1527 Commits

Include renames

Author	SHA1	Message	Date
devsyncwrldandClaude Opus 5	4fd6ac890c	feat(i18n): translate five more systems ... - Settings > Voice: video — preview, permission states, camera picker. This closes the Voice & Video tab; input, output and video are all done. - Create channel / category / space - Group DMs — new DM, add friends, group settings, leave - Join a space — discovery, invite code, and both federated auth phases - Delete account, transfer ownership, and the top-level error screen Three patterns worth noting. Strings that are chosen in a helper or held in state (the camera's hard-blocked copy, its preview errors, the space visibility options, the invite failure reasons) now travel as translation keys and are resolved where they render, so switching language re-labels what is already on screen. Sentences that wrap an emphasised literal — the host name when joining, the space and member names when transferring — are split around their placeholder instead of interpolated, leaving word order to the translation. And `CreateChannel` mapped over `(t) =>` for the channel type, which shadowed the translator; the loop variable is now `channelType`. The error boundary in main.tsx is a class component, so it reads the locale once per render via `translate` rather than the hook — correct here anyway, since an error screen has no reason to re-render on a language switch. Two GroupDmSettings tests located the name input by its aria-label, which this change translates. They now use the `data-group-dm-name-input` attribute the input already carries, matching how the rest of that file locates elements — and no longer break when copy changes. Dictionary is at 595 keys, en and pt-BR at exact parity. Verified: web build (tsc + vite), 490 web tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 20:38:54 -03:00
devsyncwrldandClaude Opus 5	115c81cba3	feat(i18n): translate five more systems, and check for updates more often ... Update cadence: the desktop app checked once ten seconds after launch and then every four hours. A release published while the app sits open went unnoticed until the next poll — which is exactly what happened with 1.4.0. It now polls every 30 minutes and also checks when the window regains focus, throttled to one check per five minutes so alt-tabbing does not hammer the feed. `lastCheckAt` is stamped from the `checking-for-update` event rather than by the callers, so a manual check from the settings panel counts too. The focus listener is on `app`, not on mainWindow, because the window is destroyed and recreated when closed to tray. Translations, five whole systems: - Settings > Desktop (autostart, updates, instance) - Settings > Voice: output device, which completes that tab - Settings > Keybinds, including the action names and conflict prompt - Settings > Account, the largest — profile, password, detached-instance notice, danger zone - Explore spaces Two sentences wrap a literal that must not be translated (the `input` group name, the `user@instance` example). Those are split around a placeholder rather than interpolated as text, so a translation keeps control of the word order on both sides of it. Keybind action labels gained a `labelKey` alongside the English `label`, which stays for non-React callers. Verified: web build (tsc + vite), desktop typecheck, 490 web tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 13:38:28 -03:00
devsyncwrldandClaude Opus 5	a54d998ba9	chore: version 1.4.0 ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 12:52:31 -03:00
devsyncwrldandClaude Opus 5	860f02b2c1	feat(channels): rename channels, and quieter defaults for sound and streams ... Four owner requests in one pass. Rename: the PATCH /api/channels/:id route already accepted a name and a topic, and the API client already exposed it — the only thing missing was a way to reach it. The channel settings Overview tab now edits both, gated on MANAGE_CHANNELS like the server is, with Save/Discard appearing only when the form is dirty. The server's lowercase-and-hyphenate rule moved to @backspace/shared so the field can show what a name will actually become instead of letting it change shape on save; one copy of the rule, used by both sides. Stream volume: someone else's screen share now starts at 50 instead of 100 (DEFAULT_STREAM_VOLUME). The publisher boosts system audio before sending, so the old default arrived far too loud for a viewer who never touched the slider. Only the default moves — the slider still covers the full range and a value the user set is still persisted. Sound effects: SFX_BASE_VOLUME 0.8 -> 0.4, halving every cue. The .ogg files were left alone; they already peak below full scale, so the harshness was level, not recorded distortion. Every SFX playback path goes through getSfxVolume(), so this is the single knob. Translations: channel settings (including the override editor's permission labels), the friends page end to end — tabs, lists, requests, the add tab and discovery cards — the invite modal including its per-invite failure reasons, and the group-DM member actions. Failure reasons are carried as translation keys rather than finished text, so results already on screen re-label when the language changes. Verified: web build (tsc + vite), server typecheck, 490 web tests, 804 server tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-02 11:59:25 -03:00
