasks survive stop_livekit_proxy -- so they leaked on every SDK retry. cargo test 80 passed; clippy --all-targets -D warnings clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): keep voice E2EE alive across WS resume and unify voice teardown A network reconnect transferred voiceChID/joinToken to the new connection but left it unsubscribed from voice:<id> (the only transport for voice_e2ee_announce relays) and wiped the announced ECDH key, so a resumed key holder could never offer the room key to later joiners and voice_join replayed nothing for the resumed user. registerNow now transfers the announced key with the voice state and re-subscribes VoiceTopic unconditionally (it is CONNECT_VOICE-gated at join; only the message-stream ChannelTopic needs the READ gate). The LiveKit participant_left webhook and CleanupVoiceForChannel cleared voice state without dropping the voice-topic subscription, leaving the socket receiving another room's announces (which carry no channel_id to filter on) for its lifetime. All take-out-of-voice paths now go through one clearVoiceAndUnsubscribe helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): route sequenced DMs through the normal FIFO writePump drains sendHigh to exhaustion before send, so a seq-stamped DM on the high queue reached the socket ahead of lower-seq events still queued behind a slow write. The client acks max(seq) and replay is strictly seq > last_seq, so a disconnect in that window silently and permanently lost the overtaken events while auth_ok reported a clean resume. Sequenced frames now share the one per-client FIFO; the high queue remains for unsequenced targeted messages (DM opens, voice tokens). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): remove the partial file when Save fails after create The io.Copy and f.Sync error paths returned without deleting the file created for the upload, and the orphan sweep is DB-row-driven, so a write-side failure (ENOSPC, disk I/O error) permanently leaked a partial storage/<uuid> with no DB row. One success-flag deferred cleanup now covers every failure path (the oversize branch folds into it), fixing all three callers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): close three voice-E2EE ordering gaps and wire the DM mention badge - setupKeyExchange generated the room key AFTER draining queued announces, so a key holder joining an ongoing call sent drained peers no offer — they waited on the 5-minute rotation timer. Keygen now precedes the drain and every drained peer gets its offer immediately. - A key-holder re-election arriving while the elected client was still connecting was dropped (getCurrentChannelId is null for the whole key-exchange wait), stranding the client until timeout ejection. The manager now remembers its channel from setupKeyExchange, and the become-holder rotation resolves a pending room-key wait. - Offers applied concurrently could finish out of order (no epoch on the receiver side), leaving the older key active. handleOffer now chains applications so offers apply strictly in WS delivery order. - incrementDmMention had zero callers: the DM @mention badge (dmStore's mentionCount, the mute-immune signal DmSidebar renders) never fired live, only after a reconnect restored the server count. The dispatcher now bumps it under the same guards as the DM unread count. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(tauri): restart the LiveKit proxy when the TOFU pin changes After the user accepted a rotated cert, two stale caches kept every voice rejoin tunneling into the old pin until logout: the Rust reuse branch returned the running listener (which bakes its fingerprint in at spawn) without re-reading certs.json, and ensureLiveKitProxy's port cache never invoked Rust again at all. start_livekit_proxy now loads the stored fingerprint before the reuse check and tears down on host OR pin change, and the TS side invokes it on every join — the reuse branch dedups the unchanged case. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(tauri): ignore two unreachable cargo-audit advisories RUSTSEC-2024-0429 (glib 0.18, Linux-only, Variant::array_iter_str never called; no semver-compatible fix exists) and RUSTSEC-2026-0097 (rand 0.7 as a phf_generator build-dep with a fixed seed and no log feature; the pre-release kuchikiki pin blocks the upgrade path). Both entries document their drop condition inline. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): transfer the focused channel on WS resume so the message stream survives registerNow's replaced-client branch moved voice state and the E2EE key to the resumed connection but not the focused channel; newClient always starts with channelID == 0 and the client never re-sends channel_focus on a resume, so the ChannelTopic re-subscribe was a no-op and the user silently stopped receiving chat_message until manually switching channels. Transfer the old connection's focused channel, READ-gated and fail-closed like every other ChannelTopic subscription. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): always include a voice room's participants in its voice-event audience broadcastVoiceEvent filtered recipients on READ_MESSAGES while voice membership is gated on CONNECT_VOICE alone, so a participant in the gap (e.g. READ revoked mid-call by a channel override) never received the room's voice_state/voice_leave. The client's E2EE key-holder election and forward-secrecy rotation run only off the voice_leave WS event, so a departing key holder was never replaced and new joiners hung until the e2ee_timeout eject. Union the READ audience with the room's current participants; what outsiders may observe is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): tear down the failed reconnect attempt's room instead of leaking it The catch block read this._room, whose typed accessor returns null in the "reconnecting" state — so the failed attempt's freshly created Room was never disconnected and kept all its listeners. livekit-client emits Disconnected synchronously on a failed connect, and in "reconnecting" state the token/channel/url getters all return values, so each leaked room spawned an additional concurrent reconnect loop whose AbortController was discarded and unreachable from leaveVoice. Alias the attempt's room outside the try and clean it up in the catch, mirroring cleanupAbortedReconnect. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(admin): evict voice participants before deleting a channel CleanupVoiceForChannel was doc-commented 'Called when a channel is deleted' but had zero production callers, and the voice_states FK cascade wipes the rows it reads — so deleting a voice channel stranded its participants with live client voice state, a voice-topic subscription, and a LiveKit session, and the stale sweeper could never recover them (a nonexistent channel resolves base-role permission bits). Wire the cleanup into handleDeleteChannel BEFORE the row delete, via HubBroadcaster. Also harden the cleanup itself: the row delete and client-state clear are now conditional on the participant still being in the deleted channel, so a user who moved rooms mid-cleanup is untouched, and the evicted participants are always included in their own voice_leave audience (their client state is already cleared, so the participant union in broadcastVoiceEvent cannot see them). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): stop leaking an E2EE worker and SetKey listener per voice join createRoom spun up a fresh E2EE Worker per Room while the key provider lives for the whole process; livekit's per-room E2EEManager registers a SetKey listener on the provider with no matching removal and never terminates the worker. Every join, channel switch, or failed reconnect attempt therefore permanently added one running worker plus one listener, and every later setKey posted the new room key into every orphaned worker — key material outliving its session. Track the worker on the session: clear provider listeners and terminate the stale worker before each Room, and terminate it in leaveVoice so the last key does not stay resident. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(service): reject role position collisions on update, matching create UpdateRole's position branch ran only validatePosition and let an explicit position land on a slot another role holds — while CreateRole refuses exactly that, with a comment explaining why: every hierarchy comparison uses >=/<=, so tied positions read as equal rank and the two roles can no longer manage each other's members. Refuse a position held by a different role with the same ErrBadRequest; re-stating the role's own position stays allowed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): close the window where a dying connection re-takes a pubsub topic Subscribe had no counterpart to unsubscribeLocked's identity guard: an old connection's in-flight handler (a channel_focus mid DB round-trip shares no lock with registerNow) could Subscribe after UnsubscribeAll(old) had run, stealing the topic from its replacement — whose own unsubscribes then skip the entry while publishes go to the closed connection. Subscribe now refuses a client whose send is closed (checked under ps.mu), and registerNow closes the old client's send BEFORE stripping it, so a late Subscribe either sees the closed send and is refused or slipped in earlier and is removed by the subsequent UnsubscribeAll. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(ws): rewrite cold-replay if-else chain as switch (gocritic) Fixes the ifElseChain lint failure on CI for both platforms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): restore incrementDmMention deleted as dead code on dev The audit PR (#1327) removed it from dm.store.ts because its only caller lives on this branch (the DM mention badge wiring), which was not merged yet. The rebase was textually clean but left dispatcher.ts calling a function that no longer existed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * Audit closure pass: DC-04/06/08/09/12/13/15 (E2EE + updater e2e, fail-closed pin lookup, a11y pass, UX polish) (#1329) * ci(server): run the tag-gated wazero/otel Go tests (DC-06) The build-tag matrix only compiled the otel/wazero variants; the tests behind those tags (plugin/sandbox_wazero_test.go 462 lines, telemetry/telemetry_otel_test.go 214 lines) ran nowhere since they were written (T-2026-07-25-16). Scoped to the two packages that carry tagged files; verified green locally before wiring: go test -tags wazero ./plugin/... and -tags otel ./telemetry/... both pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): fail closed when the identity pin store is unreadable (DC-08) getIdentityPin collapsed a keyring read error into "no pin stored", so a transient failure sent a pinned peer down the TOFU first-sight path: verifyPeerAnnounce verified against the server-delivered key and then RE-PINNED it — a fail-open a malicious server could exploit by inducing store errors (F3 follow-up 3, plans/security-scan-2026-07-22). getIdentityPin now returns a three-state IdentityPinLookup (pinned/unpinned/unavailable), mirroring how tofu.rs keeps Err distinct from Ok(None) first-use. verifyPeerAnnounce rejects the announce on "unavailable" without any pin write, records the new "unknown" PeerVerification status, and the roster badge renders it as an amber shield-question ("could not check") distinct from the legacy "unverified" state. Pinned by unit tests: pin present, no pin, store error (identity.ts), the fail-closed rejection path (livekit-session), and the badge presentation (channel-sidebar). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(admin): write a backup_restore audit row that survives the restore (DC-09) Backup restore was the one admin mutation with no audit_log row — docs/security.md documented the gap as inherent ("the database is closed as part of the restore"). The row IS writable durably: written synchronously (LogAudit, deliberately not the async WriteAudit fast path) before BackupTo takes the pre-restore safety copy, it is captured inside pre_restore_*.db and survives the file swap forensically. The extended restore test opens the pre-restore backup as a database and asserts the backup_restore row is inside it — proving both the write and its ordering. docs/security.md now documents where the row lives instead of the gap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(client): channel-delete toast + optimistic reaction toggle (DC-12) Two messaging-surface gaps the UX specs carried as open: - channel_delete on the active channel now toasts "This channel was deleted" alongside the existing redirect (ux/channels-members-dms §1.2) — the redirect alone read as the app spontaneously changing channels. Non-active deletions stay silent. - Reactions toggle optimistically (ux/messaging §5): the pill flips on the click, registered under the send's WS envelope id — the same correlation scheme as the optimistic message rows. updateReaction consumes the matching self-echo instead of re-applying it (the delta-based arithmetic would double-count), other users' echoes apply normally, and an error reply or local transport failure rolls back exactly that toggle via rollbackReaction in the dispatcher's error and send-failure handlers. The pill reverting is the failure feedback. Both spec gap notes flipped to implemented; the stale §2 note claiming the ready payload lacks slow_mode fell in the same edit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): guard the role-change submenu against double-fire (DC-12) Every other destructive admin action already carried an in-flight guard (withConfirmation, unblockRunning, banRunning, purge) — the role-change submenu was the residual: currentRole only updates when the member_update echoes, so a double-click (or a second option clicked while the first PATCH was in flight) fired onChangeRole twice. One shared guard now inerts the whole submenu while a change is running, with the pending class on the clicked option. The settings-and-admin spec's in-flight gap note flips to implemented, and the stale messaging §8 slow-mode note is corrected in the same docs sweep (the countdown shipped with the ready payload's slow_mode — verified against ChannelController.startSlowMode and its tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): drag-reorder document listeners leak — own them per sidebar signal (DC-12) The shared document mousemove/mouseup pair was reference-counted per attached channel row: a sidebar with N channels took N refs (and N more per re-render) while its single destroy returned exactly one, so the count never reached zero and the listeners plus their activeDrag closure lived for the rest of the process — the KNOWN BUG the drag-reorder test pinned since the 2026-07-25 audit. Ownership is now a Set of AbortSignals (the sidebar's lifetime controller — the @lib/disposable teardown idiom): acquisition is idempotent per signal no matter how many rows attach, release is the signal's abort, and an owner aborted mid-drag clears the in-flight visual state (which the old containerEl comparison never actually matched in production — it compared the category container against channelList). releaseGlobalDragListeners is gone; ChannelSidebar's destroy releases via its existing ac.abort(). The pinning test changes with the fix, as its own comment instructed; the lifecycle block now pins the fixed contract, including re-registration after full teardown. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(e2e): E2EE identity-verification and updater journeys (DC-04) The two remaining client-side headline coverage gaps from the 2026-08-04 audit's flow matrix (rows 38 and 49), both driven through the web mock harness: voice-e2ee-verify.spec.ts (6 tests, ux/voice-and-e2ee §7): the peer's announce is real crypto — an ECDSA P-256 identity key signing an ECDH ephemeral key exactly as e2eeCrypto does — so the badge states come out of the production verification path. Covers the verified badge with safety number (+ TOFU pin on first sight), the legacy unverified badge, the mismatch block, the mismatch modal's reject path (peer stays blocked, nothing pinned) and Trust New Key (re-pins the displayed key), and the DC-08 fail-closed 'could not check' badge when the pin store is unreadable. The harness gap that kept this untestable is closed by a voice_join handler that grants a key-holder voice_token plus a WebSocket shim that parks LiveKit's room.connect forever, holding the session stably in 'securing'. updater.spec.ts (4 tests, ux/settings-and-admin §5): no-update silence, banner + Later dismissal, the full banner → download progress (% and MB fallback via real update-progress events) → automatic relaunch journey, and the failure state with Dismiss. There is no restart prompt by design — the applied state IS the relaunch, asserted via the recorded plugin:process|restart invoke. Harness: buildTauriMockScript gains per-test identity-pin config (identityPins / identityPinError) and a window.__invokeLog recording every IPC call so tests can assert side effects with no DOM footprint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * style(client): prettier-format the drag-reorder module and new e2e specs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(client): accessibility pass over the modal/overlay stack (DC-13) The repo had exactly one focus-trapped dialog (UserProfilePopup), one aria-live region, and no role="dialog" anywhere else. This pass generalizes that one good implementation into lib/a11y.ts (applyDialogSemantics, trapFocus, focusDialog, setRovingTabindex, enableRovingNavigation) and applies it across the stack — all additive: no DOM classes, testids, structure, or visible text changed. - modalFactory: every factory modal now carries role=dialog + aria-modal, moves focus in on open, restores it on every close path, and Tab-cycles inside; createPromptModal is labelled by its title. - Hand-rolled modals (CertMismatch/CertFirstUse/IdentityMismatch, Create/Edit/DeleteChannel, InviteManager): dialog semantics labelled by their existing headings, focus trap + restore, aria-label on icon-only close buttons, and Escape mapped to each modal's SAFE action (reject on the trust prompts — dismissal must never grant trust; cancel on the channel modals — never the destructive/submit callback). - SettingsOverlay: dialog on the panel, focus in on open/restore on close; the sidebar is a vertical role=tablist with roving tabindex and ArrowUp/Down/Home/End activate-on-focus; the content pane is a tabpanel labelled by the active tab. - QuickSwitcher: dialog + combobox/listbox/option wiring with aria-activedescendant tracking the active row. QuickSwitchOverlay: dialog + keyboard-operable rows (the inert current-server row stays unfocusable on purpose). - EmojiPicker/GifPicker: listbox/option cells with a roving tabindex (Arrow/Home/End move the single Tab stop, Enter/Space activate through the click path). inline-autocomplete: option ids + combobox attrs and aria-activedescendant on the composer textarea — deliberately NOT roving tabindex, since moving DOM focus out of the textarea would break typing (the combobox pattern). - Toast and TypingIndicator are polite live regions (role=status). Tests: +71 unit cases across 18 files (4474 total, all green) pinning roles, traps, restores, Escape safety, and roving behavior; plus an axe-style e2e smoke (a11y-smoke.spec.ts, 5 tests) proving the wiring in the running app — settings tablist + focus restore to the opener, quick switcher combobox, member-picker Tab containment, live regions, and the cert first-use dialog where Escape rejects without trusting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(ux): replace file:line anchors with symbol references (DC-15) The UX specs cited code as file:line anchors, and a three-week-old snapshot already had 15 of 58 pointing at entirely wrong code (the audit measured 200-700 lines of drift). All 55 remaining anchors across the six spec files now reference the owning symbol instead ("validateForm() in pages/connect-page/LoginForm.ts"), each target verified to exist before rewriting; the stale ones were re-aimed at the correct symbol, not just de-numbered. Zero file:line references remain under docs/architecture/ux/. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audit): record the 2026-08-05 closure pass; stamp DC statuses in place - audit-2026-08-04-docs-and-coverage.md: DC-06/08/12/13/15 marked resolved, DC-04 and DC-09 further-resolved (admin-panel journey and the handleApplyUpdate TODO are the remainders), matrix rows 38/49 flipped from headline gaps to covered, the §4 UX-problem bullets closed, and a §12 closure addendum records what shipped and the verification runs. - CHANGELOG Unreleased: operator-facing entries for the DC-08 fail-closed fix, the a11y pass, the UX polish, the backup_restore audit row, the tag-gated CI tests, and the new e2e journeys. - E2E-ISSUES.md: fresh full-suite run recorded at this HEAD — 291/291 passed in 9.2 min with zero flaky retries (276 baseline + 6 E2EE + 4 updater + 5 a11y smoke), @parity 15/15; suite inventory now 40 files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(client): fix install-settle race in the updater e2e spec The install settle handles are created only when the app's download_and_install_update invoke reaches the mock wrapper, but the spec called them right after asserting the banner text — which flips synchronously on click, before the invoke's microtask runs. Local runners won that race; CI lost it three attempts in a row (window.__rejectInstall is not a function). Both settle sites now wait for the handles, same pattern as the listener waits the file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx --------- Co-authored-by: Claude <noreply@anthropic.com> * Final audit closure: admin-panel e2e, container-safe updates, blocking e2e gate, dependency policy (#1330) * ci(server): run the tag-gated wazero/otel Go tests (DC-06) The build-tag matrix only compiled the otel/wazero variants; the tests behind those tags (plugin/sandbox_wazero_test.go 462 lines, telemetry/telemetry_otel_test.go 214 lines) ran nowhere since they were written (T-2026-07-25-16). Scoped to the two packages that carry tagged files; verified green locally before wiring: go test -tags wazero ./plugin/... and -tags otel ./telemetry/... both pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): fail closed when the identity pin store is unreadable (DC-08) getIdentityPin collapsed a keyring read error into "no pin stored", so a transient failure sent a pinned peer down the TOFU first-sight path: verifyPeerAnnounce verified against the server-delivered key and then RE-PINNED it — a fail-open a malicious server could exploit by inducing store errors (F3 follow-up 3, plans/security-scan-2026-07-22). getIdentityPin now returns a three-state IdentityPinLookup (pinned/unpinned/unavailable), mirroring how tofu.rs keeps Err distinct from Ok(None) first-use. verifyPeerAnnounce rejects the announce on "unavailable" without any pin write, records the new "unknown" PeerVerification status, and the roster badge renders it as an amber shield-question ("could not check") distinct from the legacy "unverified" state. Pinned by unit tests: pin present, no pin, store error (identity.ts), the fail-closed rejection path (livekit-session), and the badge presentation (channel-sidebar). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(admin): write a backup_restore audit row that survives the restore (DC-09) Backup restore was the one admin mutation with no audit_log row — docs/security.md documented the gap as inherent ("the database is closed as part of the restore"). The row IS writable durably: written synchronously (LogAudit, deliberately not the async WriteAudit fast path) before BackupTo takes the pre-restore safety copy, it is captured inside pre_restore_*.db and survives the file swap forensically. The extended restore test opens the pre-restore backup as a database and asserts the backup_restore row is inside it — proving both the write and its ordering. docs/security.md now documents where the row lives instead of the gap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(client): channel-delete toast + optimistic reaction toggle (DC-12) Two messaging-surface gaps the UX specs carried as open: - channel_delete on the active channel now toasts "This channel was deleted" alongside the existing redirect (ux/channels-members-dms §1.2) — the redirect alone read as the app spontaneously changing channels. Non-active deletions stay silent. - Reactions toggle optimistically (ux/messaging §5): the pill flips on the click, registered under the send's WS envelope id — the same correlation scheme as the optimistic message rows. updateReaction consumes the matching self-echo instead of re-applying it (the delta-based arithmetic would double-count), other users' echoes apply normally, and an error reply or local transport failure rolls back exactly that toggle via rollbackReaction in the dispatcher's error and send-failure handlers. The pill reverting is the failure feedback. Both spec gap notes flipped to implemented; the stale §2 note claiming the ready payload lacks slow_mode fell in the same edit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): guard the role-change submenu against double-fire (DC-12) Every other destructive admin action already carried an in-flight guard (withConfirmation, unblockRunning, banRunning, purge) — the role-change submenu was the residual: currentRole only updates when the member_update echoes, so a double-click (or a second option clicked while the first PATCH was in flight) fired onChangeRole twice. One shared guard now inerts the whole submenu while a change is running, with the pending class on the clicked option. The settings-and-admin spec's in-flight gap note flips to implemented, and the stale messaging §8 slow-mode note is corrected in the same docs sweep (the countdown shipped with the ready payload's slow_mode — verified against ChannelController.startSlowMode and its tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * fix(client): drag-reorder document listeners leak — own them per sidebar signal (DC-12) The shared document mousemove/mouseup pair was reference-counted per attached channel row: a sidebar with N channels took N refs (and N more per re-render) while its single destroy returned exactly one, so the count never reached zero and the listeners plus their activeDrag closure lived for the rest of the process — the KNOWN BUG the drag-reorder test pinned since the 2026-07-25 audit. Ownership is now a Set of AbortSignals (the sidebar's lifetime controller — the @lib/disposable teardown idiom): acquisition is idempotent per signal no matter how many rows attach, release is the signal's abort, and an owner aborted mid-drag clears the in-flight visual state (which the old containerEl comparison never actually matched in production — it compared the category container against channelList). releaseGlobalDragListeners is gone; ChannelSidebar's destroy releases via its existing ac.abort(). The pinning test changes with the fix, as its own comment instructed; the lifecycle block now pins the fixed contract, including re-registration after full teardown. