J3vbandClaude Opus 4.8 ef1aca8a67 fix(e2ee): pin the verified identity key on re-pin, rekey on keyed-peer leave ...

Multi-agent F3 security review surfaced two voice-E2EE defects:

- Re-pin TOCTOU (voice-E2EE MITM): the identity-mismatch modal showed a
  fingerprint from one membersStore read, but rePinPeerIdentity re-read the
  server-writable store to decide what to pin. A malicious server (F3's threat
  model) could swap in an attacker key via a user_update during the human
  out-of-band verification window and have it pinned, silently defeating the
  mismatch prompt. rePinPeerIdentity now takes the exact verified key as a
  parameter; ChannelSidebar passes the bytes whose fingerprint it displayed.

- Membership forward secrecy: the key holder rotated the room key only when the
  holder ROLE transferred, so a departed non-key-holder kept a valid room key
  until the next periodic (<=5 min) rotation. The holder now also rotates when a
  peer that held the key leaves (reusing rotateKeyPeriodically), gated on the
  leaver having actually held a key.

Client gates green: typecheck, lint (0 errors), prettier, vitest (3361).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-24 08:55:07 +02:00

..

components

chore: stage QuickSwitchOverlay files missed from earlier commit

2026-03-27 13:10:21 +01:00

accessibility-tab.test.ts

test: Phase 2 coverage — below-70% files now at 95-100%

2026-03-30 13:38:20 +02:00

admin-actions.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

advanced-tab.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

api.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

appearance-tab.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

attachments-cache.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

attachments-render.test.ts

feat(client): TOFU HTTP proxy for REST — close audit A-2026-07-02 (D5)

2026-07-19 14:26:25 +00:00

audio-elements.test.ts

fix(client): make the screenshare volume slider actually change volume

2026-07-19 10:50:10 +00:00

audio-pipeline.test.ts

fix: remediate low-signal test assertions in client tests (BUG-061, BUG-064)

2026-04-01 18:22:09 +02:00

auth.store.test.ts

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

blocks-store.test.ts

feat(dm): gate DM composer on block state with spec reasons

2026-07-20 10:19:31 +02:00

capabilities-scope.test.ts

feat(client): narrow Tauri HTTP capability scope

2026-07-20 14:51:14 +02:00

cert-first-use-modal.test.ts

fix(security): gate TLS trust-on-first-use behind explicit confirmation (F4/F8)

2026-07-23 12:47:30 +02:00

cert-mismatch-modal.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

channel-controller.test.ts

feat(dm): gate DM composer on block state with spec reasons

2026-07-20 10:19:31 +02:00

channel-sidebar.test.ts

fix(e2ee): pin the verified identity key on re-pin, rekey on keyed-peer leave

2026-07-24 08:55:07 +02:00

channels.store.test.ts

feat(client): optimistic message send + composer permission gating

2026-07-19 17:47:39 +00:00

chat-area.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

chat-header.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

chat.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

connect-page.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

connected-overlay.test.ts

feat: fix all E2E failures, add credentials/window-state, wire QuickSwitcher + SettingsOverlay

2026-03-16 16:43:46 +01:00

connection-stats.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

context-menu.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

create-channel-modal.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

delete-channel-modal.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

device-manager.test.ts

fix: remediate low-signal test assertions in client tests (BUG-061, BUG-064)

2026-04-01 18:22:09 +02:00

dispatcher.test.ts

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

disposable.test.ts

feat: comprehensive spec docs, test suite, E2E overhaul, and security hardening

2026-03-28 10:39:23 +01:00

dm-profile-sidebar.test.ts

feat: wire UI features — status picker, screen share, profile popup, DM sidebar

2026-04-01 11:39:30 +02:00

dm-sidebar.test.ts

test: Phase 4 coverage — meaningful behavior tests push client to 95%

2026-03-30 14:20:05 +02:00

dm-store.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

dom.test.ts

feat: add Tauri v2 desktop client with full chat UI and security hardening

2026-03-15 19:44:02 +01:00

e2eeCrypto.test.ts

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

edit-channel-modal.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

embeds.test.ts

fix(client): parse OG tags with DOMParser to remove ReDoS vector

2026-07-23 11:59:13 +02:00

emoji-picker.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

file-upload.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

gif-picker.test.ts

feat(client): call own server for GIFs, drop VITE_KLIPY_API_KEY

2026-07-20 13:29:57 +02:00

gif-provider.test.ts

feat(client): call own server for GIFs, drop VITE_KLIPY_API_KEY

2026-07-20 13:29:57 +02:00

http-proxy.test.ts

feat(client): TOFU HTTP proxy for REST — close audit A-2026-07-02 (D5)

2026-07-19 14:26:25 +00:00

icons.test.ts

feat(e2ee): surface F3 voice identity verification in the channel sidebar

2026-07-23 22:06:50 +02:00

identity-mismatch-modal.test.ts

feat(e2ee): surface F3 voice identity verification in the channel sidebar

2026-07-23 22:06:50 +02:00

identity.test.ts

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

invite-manager.test.ts

test: update invite manager selectors for modal redesign

2026-03-22 08:26:21 +01:00

keybinds-tab.test.ts

fix: update test mocks for createLogger, ExternalE2EEKeyProvider, and keybinds string