devsyncwrldandClaude Opus 5	c5abb6fd64	chore: version 1.3.0 ... Carries the silent native notification, which lives in the Electron main process and therefore only takes effect from a new installer — the reason this release is needed beyond exercising the restart prompt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 19:07:26 -03:00
devsyncwrldandClaude Opus 5	1fb61377b9	feat(notify): in-app notifications with the app's own sound ... The system balloon carries the OS notification sound, which does not belong to this app, and it only fired while the window was out of focus — with the app focused nothing appeared at all. Notifications now surface inside the window, carry the same synthesised timbre as the rest of the app's sounds, and clicking one opens the channel. The native balloon is kept for when the window is not visible, since an in-app card nobody can see is no notification, but it is now silent: the app plays its own effect instead. A focused window is notified only about other channels — announcing the conversation someone is already reading is noise. Also fixes the Gitea publish cleanup, which silently deleted nothing: it interpolated an Actions expression inside a bash , and when the pattern did not match, the loop passed over every asset. The release ended with two latest.yml files and the updater served the older one, reporting 1.1.0 as current — an update that exists but is never offered, with no error anywhere. The filter is plain bash now, logs what it found, and the job fails if more than one latest.yml survives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 18:57:02 -03:00
devsyncwrldandClaude Opus 5	1a1067bbb6	chore: version 1.2.0 ... Pins, filtered search, custom emojis and stickers, and the in-app restart prompt. The prompt itself is only visible once an update is offered, so this release is what makes it observable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 18:49:23 -03:00
devsyncwrldandClaude Opus 5	71d2109b2f	feat(desktop): in-app prompt to restart for an update ... The main process already showed a system notification when an update finished downloading, and nothing in the renderer listened — so the only cue vanished on its own and was missed by anyone not watching the desktop at that moment. A prompt now stays in the window until it is acted on or dismissed, with the restart wired to the install-update channel the preload already exposed. Dismissing is 'not now', not 'never': a later version reopens the prompt, since the version it refers to has changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 18:31:59 -03:00
devsyncwrldandClaude Opus 5	7f08384372	feat(expressions): pickers and upload for emojis and stickers ... Completes the feature: the tables existed but nothing could be put in them. Space settings gain an Emojis & Stickers panel behind MANAGE_SPACE, with a 512KB ceiling — both are fetched on every message that uses them, so weight matters more than fidelity. The suggested name is pre-normalised so the common case needs no typing, and a name collision reports itself distinctly from an upload failure: the corrective action is different. Custom emojis join the emoji picker as their own category. They have no native character, so selecting one inserts :name: — the same text the renderer resolves back to an image, which also means copying a message yields something that still reads. Stickers get a picker tab that only appears inside a space, since that is where they exist, and send immediately on click: a sticker is the whole message, so parking it in the composer to await Enter would make no sense. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 18:25:10 -03:00
devsyncwrldandClaude Opus 5	7d003021d1	feat(expressions): custom emojis and stickers per space ... Emojis and stickers get separate tables on purpose: an emoji sits inside a sentence and a sticker is the whole message, so their sizes, limits and render paths differ. Emoji names are unique per space and restricted to letters, digits and underscore — :name: has to resolve to one image, and a space or colon inside the name would make the reference impossible to delimit. Sticker names are labels picked from a grid, so they accept anything. Rendering reuses the existing markdown pipeline by rewriting :name: into image syntax, which needs no plugin. Code spans and fences are left alone: text someone wrapped in backticks was meant to be shown literally, and turning it into an image would destroy what they wrote. Messages carry stickerId with ON DELETE set null — removing a sticker from the space must not delete the history of everyone who used it. The server refuses a sticker from another space, which would otherwise leak images between unrelated servers. Expressions load once per space and stay in memory: the message renderer consults the map for every :name: it finds, and a request per lookup would turn each message into a cascade. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 17:57:32 -03:00