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(e2e): E2EE identity-verification and updater journeys (DC-04) The two remaining client-side headline coverage gaps from the 2026-08-04 audit's flow matrix (rows 38 and 49), both driven through the web mock harness: voice-e2ee-verify.spec.ts (6 tests, ux/voice-and-e2ee §7): the peer's announce is real crypto — an ECDSA P-256 identity key signing an ECDH ephemeral key exactly as e2eeCrypto does — so the badge states come out of the production verification path. Covers the verified badge with safety number (+ TOFU pin on first sight), the legacy unverified badge, the mismatch block, the mismatch modal's reject path (peer stays blocked, nothing pinned) and Trust New Key (re-pins the displayed key), and the DC-08 fail-closed 'could not check' badge when the pin store is unreadable. The harness gap that kept this untestable is closed by a voice_join handler that grants a key-holder voice_token plus a WebSocket shim that parks LiveKit's room.connect forever, holding the session stably in 'securing'. updater.spec.ts (4 tests, ux/settings-and-admin §5): no-update silence, banner + Later dismissal, the full banner → download progress (% and MB fallback via real update-progress events) → automatic relaunch journey, and the failure state with Dismiss. There is no restart prompt by design — the applied state IS the relaunch, asserted via the recorded plugin:process|restart invoke. Harness: buildTauriMockScript gains per-test identity-pin config (identityPins / identityPinError) and a window.__invokeLog recording every IPC call so tests can assert side effects with no DOM footprint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * style(client): prettier-format the drag-reorder module and new e2e specs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(client): accessibility pass over the modal/overlay stack (DC-13) The repo had exactly one focus-trapped dialog (UserProfilePopup), one aria-live region, and no role="dialog" anywhere else. This pass generalizes that one good implementation into lib/a11y.ts (applyDialogSemantics, trapFocus, focusDialog, setRovingTabindex, enableRovingNavigation) and applies it across the stack — all additive: no DOM classes, testids, structure, or visible text changed. - modalFactory: every factory modal now carries role=dialog + aria-modal, moves focus in on open, restores it on every close path, and Tab-cycles inside; createPromptModal is labelled by its title. - Hand-rolled modals (CertMismatch/CertFirstUse/IdentityMismatch, Create/Edit/DeleteChannel, InviteManager): dialog semantics labelled by their existing headings, focus trap + restore, aria-label on icon-only close buttons, and Escape mapped to each modal's SAFE action (reject on the trust prompts — dismissal must never grant trust; cancel on the channel modals — never the destructive/submit callback). - SettingsOverlay: dialog on the panel, focus in on open/restore on close; the sidebar is a vertical role=tablist with roving tabindex and ArrowUp/Down/Home/End activate-on-focus; the content pane is a tabpanel labelled by the active tab. - QuickSwitcher: dialog + combobox/listbox/option wiring with aria-activedescendant tracking the active row. QuickSwitchOverlay: dialog + keyboard-operable rows (the inert current-server row stays unfocusable on purpose). - EmojiPicker/GifPicker: listbox/option cells with a roving tabindex (Arrow/Home/End move the single Tab stop, Enter/Space activate through the click path). inline-autocomplete: option ids + combobox attrs and aria-activedescendant on the composer textarea — deliberately NOT roving tabindex, since moving DOM focus out of the textarea would break typing (the combobox pattern). - Toast and TypingIndicator are polite live regions (role=status). Tests: +71 unit cases across 18 files (4474 total, all green) pinning roles, traps, restores, Escape safety, and roving behavior; plus an axe-style e2e smoke (a11y-smoke.spec.ts, 5 tests) proving the wiring in the running app — settings tablist + focus restore to the opener, quick switcher combobox, member-picker Tab containment, live regions, and the cert first-use dialog where Escape rejects without trusting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(ux): replace file:line anchors with symbol references (DC-15) The UX specs cited code as file:line anchors, and a three-week-old snapshot already had 15 of 58 pointing at entirely wrong code (the audit measured 200-700 lines of drift). All 55 remaining anchors across the six spec files now reference the owning symbol instead ("validateForm() in pages/connect-page/LoginForm.ts"), each target verified to exist before rewriting; the stale ones were re-aimed at the correct symbol, not just de-numbered. Zero file:line references remain under docs/architecture/ux/. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audit): record the 2026-08-05 closure pass; stamp DC statuses in place - audit-2026-08-04-docs-and-coverage.md: DC-06/08/12/13/15 marked resolved, DC-04 and DC-09 further-resolved (admin-panel journey and the handleApplyUpdate TODO are the remainders), matrix rows 38/49 flipped from headline gaps to covered, the §4 UX-problem bullets closed, and a §12 closure addendum records what shipped and the verification runs. - CHANGELOG Unreleased: operator-facing entries for the DC-08 fail-closed fix, the a11y pass, the UX polish, the backup_restore audit row, the tag-gated CI tests, and the new e2e journeys. - E2E-ISSUES.md: fresh full-suite run recorded at this HEAD — 291/291 passed in 9.2 min with zero flaky retries (276 baseline + 6 E2EE + 4 updater + 5 a11y smoke), @parity 15/15; suite inventory now 40 files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(client): fix install-settle race in the updater e2e spec The install settle handles are created only when the app's download_and_install_update invoke reaches the mock wrapper, but the spec called them right after asserting the banner text — which flips synchronously on click, before the invoke's microtask runs. Local runners won that race; CI lost it three attempts in a row (window.__rejectInstall is not a function). Both settle sites now wait for the handles, same pattern as the listener waits the file already uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * ci: promote client-e2e to blocking (DC-07) The soak is decided: green full-suite runs at 270, 276 and 291 tests across the audit branches, and the one hard failure in the window was a real spec bug a non-blocking job would have let rot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * feat(server): refuse in-place self-update in container deployments Resolves the long-standing handleApplyUpdate TODO. In a container the running binary is image content: the staged replacement dies with the container and the restart comes back as the old image. RunningInContainer (OWNCORD_CONTAINER authoritative both ways — the shipped Dockerfile sets 1, bind-mount operators can set 0 — with /.dockerenv//run/.containerenv as fallback) now gates POST /admin/api/updates/apply with 503 CONTAINER_DEPLOYMENT before any updater logic, GET /admin/api/updates gains can_apply, and the admin SPA swaps the apply button for an image-upgrade note when it is false. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs: adopt the dependency pinning/review policy (DC-11, 2026-04-07 #8) Writes down the policy the lockfiles already enforce: lockfiles authoritative with npm ci-only installs, weekly Dependabot with majors adopted deliberately, per-PR security gates (npm audit on shipped deps, govulncheck, cargo audit, knip), and toolchain-level version pins. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * test(admin): add the admin-panel e2e journey against a real server (DC-04) The admin SPA was the one surface no suite could reach: it is served by the Go server and mocked nowhere. start-server.sh builds and boots a real server (fresh temp data dir, TLS off, loopback) and the journey drives the SPA end to end — first-run wizard creating the owner, dashboard stats, channel create/rename, audit-log rows for both mutations, and sign-out/ sign-in. One shared page keeps the localStorage session across the serial steps, mirroring the native suite's persistent fixture and staying under the 5-logins/min limiter; on a Playwright retry the wizard branch downgrades to login since setup is one-shot server-side. New non-blocking admin-e2e CI job on the same graduation convention client-e2e followed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx * docs(audit): final closure — every DC finding resolved or deliberately reserved Records the owner-directed closure pass (§13): DC-04 fully (admin journey was the last row), DC-07 (client-e2e blocking), DC-09 fully (container- aware update refusal), DC-11 + 2026-04-07 #8 (dependency policy). Remaining open items are all deliberate: DC-14 reserved protocol entries, the admin-e2e soak graduation, and the accepted/tracked 2026-04 carryovers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDaeRAN79nVdgtNX2zJVrx --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(attachments): stop the orphan sweep destroying every avatar and the grace period The 15-minute maintenance sweep deleted attachment rows and their files for any attachment with message_id IS NULL. Avatars are exactly that by design: users.avatar points at the attachment by URL and nothing ever links it to a message (migration 027). Every avatar in the instance was therefore destroyed on the first tick past the grace period, permanently 404ing every profile picture. The query now excludes attachments a user's avatar still points at. Independently, the cutoff was formatted RFC3339 while uploaded_at is written by SQLite as 'YYYY-MM-DD HH:MM:SS'. TEXT comparison is bytewise and ' ' sorts before 'T', so every unlinked upload sharing the cutoff's UTC date was swept regardless of time -- the one-hour grace collapsed to 'immediately'. Rather than fix the format at the one call site, DeleteOrphanedAttachments now takes a time.Time and formats it internally, so no caller can reintroduce the class. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): send old_password so changing a password can succeed The client posted {current_password, new_password} while the server decodes json:"old_password" (Server/api/profile_handler.go:43). Go's encoding/json does no alias matching, so OldPassword was always empty and every password change returned 400 INVALID_INPUT -- the feature could never work for anyone. docs/api.md and every server test already document old_password. The existing unit test asserted the client's own broken payload, so it passed while the feature was dead; it now asserts the documented server contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(admin): roll back and restart when a backup restore fails mid-copy copyFile truncates the destination with os.Create before it can know whether the read will succeed. On the restore path the destination is the live database, already closed, so a failure in io.Copy or Sync left a zero-byte chatserver.db, no rollback, and -- because the old code returned before the restart -- a process still answering requests against a closed DB while the response and the server_restart broadcast both claimed a restart was underway. The failure branch now puts the pre-restore safety copy back (saying so honestly in the error, including when the rollback itself fails) and requests the restart the success path already did. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(voice): refuse client-side unmute while server-muted by a moderator Push-to-talk called LiveKitSession.setMuted directly, which had no server-mute guard -- only the voice widget's own handler checked. Unmuting re-publishes a fresh mic track, and since MuteParticipantAudio only mutes the track SIDs that exist at mute time while the LiveKit grant still carries the microphone publish source, the SFU accepted it: holding PTT lifted a moderator's mute and never told the server. The guard now lives in setMuted itself, the one entry point every caller shares, so PTT and any future caller are covered. Muting stays allowed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): force a full ready when a client's seq is ahead of the ring buffer EventsSince/EventsSinceFiltered guarded only the lower bound, so a client asking for events newer than anything the buffer ever held got a non-nil empty slice -- which handleReconnect reads as a successful, complete replay. It then registers the client, sends auth_ok with replay_source=buffer and skips ready entirely, leaving stale members, channels and read state until the counter climbs back past the client's remembered value. That disagreement is reachable in normal operation: the hub seeds its counter from GetMaxEventSeq, which is 0 once the 24h pruner has emptied the table, so a restart can reseed seq below a lastSeq clients preserve across reconnects. Both functions now return nil (the existing 'cannot guarantee coverage' signal) when afterSeq exceeds the newest buffered seq, so the caller falls through to the cold tier and the intended full ready. afterSeq == newestSeq remains the legitimate caught-up case and still replays empty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): re-send channel_focus on auth_ok so reconnects keep receiving messages channel_focus was sent only by mountChannel, which early-returns when the channel id is unchanged, so a reconnect into the same channel never re-sent it. The server transfers the focused channel from the old connection, but only while that connection is still registered -- readPump's defer unregisters it and drops every topic subscription the moment the server observes the close, about a second before the client's first retry. Any server-observed close (restart, proxy close, network reset) therefore resumed with no ChannelTopic subscription: server channel messages, edits and reactions are delivered exclusively over that topic, so the message stream went silently dead while global events kept arriving and made the connection look healthy. auth_ok fires on every connection including resumes and the full-ready fallback, and it also covers the server-restart case where there is no old state to transfer from. The server's handler is idempotent, so the extra focus on a fresh connect is harmless. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(messages): stop persisting HTML-escaped text, safely bluemonday writes text tokens through html.EscapeString, so sanitizeContent persisted and broadcast the escaped form: every apostrophe, quote, ampersand and angle bracket reached other users as a literal entity, and because stored quote lines began with '&gt;' the client's blockquote regex could never fire. cleanText (display names, about, custom status, DM names) had the same bug. Unescaping bluemonday's output alone would be a sanitizer bypass: surviving text tokens can recombine into live markup -- '<<script>script>alert(1)<' + '</script>/script>' reassembles a real end tag. Instead the whole unescape -> Sanitize -> unescape cycle now runs to a fixpoint, so the stored result is by construction stable under re-sanitizing: any '<' that the tokenizer would read as a tag start is stripped rather than re-encoded, and only inert punctuation survives. The loop is bounded by the input length and each pass is non-increasing; measured worst case over pathological tag/entity soup at the 16 KiB input ceiling is under a millisecond. The fuzz sinks are tightened to match the new contract rather than loosened: they now require a tag-like start ('<' + letter or '/') because a bare '<' followed by punctuation is inert plain text under every client render path. The <script substring and idempotency checks are unchanged. Verified with 4.2M fuzz executions, zero crashers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(client): close the WS task and TLS socket on disconnect via generation-owned teardown ws_disconnect dropped the slot's sender expecting the write task to end, but the monitor task held my_tx — a Sender clone kept only to prove teardown ownership — so rx.recv() could never yield None: the monitor waits on the writer via join_next() while the writer waits on the monitor's clone dropping. Every intentional disconnect or profile-switch reconnect leaked the writer, the reader, and the TLS socket, and with no server-side read deadline the connection stayed registered — the user remained presence-online after logout, and the stale Rust reader kept injecting the old server's events into the new session's stores. Ownership is now proven by the connection generation that already guards install: the monitor captures my_generation plus the generation Arc and clears/announces only if the generation is still current, checked under the slot lock (generation only advances inside begin_connection while that lock is held, so check-and-clear is atomic against new attempts). install_sender receives the only Sender, so dropping the slot's sender really closes the channel: writer exits, join_next returns, abort_all reaps the reader, and the socket drops. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(voice): send voice_leave when the E2EE key exchange times out connectAndSetup's key-exchange failure branch called leaveVoice(false) — no voice_leave frame, no leaveVoiceChannel(). The timeout fires BEFORE room.connect(), so no SFU participant ever exists and no LiveKit webhook can clean up, while the server already registered the join when it sent voice_token. The orphaned voice_states row matches the connected client's channel, so sweepStaleVoiceStates never reaps it; once the ghost has the lowest uid it wins key-holder election with a cleared E2EE state, every later joiner's exchange times out and ghosts too, and rejoining the same channel bounces off ALREADY_JOINED. Mirror the reconnect-exhausted give-up path: leaveVoice(true) + leaveVoiceChannel(), so the server drops the row and the local store converges. The supersession checkpoints keep leaveVoice(false) — there a newer attempt owns the server-side state and a voice_leave would destroy it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): keep voice state when the replay-failure fallback will transfer it handleFreshConnect's stale-voice cleanup ran unconditionally, but the replay-failure fallback (lastSeq > 0, e.g. after a restart reset the seq counter) reaches it while the old connection is still registered — and registerNow then transfers that connection's live voice state into the new client. The cleanup had already deleted the DB row, broadcast voice_leave, and removed the live LiveKit participant (using the very JoinedAt token being transferred), so the user ended up "in voice" on the hub only: voice_join bounced off ALREADY_JOINED and sweepStaleVoiceStates never reaps in-memory state without a row. Skip the cleanup when lastSeq > 0 and the still-registered old client's voiceChID matches the row — exactly the case registerNow transfers. All other cases (F5 fresh connects, no old client, mismatched channel) keep the existing cleanup, and if the old client unregisters in the window before registerNow, the untransferred row is reaped by the next sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(settings): stop the mic meter stream when it resolves after teardown The mic-meter IIFE had no post-await guard: a getUserMedia resolving after SettingsOverlay.hide() ran cleanup() (or after the tab's signal aborted) opened the microphone anyway, started the rAF meter loop, and registerMic re-armed state that cleanupMic() had already cleared — the mic stayed hot for the rest of the session with nobody left to stop it. Mirror the camera preview's request-id guard: cleanupMic()'s invalidation callback now bumps a micRequestId alongside cameraRequestId, the IIFE captures the id before the await, and a stale or aborted request stops the just-acquired tracks and bails before touching the AudioContext. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api,db): close the API-token and stale-ban holes in 2FA and account deletion Four related gaps around sessionless (API-token) principals and account teardown, all found by the bughunt harvest: - 2FA enable/disable skipped the BUG-108 "revoke other sessions" step entirely when the caller authenticated with an API token (nil session). Both handlers now use the change-password pattern: keep=0 matches no row, so every login session is revoked. - verify-totp issued a session to a user banned after the password step; it now runs the same IsEffectivelyBanned refusal as login. - DeleteAccount left API tokens active (they authenticate independently of the purged sessions) and left a stale lapsed ban_expires in place, which makes banned=1 read as NOT banned — together a previously temp-banned self-deleted account stayed fully usable through any owner-minted token. Tokens are now revoked in the purge and anonymiseUser sets ban_expires = NULL. - The last-admin guard resolved admin-class roles by display name ('Owner','Admin'), so renaming the seeded Admin role silently disabled self-deletion protection for its holders. It now keys on the canonical OwnerRoleID/AdminRoleID plus any role holding the Administrator bit. (The harvest's suggested criterion — Owner ID or Administrator bit alone — would have DROPPED seeded Admins, whose 0x3FFFFFFF permissions lack bit 30; the ID-based form preserves existing guard semantics.) - DeleteAccount also now applies LeaveGroupDM's invariant: DM channels left with zero participants are removed instead of becoming unreachable, undeletable rows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api,ws): rate-limit gaps — bucket isolation, focus/mark_read, call_decline, reaper horizon - Every empty-prefix RateLimitMiddleware mount shared one bare-IP bucket, and the limiter records a timestamp per call regardless of the limit passed — so unrelated endpoints capped each other at the minimum limit (five ordinary profile edits 429'd the password endpoint; NAT'd logins blocked register). The prefix is now a required parameter and every mount names its own bucket, mirroring the existing client_update:/ livekit_proxy:/gif: pattern. The sessions-list handler also stops 401ing API-token principals (nil session only ever fed IsCurrent). - channel_focus and mark_read were the only user-facing V2 handlers with no rate limit, and each drives an unmetered SQLite write plus pubsub churn; they now share a 5/s per-user budget (same underlying service call), silently dropping over-budget frames like their siblings. - call_decline gets the same limiter as its sibling call_ring — the identical participant-lookup-plus-fan-out cost shape. - The rate-limiter reaper pruned any entry idle past 15 minutes, but slow mode passes windows up to the 6 h admin cap, so long slow modes were silently reset; the cleanup horizon now covers the largest real window. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(server): unreachable route envelopes, dead env override, admin paging, plugin/updater defects Seven harvest findings across router, config, admin, plugin and updater: - The global 1 MiB body cap shadowed every route with a larger documented envelope: the 16 MiB plugin install 400'd at ~1 MiB and an at-limit avatar could never fit its multipart framing. The exemption list is now a named var covering uploads, plugin install, and avatar — each of which enforces its own cap at the route/handler level. - queryInt clamped offset with the limit's 500 cap, so the admin audit log and user list could never page past row 550; the cap is now an explicit per-call bound (offset callers pass MaxInt32). - OWNCORD_EVENT_PERSISTENCE_* env overrides were documented but dead: envKeyToKoanf cut at the first underscore, producing the unknown path event.persistence_* that koanf silently drops. - InstallPlugin trusted LastInsertId, which SQLite does not update on the upsert's DO UPDATE branch — on the shared writer connection a reinstall returned the rowid of some unrelated prior INSERT, so EnablePlugin no-opped and plugin_kv wrote to a nonexistent plugin id. RETURNING id is correct on both branches. - Every wazero plugin re-activation compiled the module again and leaked the previous CompiledModule; the handle is now retained on the instance and closed in deactivate, the lost-activation race, and the closed-module release path. - Linux server self-update was gated on the Windows-only chatserver.exe.sig asset it never uses; the required-asset check and the signature fetch are now GOOS-aware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ws): batch S4 — seq-gap shed, replay tail merge, drain-on-close, handshake teardown Eight harvest findings in the hub/replay/pump paths, each locked by a watched-red test in harvest_s4_internal_test.go / reconnect_db_test.go: - kickClient closes the send channel BEFORE UnsubscribeAll so a racing Subscribe can never leave a dead client holding a topic. - deliverBroadcast consults the topic limiter BEFORE allocating a seq: a shed frame no longer burns a sequence number that sits in the replay buffer forever unpublished. - onStaleTick prunes idle topic-limiter buckets (Cleanup had no caller). - dm_channel_open bumps the visibility watermark so a client resuming from an older seq takes the full-ready path instead of silently losing the targeted, unsequenced open. - computeAllowedChannels treats a DM-lookup failure as fatal (full ready) instead of replaying with every DM event silently stripped. - Cold-tier replay merges the ring-buffer tail past the newest persisted row; if the buffer cannot vouch for the flush gap it forces full ready. - writePump drains queued frames (e.g. the BANNED kick reason) after closeSend instead of dropping them on the first closed channel. - A failed post-registerNow handshake runs the offline teardown when no replacement connection holds the slot — no more users stuck online. Declined by design: hoisting registerNow above the replay snapshot (report L390) — every fallback path would re-register the same client and registerNow self-kicks the slot holder; the µs dedup window does not justify that risk in the hottest path. The kickClient ordering test is a 300-iteration stress whose race window is too narrow to hit reliably; it documents the invariant rather than having been watched red. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(client): batch C1 — store merges, ready-badge resync, pending-send teardown Ten harvest findings in the stores/dispatcher layer, each locked by a watched-red vitest test: - setMessages merges instead of clobbering: live broadcasts and pending/failed optimistic rows that landed while the history GET was in flight survive the snapshot. - addChannel is idempotent — the re-sent channel_create on role edits no longer wipes unread/mention counts, lastMessageId, or canSend. - setChannels carries client-synthesized DM rows across the rebuild. - READY marks the focused channel read after the store repopulation so stale server read_states cannot resurrect badges on the channel the user is actively reading (skipped on first connect). - setVoiceStates maps the ready payload's camera/screenshare flags instead of blanking live streams on a mid-call resync. - The dm_channels length guard is gone: an empty array is authoritative and clears ghost DMs. - addMessage's defensive pending-row reconcile requires content equality so another session's replayed message cannot consume the pending row. - performSend into a detached history window reattaches to present first, mirroring onJumpToPresent. - prependMessages at the cap keeps the fetched older page and detaches the window instead of silently discarding the fetch (which refetched the same page forever); hasMore is the server's value again. - A connection leaving "connected" fails every pending optimistic send (retry affordance) instead of letting rows spin forever. One existing assertion updated to the corrected semantics: trimming on prepend now drops rows below the window, so hasMore stays the server's value and the test asserts the detach instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(server): batch S5 — voice eviction scoping, fail-closed camera cap, role-service races Seven harvest findings in the voice/service layer, each locked by a watched-red test: - The CONNECT_VOICE revocation sweep evicts via a channel-conditional clear (the in-memory analogue of LeaveVoiceChannelIfMatch): a voice_join to a permitted channel that commits while the DB-backed permission check runs can no longer be torn down. The report's suggested pre-check guard was rejected — it leaves the same race open between guard and clear, proven by the interleaving test. - A failed channel switch's abort branch re-subscribes the restored session to its VoiceTopic and re-elects the key holder; without them the session silently missed every voice_e2ee relay. - voice_camera fails closed when the VoiceMaxVideo lookup errors instead of skipping the cap check and enabling unconditionally. - LiveKitProcess starts the child inside the p.mu critical section that publishes p.cmd (Wait stays outside), removing the data race between Start's cmd.Process write and IsRunning/Stop reads. - AffectedUserIDs reports lookup success; handlePatchRole falls back to a blanket permission-cache invalidation when the member list was unreadable, instead of evicting nobody and leaving revoked grants live. - RoleService serializes its read-check-write mutations (position uniqueness and the role cap are snapshot-enforced, not DB-enforced); concurrent creates can no longer land on the same position and tie every hierarchy comparison. - channel_focus writes the read state even when the channel has no undeleted messages — the upsert is what zeroes mention_count, so emptied channels finally clear their badge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(client): batch C2 — voice eviction teardown, supersession scoping, VAD generation Seven harvest findings in the voice/session layer, each locked by a watched-red vitest test: - A server-initiated voice_leave for self tears down the LiveKit session (mic publish + E2EE key material), guarded on channel match so a late-arriving leave cannot kill a newer join. - VIDEO_LIMIT refusal rolls back with disableCamera() — max_video has no SFU-level enforcement, so the already-published track kept streaming. - teardownForReconnect sends voice_camera/voice_screenshare OFF frames before stopping local tracks, freeing the server-side max_video slot a reconnect otherwise occupies forever. - Supersession checkpoints 3/4/5 disconnect only their own local room (mirroring checkpoint 2) instead of calling the global leaveVoice, which by then tears down the newer attempt's live session. - retryMicPermission honors a moderator's server-mute like it honors deafen — granting mic while listen-only no longer hands the channel an unmuted track. - handleDisconnected defers to the active reconnect loop (livekit-client fires Disconnected synchronously inside the loop's own connect call), preventing a second uncancellable retry loop. - stopVadPolling invalidates an in-flight startVadPolling addModule via a VAD-scoped generation counter, so VAD cannot resurrect itself with a stale threshold. Deliberately skipped: the report's optional RATE_LIMITED camera rollback — that error code is shared by unrelated actions and the payload cannot attribute it to a camera toggle, so a blind rollback would be wrong. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(client): batch C3 — E2EE rotation races, pin-write tri-state, stale-offer guards Six harvest findings in the voice-E2EE key-exchange layer, each locked by a watched-red vitest test; the security-invariant sweep (re-pin TOCTOU, forward-secrecy rekey, concurrent-rotation, blind-repin — 239 E2EE-adjacent tests) stays green: - Re-election as key holder during an in-flight rotation defers (sets _isKeyHolder + _rotationPending, mirroring the sibling branch) instead of dropping the election and stranding the room without a holder. - storeIdentityPin returns tri-state stored/no-store/failed; a FAILED pin write now marks the peer unverified instead of displaying "verified" with no pin persisted — an unpinned peer could never trip mismatch detection, the exact MITM window the pin exists to close. - handleOfferInner discards a stale offer when the session keypair changed, not just the epoch — a non-key-holder never bumps epoch, so an offer surviving clearState() into the next session passed the epoch-only check. - handleAnnounce's wrap-and-offer path gets the same epoch guard as the receive path, so a rotation landing mid-wrap cannot ship a dead key. - The key-exchange retry races a FRESH promise (the first rejection had permanently settled the old one, making the retry window zero), and aborts cleanly when clearState() tore the session down mid-exchange. - setupKeyExchange publishes _ecdhKeyPair only after _isKeyHolder and _roomKey are ready, so a concurrent announce is queued and drained through the offer-sending path instead of being consumed offer-less. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(client): batch R1 — secret store must not report a broken keyring as empty Three harvest findings in the Tauri credential store, each locked by a watched-red test: - secret_store::get treated a keyring read error as "nothing stored" whenever the fallback file was also empty, which is indistinguishable from first login. loadOrGenerateIdentityKeyPair reads exactly that signal, so an unreadable keychain made the client mint and publish a fresh identity key over the existing one, invalidating every peer's TOFU pin. It now prefers a fallback copy and otherwise propagates the error; loadIdentityKey rethrows instead of swallowing to null. - A failed keyring write left any older entry in place while the fresh secret went to the fallback file — and get() reads the keyring first, so the stale value shadowed the new one forever. The write-failure arm now purges the entry, mirroring the read-back-mismatch arm beside it. - fallback_crypto deleted nothing when the key file's write or sync failed, leaving a short file that every later load rejects; since the key file is never rewritten once it exists, one ENOSPC poisoned the fallback store permanently. Both Rust fixes needed a small injectable seam (get_with/set_with, finish_new_key_file) because the keyring error branches are otherwise unreachable without a live OS credential store. The saved-login path is unaffected in behavior: loadCredential still catches and degrades to "no saved credential" rather than surfacing the new error. The persistence re-read in loadOrGenerateIdentityKeyPair deliberately does not rethrow — the keypair already exists in memory by then, so a transient failure keeps the existing "did not persist" warning. fallback_crypto is cfg(not(windows)), so its test ran only under a temporary local gate lift (reverted, verified no residual diff); it executes for real on the Linux and macOS CI runners. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: rewrite CLAUDE.md per Claude 5 context guidance; commit skills + hunt workflow The CLAUDE.md files were a manual: build commands, code style, layout Claude can read off the filesystem. Rewritten so they are short and spend their tokens on gotchas instead — the things that are invisible until they cost an afternoon. Moved out of CLAUDE.md into skills (progressive disclosure), which also fixes three references to skills that never existed: - ci-check: the full local CI mirror, including the four Go build-tag variants and the deadlock pass a plain build/test misses, and the windows-latest runtime.scanstack GC fault that should be rerun rather than investigated. - db-change: the sqlc workflow plus three silent traps — non-ASCII query files truncating the NEXT query's emitted SQL, semicolons in migration comments orphaning statements, and LIMIT 1 mis-emitting on a :one query. - protocol-change: regenerate both constant files and commit the pair. Dropped: command lists duplicated from the Makefile and package.json, prettier style rules the formatter already enforces, and layout facts a directory listing answers. Added the subsystem invariants that keep getting rediscovered the hard way — the ws seq/FIFO contract, voice-session supersession scoping, E2EE staleness guards, and the Node 22 webstorage failure mode. .claude/ is no longer ignored wholesale: skills and workflows are tracked so a cloud session, which sees only tracked files, starts with instructions rather than nothing. Machine-local settings and locks stay ignored. Deleted bughunting.js, a superseded copy declaring the same workflow name as bughunt.js, which left the registry ambiguous. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(client): batch C4 — cert-latch scoping, stale active channel, credential opt-out Thirteen harvest findings across the client UI and wiring, each locked by a watched-red vitest test: - The TLS cert-mismatch latch fired on any host's event, so an unrelated saved profile's rotated certificate permanently killed this socket's reconnect loop. It now latches only for the connected host, cancels any pending reconnect (a timer armed before the mismatch would otherwise fire connect(), clearing the latch and resuming against that host), and resets on a fresh connect. - ready never cleared activeChannelId when the channel vanished from the snapshot, and MainPage's subscriber had no else branch — the message list and composer stayed mounted and enabled against a channel the server no longer recognizes. Both sides fixed; the mark-read from batch C1 is suppressed when the clear happens. - user_update re-saved the session token unconditionally, bypassing the remember-password opt-out, and dropped the stored password while doing it. - A failed older-page fetch latched loadingOlder, permanently killing infinite scroll for that view; it now clears in a finally. - Concurrent message jumps raced, letting the older response overwrite the newer window. Guarded by a generation counter. - A FORBIDDEN send in a group DM flagged participants[0] as blocking, which disabled the unrelated 1:1 composer with that person; block gating is 1:1-only. - streamPreview added an abort listener per call instead of per signal. - dm_channel_close had no fallback when the closed DM was being viewed; both call sites now share one closeDmLocally helper. - The GIF picker routed through the textarea and discarded the draft. - QuickSwitcher listed DM rows that the DM section already shows. - Accepting a rotated certificate reconnected into a page with nothing left listening, stranding the user on the connect screen. - Logout read voiceStore after clearAuth had already reset it, so the voice_leave was never sent; clearAuth now snapshots logoutWasInVoice. - disconnect() left reconnectAttempt set, carrying a stale backoff ceiling into the next login. Also fixes two lint errors this branch introduced earlier and that only a full `npm run lint` catches: a useless spread in the C1 pending-send sweep (now Array.from, which states the snapshot intent), and two floating promises in C2's voice_leave handler, where converting an implicit-return arrow to a block body stopped chaining them. main.ts and MainPage.ts have no unit-test seam, so three focused pieces were extracted to make the fixes testable: createUserUpdateCredentialSaver, reconnectAfterCertAccept, and the logoutWasInVoice snapshot. One existing assertion corrected: a dispatcher test claimed ready must keep an active channel that was absent from the payload, which locked the bug. It now keeps a channel that is present, with a sibling test for the absent case. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client Findings came from a multi-round hunt, each verified against the tree by an independent adversarial pass before any code changed, then fixed and re-reviewed. Every behavioural fix carries a regression test that was confirmed to fail against the pre-fix code. Server (Go) - Reconnect/replay: force a full ready when retention pruning has removed the events after a client's last_seq, rather than accepting the surviving suffix as a complete resume; close the snapshot-to-registration window under seqMu; restore the focused-channel subscription during the handshake via a new READ-gated active_channel_id auth field; supplement replay with the client's own voice room; tear down transferred voice sessions on a failed handshake. - Hub: ratchet visibilityChangeSeq upward only (all three writers); make the stale-voice sweep error-aware so a transient DB failure no longer evicts every participant; re-elect the E2EE key holder on sweep and cleanup paths. - Voice: preserve moderator mute/deafen across channel switches; deliver voice_leave to evicted users; gate camera/screenshare permission checks on the enabling direction only; reject joins to non-voice and archived channels. - Permissions: archived channels are now read-only and unjoinable, and can_send is recomputed per client on role/override changes. - Data: stop cascaded message deletes from stranding uploaded files (migration 030 unlinks instead); clear personal data on account deletion; exclude banned users from owner lookup; drop the silent 1000-member cap; advance the author's own read state on send. Client (TypeScript / Rust) - Voice: make joinGeneration monotonic so a superseded attempt can no longer pass supersession checks; scope aborted-path cleanup to the attempt's own room; send voice_leave on connect failure; stop push-to-talk from writing the user's explicit mute flag; gate join-time PTT muting on a new backend capability probe so platforms that cannot report key state are unaffected. - E2EE: act on the tri-state pin-write result instead of reporting an unverified peer as verified; use keypair ownership rather than null checks. - State: reset the message cache on logout; clear NSFW acknowledgements on logout; scope channel mutes, NSFW acks and DM notes per server host. - UI: make the attachment remove button and the failed-send Retry/Discard buttons work; fix drag-reorder's phantom-drag latch and its permission gate. Docs: protocol.md now documents can_send, active_channel_id, the archive read-only contract, and the sequenced/unsequenced presence split. Verified: all four Go build tag variants, go vet, go test -race, the ws deadlock detector, sqlc and protocol generation, tsc, eslint, prettier, and the full client suite (169 files, 4664 tests). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LWUzUmsjCKNAzAfQzT4fz7 * fix(ci): satisfy golangci-lint, knip, and the host-scoped mute key in e2e Three CI failures on the previous commit, all genuine fallout from it. golangci-lint (v2.11.3) — 6 issues in tests added by that commit: - contextcheck: the temp-ban subtest captured an outer ctx while calling seedTokenUser, which builds its own; declare ctx inside the subtest instead. - modernize: use WaitGroup.Go and range-over-int in three tests. knip — SessionResponse in lib/types.ts became unused. The getSessions fix replaced it with SessionInfo in lib/api.ts, which documents why the old declaration was wrong (it named ip_address/expires_at, which the server never sends, and omitted ip/is_current, which it always does). Delete the dead type rather than re-export it, and fold that reasoning into the surviving comment. Client E2E — the per-channel-mute parity test asserted the pre-scoping localStorage key. Channel mutes are now keyed mutedChannels:<host>, because channel ids are per-server autoincrement integers sharing one webview origin; verified in a browser that the app writes owncord:settings:mutedChannels:localhost:8443. The test now resolves whichever scoped key exists instead of pinning the test server's host, so it still asserts the same thing: the id persists on mute and is gone on unmute. Verified with the CI linter version built against Go 1.26 (0 issues), all four build tag variants, go vet, go test -race, the ws deadlock detector, knip, tsc for both tsconfigs, prettier, the full client unit suite, and the previously-failing parity specs run in a real browser. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LWUzUmsjCKNAzAfQzT4fz7 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 21:20:48 +02:00
J3vbandClaude Opus 5	086979b7e8	Release v1.2.0-alpha.1 -> main (#1309) ... * fix(admin): accept same-origin first-run setup requests A freshly generated config.yaml leaves allowed_origins commented out, so the list is empty. The setup handler's CSRF guard assumed "no Origin header means same-origin", but browsers send Origin on same-origin POSTs too — Chrome and Edge always, Firefox since 70. The admin panel's own setup call is one of those POSTs, so every new install hit "cross-origin setup request blocked" and could never create an owner account. The guard now accepts a request whose Origin names the same host:port as the request's own Host header, falling back to the allowlist otherwise. That is what the original comment intended. CSRF protection is unaffected: a cross-site attacker cannot set Origin, the browser does, and a foreign origin still needs an explicit allowlist entry. Scheme is not compared. Nothing in this server derives the external scheme (no r.TLS or X-Forwarded-Proto handling exists anywhere), so a scheme check would reject legitimate requests behind a TLS-terminating proxy. Tests: isSameOrigin table covering port/host/suffix/schemeless/opaque-origin cases, plus two handler-level tests pinning both halves — same-origin succeeds against an empty allowlist, a foreign origin still 403s and creates no user. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(identity): implement identity keypair caching and error handling * fix(client): use the real OS credential store, not keyring's mock (#1281) The `keyring` crate declares no `default` feature. Every platform arm in its lib.rs selects a backend only when that platform's feature is on and otherwise falls through to `pub use mock as default`, so the client's bare `keyring = "3"` compiled the in-memory mock store on Windows, macOS and Linux alike. The mock keeps its secret in the `Entry` object itself, and each command built its own `Entry`: save_identity_key -> Entry::new(..) -> set_password -> Ok(()) load_identity_key -> Entry::new(..) -> get_password -> NoEntry So a save reported success, the very next read in the same process returned nothing, `NoEntry` was mapped to `Ok(None)` so neither side logged anything, and no entry was ever written to Credential Manager on any machine. Downstream, the voice-E2EE identity keypair was regenerated on reconnect, the published identity key stopped matching the key that signed the announce, and peers correctly rejected it as a possible MITM. Name the platform backends explicitly, and stop trusting a store that reports a write it did not keep: - secret_store: read every write back and compare before reporting success. If the store returns a value we did not write, purge it so it cannot shadow the fallback on the next read. - On Windows only, fall back to a DPAPI-protected file in the app data dir, engaged solely after a proven round-trip failure and cleared as soon as the real store works again. The account name is mixed into the DPAPI entropy so a blob cannot be moved between entries and decrypt. macOS/Linux report an error instead of writing secrets to plaintext. - Log the compiled backend at startup and add `probe_credential_store` so an affected machine can be diagnosed from its own log file. - Guard the regression: `compiled_keyring_backend_is_persistent` fails the build if the features are ever dropped again. Verified to fail against `keyring = "3"`. The E2EE fail-closed posture is unchanged: a peer whose announce signature does not verify is still rejected. Linux builds now need `libdbus-1-dev` for the Secret Service backend. Claude-Session: https://claude.ai/code/session_016oUHtEUWWxC79eB88GvX58 Co-authored-by: Claude <noreply@anthropic.com> * fix(client, admin): make the settings panel, client, and admin panel do what they say (#1282) * fix(client): make the settings panel do what it says Functional review of every control in the settings overlay. Each fix below closes a gap between what a control promised and what it did. - Appearance: picking a theme no longer drops a saved accent colour. applyThemeByName strips every inline custom property from <body>, which includes the accent override; under neon-glow (whose body class sets --accent) the user's colour silently reverted until restart. - Overlay: reopening the panel rebuilds the active tab. The Voice & Audio mic meter and camera preview are torn down on close, so a reopened panel showed a dead meter and a black preview; tabs also now re-read prefs. The Logs tab's live listener is released when you switch away from it. - Status: the UserBar picker always started at "online" and never persisted, while the Account tab read a pref nobody else wrote — the two surfaces disagreed. Both now go through lib/userStatus, sync live via the pref-change event, and the saved status is re-asserted on connect. - Notifications: Do Not Disturb now suppresses the desktop notification and the chime, as its description in the panel claims. The taskbar flash, a passive cue, stays. - Keybinds: Ctrl+F, Ctrl+M, Ctrl+D, Ctrl+Shift+V and Ctrl+U were listed but unimplemented. They are wired now (voice ones only while in voice, all of them suspended while the settings panel is open). "Mark as Read" had no feature behind it at all and is replaced by the Escape behaviour that actually exists. - Account: backup codes now carry a "you won't see them again" warning and a copy button; the change-password form requires the current password before spending a server attempt and disables itself while in flight. - Advanced: removed the Hardware Acceleration toggle. Nothing read the preference it wrote — the webview decides GPU compositing before any JS runs, so honouring it needs a Rust startup change. - The settings sidebar name/avatar follow a rename instead of going stale, and settings/helpers no longer keeps a drifted copy of lib/preferences (the copy lacked the write guard, so a failed save could throw). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * fix(client): close silent-failure gaps in the inline admin surface Continuation of the settings-panel review into the rest of the client. - Member context menu had no styling at all: AdminActions renders BEM class names (context-menu__item and friends) that appear nowhere in the CSS, so the menu had no hover, no danger colour, and the "Change Role" submenu pushed the menu open instead of flying out. Added the missing rules. - The submenu offered a hardcoded admin/moderator/member list. On a server with custom roles those roles were unreachable, and picking a name that didn't resolve to a role id silently did nothing. Roles now come from the server's ready payload (owner excluded), and an unresolvable role reports an error instead of dead-ending. - Kick / ban / delete-channel now show an in-flight state, and the two-click confirm disarms after a few seconds so a menu left open can't turn a stray click into a ban (docs/architecture/ux/settings-and-admin.md §3). - Ban collects a reason, which the server already stores and displays (adminBanMember has always accepted one; the menu never passed it). - Copying an invite code was silent: no confirmation, and a clipboard rejection looked identical to success. It now toasts either way. - Creating an invite double-click-minted two of them, and revoking — which kills a live link — had neither a confirm nor an in-flight guard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * fix(client): restore moderator message deletion and formatting - The delete affordance was offered only on your own messages, so a moderator could not moderate anything from the client. It now also appears when the signed-in user's role carries MANAGE_MESSAGES, derived from the role bitmasks the server already sends in `ready` (this is what docs/architecture/ux/messaging.md §4 specifies as "Delete (own / moderator)"). lib/permissions.ts existed for exactly this and had no callers at all. - Developer-mode "Copy ID" was silent on success and swallowed clipboard failures; it toasts either way now. - prettier --write on AdminActions.ts (Client Static Checks). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * fix(admin): stop the panel reporting success it didn't have Functional review of the server admin web panel. - An expired admin session left the panel on screen toasting "invalid or expired session" for every action, with no way back to the login form — only the log-stream code handled it. api() now handles 401 centrally: clear the token, return to login, and say why. - Deleting a backup called fetch() without looking at the response, so a failed delete reported "Backup deleted" and left the file in place. It now goes through api(), and — like every other destructive action here — asks for confirmation first. - A failed update check rendered as "Up to date. You're running the latest version", which is a lie that hides a broken update path. It now says the check failed and why. A failed apply no longer leaves the button stuck on "Applying...". - The Edit Channel modal could only rename. PATCH /channels/{id} accepts topic, slow_mode, position and archived, and the channel table has an Archived column — which was read-only state with no control behind it. All four are editable now. - Banned users showed "Yes" with no reason, even though the ban reason is collected on ban and returned by the API. It's now displayed. - Login and first-run setup had no in-flight guard, so a double-click spent two attempts against the login lockout / setup rate limit. Settings' Save stayed enabled after a successful save, implying unsaved changes. - Clipboard copies (invite code, new API token) had no rejection path: a refused clipboard looked exactly like a successful copy. - Backup names in inline onclick handlers go through jsq() like every other interpolated string. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * feat(admin): add the plugin management UI the backend already had /api/v1/admin/plugins has exposed list/install/enable/disable/uninstall since Phase C Step 9 — its own header says it "exposes plugin lifecycle operations to the admin panel", and docs/architecture/ux/settings-and-admin.md tells operators plugin management lives in the web panel. The panel had no Plugins section at all, so installing a plugin meant hand-crafting a multipart POST. Panel: - Plugins section: installed table (name, manifest description and requested permissions, version, enabled state, install date), zip upload with the 16 MB server cap stated up front, enable/disable, and uninstall behind a confirm. One lifecycle call at a time. - The lifecycle API sits under a different prefix than the rest of the panel and answers errors as plain text (http.Error), not JSON, so it gets its own fetch helper — sharing api() would have surfaced "unexpected token" instead of the server's reason. 401 still routes back to login. Server: - PluginRow had no JSON tags, so the list marshalled Go field names and every column would have rendered empty. Now snake_case like the rest of the API. - GET /plugins returns X-Plugin-Runtime: enabled|disabled. An empty list means "nothing installed" on a live runtime and "you can't install anything" on a disabled one; the body can't tell them apart, so the panel's empty state had no way to be honest about it. The plugin-store test helper now hands back the database the registry writes to — the existing happy-path test wired a *different* in-memory DB into the handler, which is why nothing noticed the list was always empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * feat(client): gate the composer on slow mode instead of failing the send Verified the optimistic message lifecycle against docs/architecture/ux — pending → chat_send_ok → sent, failed rows with mapped reasons, retry and delete-draft all behave as documented. One thing did not: slow mode. The UX spec (§5) says slow mode should "disable send with a live countdown in the composer; do not drop the drafted message". In practice the composer knew nothing about it: you typed, sent, and got a red failed row back — the exact enabled-then-rejected pattern §6.2 forbids. The client never even received the channel's slow_mode value. - Server: channel payloads (ready, channel_create, channel_update) now carry slow_mode alongside can_send, for the same reason can_send is there — the client can express the limit as affordance. The server still enforces. - Client: after an accepted send the composer disables itself for the channel's cooldown with a per-second countdown, and a SLOW_MODE refusal restarts the full window (the server's limiter is the authority on when the next send is allowed). The draft stays in the textarea. Moderators, who bypass slow mode server-side, are not gated. - The MANAGE_MESSAGES lookup added for moderator deletes moves into lib/permissions as currentUserPermissions/currentUserHasPermission/ canManageMessages, so the composer and the message renderer share one definition instead of two. - WsErrorCode listed 9 of the server's 16 codes: SLOW_MODE, CONFLICT, BAD_REQUEST, INVALID_JSON, UNKNOWN_TYPE, BAD_PAYLOAD, NOT_KEY_HOLDER and ALREADY_JOINED were missing, so code switching on it could not name cases the server actually sends. Now mirrors Server/ws/errors.go. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * fix(admin): make backup restore actually restart, and fail closed without a safety copy Verification pass over the remaining review items. Two real defects in restore, one duplicate resolved; cert TOFU and the replay path checked out as-is. Restore: - The handler closed the database, swapped the file underneath it, told the admin "database restored — server restarting", broadcast a 5-second restart countdown to every client... and then kept running. Nothing restarted it, so the server answered every subsequent request against a closed DB until an operator noticed. It now respawns for real, reusing the update-apply pattern (SpawnDetached → SIGTERM → os.Exit backstop) behind a test seam. - A failed pre-restore backup was a warning, and the irreversible overwrite went ahead anyway — removing the safety net the panel explicitly promises ("A pre-restore backup will be created"), precisely when it matters. It now aborts with the database untouched. - The safety copy was written to a cwd-relative "data/backups" while every other backup handler uses the absolute backupBaseDir, so a server started from another directory filed it somewhere the operator would never find. Both new tests were confirmed to fail against the previous behaviour. Client: - SidebarArea kept a private 140-line copy of the member-list wiring that SidebarMemberSection already provides (the extracted, tested one was never imported). Fixing the silent role-change failure earlier meant patching both; now there is one copy. Verified without changes: the optimistic send lifecycle (pending → chat_send_ok → sent, failed rows with mapped reasons, retry, delete-draft), reconnect replay (monotonic last_seq, dedup on reconnect, replay suppression of unread/notifications), and cert TOFU (first-use and mismatch modals, accept re-pins and reconnects, reject disconnects back to connect). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm * fix(admin): remove the data race in the restart test hook CI (-race) failed identically on ubuntu and windows: TestHandleRestoreBackup_ Success polled a plain bool that the restore handler's goroutine wrote, and swapped the restartSelf package var from the test goroutine while that handler read it. The hook is now behind a mutex with an atomic flag in StubRestart. Production behaviour is unchanged — the race was entirely in the test seam I added. Verified with `go test -race -count=2 ./admin/`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TDE7ZPi38jLfEKhj7kvmm --------- Co-authored-by: Claude <noreply@anthropic.com> * refactor + perf: split largest source files into modules; optimize hot paths (#1283) * refactor(updater): split updater.go into cohesive files Split the 1070-line updater.go into four files within the same package: updater.go (core types, release checking), download.go (download and tarball extraction), verify.go (signatures, checksums, staged binary), and assets.go (client assets, text-asset cache, HTTP fetching). Pure mechanical move — no behavior or API changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * refactor(ws): split hub.go into cohesive files Split the 1289-line hub.go into five files within the same package: hub.go (Hub struct, lifecycle, register/unregister), hub_broadcast.go (broadcast fan-out and per-user sends), hub_events.go (sequencing, replay, persistence), hub_sweep.go (stale client/session/voice sweepers), and hub_livekit.go (LiveKit accessors). Also optimizes wrapWithSeq on the hot broadcast path: build the seq prefix with a single preallocated append + strconv.AppendUint instead of fmt.Sprintf, halving allocations per broadcast message. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * refactor(client): extract E2EEManager from livekitSession Move all client-side E2EE key-exchange logic (~550 lines) out of LiveKitSession into a new E2EEManager class in livekitE2EE.ts: ECDH keypair management, identity signing and TOFU pin verification, announce/offer handling, key-holder election, membership rekeying, and periodic key rotation. Dependencies are injected following the existing roomEventHandlers pattern. LiveKitSession keeps thin public delegates (handleE2EEAnnounce, handleE2EEOffer, handleParticipantLeft, rePinPeerIdentity) so the module-level bound exports and the public API are unchanged. livekitSession.ts shrinks from 1955 to 1409 lines. Adds focused unit tests for E2EEManager (key-holder setup, pending announce queue, offer resolution, clearState, rotation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * perf(server): hot-path and query optimizations Logging (biggest win): rewrite the admin log RingBuffer as a true ring (fixed array + head/count) instead of allocating a fresh 2000-entry slice + full copy per log line; gate the ring handler on a configurable level instead of unconditional DEBUG capture; move the broadcast debug log out of the seqMu critical section; drop the per-message slog.With clone in the WS handler. Database: new migration 019 adds idx_attachments_message (message pages no longer scan the attachments table), a covering role-leading index on channel_overrides (replacing a duplicate of the UNIQUE auto-index), a partial index for pinned messages, and narrows the FTS trigger to content changes only; ANALYZE runs after migrations. Rewrite GetChannelUnreadCounts and GetUserDMChannels to correlated subqueries that range-scan idx_messages_channel — O(unread) instead of O(all messages) per WS connect. New GetUserDMChannelIDs replaces the full DM query where only IDs are needed. CreateMessage/EditMessageContent use RETURNING, removing the re-read after every send/edit. Write-path contention: TouchSession throttled to once per minute per session (was one UPDATE per authenticated request); EventPersister flushes its batch in a single transaction with per-row fallback; revoked-session and stale-voice sweeps run off the hub dispatch goroutine with an in-flight guard, and session checks are batched into one IN query; the rate limiter is sharded into 32 buckets with allocation-free strconv key building (auth.Key). WS structural: voice E2EE channel fan-out goes through the existing pubsub voice topic instead of scanning every connected client under h.mu; channelReadAudience memoizes role lookups per call; hasChannelAccess drops its redundant duplicate permission check; voice_join batches SPEAK/VIDEO/SCREENSHARE checks via HasChannelPermBatch. Also: pubsub topic builders and NewAppMetrics stop allocating via Sprintf/global mutex. Verified with go test -race across all packages, go vet, gofmt, and sqlc generate idempotency. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * perf(client): render-path, logging, and bundle optimizations Logging: the logger no longer runs permanently at debug — level is set from the environment at startup (debug in dev, info in prod), so every hot-path debug entry stops being serialized, buffered, consoled, and persisted to disk; per-URL debug logs in embed rendering removed. Render path: MessageList's store selector is scoped to the mounted channel, so messages in other channels no longer trigger re-renders, and a new incremental tail-append fast path appends rows instead of tearing down the whole window; Intl.DateTimeFormat instances are cached at module level; parseTimestamp memoizes epoch millis; media prefs (showEmbeds/inlineMedia/showLinkPreviews/animateGifs) are cached with pref-change invalidation; members store gains a roleRevision counter so MessageList stops rebuilding a role map on every presence/typing event. MemberList patches presence changes in place (status dot + offline class) via a row map instead of rebuilding every row, with single-pass role grouping. ChannelSidebar splits its voice subscription into a structural selector (excluding speaking) and a speaking-only patcher using a cached element map instead of per-user querySelector on every speaker event. Memory: GIF/media elements are unobserved before the message window discards them, fixing unbounded IntersectionObserver retention of detached DOM (including frozen-frame data URLs). Bundle: livekit-client (1.3 MB) moves to its own chunk via dynamic imports and manualChunks; the READY handler's stale-voice check reads the voice store instead of requiring the module synchronously. Adds 11 focused tests (different-channel no-rerender, append fast path, media release, presence patch, speaking patch). Full unit suite: 3606/3606 passing; typecheck, lint, and production build clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(ci): skip alloc test under deadlock tag; cut bcrypt cost in tests (#1284) The deadlock-tag CI pass failed on TestRingBuffer_WriteDoesNotAllocate: under -tags deadlock, syncutil.Mutex is the go-deadlock mutex whose Lock allocates, so the steady-state ring write measures 1 alloc/call. Extend the build constraint to !race && !deadlock — the test's guarantee is about the ring buffer itself, which the -race-less default pass covers. Make bcryptCost a var with an exported SetCostForTesting hook that also resets the dummy timing pad, and call it with bcrypt.MinCost from the api, auth, and admin TestMains. Password hashing at production cost 12 dominated those suites (~264 hashes): with the race detector the api package alone took ~860s; it now runs in ~33s. Nothing under test depends on hash strength, and no test asserts the cost. Hygiene in the same pass: migration 020 drops idx_sessions_token and idx_invites_code (exact duplicates of their UNIQUE auto-indexes, pure write overhead) with updated db_test assertions; remove the dead tar.TypeRegA comparison in the updater (stdlib normalises it to TypeReg since Go 1.11); gofmt storage/storage.go comment alignment. Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu Co-authored-by: Claude <noreply@anthropic.com> * perf(ws): route hot-path permission checks through the cached PermissionService (#1285) The ws package was the only major subsystem still doing live per-check permission queries (GetRoleForUser + GetChannelPermissions per check): a V2 voice join cost 9+ DB reads across its four gates, and every channel broadcast resolved one role query per connected client. Hub now holds svc.Permissions and the voice deps carry it (nil-safe: bare test fixtures fall back to the existing live path, fail-closed semantics preserved everywhere). Converted sites: the voice join and token-refresh permission gates, USE_VIDEO/SHARE_SCREEN controls, requireChannelAccess, channelReadAudience, and RefreshChannelVisibility. Caching these is revocation-correct: every permission-changing mutation already invalidates synchronously before hub fan-out (InvalidateUser on role change, InvalidateAll on override change), the 30s TTL is only a backstop, and the service's gen-counter guard prevents a populate that races an invalidation from caching stale data — the audience-resolution comments now document that invariant. The stale-voice sweeper's check deliberately stays live: it is the last-line backstop for revocations that might bypass an invalidation hook, runs once a minute for only in-voice clients, and its eviction test pins exactly that guarantee. requirePerm keeps its INTERNAL-vs-FORBIDDEN distinction by using the cache only for positive verdicts and falling through to the live path on denial. Adds perm_cache_test.go: role-change invalidation is immediate (no TTL wait), and a counting-store test proving the second check is served from cache. All pinning tests (authz, voice_perm_stale, channel visibility agreement, sweep eviction) pass unmodified. Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu Co-authored-by: Claude <noreply@anthropic.com> * perf + refactor: SQLite reader pool, async audits, real lazy-livekit, test splits, eslint 10 (#1286) * perf(db): batch audit writes through an async writer Audit inserts ran synchronously on the request path — including one INSERT per WebSocket connect — each an implicit transaction on the single SQLite connection. WriteAudit keeps its exact signature and D8 policy (never fail the caller, never silently discard): it now upgrades to an async path when the passed Auditor also implements AsyncAuditor. *DB implements that via an atomic pointer that main.go populates at server startup with an AuditWriter modeled on the event persister (bounded queue, batched single-transaction flush with per-row fallback, drain-on-stop, atomic counters, non-blocking enqueue that error-logs drops without leaking the detail field). The token CLI and tests never install a writer, so they keep today's synchronous behavior with zero call-site changes. The writer's Stop defer registers after database.Close's so the LIFO unwind drains the queue before the DB shuts. Adds audit_writer_test.go: batch flush, D8 drop logging, drain-on-stop, flush-failure accounting, poison-row fallback, concurrent enqueue, and seam tests pinning sync-without-writer vs async-with-writer behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * perf(client): actually defer livekit-client; honor saved log level at startup The manualChunks split was cosmetic: index.html modulepreloaded the 531 kB livekit chunk and the entry statically imported it. All four import chains from startup are now cut — auth.store's logout leaveVoice and ptt's setMuted go through dynamic imports, applyStoredAppearance moved to lib/appearance.ts so main.ts and ConnectPage stop pulling the settings tree (whose overlay now loads on first open), and MainPage itself is a dynamic import in renderPage, guarded against the destroy-before-mount race by a navigation-generation helper and pre-warmed once the socket connects. Entry chunk drops 387 kB -> 114 kB (gzip 36 kB); index.html has no modulepreload links; livekit/MainPage/SettingsOverlay/livekitSession load as lazy chunks. The logger now honors the Logs tab's saved minimum level at startup (applyStoredLogLevel with the legacy-key migration moved into lib/preferences.ts) and re-applies it live on pref changes. Dead code: remove unreachable VoiceChannel.ts (superseded by ChannelSidebar's renderer) and its test, plus all knip-flagged unused re-exports in message-list/renderers.ts and ConnectPage's unused form types — knip is now clean apart from pre-existing config hints. Tests: +12 (navigation guard incl. stale-mount discard; logger startup pref, migration, and live re-apply); ptt/stored-appearance updated for dynamic-import plumbing only. Full suite 3593 passing; typecheck, lint, and production build clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * perf(db): split SQLite into single-writer + multi-reader connection pools The entire server serialized on one SQLite connection: every read queued behind every other read and every write, throwing away WAL's concurrent-reader capability. File-backed databases now open two pools from a DSN that carries all seven PRAGMAs as per-connection _pragma parameters (an Exec'd PRAGMA only configures one arbitrary pooled connection — moving them into the DSN is what makes >1 connection safe, foreign_keys included): a single-connection writer with _txlock=immediate, and a reader pool sized max(4, NumCPU). In-memory databases keep the exact historical single-connection behavior, which preserves every :memory: test site and the connection-scoped PRAGMA-toggle tests untouched. Routing lives in a dbtx router implementing sqlc's DBTX: statements go to the reader only when provably read-only (leading SELECT/PRAGMA after skipping comments — necessary because sqlc routes INSERT/UPDATE/DELETE ... RETURNING through QueryRowContext/QueryContext, which must stay on the writer); Exec, transactions, migrations, ANALYZE, VACUUM INTO, and the SQLDb() escape hatch all pin to the writer. Every former sqlDB reference across the package was re-pointed deliberately. New pool_test.go pins the properties the split must preserve on a file-backed DB: foreign_keys=1 across many reader connections, WAL journal mode, FK enforcement through both write paths, 8x8 concurrent reader/writer hammering with exact row counts, and a read completing against the pre-tx snapshot while a write transaction is open — the property this change exists to unlock. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * test(client)+chore: split the two largest test files; eslint 10; audit clean Split tests/unit/ws.test.ts (3340 lines) into ws-cert / ws-reconnect / ws-messaging / ws-lifecycle plus a shared helpers/ws-mocks.ts module, and tests/unit/audio-pipeline.test.ts (2547 lines) into core / gain / vad-worklet / vad-fallback files. Test bodies moved verbatim; the suite count is unchanged at 3593 passing. Upgrade eslint 9 -> 10 (with @eslint/js 10; typescript-eslint's peer range already covers v10, flat config unchanged, zero new findings) and pin test-exclude ^8 via the existing overrides block so the coverage chain picks up patched glob/minimatch/brace-expansion. npm audit: 8 high -> 0 vulnerabilities. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * refactor(server): split remaining large files; dependency hygiene notes Split ws/coverage_boost_test.go (2856 lines) into coverage_helpers / chat / voice / voice_lifecycle / misc test files — bodies verbatim, 746 passing tests before and after. Split service/message.go (781) into message_crud / message_reactions / message_query / message_perms with types and the constructor staying put, and ws/serve.go (754) into serve / serve_pumps / serve_auth / serve_ready. Dependency findings (no changes needed): coraza-coreruleset's stale Feb-2024 pseudo-version is unreachable from our code — it enters the module graph only through coraza's own internal tests, and our WAF uses inline directives, never the CRS (fresher rules would require adopting the /v4 module and rewiring the WAF config — deliberate follow-up, not hygiene); gogo/protobuf is likewise graph-only via the livekit SDK and never built into our binaries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * style: satisfy golangci-lint modernize/staticcheck in new pool and audit code CI's golangci-lint pass (not run locally until now) flagged the Phase 3/4 additions: range-over-int loops, interface{} -> any on the dbtx router, WaitGroup.Go in the pool tests, and a De Morgan simplification in isReadOnlySQL's identifier-boundary check. Pure style — verified against the same golangci-lint v2.11.3 binary CI uses (0 issues) and re-ran db/ws race + deadlock suites green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu --------- Co-authored-by: Claude <noreply@anthropic.com> * feat(waf) + fix(deps) + test(ws): OWASP CRS, Dependabot fixes, sleep-free ws tests (#1287) * fix(deps): clear quick-xml RUSTSEC advisories in Tauri lockfile cargo-audit identified the two Dependabot alerts on the default branch: quick-xml 0.37.5 and 0.38.4 both carry RUSTSEC-2026-0194 (quadratic runtime on duplicate-attribute checks) and RUSTSEC-2026-0195 (unbounded namespace allocation DoS), fixed in >=0.41. Both were transitive: plist 1.8.0 (via tauri) and tauri-winrt-notification 0.7.2 (via notify-rust). Semver-compatible updates fix both — plist 1.10.0 moves to quick-xml 0.41, and tauri-winrt-notification 0.7.3 drops quick-xml entirely. cargo-audit is now clean of vulnerabilities; the remaining 20 informational notices are the unmaintained GTK3-binding crates inherent to Tauri v2 on Linux. Verified plist compiles against quick-xml 0.41 (full Tauri build needs the GTK/WebKit system libs CI installs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * feat(waf): layer the maintained OWASP Core Rule Set onto the WAF The WAF previously ran six inline directives only — the CRS never loaded (the old coreruleset dep was a stale graph-only pseudo-version). A second Coraza engine now loads the embedded CRS from coraza-coreruleset/v4 (v4.25.0), layered on top of the inline rules, which stay byte-identical and keep blocking exactly as before. CRS ships in a new server.waf_crs_mode knob (off|detect|block), defaulting to detect: chat traffic is CRS-false-positive-prone (a new test pins that block mode rejects benign SQL-ish chat prose at the default threshold), so operators get rule-match visibility via structured logs first and opt into blocking after tuning. Setup mirrors the official connector: Host/Transfer-Encoding restored to the transaction (else 920280 fires on everything), phase 2 always runs so query-string attacks are scored, PUT/PATCH/DELETE added to the CRS method policy for this REST API, body limits matched to the app's 1 MiB cap with uploads excluded from body access and the content-type policy. Also fixes a latent middleware bug: the body was previously swapped for the buffered reader even when nothing was buffered, which would have handed body-access-off routes an empty body; now pinned by a test across all modes. Adds waf_crs_test.go (load, mode wiring, XSS/traversal detection without blocking, block-mode blocking + benign passthrough, upload body preservation); waf_test.go passes unmodified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * test(ws): replace fixed sleeps with condition-based waits The ws suite paced async hub effects with 537 fixed time.Sleep calls — slow at best, flaky under load at worst. They are now condition-based: a small waitFor/waitRegistered/waitClientCount/waitMsgOfType helper set (waitRegistered exploits the hub's in-order client-event processing), plus blocking decode-scans for the DM tests. The bulk deletion is grounded in verified production facts, unchanged by this commit: sendMsg is a synchronous buffered send (error replies are already buffered when the handler returns), the voice control / rollback / cleanup / sweep paths are synchronous, and serve.go registers the client before writing the ready frame. Absence assertions were deliberately NOT inverted into polling — they keep bounded windows, each commented. 