2026-04-05 19:57:01 +02:00

livekit-session.test.ts

fix(e2ee): pin the verified identity key on re-pin, rekey on keyed-peer leave

2026-07-24 08:55:07 +02:00

log-persistence.test.ts

chore(client): remove dead files, exports, and unused dependencies

2026-07-23 15:29:01 +02:00

logger.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

logout.test.ts

fix(client): revoke server session on user-initiated logout

2026-07-20 08:39:12 +02:00

logs-tab.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

media-cache.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

media-visibility.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

media.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

member-list.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

member-picker-modal.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

members.store.test.ts

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

message-controller.test.ts

fix(client): review follow-ups for the connection-status batch

2026-07-19 19:42:36 +00:00

message-input.test.ts

feat(client): call own server for GIFs, drop VITE_KLIPY_API_KEY

2026-07-20 13:29:57 +02:00

message-list.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

messages.store.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

modal-factory.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

notifications.test.ts

feat(client): optimistic message send + composer permission gating

2026-07-19 17:47:39 +00:00

os-motion.test.ts

fix: settings tab bug fixes, expanded tests, and coverage improvements

2026-03-30 12:42:31 +02:00

overlay-managers.test.ts

fix: send invite code instead of numeric ID for revoke endpoint

2026-04-02 15:41:25 +02:00

permissions.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

pinned-messages.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

preferences.test.ts

test: fix 10 test quality bugs (BUG-058–067) and resolve 115 TS type errors

2026-03-30 16:35:02 +02:00

profiles.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

ptt.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

quick-switcher.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

rate-limiter.test.ts

chore: remove soundboard feature entirely

2026-04-02 17:00:27 +02:00

reaction-controller.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

reconcile.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

renderers.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

rnnoise-worklet.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

router.test.ts

feat: add Tauri v2 desktop client with full chat UI and security hardening

2026-03-15 19:44:02 +01:00

safe-render.test.ts

fix: resolve CI failures — lint errors and coverage threshold

2026-03-22 20:06:59 +01:00

screen-share-button.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

screen-share-fps.test.ts

fix(client): make source-quality screen share FPS take effect at capture

2026-07-19 11:20:01 +00:00

search-overlay.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

server-banner.test.ts

fix(client): review follow-ups for the connection-status batch

2026-07-19 19:42:36 +00:00

server-panel.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

server-strip.test.ts

fix: address code review — test regression, theme consolidation, validation, dead CSS

2026-03-27 12:22:22 +01:00

settings-helpers.test.ts

fix: address PR review findings (issues #9-#14)

2026-03-17 04:11:04 +01:00

settings-overlay.test.ts

test(client): account for the screen share FPS select in settings tests

2026-07-19 10:50:11 +00:00

sidebar-area.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

sidebar-dm-helpers.test.ts

feat(client): optimistic message send + composer permission gating

2026-07-19 17:47:39 +00:00

sidebar-dm-section.test.ts

refactor: split large files under 800-line limit

2026-04-01 11:39:01 +02:00

sidebar-member-section.test.ts

fix(client): unify role lookups onto the dispatcher-updated store

2026-07-20 08:39:01 +02:00

status-picker-userbar.test.ts

fix(security): gate TLS trust-on-first-use behind explicit confirmation (F4/F8)

2026-07-23 12:47:30 +02:00

store.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

stored-appearance.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

stream-preview.test.ts

feat: add stream preview, video grid track lifecycle, and build cleanup

2026-04-01 17:07:02 +02:00

test-harness.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

text-images-tab.test.ts

fix: settings tab bug fixes, expanded tests, and coverage improvements

2026-03-30 12:42:31 +02:00

themes.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

toast-coverage.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

toast.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

totp-settings.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

types.test.ts

chore: remove soundboard feature entirely

2026-04-02 17:00:27 +02:00

typing-indicator.test.ts

refactor: UI architecture improvements + GIF auto-pause

2026-03-20 15:21:56 +01:00

ui.store.test.ts

test: client test updates — fix failures + align with security hardening

2026-04-01 11:40:31 +02:00

update-notifier.test.ts

feat(updater): surface download progress in the update banner

2026-07-20 10:19:42 +02:00

user-bar.test.ts

feat(client): connection-status store + no-silent-failure batch

2026-07-19 19:08:19 +00:00

user-profile-popup.test.ts

fix: resolve TypeScript strict mode type errors

2026-04-01 11:51:07 +02:00

video-grid.test.ts

fix(client): make the screenshare volume slider actually change volume

2026-07-19 10:50:10 +00:00

video-mode-controller.test.ts

fix: add setScreenshareAudioVolume to livekitSession mocks in video tests

2026-04-03 09:05:18 +02:00

voice-audio-tab.test.ts

feat(client): screen share FPS setting with 60 and 120 fps options

2026-07-19 10:50:11 +00:00

voice-callbacks.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

voice-channel.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

voice-disconnect.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

voice-widget.test.ts

test(voice): pin voiceStatus transitions, widget indicators, and control freeze

2026-07-20 09:31:27 +02:00

voice.store.test.ts

feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI

2026-07-23 21:07:09 +02:00

window-state-restore.test.ts

fix(client): skip window-state save while minimized

2026-07-19 11:20:00 +00:00

window-state.test.ts

feat: fix all E2E failures, add credentials/window-state, wire QuickSwitcher + SettingsOverlay

2026-03-16 16:43:46 +01:00

ws.test.ts

fix(security): gate TLS trust-on-first-use behind explicit confirmation (F4/F8)

2026-07-23 12:47:30 +02:00