devsyncwrldandClaude Opus 5	50a8f12c77	feat(search): inline filters, and translate the search UI ... The filters themselves already existed end to end — the server takes q, from, has, before and after, the API client passes them, and the popover has fields for each. What it lacked was discovery: the panel sits behind a button, so the capability was invisible. Typing 'de:fulano' or 'has:image' straight into the search box now applies the same filters. Keys are accepted in both languages, since the app is bilingual, and an unrecognised token falls back to being search text — otherwise a message containing a URL or 'algo:coisa' would become unfindable. Inline filters win over the panel's: whoever just typed one is expressing the more recent intent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 17:49:05 -03:00
devsyncwrldandClaude Opus 5	4ceb5cd66a	feat(pins): pin messages to a channel ... Pinned state lives on the message rather than a join table: a message is pinned in exactly one channel, its own, so a separate table would add a join to every lookup and buy nothing. Every message now carries its pin state, so the timeline can mark a pin without a second request and the panel and the timeline cannot disagree. Toggling is deliberately not optimistic — the server refuses past the channel's limit, and showing it pinned before confirmation would lie in exactly that case. The pins list reuses the same assembly the channel history uses, extracted into one helper, so the two cannot drift apart in what they include. The migration also adds the (channel, user, created) index the filtered search will need, since both touch the same table and one migration is cheaper than two. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 17:45:33 -03:00
devsyncwrld	61c68761df	i18n: translate the channel and member sidebars ... Clears the two remaining rounds owed under the fork's per-update translation rule. Covers channels, direct messages, the context menus, the inline voice settings and the member list's loading and grouping labels. The member grouping needed care: one function returns either a fixed label or a role's own name, and role names are user data that must never be translated. It now marks only the fixed cases and the component resolves them at render, leaving role names untouched. The function is not a component, so it cannot call the hook itself.	2026-09-01 17:03:48 -03:00
devsyncwrld	c04b8b47eb	i18n: translate the chat composer and messages ... Catching up on the fork's rule that every update also translates one existing system — three updates went by without one. The composer's placeholder takes the channel as a parameter rather than being concatenated, since Portuguese puts the channel elsewhere in the sentence than English does. The translation hook is bound to `tr` in these two files, not `t`: both already use `t` for transfer records in inner scopes, which shadowed the function and made it uncallable exactly where it was needed.	2026-09-01 16:59:50 -03:00
devsyncwrld	9f7723d104	ci: build on GitHub, publish updates from Gitea ... GitHub stays the build machine — it has the Windows runners the native audio module needs — but the update feed moves to this fork's own Gitea. The GitHub repository is private, and electron-updater against a private GitHub repo needs a token inside the shipped app, which is a leaked token. Gitea serves release assets to anyone, so the installer carries no credential. The flow was verified end to end against the live instance before writing this: create release, upload asset, download anonymously. The release tag is fixed at 'latest' because electron-updater fetches latest.yml before it knows which version exists, so the URL cannot carry a version; CI replaces that release's assets each publish. electron-builder runs with --publish never since it cannot upload to Gitea, but still emits the latest.yml the updater reads. Needs a GITEA_TOKEN secret on the GitHub repository.	2026-09-01 15:49:25 -03:00