20 sleeps remain, all justified in place: poll intervals inside condition loops, absence windows, clock-granularity pacing, and the event-pruner's inherently time-based no-prune-after-cancel assertion. Suite: 746 tests before and after; 62.6s -> 46.1s (30s of the remainder is GracefulStop's hard-coded production 5s drain, out of scope here); race flake check passes 3 consecutive iterations; deadlock pass and golangci-lint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu --------- Co-authored-by: Claude <noreply@anthropic.com> * fix: audit-driven fixes — client leaks/lazy-load, WAF detect logging, audit shutdown race (#1288) * fix(waf,db): aggregate CRS detect-mode logging; make audit Stop await goroutine exit WAF detect mode wired logCRSMatch as the engine-level error callback, which fires one slog.Warn per matched rule on the request goroutine. In the default detect mode ordinary chat prose trips several CRS SQLi/XSS rules plus anomaly scoring, so each request logged a burst of Warn lines in the hot path. Aggregate per request from per-transaction state instead of the shared global callback: in the default detect path leave the engine error callback nil and, in the existing crsTx defer, emit at most one Warn per request that had matches (count + highest-severity rule), demoting the full rule-id list to Debug. Block mode keeps per-rule logging (blocked requests are rare and their detail is wanted), and a caller-supplied onCRSMatch callback keeps per-rule delivery so existing tests stay unmodified. Detection, interruption, and body handling are unchanged — only the detect-path logging shape. The audit writer's Stop selected between <-done and <-ctx.Done(); on a slow flush the 5s ctx could win, returning while run() was still flushing. main.go's LIFO defers then closed the DB pool under a live flusher, losing audits. Stop now always waits on done (the goroutine has stopped touching the store) while ctx bounds only the drain inside run() via a published stopCtxDone channel, so a slow store delays shutdown by at most one in-flight flush and the pool is never closed under a live writer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu * fix(client): plug listener leaks, guard lazy livekit load, honor saved log level Follow-up audit of the recently-landed lazy-livekit and session wiring found three real issues: - clearAuth unconditionally dynamic-imported livekitSession to call leaveVoice on every logout, pulling the ~531 kB livekit chunk into the logout path even when no voice session was ever active. Guard the import on an active voice session (currentChannelId set and status not idle) and add a .catch so a failed teardown import can't reject unhandled. - The onStateChange handler unsubscribed session listeners only on the ready transition, not on disconnected; user_update and ready listeners registered per session were never collected for cleanup. Collect them into a sessionUnsubs array cleaned up on both ready and disconnected, preventing duplicate handlers accumulating across reconnects. - The Logs tab min-level select ignored the persisted log level when no explicit dropdown preference was saved. Add logger.getLogLevel() and default the select to it so the UI reflects the level actually in effect. Also add .catch to the ptt setMuted dynamic import. New unit tests cover the clearAuth guard, getLogLevel, and the LogsTab default. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(waf): load embedded OWASP CRS ruleset correctly on Windows (#1289) The CRS WAF engine failed to initialize on Windows, taking the whole api package's test suite red there. coraza's seclang parser resolves Include globs through path/filepath: for every match of `Include @owasp_crs/*.conf` it calls filepath.Join(currentDir, match), which on Windows rewrites the forward slashes to backslashes. It then feeds names like `@owasp_crs\REQUEST-901-INITIALIZATION.conf` back into the root fs.FS. That FS is the ruleset's embed.FS, which is always forward-slash and rejects a backslash name, so newCRSWAF returned "file does not exist" and no CRS rule under a subdirectory was ever loaded. Wrap coreruleset.FS in a small slash-normalizing fs.FS (Open/ReadFile/ReadDir/ Glob) that converts backslashes to forward slashes before delegating. This fixes CRS loading on Windows without patching coraza or the ruleset module and is a no-op where the separator is already "/". The Linux-only local verification for the CRS work missed this because coraza never emits backslashes there. The new test reproduces the failure mode on any OS by constructing the exact backslash name coraza produces on Windows: the raw ruleset FS fails to read it, the wrapper resolves it, and a forward-slash path still works. Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu Co-authored-by: Claude <noreply@anthropic.com> * fix(e2e): repair the Playwright suite so the CI job stops timing out (#1291) The Client E2E CI job never completed: every run hit its 25-minute cap and was cancelled. ~229 of the 255 web tests were failing, all cascading from the shared login helper, and 255 tests x 3 attempts x 20-45s of timeout burn on 1 worker deterministically exceeds the cap. Root cause: the e2e Tauri mock predates the Rust HTTP TOFU proxy. api.ts now awaits invoke("start_http_proxy") and builds REST URLs as http://127.0.0.1:{port}/api/v1/..., but the mock's invoke returned null for the unstubbed command, so every URL got a literal "null" port and Request construction threw before the mocked plugin:http transport was consulted. Login rejected, [data-testid='app-layout'] never mounted, and every logged-in test burned its full timeout. Stubbing start_http_proxy with any numeric port fixes the cascade because route matching is substring-based. The tail of failures after that fix were tests asserting behavior the app intentionally changed: - The ready payload can no longer pre-connect the local user to voice: the dispatcher treats "self in ready.voice_states while idle" as stale state from a reload and immediately leaves. MOCK_VOICE_STATE now seeds remote users only (2, 3), and widget tests join through the real click path via a new joinVoiceChannelByName helper. - The mock's voice_join reply no longer includes a voice_token: a token starts a real LiveKit session that deterministically self-destructs in the browser mock (E2EE key exchange timeout ~15s / connect-refused retries), tearing the widget down mid-test. These web tests validate the WS/UI layer only; real LiveKit is covered by the native suite. The reply also gained the full VoiceStatePayload shape — the sidebar renders user.username directly, and the omitted field broke the whole voice-user list render. - Message-load failure now renders an inline region error + Retry instead of a toast (UX spec 2), so the toast specs assert the inline UI and get their auto-dismiss vehicle from the delete-confirmation toast. CI hardening so a future systemic breakage can never burn the full cap again: maxFailures 20 and a 20-minute globalTimeout in CI (Playwright now self-terminates with a usable report instead of being SIGKILLed), with the workflow's timeout-minutes 25 as the outer backstop. The job stays continue-on-error until it has proven stably green across a few pushes; the ci.yml comment documents that flip trigger. Full suite: 255/255 passing locally (~7.5 min at 1 worker, ~4 min at 2). Unit tests (3598), typecheck, and prettier all clean. Claude-Session: https://claude.ai/code/session_01BJM9kF4JBhRHEqtcv3sasu Co-authored-by: Claude <noreply@anthropic.com> * feat(admin): first-run setup wizard with config.yaml write-back + LiveKit auto-download (#1290) * feat(admin): first-run setup wizard with config.yaml write-back Turn the single-screen owner-account setup into a guided multi-step wizard so non-technical operators never have to hand-edit YAML: - config: new comment-preserving config.Save (yaml.Node round-trip, atomic temp+rename write, verified loadable before replacing the file) plus a shared config.DefaultPath. Persists the runtime-generated LiveKit credentials so voice tokens survive restarts. - admin: POST /admin/api/setup accepts an optional "wizard" object (server name, MOTD, registration, port, TLS mode/domain, upload limit, voice quality). Values are validated before the account is created; DB settings and config.yaml are written after; failures downgrade to warnings so the created owner is never orphaned behind a 5xx. When a startup-only value changed the server restarts itself (reusing the backup/update restart machinery) and returns the new admin URL. - admin: GET /admin/api/setup/status now returns secret-free prefill defaults while setup is pending. - admin panel: six-step wizard UI (welcome, account, server basics, uploads & voice, access, review) with plain-language explanations, a restart/reconnect screen, and a "skip" path that keeps the legacy account-only flow byte-for-byte. - legacy payload {username,password} and all existing call sites keep working (SetupOptions is a trailing variadic parameter). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB * fix(lint): satisfy modernize — any over interface{}, new(expr) over ptr helper Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB * feat(voice): auto-download the LiveKit server binary Voice now works with zero manual setup: when voice.auto_download_livekit is enabled and no voice.livekit_binary is configured, the server fetches the pinned livekit-server release (v1.13.5, overridable via voice.livekit_version) from the official LiveKit GitHub releases in the background at startup, verifies it against the release's checksums.txt, extracts it into data/livekit/, and manages it as the existing companion process (crash recovery, health checks, graceful shutdown). - ws: new livekit_download.go — pinned version, per-platform asset mapping (linux/windows × amd64/arm64/armv7, matching LiveKit's goreleaser config), size-capped downloads, hash verification and extraction through one open handle (TOCTOU-safe), O_EXCL staging, atomic rename, stale-version cleanup. LiveKitProcess.Start resolves the binary asynchronously with retries so boot is never blocked. - config: voice.auto_download_livekit + voice.livekit_version; enabled in the generated default config so fresh installs get working voice out of the box, while the compiled-in default stays off for existing configs. config.Load now loads the default file it just wrote, so the first boot runs with exactly the configuration the file documents. - wizard: "Voice chat" toggle (on by default) in the Uploads & voice step; the choice is written to config.yaml and factored into the restart decision. - docs: livekit-setup, server-configuration, deployment, README. Verified end-to-end against the real v1.13.5 release: download, checksum match, extraction, and process spawn all succeed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB * chore: remove stray server.log, ignore local run logs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(voice): desktop-client origins on LiveKit proxy + client version bump to alpha.5 + release version guard (#1293) * fix(voice): accept the desktop client's webview origins on the LiveKit proxy The desktop client's chat connection goes through its Rust proxy, which sends no Origin header, so the safe-default empty allowed_origins never blocked it. The LiveKit JS SDK's signal requests and validate probes, however, are issued directly from the webview and carry its fixed origin (http(s)://tauri.localhost on WebView2, tauri://localhost on WKWebView/WebKitGTK). isOriginAllowed treated those as cross-origin and returned 403, so on every default install voice failed for any desktop client that wasn't on the server machine — chat worked, voice didn't, with /livekit/rtc/v1 403s in the server log. Treat these fixed first-party origins as always allowed. This is the same trust already extended to absent-Origin requests: web content can never present them (browsers resolve *.localhost to loopback and cannot reach the tauri:// scheme), so the CSRF surface is unchanged. Exact, case-insensitive matching only — lookalikes (tauri.localhost.evil.com, tauri.localhost:8080) still require an explicit allowlist entry. Operators no longer need to hand-add these origins to server.allowed_origins for voice to work; that list is now only for web/browser clients. Docs and the generated config comment updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB * chore(client): bump version to 1.1.0-alpha.5 The v1.1.0-alpha.4 release shipped client artifacts still versioned 1.1.0-alpha.3 because the client manifests were never bumped — deployed desktop clients therefore consider themselves up to date and never auto-update. Bump package.json, package-lock.json, tauri.conf.json, Cargo.toml and Cargo.lock to 1.1.0-alpha.5 so the next release's clients update normally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB * ci(release): fail the release when client version does not match the tag Guards against the v1.1.0-alpha.4 mistake recurring: a new verify-versions job compares the pushed tag against tauri.conf.json, package.json and Cargo.toml and fails before any build starts; every build job now depends on it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018iHyK5WtjSQgjubTegSrUB --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(admin): allow API-token principals to use the SSE log stream (#1294) The log stream was session-only: POST /admin/api/logs/ticket required a *db.Session in the request context (deliberately nil for API-token principals), and the stream handler re-validated the ticket hash against the sessions table alone. API tokens could reach every other /admin/api/* route but not the log stream, breaking the mcp-introspect server_logs tool that docs/mcp-introspect.md documents as working. Bind tickets to the hash of whichever bearer credential authenticated the request, and resolve it in the stream handler via auth.ResolveTokenHash — the same session-first, API-token-fallback path the admin middleware uses. Ban, role demotion, and mid-stream revocation of either credential kind cut the stream exactly as before. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(voice): treat the server's own origin as same-origin on the LiveKit proxy (#1295) A page served by the server itself (e.g. a browser client at https://<server>:8443) chats fine but cannot join voice: browsers attach the page origin to every WebSocket handshake, and the LiveKit proxy's hand-rolled isOriginAllowed only recognized "no Origin" as same-origin, so the RTC upgrade 403'd while same-origin fetches (which omit Origin) succeeded — /livekit/rtc/v1 403s with validate flipping 403/200 in the server log. Allow an Origin whose host equals the request Host, mirroring websocket.Accept's default same-origin policy that the chat WS endpoint already applies — which is exactly why chat worked and voice didn't. Web content on another origin can never present this origin (the browser pins it), so the CSRF surface is unchanged. Same host on a different port remains cross-origin and denied. Also log rejected origins on the 403 path (origin, path, remote) — this failure was previously undiagnosable from the server log, which recorded the 403 but not the offending origin. Existing allowlist tests used origins colliding with httptest's default request host (example.com), which the new semantics correctly treat as same-origin; their fixtures now use distinct hosts so they keep exercising the allowlist path. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(release): strip bundled libwayland from Linux AppImages (white screen on Arch) (#1297) linuxdeploy bundles the Ubuntu 22.04 runner's libwayland-{client,cursor, egl,server} into the AppImage, and AppRun forces them onto LD_LIBRARY_PATH. On hosts with newer Mesa (Arch, Fedora), EGL init dlopens libwayland-client, hits the stale bundled copy, and fails with "Could not create default EGL display: EGL_BAD_PARAMETER. Aborting..." - WebKit's web process dies and the window stays white. Reproduced in an Arch container with the published alpha.5 aarch64 AppImage (identical stderr to the field report); the same image renders normally on Ubuntu 24.04, and removing the four bundled libwayland libs makes it render on both. WEBKIT_DISABLE_COMPOSITING_MODE=1 does NOT help (tested). Add scripts/strip-appimage-bundled-libs.sh and run it in both Linux release jobs after the Tauri build: strip the libs, repack with appimagetool, regenerate the updater tar.gz, and re-sign both artifacts with the Tauri updater key. Every supported distro ships libwayland at or above the 1.20 the client links against, so the host copy is always the right one. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(client): send the session bearer token when fetching attachments (#1298) Uploaded images rendered only as loading placeholders: the server's /api/v1/files/{id} endpoint requires a Bearer token (it enforces per-channel ACLs), but the client's attachment image fetch and file download never attached one, so every request came back 401 and the placeholder was never replaced. Server-hosted attachment fetches now go through fetchServerFile, which routes through the cert-pinned TOFU proxy with the session token from the auth store. The token is only ever sent to the configured server host — external image URLs keep a plain, credential-free fetch. Claude-Session: https://claude.ai/code/session_018tt1rh32f75EAtad6qLraa Co-authored-by: Claude <noreply@anthropic.com> * fix(client): enable microphone/camera detection on Linux (WebKitGTK) (#1299) On Linux no audio or video devices were ever detected: WebKitGTK ships with enable-media-stream and enable-webrtc off, and wry installs no permission-request handler on its webkitgtk backend (unlike macOS, where it auto-grants media capture), so WebKit's default denies every getUserMedia/enumerateDevices request. Add a Linux-only setup hook that turns both settings on for the main window's webview and grants WebKitUserMediaPermissionRequest and WebKitDeviceInfoPermissionRequest. All other permission request types still fall through to WebKit's default deny. The webkit2gtk crate becomes a direct dependency, pinned to the exact version wry already links (=2.0.2, v2_38 for enable-webrtc), so the binary's native library footprint is unchanged — the AppImage bundle set stays identical and the libwayland strip step from #1297 is unaffected. Claude-Session: https://claude.ai/code/session_018tt1rh32f75EAtad6qLraa Co-authored-by: Claude <noreply@anthropic.com> * feat(client): kick to login and reset call state on server shutdown (#1300) When the server shut down, connected clients stayed on the main page in an endless "Reconnecting..." loop, and a live call's webcam/screenshare toggles kept whatever state they had. The server already broadcasts server_restart with reason "shutdown" from hub.GracefulStop before closing connections — the client just ignored the reason. The dispatcher now treats reason "shutdown" as terminal: it signs the user out (clearAuth), which navigates back to the login screen, leaves the voice session — stopping any live camera/screenshare tracks — and resets all call settings (camera, screenshare, mute, deafen, channel) to their normal state. Other restart reasons (update, setup, backup_restore) keep the existing countdown-banner + auto-reconnect behavior. clearAuth gains a LogoutReason so the logout wiring can tell a server-initiated kick from a user logout or invalid-token path: on "server_shutdown" the saved credential is kept (the token is still valid), so profiles with auto-login reconnect on their own once the server comes back, instead of losing their stored login on every server restart. The main page also skips the restart countdown banner for shutdown notices since the page unmounts immediately. Claude-Session: https://claude.ai/code/session_018tt1rh32f75EAtad6qLraa Co-authored-by: Claude <noreply@anthropic.com> * fix(client): credential fallback store on every OS, not just Windows (#1301) Credential saves still failed outright on machines where the OS keychain does not round-trip — most commonly a Linux desktop with no Secret Service provider (no gnome-keyring / KWallet, e.g. a bare window manager) and a locked macOS Keychain. The verified-write fallback introduced for the 2026-07 keyring regression existed on Windows only; on macOS and Linux secret_store::set returned an error and nothing was persisted, so logins and the voice-E2EE identity key vanished on every restart. The fallback now engages on every desktop platform, under the same rule as before: only after a keychain write has provably failed to round-trip, with the OS credential store taking over again the moment it recovers. Windows keeps DPAPI. macOS/Linux entries are sealed with ChaCha20-Poly1305 (via ring, already in the tree) under a per-install random key file written owner-only (0600) to the app data dir; the account name is bound in as AEAD associated data, mirroring the DPAPI entropy, so a blob cannot be moved between entries. Secrets at rest are never plaintext, and a copied fallback store is useless without the key file beside it. The shared set/get fallback path is now platform-neutral with only the sealing primitive per-OS, Backend gains an EncryptedFile variant, and fallback_crypto ships round-trip, AAD-mismatch, tamper, nonce uniqueness, and key-file permission tests that run in CI. Claude-Session: https://claude.ai/code/session_018tt1rh32f75EAtad6qLraa Co-authored-by: Claude <noreply@anthropic.com> * fix(voice): keep stream audio playing when the user mutes/deafens (#1302) Muting yourself in a call (which the deafen control also engages — deafen forces mute) silenced the audio of any screen-share stream being watched: the deafen path unsubscribed every remote audio publication, including ScreenShareAudio tracks, and the subscribe-time guard blocked new stream-audio tracks the same way. Muting/deafening yourself gates voices, not the content someone is streaming. Both paths now exempt ScreenShareAudio: the stream's audio keeps playing while the user is muted or deafened, and remains controllable through its own per-tile mute button and volume slider. Microphone (voice) audio is still fully unsubscribed on deafen exactly as before. The mic-mute path itself never touched incoming stream audio (verified against livekit-client: setMicrophoneEnabled, RemoteParticipant.setVolume and the audio pipeline are all scoped to the Microphone source) — the coupling was only ever the deafen subscription sweep. Claude-Session: https://claude.ai/code/session_018tt1rh32f75EAtad6qLraa Co-authored-by: Claude <noreply@anthropic.com> * feat: Discord-parity quick wins (blocks UI, topics, role colors, profile popup, temp bans, archived filtering) (#1303) * feat: Discord-parity quick wins — blocks UI, topics, role colors, profile popup, temp bans, archived filtering Adds docs/plans/discord-parity.md (full gap analysis vs Discord free/Nitro, phased plan) and lands phase 1 — the six features where one side already existed and the other was never finished: - Block/unblock from the client: PUT/DELETE /blocks/{userId} were server-only; the member context menu now offers Block (with confirm) / Unblock to every user, admin actions stay role-gated. New setUserBlockedByMe store helper. - Channel topics end-to-end: topic now ships in the WS ready payload (protocol.md updated), renders live in the chat header, and is editable in the client's Edit Channel modal (PATCH already supported it). - Role colors from server data: member list groups and message username colors now use roles.color from ready (with theme-var fallbacks) instead of a hardcoded 4-name switch; custom roles render their own groups, and members with an unknown role render in a gray group instead of vanishing. - Profile popup mounted: left-clicking a member opens the existing UserProfilePopup (previously dead code); its Message button starts a DM. Action buttons without handlers are no longer rendered. - Temp bans: PATCH /admin/api/users/{id} accepts ban_duration_hours (1..8760) feeding the existing BanUser expiry plumbing; ban menu gains a duration selector (Forever/1h/1d/7d/30d). - Archived channels actually hide: VisibleChannelIDs now skips archived refs, so REST list, ready payload, and replay filtering all exclude them; archiving live-syncs connected clients via RefreshChannelVisibility. The admin panel still lists archived channels for unarchiving. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * fix(lint): rewrite visibility if-else chain as switch (gocritic ifElseChain) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR --------- Co-authored-by: Claude <noreply@anthropic.com> * feat: Discord-parity phases 2–6 (moderation, mentions, markdown, roles, social) (#1304) * feat: parity phase 2 — moderation depth (live permission bits, voice moderation, purge) - Admin perimeter now admits any role holding a moderation-capable bit (AdminPerimeter mask); each route group re-checks its own bit: channels/overrides -> MANAGE_CHANNELS, audit log -> VIEW_AUDIT_LOG, settings -> MANAGE_SERVER, force-logout -> KICK_MEMBERS. Ban and role assignment authorize inside ModerationService (BAN_MEMBERS / MANAGE_ROLES). New GET /admin/api/me lets the panel hide tabs and row actions the caller cannot use; the desktop member-list menu gates on permission bits from the ready role list instead of role names. - Hierarchy beyond ban: ChangeUserRole requires the actor to strictly outrank the target and refuses to assign a role at or above the actor's own position (closes "any admin can promote anyone to Owner"); ForceLogout enforces the same rule. - Voice moderation on MUTE_MEMBERS: voice_mod_mute/deafen/move/kick WS commands (bit + strict outrank, 5/s rate limit, audit-logged). voice_states gains server_muted/server_deafened, carried on voice_state; server mute is enforced at the SFU via LiveKit MutePublishedTrack and the target's own unmute attempts are refused with SERVER_MUTED/SERVER_DEAFENED. Move/kick run the hub voice-leave routine then send voice_moved (client rejoins through the normal join path) or voice_disconnected. Client voice-row menu grows a moderation section gated on the bit. - Bulk delete: POST /api/v1/channels/{id}/messages/purge {limit 1-100, before?} gated on READ|MANAGE_MESSAGES, soft-deletes preserving tombstones, one message_purge audit row, fans out a single chat_bulk_deleted broadcast. Channel context menu gains "Purge Messages…" for holders of MANAGE_MESSAGES. - Honest kick semantics: the session-revoking "Kick" action is renamed Force Logout in the client and admin panel (endpoint unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * fix(lint): use slices.Contains in voice moderation tests (modernize) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * fix(test): widen the occupied pre_restore window in the abort-restore test The test blocked the safety backup by occupying pre_restore_<ts>.db names for the next 4 seconds; on slow Windows CI runners the request outlived the window and the restore succeeded, failing the 500 assertion. Occupy two minutes of candidates instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * feat: parity phase 3 — real mentions (server resolution, badges, notifications, autocomplete) - Mentions resolve server-side at send time: whole-word @username parsing (address-shaped text rejected), case-insensitive against unique usernames, 20-mention cap; stored in message_mentions in the same writer transaction as the message. chat_message/chat_edited and REST history/pinned/search carry mentions + mentions_everyone. - New MENTION_EVERYONE permission (bit 21, seeded to Owner/Admin/Moderator) gates @everyone/@here; never honored in DMs. @here skips offline users. Fan-out respects per-channel read permissions and skips users who blocked the author. - read_states.mention_count is live: incremented on insert (never on edit), zeroed by channel_focus, shipped per channel in ready. - Client: mentions highlight only when they resolve; mentioning the current user accents the whole row; #channel-name renders a navigating chip; channels show a red mention badge that outranks the unread badge; notifications say "X mentioned you in #channel" and the suppress-@everyone pref now suppresses only honored everyone-mentions; the composer gets an @-autocomplete popup (prefix-ranked, keyboard-driven, @everyone/@here offered only with the permission). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * feat: parity phase 4 — markdown rendering, message navigation, reactions/media/read-state polish - Discord-flavored markdown via a tokenizer (message-list/markdown.ts): bold/italic/underline/strike/spoiler with nesting, escaping and a word-boundary rule keeping snake_case literal; line-start quotes, headings, lists; masked links restricted to absolute http(s) + isSafeUrl (rejects render as literal source); language-tagged code fences with a hand-rolled highlighter (no new dependency); markdown is inert inside code. Renderer stays a strict DOM builder — no innerHTML. Composer gains Ctrl+B/I/U wrapping. - Message navigation: GET /channels/{id}/messages/around/{messageId} (half-before/half-after window, has-more flags via over-fetch); detached-window support in the messages store with a "Jump to Present" pill; search/pin jumps fetch the window when the target isn't loaded; reply previews are clickable; "Copy Message Link" + owncord://message/{channel}/{message} deep-link route; pasted message links render as jump chips. - Who-reacted: GET .../reactions/{emoji}/users (100 cap) + hover tooltip with per-message+emoji cache invalidated on reaction_update. - Inline media: video/audio attachments render native players from MIME allowlists (unknown containers keep the download chip); SVG stays out. - Read-state polish: NEW-messages divider, explicit Mark as Read / Mark All as Read, DM unread count badges (real counts shipped in ready instead of a dot; DM mention counts survive reconnect). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * feat: parity phase 5 — role CRUD, per-user overrides, override matrix, client channel management - Roles are real entities: /admin/api/roles CRUD + reorder behind MANAGE_ROLES, with all rules in a new RoleService measured against the actor's position (only strictly-below roles may be touched; never grant a bit your own role lacks; seeded Owner immutable; default role undeletable — deletion reassigns members, drops its overrides, and invalidates exactly the moved members' cached perms in one writer transaction). Case-insensitive unique names (migration 023), normalized colors, roles_update broadcast keeps clients current, and both admin surfaces stopped hardcoding the four seeded roles. A new ASCII guard test protects sqlc-generated SQL from a byte/rune offset bug that silently splices queries when comments contain non-ASCII. - Per-user channel overrides (migration 024): resolution is now base -> role override -> user override with one implementation (EffectiveChannelPerms); both layers load in two batch queries behind every visibility/permission site, per-role visibility memoization removed (two members of one role can now differ), and the @everyone fan-out honors user-layer allow and deny. Admin REST + full tri-state override matrix UI (role or user per channel) replace the single "Can access" checkbox; the visibility-agreement test grew a same-role different-overrides case. - Categories stopped being magic strings: any channel type under any free-text category (server + client validation removed), category editable everywhere with datalist suggestions, voice channels group under their real category. - Desktop channel management: Edit Channel gains slowmode presets, NSFW toggle, and voice user/video limits (bounds-checked server-side, broadcast on channel_create/update via one shared constructor); NSFW channels show a per-session age-gate overlay; VIEW_AUDIT_LOG holders get an Audit Log entry point opening the admin panel at #audit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * feat: parity phase 6 — custom emoji, profiles & presence, group DMs, DM calls, channel mutes - Custom emoji end-to-end: the dormant emoji table gains a mime column and real routes (list/upload/delete + authenticated image serving, MANAGE_SERVER-gated, 512KiB / 128px caps validated against sniffed bytes, SVG refused, 200-emoji cap, audited, emoji_update broadcast). :shortcode: renders inline (jumbo when emoji-only, never in code), the picker gains a Server category, the composer a :-autocomplete, reactions accept and render custom emoji, and the admin panel gets an Emoji section. - Profiles: avatar upload (sniffed, capped, served authenticated) with one shared client avatar helper replacing letter-initials everywhere; display_name (heading with @username handle preserved for mentions), about, and custom_status columns with sanitized bounds; user_update broadcast keeps clients current. - Presence: invisible is a real stored status collapsed to offline for every other viewer at every serialization site (owner sees truth); connect no longer force-stamps online (idle/dnd/invisible survive reconnect — the flash-online bug is gone); auto-idle after 10 minutes of inactivity that never overrides a manual status. The @here fan-out now collapses status first so invisible users are not pinged. - Group DMs: channels.is_group discriminator; create (2-8 others, bidirectional block checks), rename (participants only), leave (channel deleted with the last participant); per-viewer dm_channel_open payloads; stacked-avatar rows, multi-select member picker, participant headers; 1:1-only composer block gating. - DM calls: call_ring/call_decline signaling over existing DM voice (no new call state), Call button in DM headers, incoming-call banner with accept/decline/30s timeout and chime. - Per-channel mutes (client prefs): muted channels/DMs stay silent for non-mention noise (badge dims, mentions still notify), managed from context menus and the Notifications tab. The dead Friends nav item is removed as the plan prescribed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR --------- Co-authored-by: Claude <noreply@anthropic.com> * Pre-release review fixes + v1.2.0-alpha.1 prep (#1305) * fix(review): pre-release security & performance fixes for the parity work Security: - Channel-override endpoints (role + per-user) now enforce grantability: a MANAGE_CHANNELS holder can no longer grant itself or a user a permission bit its own role lacks, and the role-layer endpoint refuses targeting a role at or above the actor's position (Administrator bypasses). Closes a privilege-escalation path opened when the override routes were downgraded from ADMINISTRATOR-only. - DM voice events no longer leak: channelReadAudience resolves a DM channel's audience from its participants (intersected with connected clients) instead of the role scan, which passed every user with base READ_MESSAGES since DMs carry no overrides. A private DM call's voice_state/voice_leave now reaches only its participants. - Invisible users no longer flash online on connect: member_join carries a viewer-safe status (db.BroadcastStatus) and the client defaults a missing status to offline instead of hardcoding online. - Voice moderation can no longer reach a private DM call: voiceModTarget refuses a DM-channel target unless the actor is a participant, with the same shape as "not in voice" so nothing about the call leaks. Correctness: - Un-deafening a member now also clears the deafen-implied server mute, so the target regains the ability to unmute themselves instead of staying silenced at the SFU until a separate unmute. Performance: - IncrementMentionCounts batches its upserts into chunked multi-row statements instead of one exec per recipient, so an @everyone mention holds the SQLite writer for one exec per 500 readers instead of N. - applyMentionCounts resolves mentions against a set built once from the readers instead of a nested O(mentions x readers) scan. - The markdown parser's bracket/paren matching is computed once per line instead of rescanned at every opener, removing the O(n^2) worst case on pathological input. - Video/audio attachment blob URLs are now LRU-capped and revoked, and the attachment caches are cleared on logout, fixing an unbounded per-session Blob leak. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * chore(release): prep v1.2.0-alpha.1 Bump the client manifests (package.json, package-lock.json, tauri.conf.json, Cargo.toml, Cargo.lock) from 1.1.0-alpha.5 to 1.2.0-alpha.1 so the release workflow's verify-versions guard passes for tag v1.2.0-alpha.1. The server version is injected via ldflags at build time and needs no bump. Add a curated CHANGELOG section for v1.2.0-alpha.1 documenting the Discord-parity feature drop (mentions, markdown, custom emoji, message navigation, role management, per-user overrides, voice moderation, profiles, group DMs, DM calls, channel mutes) and the pre-release security/performance review, plus an operator note covering the nine new migrations and the new WebSocket message types. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * perf(mentions): apply mention counts off the send path SendMessage resolved every reader and wrote the mention/@everyone badge counts synchronously after the commit but before returning, so a mention in a large channel delayed delivering the message to everyone else by the full reader-resolution chain plus the batched increment. Move that bookkeeping onto a background goroutine via an injectable dispatcher field (bg, defaulting to `go fn()`). The write already ran on a cancellation-detached context and swallowed its errors, so detaching it from the request is safe; the count is advisory, so the tiny window where a reader's channel_focus clears it just before the increment lands is harmless (matching Discord's eventual consistency). Tests read the counts synchronously right after a send, so the shared mention fixture and the ws mentions test opt into an inline runner (RunBackgroundInlineForTest / the hub's RunMentionCountsInlineForTest seam); a new test exercises the real async path by polling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * refactor(client): extract shared inline-autocomplete factory MentionAutocomplete and EmojiAutocomplete duplicated ~90 lines of identical listbox scaffolding (AbortController cleanup, suggestions/ activeIndex state, the root listbox + .ma-list, mousedown-to-choose rows, and a byte-identical arrow/Enter/Tab/Escape keydown switch), so a fix to one silently diverged from the other. Factor that into createInlineAutocomplete<T>, parameterized by the four things that actually differ: the filter, the selected value, the per-row children, and the row/root test ids + class (emoji keeps the shared mention-autocomplete base class plus its own, and only mentions prime the list on create). Both components become thin adapters that keep their existing exports — createMention/EmojiAutocomplete, the pure filter functions, and the MIN/MAX constants — unchanged, so MessageInput and every test are untouched and still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * fix(lint): drop now-unused appendChildren import in MentionAutocomplete The row rendering moved into the shared inline-autocomplete factory, so the import is no longer referenced; oxlint fails the Client Static Checks job on the unused identifier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR --------- Co-authored-by: Claude <noreply@anthropic.com> * fix(review): full-project review — hierarchy, role positions, search, clarity (#1306) From a full-codebase review (Opus security + Sonnet server/client + Haiku consistency): - Per-user channel overrides now enforce the same role-hierarchy guard the role-layer endpoint already has: a non-admin MANAGE_CHANNELS holder can no longer write or clear a per-user override against a member ranked at or above their own. Without it, because the per-user layer is last in the resolution order, a Moderator could deny a higher-ranked member the channel access their role grants. Applied to both PUT and DELETE. - CreateRole no longer places two default-positioned roles at the same position: it steps to the highest free slot below the actor and rejects an explicit position that is already taken. Colliding positions read as equal rank in every hierarchy check, so two such roles could never manage each other's members. The rank guard still takes precedence over the collision message for an at/above-rank position. - Search overlay no longer silently drops a query that arrives inside the 500ms rate-limit window (which sits above the 300ms debounce): it reschedules the search for when the window opens instead of leaving the previous query's results on screen. - Corrected a misleading TODO on chat_send attachments: they are upload UUIDs resolved by ownership at link time, not URLs, so a javascript:/data: string is never stored or rendered — a scheme check would wrongly reject valid ids. The comment now states this and the loop variable/error name say "id". Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR Co-authored-by: Claude <noreply@anthropic.com> * Test hardening: fuzzing, contract/upgrade, load, e2e (#1307) * fix(image): reject zero-dimension images in header decode FuzzImageDimensions found two inputs the emoji/image size guard accepted as valid with a nil error despite having no real dimensions: - a GIF whose logical screen descriptor decodes to height=0 via Go's own image.DecodeConfig, and - a VP8 keyframe whose size field is all zeros (VP8, unlike VP8L/VP8X, stores the size directly, so 0x0 is a validly-shaped header). Both callers compare the returned size straight against their pixel cap, so a degenerate 0-dimension header slipped through as a "small" image. Reject non-positive dimensions centrally in imageDimensions and reject zero VP8 dimensions in webpDimensions, so the invariant holds even for a caller that forgets its own bounds check. The two crashers are checked in as the fuzz regression corpus. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(fuzz): add Go fuzzers and TS property tests for parsers/validators Adds coverage on the parsers and validators most exposed to hostile input, each with a tricky seed corpus and invariant assertions: Server (Go native fuzzing): - FuzzParseMentionTokens: never panics; resolved count within cap. - FuzzSanitizeFTSQuery: output never errors against real SQLite FTS5. - FuzzValidateShortcode: accepted shortcodes match the documented charset/length. - FuzzEffectivePerms / FuzzEffectiveChannelPerms: ADMINISTRATOR implies all bits, user-deny beats role-allow, result is a subset of AllPerms. Client (fast-check property tests): - markdown tokenizer never throws and emits no script/on*/javascript: sinks, bounded time on pathological input. - mention/emoji content parsing never throws. - filterMentionSuggestions/filterEmojiSuggestions never throw and respect the caps and the MIN_EMOJI_QUERY/permission gates. The image-header fuzzer that found the zero-dimension bug landed with its fix in the preceding commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(migration): add full-chain and upgrade round-trip tests Applies every embedded migration to a fresh DB and asserts the resulting schema is coherent, then applies the full chain on top of a pre-parity (migration 019) snapshot and asserts it upgrades without error and preserves seeded rows. Protects existing operators on the v1.2.0 upgrade (9 new migrations, 020 through 028). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(protocol): assert protocol schema matches generated Go constants Asserts every wire constant in docs/protocol-schema.json has a matching generated Go constant and vice-versa, with a small explicit exception list for intentionally-undocumented internal constants. Catches the chat_command-style drift the review flagged before it reaches the wire. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(load): add hub load/soak harness with goleak verification Adds a long test (skipped under -short, run under -race in CI) that concurrently registers and unregisters 200 WS clients across churn rounds while six broadcaster goroutines fan out to the hub, then asserts via go.uber.org/goleak that no goroutines leak and no deadlock or panic occurs. Exercises the client registry, broadcast audience resolution, and the background mention goroutine under contention -- the class of bug the race detector only reveals at scale. Adds a BroadcastVoiceEventForTest seam to export_test.go for the broadcaster loop. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(e2e): add blocking parity-feature Playwright specs Adds end-to-end coverage for the v1.2.0 parity features that had none, all tagged "@parity" and driven through the existing mocked-Tauri harness (tests/e2e/helpers.ts) — 15 tests across three files: - gating-badges.parity.spec.ts: NSFW age-gate mount/continue, mention red badge (ready-payload render + live incoming-mention bump), per-channel mute toggle + localStorage persistence. - social.parity.spec.ts: group-DM create via the member picker (asserts the POST /dms/group request), group render + leave (DELETE), and Change Role via the member context menu (asserts the PATCH /admin/api/users/{id}). - emoji-voicemod.parity.spec.ts: custom-emoji ":shortcode" autocomplete + message-list <img> render, and the voice-moderation menu — both the admin-can path (asserts voice_mod_mute / voice_mod_kick ws_send) and the gated path (menu absent without MUTE_MEMBERS). The specs assert the exact outgoing HTTP/WS request where the flow is request-driven, not just DOM side effects. No product bugs were found. Adds a dedicated CI job "Client E2E (parity subset, blocking)" that runs only the @parity specs (playwright --grep "@parity") WITHOUT continue-on-error, so a regression in these features fails CI. The pre-existing full e2e job stays non-blocking, per the maintainer note that it needs a few green pushes before graduating. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR --------- Co-authored-by: Claude <noreply@anthropic.com> * More hardening: fuzz the input surface + fix mis-written tests (#1308) * fix(upload): keep sanitizeUploadFilename output a safe, valid basename FuzzSanitizeUploadFilename found two inputs the upload-filename sanitizer returned unchanged in violation of its own contract: - "/" survived verbatim: filepath.Base("/") returns "/" (root is its own basename), and the final reserved-name check only special-cased "", ".", and "..", so a path separator reached the served download name and the client's save-dialog prefill. - a name longer than the 255-byte cap was truncated with a byte slice (name[:max]), which can land mid-rune and yield invalid UTF-8 — which then misbehaves in JSON encoding, on disk, and in download-name handling. Now any residual '/' is dropped in the character filter, and truncation trims back to the last full rune so the result is always valid UTF-8. The two crashers are checked in as the fuzz regression corpus. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test(fuzz): fuzz the file/path and content/identity input surface Adds Go native fuzzers on the untrusted-input parsers/validators the first fuzzing pass didn't reach, each with a tricky seed corpus and both a never-panics and a semantic/security invariant: - storage.sanitizeFilename + resolvedPath composition (a name that passes sanitize must resolve inside the storage dir — no traversal), and storage.ValidateFileType (error iff a blocked magic prefix matches, for any header length). - plugin.validateRelativePath (accepted paths are non-absolute, separator- and traversal-free). - service.sanitizeContent: output carries no surviving <script/js:/on* sink, is length-bounded, and is idempotent (the bluemonday StrictPolicy contract). Two documented regression seeds pin the "inert plain text that merely contains the word javascript:/onclick=" non-bug. - auth.ValidateUsername / ValidatePasswordStrength — accept implies the documented charset/length. - api.validateAvatarURL (never accepts a non-https / javascript: / data: URL) and api.validateDisplayName. - ws.parseParticipantIdentity / parseRoomChannelID — never panic on adversarial LiveKit webhook strings. Each target survived active fuzzing (hundreds of thousands to millions of execs) with no crash; the one real bug found (sanitizeUploadFilename) landed with its fix in the preceding commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * test: make mis-written tests actually assert their claimed behavior A test-quality audit found tests that ran an action but asserted nothing (or asserted a tautology), so they would pass even if the code under test were deleted. Each is now wired to the real observable effect it names — no product code changed, no assertion weakened: Client (vitest): - notifications.test.ts: 19 notifyIncomingMessage tests had zero expect() calls; each now asserts the sendNotification / requestUserAttention / oscillator mock per its name (suppress vs fire, truncation, fallback title), with mockClear() so a stale call can't make it trivially green. Three catch-path tests now assert the debug log fired. One test whose title contradicted its body (and the code's guard) was renamed to match verified behavior. - livekit-session.test.ts: token-refresh test asserts the stored token and the rearmed refresh timer; the two "no active room" device-switch tests assert Room.switchActiveDevice is not called. - connection-stats.test.ts: the "start is idempotent" test now advances timers and asserts the poll callback fires once per tick (no double interval). - voice-audio-tab.test.ts: the cleanup test now actually starts a camera preview (it previously couldn't reach the camera-stop path) and asserts both mic and camera tracks are stopped. - dispatcher.test.ts: replaced an expect(true).toBe(true) with assertions on the voice-store speaking state the handler writes, incl. a control. - sidebar-area.test.ts: performs the back-navigation the test described and asserts the pre-DM text channel (not the DM) is restored. - profiles.test.ts: asserts no profile is created/mutated for a missing id. - log-persistence.test.ts: activeFlush tests assert flush sequencing, and the cleanup error test asserts the logged error. Server (Go): - db/coverage_boost_test.go: TestCreateAttachment_WithDimensions now links the attachment to a message and verifies the persisted width/height via GetAttachmentsByMessageIDs, instead of only checking a row exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR * style(fuzz): satisfy golangci-lint on the new fuzz seed corpora - Escape the raw bidi/zero-width Unicode format characters embedded in the seed strings as \u escape sequences (staticcheck ST1018) — same runes, now greppable and lint-clean. - Range over strings.SplitSeq instead of strings.Split in the relative-path fuzzer's traversal check (modernize). No change to what any seed exercises. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGozcKwpbG5GHU8e4cJYmR --------- Co-authored-by: Claude <noreply@anthropic.com> * docs(changelog): note pre-release test hardening and the two bugs it found #1307 and #1308 landed fuzzing, migration/protocol/load tests, a blocking @parity e2e job, and a test-quality audit. Two of those were real product fixes (zero-dimension image headers, sanitizeUploadFilename) that belong in the release notes, not just the test log. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(changelog): restore the alpha.5 behavioural notes dropped in the rewrite The v1.2.0-alpha.1 section replaced the v1.1.0-alpha.5 one wholesale, taking the LiveKit-proxy origin-gate and log-stream API-token bullets with it. Both fixes are in this release's code (#1293, #1294, #1295) — only their operator notes went missing, and an operator upgrading from alpha.3 would never have seen them. Restored verbatim from main. This is the sole content main had that dev lacked. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(client): gate CREDENTIAL_FALLBACK_KEY_FILE to non-Windows `cargo clippy -- -D warnings` failed the Windows Tauri build with "constant CREDENTIAL_FALLBACK_KEY_FILE is never used". Its only consumer, `fallback_crypto`, is `#[cfg(not(windows))]` (lib.rs:6) because Windows seals fallback entries with DPAPI instead — so on Windows the constant is genuinely dead and -D warnings promotes that to an error. Gated the constant to match its consumer rather than silencing it with #[allow(dead_code)], so it still trips if it ever goes dead on the platforms that do use it. Latent on dev, not introduced here: Tauri Full Build is gated on base_ref == 'main', and the fast suite only compiles Rust on ubuntu (rust-tests runs on ubuntu-22.04), where fallback_crypto *is* compiled. Nothing built the Rust lib for Windows until this dev -> main PR. Verified locally on Windows: `cargo clippy -- -D warnings` and `cargo clippy --all-targets -- -D warnings` both exit 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(voice): stop writing a credential byte to the log on bad LiveKit config CodeQL go/clear-text-logging (high, alert #13): the YAML-safety check in generateConfig rejected a bad credential with fmt.Errorf("LiveKit credential contains unsafe YAML character %q", ch) where ch is a byte taken from LiveKitAPIKey or LiveKitAPISecret. Start() wraps that error and api/router.go logs it, so a byte of the API key or secret reached the server log in clear text. The check now uses strings.ContainsAny and names the offending config field instead of echoing the byte — strictly more useful to an operator, who previously got a character with no indication of which credential it came from. Same rejection set, so behaviour is otherwise unchanged. Adds a regression test asserting the error names the field and contains no part of either credential. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(plugin): resolve UI asset paths at construction, not per request CodeQL go/path-injection (high, alerts #11 and #12): AssetHandler built the on-disk path from req.URL.Path on every request, then validated it with filepath.Rel. The validation was sound — traversal was already blocked by the manifest allowlist, the Rel check, and the serve-time Lstat — but a path was still being constructed from user input, which is the pattern the rule flags and the one that goes wrong when someone later edits the ordering. Each declared asset is now resolved and traversal-checked once, when the handler is built, into an asset-name -> absolute-path map. At serve time the request path is only ever a map key, so no filesystem path is derived from user input at all. An asset that fails validation is absent from the map and 404s, as an undeclared file already did. Also moves filepath.Abs/Join/Rel off the per-request path. The serve-time Lstat symlink and IsRegular checks stay exactly as they were — they close the post-install TOCTOU window and are still needed per request. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(plugin): constrain default-build registry tests to !wazero registry_test.go opens "Registry lifecycle tests for the default (non-wazero) build" and asserts activation fails with ErrRuntimeUnavailable, but carried no build constraint. Under -tags wazero a real runtime is linked in, so TestRegistry_Activate_ WithoutRuntime and TestRegistry_EnablePlugin_RollsBackWhenActivationFails both failed. Nothing caught it: CI builds all three tag variants but only runs tests untagged, so these have been red under -tags wazero without surfacing. Adds the //go:build !wazero the file always implied, matching the sandbox_default.go / sandbox_wazero.go split already used here. Its helpers are used by no other file, so nothing else loses coverage; the wazero build keeps its own activation tests in sandbox_wazero_test.go. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 22:06:14 +02:00