devsyncwrld	5b84843217	fix(screenshare): make shared system audio audible ... Listeners had to run the participant at 200% with attenuation off. Two causes, both on the publishing side. WASAPI returns the process mix at a level well below what a microphone track arrives at, so the track was quiet before it ever left the machine. A gain stage now boosts it, followed by a limiter — a compressor with a high ratio and fast attack — so the boost cannot clip loud passages. And the track was published with LiveKit's defaults, which are tuned for speech: mono, low bitrate, and DTX enabled, which stops transmitting during silence. On game and music audio that reads as thin and clipped. It now publishes with the music stereo preset, stereo forced, and DTX and RED off. Lives in packages/web, so it reaches the desktop app through a normal deploy — no new installer.	2026-09-01 15:36:55 -03:00
devsyncwrld	bd8decb4b3	fix(ci): actually compile the native audio module, and prove it ... The previous run went green and produced an installer with no system-audio capture in it — the exact silent failure this module exists to prevent. Two causes. electron-rebuild takes -w as one comma-separated list, not a repeated flag; passing it twice made argv.w an array and the CLI threw 'argv.w.split is not a function', which also broke uiohook-napi's rebuild that had been working. And pnpm 10 refuses to run a dependency's build script unless it is listed in onlyBuiltDependencies, so node-gyp never ran for it at all — the log said 'Ignored build scripts' and nothing else complained. Neither surfaced because desktop's postinstall ends in , which exists so contributors without build tools can install. That is reasonable locally and dangerous in CI, so the workflow now asserts a compiled .node exists and fails loudly when it does not, instead of trusting an exit code that was designed to lie.	2026-09-01 15:13:26 -03:00
devsyncwrld	60c51a1635	chore: version 1.1.0 ... First release built from the fork. electron-builder names artifacts and the GitHub release from package.json rather than the git tag, so the two have to agree or electron-updater compares mismatched versions and never offers the update. v1.0.0 is already taken by upstream's tag in this history.	2026-09-01 13:15:13 -03:00
devsyncwrld	d208b0c277	build(desktop): publish releases to syncwrld/resenhacord	2026-09-01 13:14:43 -03:00
devsyncwrld	2f836cd366	build(desktop): correct the fork's GitHub owner to syncwrld	2026-09-01 13:11:49 -03:00
devsyncwrld	f7f2cf75ab	build(desktop): point releases at the fork and rebuild the new native module ... release.yml already builds and publishes desktop installers for every platform on a v* tag, so no new workflow was needed — it needed adapting to the fork. electron-builder published to upstream's repository, so releases (and with them the electron-updater feed, which had no source at all) went nowhere useful. More consequential: postinstall ran electron-rebuild against uiohook-napi only. electron-native-screenshare would have been compiled for Node's ABI rather than Electron's and failed to load at runtime — and since the loader degrades quietly by design, the symptom would have been screen sharing with no sound and no error, which is the exact bug this module exists to fix. Documented in docs/build-desktop.md, including why the build has to run on GitHub (Gitea Actions provides no hosted runners, and the module needs MSVC) and why the Windows runner stays pinned to windows-2022.	2026-09-01 13:10:10 -03:00
devsyncwrld	3deed92dd9	feat(sounds): replace call and stream effects ... The originals were all 1.14s — long enough to be intrusive for events that fire whenever anyone joins, leaves, or watches a stream. Synthesised rather than sourced: no third-party file, so no licensing question in a public repository. The parameters are measured, not guessed — envelope, spectral peaks and decay taken from two reference sounds the instance owner supplied. The timbre is fundamental plus octave at near-equal strength (1.00 / 0.85 / 0.10 / 0.02) decaying to 1/e in 0.19s, with no reverb. Call join rises C4→G4, leave falls D4→G3, matching the references' intervals and their 100ms spacing. The stream pair reuses those resolution notes as single tones at ~55% the volume: they fire far more often during a broadcast, so they have to sit under the call sounds rather than beside them. Stream start is the one event that happens once per broadcast, so it can be a chord — with a low thump and a short air layer that both die inside 150ms, adding weight without length. Stream end mirrors it descending, quieter, and without the air, since brightness reads as arrival. Generators and the measured parameters are kept in tools/sfx so these can be retuned without redoing the analysis. Total size drops from 150KB to 41KB.	2026-09-01 13:01:06 -03:00
devsyncwrld	d525bbb8c5	feat(desktop): capture system audio with process isolation ... Electron's audio: 'loopback' captures the whole output mix, this app's own playback included — so everyone else's voices went back out inside the share and each listener heard themselves. Not acoustic echo but a digital copy of the output, which is why headphones never helped, and why shareAudio already defaulted to off in the desktop app. Electron offers no way to exclude our own audio: the docs allow only 'loopback' or 'loopbackWithMute', and the handler discards the renderer's constraints (restrictOwnAudio never arrives). electron-native-screenshare does it at the OS level — WASAPI process loopback on Windows — capturing only the shared window when its pid resolves, and otherwise everything except us. The module hands raw PCM to the main process, so it crosses IPC and is scheduled onto a running cursor in Web Audio to become a MediaStreamTrack, published as ScreenShareAudio. Loading is optional and failure degrades to a silent share rather than blocking the app or the screen share. The browser path is untouched: Chrome honours restrictOwnAudio and has no echo. Verified by typecheck (web and Electron main) and the web suite. The audio path itself cannot be exercised here — no Windows, no Electron, no audio device.	2026-09-01 00:56:34 -03:00
devsyncwrld	c899253e52	fix: soundboard upload in Electron, and Spotify sync/disappearing/progress ... Soundboard: naming a clip used window.prompt, which Electron does not implement — it returned nothing, the flow aborted in silence, and adding a sound worked in the browser while doing nothing at all in the desktop app. Replaced with a two-step field inside the popover, identical in both. Spotify, three separate defects behind the two symptoms reported: Out of sync — a 20s poll stacked on the activity store's 5s debounce left everyone else on the previous track for up to 25s. The next poll is now scheduled just past the current track's end instead of on a fixed interval, and a track change bypasses the debounce (it happens once every few minutes; the debounce exists for chatty producers). Vanishing — a paused track, and the silent gap Spotify reports between two songs, both cleared the activity outright. Pausing is now carried as state rather than absence, and an empty answer is tolerated for 25s before the block comes down. Progress bar — timestamps are computed with the server's clock and were drawn against the viewer's, so any drift displaced the bar; and it kept advancing after a pause until the next poll. The ready payload now carries server time so each client can correct its own offset, and the bar freezes when paused. Tray, native notifications and system audio in screen share were all found already implemented and wired end to end; recorded in the roadmap rather than built again.	2026-08-31 22:39:28 -03:00
devsyncwrld	e89966435a	fix(soundboard): read MANAGE_SPACE from the space bitfield ... The add-sound control was gated on channelPermissions, which carries the per-channel bitfield; MANAGE_SPACE lives in the space-level one. The check silently evaluated false for everybody, including owners, so the button never rendered and there was no way to add a sound at all. Also raise the clip cap to 2 MB — a 30-second clip at a high bitrate cleared 1 MB — and stop reporting every upload failure as 'too large', which sent people to shrink a file that was not the problem.	2026-08-31 13:54:00 -03:00
devsyncwrld	f5451e1b14	feat: soundboard, account menu, and call timer ... Soundboard: the trigger travels over the WebSocket and every client in the call plays the clip locally, instead of mixing it into the presser's microphone or publishing a LiveKit track. No upstream bandwidth, no media stack changes, and the clip is not degraded by voice processing. Fan-out uses a new sendToRoomParticipants rather than sendToRoom: the latter broadcasts a space room to the whole space, which is right for the presence the sidebar shows and wrong for anything audible. The cooldown is enforced server-side — a client-side one only slows down people not trying to abuse it, and a soundboard is the easiest thing here to turn into a weapon. Playing is open to anyone in the call; deciding what the buttons are needs MANAGE_SPACE. Account menu: the name in the user bar had cursor-pointer and no handler, so the interface was already promising a click that did nothing. Offers profile, status and copy-id — not the Clips or account switching the reference design shows, which would be dead UI here. Call timer: startedAt comes from the server, so a late joiner sees the call's age rather than their own arrival. Empty space rooms are destroyed already, which is what makes the next call start from zero — no reset logic needed.	2026-08-31 13:45:18 -03:00