J3vbandClaude Opus 5	6258681731	fix(plugin): guard against wasm guests with no memory section (F2) ... The guest's linear memory was taken from mod.Memory() and used unchecked, so an untrusted plugin wasm with no memory section nil-dereferenced on the unrecovered startup path and crashed the server. All guest-memory access now goes through one guestMemory() helper that detects wazero's non-nil interface wrapping a nil *MemoryInstance, binding no commands at activation and returning the existing missing-export diagnostic on dispatch. Verified by a panel of agents; the added regression test panics with the finding's exact stack against the unpatched tree. Note: TestRegistry_Activate_WithoutRuntime and TestRegistry_EnablePlugin_RollsBackWhenActivationFails fail under -tags wazero, confirmed here to fail identically on the base tree. They are pre-existing and unrelated; CI builds the wazero variant but does not test it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 15:00:26 +02:00
J3vbandClaude Opus 4.8	58005c9c6f	feat(auth): revocable API tokens, introspect MCP server, and a Go 1.26 idiom pass (#1266) ... * feat(auth): add revocable API tokens (bot/service auth) Add long-lived, revocable API tokens so headless clients (the introspection MCP tool, bots, CI) can authenticate without a password. Presented as "Authorization: Bearer <token>", a token authenticates as a specific user, inheriting that user's role and permissions. - migration 018 + dedicated api_tokens table (kept separate from sessions so bulk logout and the per-user session cap never touch these); only the SHA-256 hash is stored, raw token shown once at creation - auth.ResolveTokenHash: one shared bearer resolver that both AuthMiddleware and adminAuthMiddleware now call. Sessions are matched first so existing login behavior is unchanged; API tokens are a fallback only on session miss. A DB outage is returned wrapped, never mistaken for a bad token. - `server token create|list|revoke` CLI: mints directly against the DB with no HTTP and no login — the password-free bootstrap path - tests: resolver (8 cases incl. outage-not-fallthrough), db queries (6), api middleware integration (valid + revoked token) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(tools): add owncord-introspect MCP server A local MCP dev tool that lets Claude Code introspect a running OwnCord instance: read its logs, query any REST endpoint, and tail the desktop client's log file. It is a thin wrapper over the existing API plus the client log — no new product surface. - tools/mcp-introspect/index.mjs (Node/ESM, one dep: @modelcontextprotocol/sdk) exposes api_request (full read-write passthrough), server_logs (admin SSE ring-buffer stream), client_logs (reads the desktop log file) - authenticates with an API token (OWNCORD_API_TOKEN); pins the self-signed cert and skips hostname checks (the cert has no SAN) - registered in .mcp.json (secret-free ${OWNCORD_API_TOKEN}) - un-ignore tools/mcp-introspect/ so this shared dev tool is committed, while tools/livekit-server.exe and node_modules stay ignored - docs/mcp-introspect.md: how it works, tool reference, setup, troubleshooting Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(dependencies): update and add various crate versions in Cargo.lock * feat(admin): manage API tokens from the admin panel Add Owner-gated HTTP endpoints and a UI card to create, list, and revoke API tokens from the web admin panel. Previously only the `server token` CLI could manage them, which requires shell access to the host. - POST|GET|DELETE /admin/api/tokens in admin/handlers_tokens.go, wired in admin/api.go. All three are Owner-only (ownerOnlyMiddleware, like backups/updates): an HTTP token-mint endpoint is a network-reachable credential-minting surface, and API tokens deliberately survive password change + bulk logout, so a hijacked admin session must not mint one. - Reuses the same db.*APIToken calls as the CLI; create sources the actor from request context (audits who clicked, not the bound user); the raw token is returned once in the 201 body, never stored. - Add json tags to db.APITokenListItem for snake_case wire consistency. - Admin panel: "API Tokens" nav item + create modal, show-once reveal, revoke confirm in admin/static/index.html. - Tests: 7 in admin/api_test.go (+api_tokens table in the in-memory schema). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor: modernize to Go 1.26 idioms + enable modernize linter Apply `golangci-lint modernize` autofixes across the server and enable the linter in .golangci.yml so these stop re-accumulating (they built up only because modernize was never in the config). Production code: slices.Contains for hand-rolled membership loops (api router, ws origin, db/account, plugin manifest); strings.SplitSeq for allocation-free line/segment iteration (db/migrate, updater, livekit_proxy); strings.Cut (config); fmt.Appendf (dm_handler); min() (event_pruner); any (ws client). Tests: range-over-int, t.Context(), WaitGroup.Go, slices.Sort, maps.Copy, new(expr), interface{}->any. - plugin/manifest.go parent-traversal check applied by hand: modernize skipped it (two conflicting rewrites); used the slices.Contains form. - Removed the now-dead ptr() test helper after newexpr inlined its callers. - Dropped dangling sort imports left by the sort.Slice->slices.Sort rewrite. No behavior change. All four tag variants build, full test suite is green, and golangci-lint (with modernize enabled) reports 0 issues. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-29 13:25:46 +02:00
Claude	0918f859a0	test: close measured test-coverage gaps across server, client and Rust ... Audits what actually has tests, then closes the gaps it found. Full write-up with before/after numbers in docs/audit-test-coverage-2026-07-25.md. Measurement first: `go test ./... -coverprofile` (what CI runs) instruments each package only for itself, so code exercised through another package's tests reads as uncovered — `service` reported 36.7% against a real 85%. All analysis here uses -coverpkg=./..., and both views now have Makefile targets. Features that had zero coverage at every layer: - user blocking (db + service + the /api/v1/blocks routes) - auth lockout persistence — the DB round-trip that survives a restart - plugin install/enable/disable/uninstall and the plugin KV namespace - event replay bounds (GetMaxEventSeq, PruneEventsOlderThan) - LiveKit participant_joined webhook (replayed-token guard), the room-service client, and proxyWebSocket/copyWS - ws_proxy.rs and livekit_proxy.rs — pure helpers extracted, matching the existing tofu.rs pattern, so cert-pin and header-injection checks are testable Gaps that were hidden rather than absent: - Server/admin reported 0.3% coverage with 307 tests passing. TestSpawnDetached_* re-execs the test binary; the child inherited GOCOVERDIR and the parent's stdout, clobbering the profile and printing "[no tests to run]". Now 71.4%, and CI's uploaded artifact is correct. - vitest.config.ts excluded 2.2k LOC unexplained, including two files that already had tests. Trimmed to three entries, each justified inline. - api.HandleLiveKitHealthForTest re-implemented the handler it claimed to expose, so eight call sites tested a copy. Added a hook to the real one. Two bugs found and pinned rather than silently patched: logctx.WithGroup nests req_id under the group, and drag-reorder.ts takes one listener ref per channel but releases one per sidebar, so the count never reaches zero. Coverage: client 92.93% -> 94.87% statements (3371 -> 3572 tests) even after un-excluding hidden files; Rust 47 -> 74 tests; Go zero-coverage functions ~70 -> 21, with plugin 61->77%, admin 67->86%, db 76->84%, service 85->91%. Verified: go vet, all four build-tag variants, go test -race, -tags deadlock, vitest --coverage, cargo test --lib, cargo clippy --all-targets, playwright. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AEETs3Vh6sAHHb1jMBL75g	2026-07-25 14:47:21 +00:00
J3vbandClaude Fable 5	6afa9e974c	refactor(server): thread context.Context through the db layer and all callers ... Fixes all 109 golangci-lint findings (106 contextcheck, 1 gocritic, 2 gosec) that accumulated after D2 wired dbgen (whose queries take ctx) under ctx-less db.DB wrappers while CI lint was quota-dead. No nolint comments added; every finding fixed by genuinely threading context. - db: all 138 hand-written db.DB methods take ctx first; the dbCtx() Background shim is deleted; raw Query/QueryRow/Exec/Begin use their Context variants; the four redundant ctx-less passthroughs removed. db.Auditor/WriteAudit gain ctx. - Seams: permissions.Checker (DB iface, HasChannelPerm, RequireChannelAccess) and the service.Store interface mirror the new signatures (ws.EventStore and plugin.PluginStore already did). - Callers: api/admin handlers use r.Context(); ws per-message paths use the connection ctx via DispatchV2; hub loops and startup wiring use context.Background(); service methods thread ctx where they have one and Background where no ctx exists. Public service surface reached by ctx-holding chains (PermissionService.HasChannelPerm/GetRoleForUser/ RequireChannelAccess, message/dm/block/invite/profile methods) is now ctx-first. - Detached (context.WithoutCancel) where cancellation would break an invariant, found by a 3-lens adversarial review of the diff: * voice-leave background retries (a dead webhook/connection ctx killed retry 2 before it ran, leaving ghost capacity-holding voice rows) * rollbackVoiceJoin's compensating delete (its trigger IS the cancel) * post-2FA-change DeleteOtherSessions and logout DeleteSession (the security tail of a committed change must not die with the request) * all api/ws audit writes (a banned user could suppress their own login_blocked_banned row by aborting the request mid-bcrypt) * admin backup VACUUM INTO (an interrupt left a truncated .db that the backup list presented as restorable) * post-commit message/edit refetches (a committed message must still fan out when the sender disconnects) * hub settings-cache refresh (one dead connection could pin stale values for the 30s TTL) - gocritic rangeValCopy fixed (index iteration); gosec G306 excluded in config with justification (generated source must stay world-readable) instead of flipping genprotocol output to 0o600. Verified: gofmt/vet, all four build-tag variants, full suite, deadlock pass, full -race pass, golangci-lint 0 issues uncapped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-23 17:03:52 +02:00
J3vbandClaude Opus 4.8	420eec227c	fix(plugin): serialize wazero guest calls with a per-Instance mutex ... invokeCommand drove a shared wazero module (allocate/mem.Write/command_dispatch/mem.Read) with no per-instance lock, so concurrent invocations of the same plugin command raced the module's linear-memory buffer. Add a per-Instance mutex around the guest-call sequence. Confirmed under -race. (Security scan F2) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 11:59:13 +02:00
J3vb	4dacb3cd4c	Merge pull request #1199 from J3vb/docs/plugin-critical-closure ... feat(plugin): close audit plugin CRITICALs — per-command ACL, storage/event/HTTP dispositions	2026-07-20 16:25:09 +02:00
J3vb	605f97051a	docs(audit): correct CRITICAL #4 closure — Dispatch has a live hub caller ... The closure rationale for audit finding #4 claimed in five places that nothing in the server calls EventSink.Dispatch. That is disprovable by grep: ws/hub.go:1034 calls Dispatch on every broadcast message, and api/router.go:134-139 wires h.pluginSink whenever plugins are enabled. The call site is pre-existing on main, not introduced by this branch. Restate the closure on the claim the evidence actually supports: Dispatch has exactly one caller outside the plugin package's tests (ws/hub.go, on the hub's broadcast goroutine under seqMu), but its loop body invokes no guest code and no production code calls Subscribe, so the subscriber set is always empty and no guest code executes on the event path. Finding #4 stays closed; the reason changes. Also warn on Subscribe that adding the first production caller turns Dispatch's loop live on the hub's hot path, and note in the SECURITY GATE that the call site already exists so wiring delivery is not a new integration. Corrected in: plugin/host_events.go (Dispatch + Subscribe comments), plugin/audit_closure_test.go, docs/audit-2026-04-07.md (row 4 and the structural-mitigation paragraph), docs/audit-2026-07-19.md §1 row, docs/plans/audit-2026-07-19-decisions.md D11. Comments and docs only — no behaviour change.	2026-07-20 14:36:24 +02:00
J3vb	3d2dd19001	feat(plugin): enforce manifest-declared per-command ACL ... Closes audit-2026-04-07 CRITICAL #3. Holding the `commands` capability used to bind whatever names the guest module returned from `list_commands`, so an admin enabling a plugin could not know which commands it would claim and a plugin could widen its own command surface after review. The manifest is now the authority. `plugin.json` gains a `commands` block (`[{"name": "hello"}]`) and `RegisterCommand` refuses any undeclared name — the single choke point both auto-registration and direct registration route through, so no caller can bypass it. Declared names are validated to the dispatcher's canonical lowercase form, deduplicated, and capped at 64. The object shape matches docs/plans/slash-commands.md so the richer per-command schema can land later without a manifest migration. Also pins the two neighbouring CRITICALs that verification found already closed, and adds the storage key cap host_storage.go's doc comment already promised: - #2 (storage key isolation): TestStorageKeysIsolatedPerPlugin — the KV namespace is the caller's Instance.ID with no parameter to override it, and plugin_kv PRIMARY KEY (plugin_id, key) makes the split structural. - #4 (event rate limit): TestEventDeliveryHasNoGuestPath — EventSink.Dispatch invokes no guest code and has no callers, so there is nothing to limit yet; a SECURITY GATE comment requires the limiter in whatever change wires delivery. - #5 mitigation: TestEmptyAllowlistDeniesEveryHost — the shipped empty http_allowlist must fail closed. BREAKING CHANGE: a plugin declaring the `commands` capability must now list its commands in the manifest's `commands` block; undeclared names no longer bind. Only the in-repo `hello` example is affected and is updated here.	2026-07-20 14:10:02 +02:00
J3vbandClaude Fable 5	01f7795557	feat(api): proxy Klipy GIF requests server-side so no key ships to clients ... The client held the Klipy key in VITE_KLIPY_API_KEY, which Vite inlines into the shipped bundle by design — a build variable can never hold a secret. Move the integration behind the server: - New authenticated GET /api/v1/gif/search and /api/v1/gif/trending. The key comes from the new `gif.api_key` config section (koanf, OWNCORD_GIF_API_KEY) and never leaves the server. - Default-off: with no key, both endpoints return 503 GIF_DISABLED so clients can hide the picker instead of showing a broken one. Auth is checked first, so anonymous callers cannot probe whether a key is configured. - Outbound call reuses the existing SSRF-guarded dialer (exported as plugin.GuardedDialContext) rather than a bare http.Get: resolve once, reject private/loopback/link-local/CGN, dial only vetted IPs. Redirects are not followed and the response body is size-capped. - Only id/title/media_formats.{tinygif,gif}.url are forwarded — decoding into the narrow struct is the allowlist, so an upstream that echoed the key could not leak it. Upstream errors become a generic 502 and the key is redacted from anything that reaches the logs. - Dedicated `gif:` rate-limit bucket (30/min per IP) so debounced search traffic cannot exhaust the shared bucket used by password/TOTP endpoints. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 13:29:46 +02:00
Claude	5f1d6fc287	refactor(server): remove the store abstraction layer (D3) ... Deletes Server/store (SQLiteStore, MemStore, the composed Store interface) and collapses to a single sqlc-backed db package, executing the prior audit's P4 "single data layer" direction (finding #6). SQLiteStore was a pure pass-through to *db.DB, so consumers now depend on narrow interfaces that *db.DB satisfies directly: - service.Store (service/datastore.go, renamed from store/store.go) - ws.EventStore (ws/eventstore.go) - plugin.PluginStore (plugin/pluginstore.go) The event- and plugin-KV methods that lived in the store's SQLite implementation move into the db package (db/event_queries.go, db/plugin_queries.go), keeping their raw-SQL form. Tests: the MemStore-based unit tests now run against a real in-memory SQLite db opened per-test with migrations applied, via package-local seed helpers. Fault-injection tests embed a real *db.DB and override the single method under test, preserving error-path coverage. Full server suite and sqlc-verify are green. Docs: audit finding #6 and A-2026-07-06 marked resolved; decisions D3 updated; architecture server.md / data-model.md diagrams and prose updated to the api -> service -> db layering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UA17KPvqGBX3XbXYnMf1rA	2026-07-19 16:33:58 +00:00
J3vbandClaude Fable 5	7fbfbef581	test(plugin): lock vetted-IP dial fallback and fail-closed vetting (W2-6) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:58:57 +02:00
J3vbandClaude Fable 5	9145f893d1	fix(plugin): restore multi-address fallback in the SSRF-guarded dialer (W2-6) ... After validating every resolved IP, the guarded dial connected only to ips[0] — an allowlisted dual-stack or round-robin host whose first record was down hard-failed despite reachable vetted alternatives. The dial now tries each vetted address in order (all records still validated before any dial: one poisoned private record refuses the whole request). Also removes the redundant rejectPrivateAddrs pre-resolves (initial request + redirect hop): the guarded dial is the authoritative check and every path flows through it, so the pre-resolve only cost an extra DNS round trip while re-opening the rebinding TOCTOU it was meant to close. Folds the W3-2-adjacent double-resolve cleanup from the plan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:58:57 +02:00
J3vbandClaude Fable 5	92abe7c173	test(plugin): lock reinstall command rebinding + hijack refusal (W2-3) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:52:31 +02:00
J3vbandClaude Fable 5	2a4b2e1628	fix(plugin): make in-place plugin upgrades rebind commands (W2-3) ... installFromDisk replaced r.plugins/r.byName with a fresh *Instance but left r.commands keyed to the old pointer and the old module running: re-installing an enabled plugin blocked its own command re-registration (RegisterCommand compared ownership by pointer) and kept dispatch routing into the orphaned module until restart. Reinstall now deactivates the old instance and clears its bindings, and RegisterCommand compares ownership by plugin identity (manifest name) — the same plugin re-binds freely, a different plugin still cannot hijack an owned command. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:52:31 +02:00
J3vbandClaude Fable 5	a3f7d63f7d	test(plugin): lock CPU-budget overrun recovery (W1-1) ... Hand-assembled wasm fixture whose command_dispatch spins forever only for payloads over 100 bytes: baseline dispatch succeeds, an over-budget dispatch surfaces the budget error, and the next dispatch on the same plugin succeeds again via lazy re-instantiation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:21:55 +02:00
J3vbandClaude Fable 5	b13adf23aa	fix(plugin): re-instantiate wazero module after CPU-budget overrun (W1-1) ... WithCloseOnContextDone(true) closes the module when the per-call budget deadline fires, and nothing ever re-instantiated it — one over-budget command bricked the plugin for every user until an admin disable/enable cycle or a server restart. Now any guest-call failure that closed the module (deadline, trap, parent-context cancellation) releases inst.module, and the next dispatch lazily re-activates the same instance; a concurrent- activation guard keeps double dispatches from leaking modules. Re- instantiation resets guest in-memory state — documented at the budget site. Host-call time exclusion from the budget is documented as a requirement but not implemented: no host imports are wired into the runtime yet, so there is no host-call time to exclude today. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:21:54 +02:00
J3vbandClaude Fable 5	0c093e8403	chore(server): delete unfinished Postgres scaffolding ... PostgresStore was 86% stubs behind a build tag nothing enables, pgdbgen carried hand-added build tags that fought sqlc-verify, and the runtime never threaded store.Store through the handler boundary. Single-engine reality shrinks the W1-3 attachment-ownership fix and ends the pgdbgen churn. Removed: store/postgres.go, db/pgdbgen/, db/queries/postgres/, migrations/postgres/, the sqlc postgres block, pgx from go.mod, the startup-refusal branch, and the dead Postgres config surface. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:15:58 +02:00
J3vb	d0da33f1da	Merge remote-tracking branch 'origin/main' into fix/security-hardening-review	2026-07-19 08:09:56 +02:00
J3vbandClaude Fable 5	1fbedb404c	fix(lint): delete dead ws broadcast cluster; demote phase-header comments ... golangci-lint had been failing invisibly behind the earlier CI gate failures. Default-build lint is now clean: - Delete the unused pre-topic-limiter rate-limit constants, the unused bluemonday sanitizer, and the dead broadcast variants superseded by their Low/High counterparts (broadcastExclude, broadcastToDMParticipants(+Exclude), sendSequencedToUsers, PubSub.debugDump). Test references were comments only; updated to name the live variants. - Separate 'Phase X Step Y' file headers from the package clause with a blank line so staticcheck ST1000 no longer reads them as malformed package comments (proper package docs exist in hub.go/manifest.go). - Add .gitattributes normalizing line endings to LF on checkout — the Windows CI runner materialized CRLF, which made every prettier-formatted file fail the format gate. Known remainder (pre-existing, out of P0 scope): golangci-lint with -tags wazero reports 3 gosec + 2 staticcheck and -tags otel 1+1; CI lints the default build. Tracked for the P1 plugin pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 12:55:22 +02:00
J3vbandClaude Opus 4.8	7b178ff30b	fix(security): harden server against verified code-review findings ... Applies fixes for 20 adversarially-verified findings from a whole-codebase security review (server side). All Go build-tag variants build, `go vet` is clean, and the suite passes (the sole failing test, ws TestEmitEvents, is a pre-existing nil-harness failure unrelated to these changes). High severity: - auth: close TOCTOU in TOTP verify rate-limit by recording each attempt atomically up-front (was Check-then-Allow), restoring the per-user brute-force cap. - plugin: enforce the CPU/time budget on every WASM guest call via a WithTimeout context (WithCloseOnContextDone interrupts runaways); the configured budget was previously parsed but never applied. - api/waf: inspect request bodies for chunked (ContentLength==-1) requests so the SQLi/XSS/RCE body rules can no longer be bypassed. - ws: rate-limit voice_join/voice_leave and voice_e2ee announce/offer, which fan out to every participant and could force mass disconnects. Medium severity: - api: run bcrypt on the unknown-user login path (no || short-circuit) to remove the timing-based username-enumeration oracle. - ws: verify LiveKit webhooks via the SDK receiver so the signature is bound to the body hash (kills forgery/replay). - authz: require READ_MESSAGES for reactions and for plugin-command broadcasts; route the latter through RequireChannelAccess. - api: cache the client-update signature fetch and rate-limit the endpoint. - service: propagate DeleteOtherSessions failure from ChangePassword instead of silently reporting success. - api: trust the rightmost non-proxy X-Forwarded-For entry, not the client-controllable leftmost one. - plugin: route auto-registered commands through the conflict-checked RegisterCommand; pin the DNS-validated IP for host_http dials (DNS-rebinding TOCTOU). - api: mark access-controlled downloads private/no-cache + Vary: Origin. Low severity: - auth: fail closed when a fully-shaped TOTP ciphertext fails GCM auth (was returning the ciphertext as plaintext). - api: apply the livekit-proxy path allowlist to WebSocket upgrades too. - service: verify attachment ownership before linking (IDOR). - admin: bound the bootstrap setup invite (5 uses / 24h); re-verify the update binary hash immediately before rename+spawn (TOCTOU). - service: require BanMembers + role hierarchy for moderation ban/unban. chore: stop tracking the stray Server/owncord-server.exe build artifact. Test infra: add uploader_id to the hand-rolled ws test attachment schemas and make MemStore.GetAttachmentByID a no-op lookup, matching production/DB behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-17 21:08:54 +02:00
J3vb	65002d0d7f	h	2026-04-07 10:13:47 +02:00
J3vb	ba66629077	fix(ci): resolve all golangci-lint and ESLint failures on PR #1132 ... Client: - ci.yml: patch auto-generated events.ts to rename Event -> _Event so @typescript-eslint/no-unused-vars does not fail on generated code Server (gocritic): - service/channel.go: rangeValCopy (line 74), elseif (line 174) - service/message.go: rangeValCopy (line 648), elseif (lines 438, 496) - ws/emit.go: caseOrder — ChannelEvent before BroadcastAllEvent - ws/handlers_command_test.go: stringXbytes — use bytes.Equal - ws/pubsub_test.go: stringXbytes — use bytes.Equal Server (nilerr): - service/channel.go: nolint:nilerr for intentional silent drops in HandleTyping Server (gosec): - plugin/host_ui.go: G703 nolint — path already sanitized above - plugin/registry.go: G302 — tighten plugin file permissions 0o640 → 0o600 - ws/hub.go, ws/serve.go: G115 nolint — seq counters never reach MaxInt64 Server (unused/unparam): - plugin/registry.go: nolint:unused for wazero-tagged module field - telemetry/metrics.go: nolint:unused for otel-tagged resetAppMetricsForInit - ws/command.go: nolint:unparam for map entries whose error return is always nil Server (staticcheck ST1000/ST1020): - Add blank line before package declarations in phase-comment files (api/plugins_handler.go, plugin/host_{commands,events,http}.go, telemetry/metrics.go, telemetry/middleware.go, telemetry/telemetry_default.go, ws/event_persister.go) - Fix GlobalTracer/GlobalMeter doc comments to start with function name	2026-04-07 10:10:38 +02:00
J3vb	81c121c2bd	fix(server): resolve golangci-lint contextcheck, errcheck, gocritic findings ... contextcheck: add ctx context.Context as first param to ListVisibleChannels, BlockUser, CreateDM, CreateInvite, UpdateProfile, SendMessage; pass r.Context() from HTTP handlers and ctx from WS handler; replace context.Background() in telemetry spans with the propagated ctx. errcheck: suppress justified Close() errors — defer func(){ _ = rows.Close() }() in sqlite_events.go (idiomatic; rows.Err() checked), _ = resp.Body.Close() in host_http.go (body fully consumed), _ = f.Close() in host_ui.go (read-only fd). gocritic/rangeValCopy: rewrite for _, ch := range all (line 60) to indexed loop in ChannelService.ListVisibleChannels to avoid 144-byte per-iteration copy.	2026-04-07 09:10:14 +02:00
J3vb	f06ddcde27	Merge branch 'claude/plan-phases-b-c-bGpoS' of https://github.com/J3vb/OwnCord into claude/plan-phases-b-c-bGpoS	2026-04-07 08:26:25 +02:00
Claude	1c476ccb58	merge: reconcile sister branch claude/plan-phases-b-c-bGpoS ... Resolves the parallel Phase B/C work that landed on the sister branch while this branch was in review. Both branches independently implemented real OTel + Wazero runtimes; this merge keeps the best of each. Conflict resolution - Server/plugin/sandbox_wazero.go: rewritten as a hybrid. Keeps the HEAD lifecycle (eager `platformInit` with WASI preview-1, explicit `platformDeactivate` per-instance, runtime closed via Registry.Close) AND adopts the sister branch's richer artefacts: * `WithMemoryLimitPages` actually enforces `cfg.MaxMemoryMB`, * the JSON-over-linear-memory ABI (`allocate` / `command_dispatch(ptr,len) → (ptr,len)` / `deallocate`), * `listExportedCommands` auto-binds commands the plugin exports via `list_commands` at activation time (capability-gated). - Server/plugin/registry.go: kept the HEAD `activate()` snapshot pattern (read `runtimePlatform` under RLock, pass into `activateWithRuntime` as a parameter) so a concurrent Close can't race the wazero call. Sister branch's LoadAll stale-staging cleanup and UninstallPlugin on-disk dir removal came in via auto-merge. - Server/telemetry/telemetry_otel.go: kept the HEAD implementation (race-fixed AppMetrics rebind, uint64 overflow guard, idempotent shutdown, trace-provider cleanup on prom failure) and wired in the sister branch's `OTLPInsecure` config field for plaintext gRPC opt-in. - Server/go.mod: accepted sister branch's `BurntSushi/toml v1.6.0` for the new TOML manifest support. - Client/tauri-client/vitest.config.ts: union of both globs (`tests/**/*.test.ts`, `src/**/*.test.ts`, `src/**/*.test.tsx`). - PHASE_BC_LOCAL_TODO.md: combined the two checkbox histories; TOML manifest, hello.wasm fixture, and OTLPInsecure are all marked done now. Sister branch additions accepted via auto-merge - Server/plugin/examples/hello/{hello.wasm,main.go}: precompiled 925 KiB TinyGo plugin with the full ABI (allocate, deallocate, list_commands, command_dispatch, on_event). - Server/plugin/manifest_{toml,nottoml}.go: TOML manifest parser behind the wazero build tag, JSON fallback elsewhere. - Server/plugin/loader.go: prefers `plugin.toml`, falls back to `plugin.json`. - Server/api/plugins_handler.go: structured error responses + slog. - Server/main.go, Server/config/config.go: OTLPInsecure plumbing, defaults polish. - docs/{contributing.md,server-configuration.md}: documentation updates. Test status - `go build` passes on default, -tags otel, -tags wazero, and -tags otel,wazero. - `go vet` passes on every tag combination. - `go test ./...` passes on default and on -tags otel,wazero. - Client: `npx tsc --noEmit` clean; vitest 3188/3188 across 112 files. https://claude.ai/code/session_01AZni6CDSQeu67WSWY1YCDX	2026-04-07 06:23:09 +00:00
J3vb	6a48665cb0	Merge branch 'claude/plan-phases-b-c-bGpoS' of https://github.com/J3vb/OwnCord into claude/plan-phases-b-c-bGpoS	2026-04-07 08:00:20 +02:00
J3vb	670e6e0323	security: harden plugin sandbox stdin and opaque internal errors ... - sandbox_wazero.go: explicitly discard plugin stdin via WithStdin to prevent WASM modules from reading the server process's stdin fd - channel_handler.go: replace ErrInternal message pass-through with generic 'an internal error occurred' — full error stays server-side in slog.Error only - invite_handler_test.go: update assertions to expect generic message	2026-04-07 07:59:10 +02:00
copilot-swe-agent[bot]andJ3vb	1f4a89ced1	audit: fix all C/H/M/L severity findings from Phase B+C PR review ... Agent-Logs-Url: https://github.com/J3vb/OwnCord/sessions/2d415fd9-6138-495b-ac29-c54d08ae4ce4 Co-authored-by: J3vb <192430104+J3vb@users.noreply.github.com>	2026-04-07 05:28:53 +00:00
copilot-swe-agent[bot]andJ3vb	2dc9a060fc	fix(review): address 6 reviewer findings from pullrequestreview-4064746778 ... - service/user.go: fix ChangePassword docstring (no old-password verification) - service/user.go: RevokeSession now maps db.ErrNotFound→ErrNotFound and all other store errors→ErrInternal, preventing internal failures from masquerading as 404s - plugin/loader.go: update scanPluginDirectory comment to reflect fail-fast behavior; fix Lstat comment wording - db/queries/sqlite/events.sql: CAST COALESCE result to INTEGER so sqlc generates int64 instead of interface{} - api/plugins_handler.go: log install error server-side and return sanitized structured JSON response instead of raw err.Error() - .github/workflows/ci.yml: remove continue-on-error from tag build steps so tag boundary drift fails CI" Agent-Logs-Url: https://github.com/J3vb/OwnCord/sessions/6635420c-af26-4cc0-9397-5e5b37887437 Co-authored-by: J3vb <192430104+J3vb@users.noreply.github.com>	2026-04-06 22:03:35 +00:00
Claude	47d848ee0a	feat(phase-bc): implement real OTel + Wazero runtimes; harden install path ... Phase B Step 8 (OpenTelemetry) and Phase C Step 9 (Wazero plugin runtime) were structurally scaffolded but the tagged builds were placeholders that errored at runtime. This commit lands the real implementations behind the existing build tags, plus three review passes worth of fixes across the plugin admin handler, plugin registry, telemetry adapter, and Solid client. Telemetry (Phase B Step 8) - Add real go.opentelemetry.io/otel{,/sdk,/exporters/{prometheus,otlp...}} modules to go.mod plus contrib/instrumentation/net/http/otelhttp. - Replace the telemetry_otel.go skeleton with a working Provider that wires Prometheus + OTLP/gRPC exporters, otelhttp middleware, span and meter adapters, and an idempotent Shutdown. - AppMetrics cache is now reset *before* SetGlobal to close a race where a concurrent NewAppMetrics() could observe a swapped provider but read stale no-op instruments. - Init releases the trace provider on a later prometheus exporter failure so Init never leaks gRPC connections. - convertAttrs handles int32/uint/uint32/uint64/float32 explicitly; uint64 values that exceed math.MaxInt64 fall back to a STRING attr rather than wrapping into a negative int64 and corrupting metrics. - Tests under -tags otel cover the prometheus scrape, span lifecycle, histogram recording, shutdown idempotency, AppMetrics rebind, and the uint64 overflow fallback. Plugin runtime (Phase C Step 9) - Add github.com/tetratelabs/wazero v1.11.0 to go.mod. - platformInit creates a shared wazero.Runtime with WASI preview1 pre-instantiated; activateWithRuntime compiles + instantiates each plugin module under that runtime; platformDeactivate closes per- plugin modules without tearing down the runtime. - DisablePlugin now calls platformDeactivate so the wazero module is freed immediately instead of leaking until registry Close. - activate() captures runtimePlatform under r.mu.RLock and passes it as a parameter to activateWithRuntime; the call no longer re-reads the field, closing a race with concurrent Close. - invokeCommand calls the plugin's command_dispatch export when present; missing/broken exports return a user-facing diagnostic instead of crashing the dispatcher. - Tests under -tags wazero cover registry creation, module compilation, re-enable after disable (verifies the leak fix), close-twice safety, invalid wasm rejection, and DispatchCommand with a missing export. Fixture is a 41-byte embedded add.wasm; no external asset required. Plugin admin handler hardening - /api/v1/admin/plugins/install now rejects uploads whose multipart Content-Type is not application/zip|x-zip-compressed|octet-stream (415) and uploads whose body lacks the PK\\x03\\x04 / PK\\x05\\x06 zip magic (400). The 16 MiB cap and registry-side zip-slip / symlink / size-bomb defences are still applied as before. - New plugins_handler_test.go covers list-empty, install-503-when-nil, content-type rejection, magic rejection, happy path, lifecycle 503, invalid id, and isZipContentType / hasZipMagic helpers. Solid client (Phase B Step 6) cleanup - vitest.config.ts now wires vite-plugin-solid and broadens the test glob to include src/**/*.test.tsx so Badge.test.tsx is actually discovered (it was silently skipped). - pluginBridge.ts targets postMessage at window.location.origin instead of "*", and exposes a destroy() that detaches the message listener and clears mounted frames. - solidMount.ts imports the JSX type from "solid-js" instead of "solid-js/web" (the latter does not re-export it), unblocking npx tsc --noEmit. Build/test status - go build succeeds on default, -tags otel, -tags wazero, and -tags otel,wazero. - go test passes on every tag combination across telemetry, plugin, api, ws, service, store, and the rest of the tree. - Client: npx tsc --noEmit clean; vitest 3188/3188 across 112 files. PHASE_BC_LOCAL_TODO.md is updated to mark the OTel modules + real Init, the wazero module + real platformInit, and the test coverage that landed in this commit as completed. https://claude.ai/code/session_01AZni6CDSQeu67WSWY1YCDX	2026-04-06 21:46:22 +00:00
J3vb	86634c531e	feat(phase-bc): add hello plugin WASM binary and source ... - main.go: TinyGo WASI plugin implementing the OwnCord plugin ABI (allocate/deallocate, list_commands, command_dispatch, on_event) - hello.wasm: precompiled binary (TinyGo 0.40.1, Go 1.25.3, wasm-opt 129) Responds to /hello [name] with a greeting; proof-of-life for wazero runtime	2026-04-06 23:40:03 +02:00
J3vb	ae496082b3	feat(phase-bc): TOML plugin manifests + Solid vitest preset ... Plugin TOML support (-tags wazero): - manifest_toml.go: tryLoadPluginTOML using BurntSushi/toml v1.6.0 - manifest_nottoml.go: no-op stub for default build - loader.go: prefers plugin.toml, falls back to plugin.json Solid vitest preset: - vitest.config.ts: add vite-plugin-solid, expand include to src/components/solid/**/*.test.tsx — Badge.test.tsx now runs automatically as part of npm test (112 files / 3188 tests)	2026-04-06 23:25:16 +02:00
J3vb	ddaaadcd43	feat(phase-bc): implement OTel SDK wiring and wazero plugin runtime ... OTel (telemetry/telemetry_otel.go, -tags otel): - Real Init: prometheus pull-exporter + OTLP/gRPC push-exporter branches - Bridge types: Tracer/Span/Meter/Counter/Histogram/Gauge wrapping SDK - HTTP middleware via otelhttp (otelchi not in proxy; otelhttp is equivalent) - Added otel v1.43.0, sdk, exporters/prometheus v0.65.0, otlptracegrpc, otelhttp v0.67.0, wazero v1.11.0 to go.mod Wazero (plugin/sandbox_wazero.go, -tags wazero): - ensureRuntimeLocked: lazy wazero.Runtime init with WASI host module - activateWithRuntime: CompileModule + InstantiateModule per plugin - invokeCommand: JSON-ABI dispatch via allocate/command_dispatch/deallocate - listExportedCommands via list_commands export Build matrix: default, otel, wazero, postgres, otel+wazero+postgres all pass Server test suite: all packages green	2026-04-06 23:21:38 +02:00
J3vb	9116a880a3	feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier ... - Generate Server/db/dbgen/{events,plugins}.sql.go and full Server/db/pgdbgen/ (//go:build postgres gated) - Implement PostgresStore EventStore and PluginStore methods in store/postgres.go - Wire plugin host_events.go EventSink into hub broadcast path (SetPluginEventSink) - Wire host_commands.go slash-command dispatcher: chat_command V1 handler + hub.SetPluginRegistry - Add handlers_command.go + handlers_command_test.go for plugin slash-command dispatch - Add reconnect_db_test.go: TestReconnect_BufferMiss_FallsBackToDBTier (cold-tier DB replay) - Add otel-up/otel-down Makefile targets; docker-compose.otel.yml + prometheus.dev.yml - Update PHASE_BC_LOCAL_TODO.md: mark in-session items complete; document remaining network-blocked steps - Minor fixes: channel_handler access-control, router plugin handler wiring, service span instrumentation	2026-04-06 22:48:59 +02:00
Claude	d320a8b587	fix(review): address 11 Copilot review findings on PR #1132 ... Clean sweep of every actionable item from the two Copilot review passes on head 59ae4d8. Grouped by severity: ─── Crash / security (must-fix) ───────────────────────────────────── 1. main.go:140 — telemetryShutdown nil panic. telemetry.Init can return (nil, err) on the -tags otel skeleton path; the deferred closure would then call a nil function. Normalise to a no-op shutdown when Init errors so the defer is always safe. 2. api/upload_handler.go — permSvc nil deref. MountUploadRoutes + handleServeFile dereference permSvc on every authenticated file request. Add a fail-fast panic at mount time so the misconfiguration surfaces at wiring, not on the first 500. Update upload_handler_test.go to pass a real PermissionService built on the test DB (the existing tests were missing the argument entirely, which meant the package wouldn't compile — this fixes the real bug Copilot flagged). 3. ws/event_persister.go — NewEventPersister nil EventStore panic. run() dereferences p.store on every flush. Panic at constructor time instead so the crash happens once at startup rather than minutes later in a background goroutine. 4. plugin/host_ui.go — serve-time symlink check. rejectSymlinksUnder only runs at install time, so a symlink created post-install (accidental or malicious) would be followed by http.ServeFile and leak host files. Add an os.Lstat + ModeSymlink check + IsRegular check to AssetHandler on every request. Cheap relative to the file read and closes the TOCTOU window. ─── Correctness / observability (should-fix) ─────────────────────── 5. ws/deps.go:77 — requirePerm hides misconfig as FORBIDDEN. Previously, nil database, nil perms, or a GetRoleForUser error all returned ErrCodeForbidden with the same message, making operator failures indistinguishable from legitimate permission denials. Split the branches: misconfig + DB error now return ErrCodeInternal with a server-side slog.Error so operators see the real problem; FORBIDDEN is reserved for the actual permission-bit check. 6. telemetry/metrics.go — ServiceCallDurationMs renamed to Sec. Field name said "Ms" but the instrument name was `service_call_duration_seconds` with unit "s". Renamed the field and updated all 8 service-layer callers so the struct field and metric semantics match. 7. ws/event_persister.go — flushEvy typo → flushEvery. Renamed the field and the one call site in run(). ─── Comments out of sync with code ────────────────────────────────── 8. plugin/loader.go — Stat vs Lstat comment. The comment claimed "Stat (not Lstat)" but the code correctly uses os.Lstat to detect symlinks. Updated the comment to match the code; the code was already right. 9. telemetry/telemetry_otel.go — compile claim wrong. Comment said the file would fail to compile without the upstream OTel modules, but the skeleton deliberately avoids importing them and Init returns a runtime error instead. Updated the comment to reflect actual CI behaviour (the -tags otel build step passes today but doesn't exercise real telemetry). ─── Nit / polish ──────────────────────────────────────────────────── 10. ws/event_pruner.go — startup delay magic constant. Hard-coded time.Minute made the "run shortly after startup" behaviour untestable (a test with a 100ms interval would still wait a full minute). Cap the startup delay by the interval: min(interval, time.Minute). Documented via a new `maxStartupDelay` constant. 11. ws/event_pruner_test.go — new file. Unit coverage for runPrune cutoff correctness, error swallowing, StartEventPruner nil-store short-circuit, ctx cancellation, and the interval-bounded startup delay from fix #10. Uses a fakeEventStore stub that records every prune call and signals the first one so tests don't sleep. ─── Verification ──────────────────────────────────────────────────── gofmt -l clean. No network access in sandbox so `go vet` and `go test` could not run; the changes are local and surgical and every touched file compiles in isolation against the existing signatures. https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk	2026-04-06 13:48:41 +00:00
Claude	59ae4d8ad2	test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG ... Final in-sandbox completeness pass. Five focused pieces; the remaining items in PHASE_BC_LOCAL_TODO.md after this commit are all genuinely local-only (toolchain, network, native deps). Test coverage (the biggest gap from prior reviews) - Server/plugin/manifest_test.go — pluginNameRegexp accept/reject table, validateRelativePath table, oversized version, unknown permission. - Server/plugin/host_http_test.go — hostAllowed dot-boundary suffix, empty-entry rejection, case insensitivity, FQDN trailing dot. ipAllowed table over loopback, RFC1918, RFC4193 (ULA), RFC6598 (CGN), link-local, multicast, unspecified — both v4 and v6 — plus public-IP accept cases. - Server/plugin/loader_test.go — rejectSymlinksUnder catches direct and nested symlinks; scanPluginDirectory rejects a plugin whose entrypoint is a symlink. Skipped on Windows where symlink creation needs elevation. - Server/plugin/host_ui_test.go — AssetHandler serves declared files, rejects undeclared files (404), rejects path traversal, supports nested asset paths. - Server/ws/hub_seedseq_test.go — SeedSeq monotonic, never-backwards, concurrent CAS safety, integration with nextSeq. - Server/ws/extract_event_type_test.go — table covering happy paths, control char rejection, escaped quote rejection, length cap (64), empty/missing/non-JSON inputs. Plugin install endpoint (closes a real feature gap) - Server/plugin/registry.go — InstallFromZip extracts a plugin .zip into a staging directory under cfg.Directory, validates it zip-slip safe (cleaned-path Rel check), refuses non-regular entries, refuses symlinks, caps compressed at 16 MiB and uncompressed total at 64 MiB (each file gated by io.CopyN against the remaining budget). Manifest is parsed at the staged root, then atomically renamed into the canonical plugin directory and registered via the existing installFromDisk path. - Server/api/plugins_handler.go — POST /install accepts multipart with one "plugin" file part, http.MaxBytesReader caps the request body, io.LimitReader caps the in-memory buffer, calls Registry.InstallFromZip, returns 201 with the new plugin name. The endpoint inherits the Pass 2 admin auth + IP gate (mounted under r.Use(admin.RequireAdminAuth)). Protocol surface - Server/ws/serve.go — buildAuthOK now takes replaySource and includes it in the auth_ok payload as "replay_source": "none" | "buffer" | "db". Two call sites updated: reconnect path passes the existing local, fresh-connect path passes "none". Test export updated to pass "none". CI build-tag matrix - .github/workflows/ci.yml — three new steps inside server-build-test build the server with -tags otel, -tags wazero, and -tags otel,wazero. All three are continue-on-error: true until the upstream OTel and wazero modules land in go.mod (tracked in PHASE_BC_LOCAL_TODO.md). Once they do, dropping continue-on-error converts the steps into hard CI gates against tag-boundary drift. Documentation - CHANGELOG.md — new root-level file with curated entries for Phase B, Phase C, security, and behavioural changes operators must know about (notably event_persistence.enabled = true by default). - PHASE_BC_LOCAL_TODO.md — ticks off the install endpoint, the replay_source field, and the existing event_persistence defaultYAML entry. The remaining items are toolchain-bound. After this pass, the in-sandbox completeness ceiling is reached. Everything still pending requires Go 1.25 toolchain, npm install, real OTel SDK + wazero modules, sqlc, postgres backend impl, or tinygo. https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk	2026-04-06 10:30:18 +00:00
Claude	7476c177b7	chore(phase-bc): pass 3 cleanup — perf, observability, hardening ... Eight focused follow-ups from the medium-severity review bucket. All in-sandbox tractable; no module changes, no new dependencies. Performance - Drop the defensive memcpy in EventPersister.Enqueue. The hub already passes a fresh slice from wrapWithSeq and the copy was happening under seqMu, serializing broadcast throughput. Documented the no-mutate contract on the call site. Observability - AppMetrics gains WSEventsPersistErrors counter; the persister run loop bumps both it and the existing WSEventsPersisted counter via cached metrics handle. - Hub.persistEvent now extracts the real event type ("chat_message", "voice_join", ...) from the wrapped JSON envelope via a small no-allocation byte scan instead of recording the generic "broadcast"/"channel_broadcast" label. - Added OTel spans + ServiceCallDurationMs histogram entries on one public method per remaining service: DMService.CreateDM, VoiceService.JoinChannel, InviteService.CreateInvite, ModerationService.BanUser, BlockService.BlockUser, UserService.UpdateProfile. Mirrors the existing pattern from MessageService.SendMessage. Hardening - plugin/loader now Lstat-walks each plugin directory and rejects any symlink, plus refuses an entrypoint that is itself a symlink. The asset handler's prefix check stays as defense in depth. - ipAllowed (plugin HTTP capability) now rejects RFC6598 carrier-grade NAT (100.64.0.0/10), closing a gap in net.IP.IsPrivate which only covers RFC1918 + RFC4193. - Registry.activateAll syncs Instance.Enabled := true after a successful activate so callers reading the in-memory flag see the live state. Documentation - defaultYAML now documents the new event_persistence, telemetry, and plugins config blocks with their defaults and one-line descriptions. - PHASE_BC_LOCAL_TODO.md ticks off five items (defaultYAML docs ×2, remaining service spans, registry wiring already-fixed in Pass 2). https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk	2026-04-06 09:49:03 +00:00
Claude	46aeccc49b	fix(phase-bc): address review findings — auth, SSRF, seq alignment ... Phase B + C review pass: critical security and correctness fixes. Security - S1: plugin admin endpoints now require admin.RequireAdminAuth in addition to AdminIPRestrict. Previously a LAN attacker on the allowed CIDR could list/enable/disable/uninstall plugins without a session. - S2: rewrite plugin HTTPDo allowlist with proper net/url parsing. Empty entries are ignored, suffix matches require a dot boundary, and a custom Dialer rejects loopback / RFC1918 / link-local addresses to close the DNS-rebinding TOCTOU window. Redirects re-validated. - S3 + #9: manifest Name pinned to ^[a-z0-9][a-z0-9_-]{0,63}$, Entrypoint and UI tab assets validated against absolute / "..", NUL byte, backslash and non-canonical paths. Asset handler hardened with filepath.Rel check for symlink and prefix-without-separator escapes. - S5: pluginBridge postMessage handler ignores the pluginId in the message body and uses an e.source -> contentWindow lookup instead, defeating spoofed messages from same-origin scripts. - S8: HTTPDo body capped at 5 MiB via io.LimitReader, redirects bounded to 5 hops. Correctness - Critical seq alignment: PersistEvent now takes the hub-assigned seq as a required parameter so the events table row seq always matches the wrapped payload seq. Hub seeds its in-memory atomic counter from MAX(events.seq) on startup. Drops in the persister queue no longer mis-align row vs payload seq. - #1: live plugin.Registry constructed in main.go BEFORE NewRouter and threaded through; admin handler is no longer wired with nil. - #3: EventPersister.Stop is now safe to call without a prior Start by tracking a started flag — previously deadlocked waiting on done. Wiring - NewRouter signature gains *plugin.Registry; two test callers updated. - admin.RequireAdminAuth exported as a thin wrapper over the existing package-private adminAuthMiddleware. - sqlc query templates updated for the new PersistEvent + GetMaxEventSeq contracts (sqlite + postgres). https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk	2026-04-06 09:29:29 +00:00
Claude	a2cb224323	feat: scaffold Phase B + C (events, telemetry, plugins, Solid.js) ... Phase B Step 6 — Solid.js incremental migration - vite-plugin-solid + solid-js + @solidjs/testing-library in package.json - vite.config.ts compiles src/components/solid/** as Solid TSX - tsconfig.json gains jsx: preserve / jsxImportSource: solid-js - lib/solidAdapter.ts wraps existing custom Stores as Solid signals - lib/solidMount.ts adapts Solid render to {mount,destroy} contract - components/solid/Badge.tsx (proof-of-concept leaf) - components/solid/ChannelListItem.tsx (store-subscribed leaf) - components/solid/Badge.test.tsx pipeline smoke test - components/solid/README.md documents the migration recipe Phase B Step 7 — Event persistence layer - SQLite + Postgres migrations for the events table - sqlc query files for both engines - EventStore interface + SQLite raw-SQL impl + MemStore impl + pg stubs - ws.EventPersister: async batched writer (queue / flush / drain / drop) - ws.StartEventPruner: background retention pruner - hub persists every replay-buffer push and exposes reconnect-tier counters - serve.handleReconnect: tiered replay (buffer -> DB -> full re-sync) - EventPersistenceConfig + main.go wiring - event_persister_test.go covers batching / drops / drain Phase B Step 8 — OpenTelemetry skeleton - Server/telemetry package with public Provider/Tracer/Meter/Counter API - telemetry_default.go (no-op build) + telemetry_otel.go (build tag otel) - telemetry/metrics.go declares the AppMetrics bundle - HTTPMiddleware mounted in Chi router (pass-through in default build) - PrometheusHandler optionally mounted at /metrics - Spans on MessageService.SendMessage, PermissionService.HasChannelPerm, ChannelService.ListVisibleChannels - Reconnect-tier counter wired into the global meter - TelemetryConfig defaults Phase C Step 9 — Wazero plugin runtime skeleton - Server/plugin package: manifest parser, loader, registry, host APIs (commands, storage, events, http, ui), errors - sandbox_default.go (no-op) + sandbox_wazero.go (build tag wazero) - SQLite + Postgres migrations for plugins + plugin_kv tables - PluginStore interface + impls + pg stubs - plugin/examples/hello manifest + README - plugin_test.go covers manifest, loader, capability gating - api/plugins_handler.go admin REST surface, mounted under admin group - PluginsConfig + main.go wiring (disabled by default) - Client: lib/pluginBridge.ts iframe + postMessage host - Client: components/solid/PluginContainer.tsx Solid host component Verification - Default build (no -tags) is intended to compile cleanly with no new third-party dependencies. The sandbox lacked Go 1.25.0 so go build could not run; PHASE_BC_LOCAL_TODO.md enumerates the local follow-up work (npm install, go mod tidy, sqlc-generate, real otel/wazero wiring, remaining service spans, full Solid migration).	2026-04-06 09:00:47 +00:00