devsyncwrld	1830051732	feat(stats): voice-time and message leaderboards per space ... Voice stays get their own table rather than joining the audit log: that table records points in time, a call is an interval, and pairing join/leave point events would leave every query guessing at joins whose leave never arrived. Sessions are opened and closed inside joinRoom/leaveCurrentRoom rather than at the seven call sites that reach them, so no path can be missed, and destroyRoom closes them too — it bypasses leaveCurrentRoom and would otherwise leak open rows. A restart leaves sessions open with an unknowable end time. They are closed at startedAt, discarding that time rather than inventing it: crediting the gap would hand someone hours they never spent, and the numbers are the point. Mirrors the existing users.status sweep on boot. Only closed sessions count, so a figure does not move on every refresh. Bars scale to the leader, not the total — with five people every share of a total looks identical. Statistics are readable by any member, since they are the group's own numbers; the audit log, which names who did what, stays on MANAGE_SPACE.	2026-08-31 13:29:59 -03:00
devsyncwrld	bbb190cbda	feat(audit): append-only audit log for spaces ... Records who changed what, and is the mechanism statistics will read — one event table rather than two logs that drift apart. The table is deliberately generic (action + target + JSON metadata) so a new action needs no migration. Writes never throw: a kick must not fail because its log entry could not be written, since the kick already happened. Leaving is recorded as a different action from being removed. The same route serves both, and a log that conflates them misleads exactly when it matters. Actor is nullable with ON DELETE SET NULL: the event outlives the account, and a log that vanished with its actor would be worthless. Reads are gated on MANAGE_SPACE rather than a new permission bit, which would default to nobody until every role was re-edited. Paging uses the snowflake id, stable even for two events in the same millisecond, and an action this build does not know still renders a row.	2026-08-31 13:22:52 -03:00
devsyncwrld	fb662bfe12	feat(gif): favourites and category shortcuts ... Favourites are stored server-side per user, so one made on the phone is there on the desktop — the point of favouriting. The whole result is stored rather than an id: the provider offers no lookup by id, so an id-only favourite could not be rendered without re-finding it through search. Category chips translate their label but not their query, which goes to a provider that indexes in English. The star sits beside the tile button rather than inside it: a button within a button is invalid and swallows the click. Toggling is optimistic and reverts on failure, and favourites skip both the loading skeleton and the infinite scroll, which belong to provider-backed browsing only. Server caps favourites per user and rejects non-http(s) URLs, which become <img src> in everyone's picker.	2026-08-31 13:12:50 -03:00
devsyncwrld	75316b0882	feat(spotify): show the current track as an activity ... OAuth Authorization Code flow, with tokens kept server-side: refreshing needs the client secret, so the browser never holds a Spotify token — it asks this instance what is playing and this instance calls Spotify. The callback arrives as a plain browser redirect with no Authorization header, so the OAuth state carries the user id signed with the instance secret and is compared in constant time; without that, anyone could bind their Spotify account to another user. Activities are now tracked per producer. pushActivities replaced the whole list, so the desktop game detector and Spotify would erase each other — losing exactly the case this is for, a game and Spotify at once. Polling backs off when the tab is hidden and keeps the last known track on a network error rather than reporting 'stopped listening'. A rejected refresh token (access revoked on Spotify's side) drops the row so the UI stops claiming a live connection. Scope is read-only: user-read-currently-playing and user-read-playback-state. Per the fork's language rule, the new UI ships in en and pt-BR, and this round also translates the privacy panel.	2026-08-31 12:37:08 -03:00
devsyncwrld	688a1335cb	feat(i18n): language foundation with en and pt-BR ... Nothing in the project was translatable — every string sat inline in English. en.ts is the source dictionary and its type is derived from it, so a typo or a missing key fails typecheck instead of rendering the raw key at runtime. pt-BR.ts is deliberately Partial: translation proceeds one system per update and anything absent falls back to English, so a half-migrated interface is never broken, only partly English. Locale is persisted, guessed from the browser on first run, and kept in sync with <html lang> through a subscription — persisted state rehydrates after first paint, so a one-off assignment would miss it. Translates the voice input panel (including the mic test shipped earlier today) and the profile card as this round's system. Language options are labelled in the active language, so a wrong pick can always be undone.	2026-08-31 12:24:50 -03:00
devsyncwrld	63afd2fc89	fix(profile): hoist the activity hook above the early return ... The activity selector sat below `if (!isOpen || !user) return null`. `user` arrives asynchronously, so the hook ran on some renders and not others; React counts hooks per render and tore the tree down with error #310 as soon as a profile finished loading. Move it above the guard and let the selector tolerate a null user. Typecheck and the suite both passed with the bug in place — TypeScript cannot see hook order and nothing renders this modal across the null-to-loaded transition.	2026-08-31 12:12:23 -03:00
devsyncwrld	d7da0ff203	feat(activity): show the current activity on the profile card ... The activity pipeline was already complete end to end — Activity type, store, WS broadcast, server validation, presence relay, and an ActivityCard used by four list surfaces — but the profile card rendered none of it, which is the 'Listening to Spotify' block the design calls for. Add ProfileActivity: richer than ActivityCard because the card has room for artwork, track and artist, so it reads details/state/assets. All optional, so it degrades to the bare name that today's process-based detector supplies. Also scheme-check activity image assets server-side. activity.url was already restricted to http(s) but assets.largeImage/smallImage were only length-checked — an asymmetry that was harmless while nothing rendered them, and is not once they become <img src>: a client could point them at a host it controls and harvest the IP of everyone opening that profile.	2026-08-31 12:05:01 -03:00
devsyncwrld	bfe62d7078	feat(voice): mic test with loopback in voice settings ... The level meter only measured a stream a call had already opened, so settings offered no way to check a mic before joining — the panel said as much. Add startMicTest/stopMicTest on AudioManager: the processed input bus is routed to the master output through a dedicated gain node, so the loopback can be disconnected precisely. Settings had deliberately never opened the mic itself; a mic test cannot honour that, so the test hands the mic back when it stops. Releasing needs two independent guards, because the user may join a call mid-test: AudioManager only stops the exact stream it opened (identity check, not a flag), and the caller must consent — the UI reads the call state, which AudioManager cannot, as it does not import stores. Unmounting mid-test tears the loopback down too.	2026-08-31 11:59:51 -03:00
devsyncwrld	37407a5ecd	feat(voice): open the profile card from voice participants ... The profile popout already existed and was reachable from eleven places — messages, mentions, avatars, member list, DMs, activity panel — but no voice surface opened it, so clicking someone during a call did nothing. Wire it into the voice user rows (VoiceChannel's sidebar list) and the name label on grid tiles, whose avatar was already a ProfileAvatar; the name beside it not reacting read as the click failing. Left mobile alone deliberately: MobileSpacesScreen already opens the profile from its row wrapper, and MobileVoiceJoinSheet would layer a history-pushed full-screen profile inside a bottom sheet, which cannot be verified here.	2026-08-31 11:49:57 -03:00
devsyncwrld	20526e1bc8	feat(gif): outlined GIF glyph, and GIF picker for the profile banner ... The composer's GIF button drew a filled rounded rect with the letters knocked out, which reads as a solid square rather than a picker. Invert it: stroked outline with filled letters, reusing the original glyph paths scaled to centre. Banners already accept absolute URLs on both ends (server isValidAssetUrl allows http(s); the profile render branches on banner.startsWith('http')), so the picker stores the remote URL directly with no upload path. Previews can now hold either a blob: or an https: URL, so revoking is guarded — calling revokeObjectURL on a remote URL is a silent no-op that would hide a mistake.	2026-08-31 11:44:40 -03:00
devsyncwrld	c70b0095a9	feat(voice): jump to the call from the voice panel ... The channel name under 'Voice Connected' was a plain div. Making it navigate needed more than an onClick: voiceStore never recorded which space the call was in, and spaceStore.channels only holds the space currently being viewed — so after navigating away the call's channel was unresolvable, which is also why the label degraded to a generic 'Voice Channel'. Capture space and channel name at join time (the only moment they are reliable) and use them for both the label and the jump. Covers space calls and DM calls.	2026-08-31 11:40:45 -03:00
cnrd	8456b8f976	fix(web): stop the profile card re-anchoring to its own avatar (#39) ... Avatar opened the profile popout whenever it received a user prop. Since user is how every avatar gets its gradient, colour and status dot, all 22 call sites became profile triggers by accident — including the picture inside the profile card itself, which re-anchored the card to that picture on every click and walked it across the screen (120px right, 36px down, until it pinned at the viewport clamp). Avatar is now presentational. A new ProfileAvatar carries the open-the-profile behaviour at the five call sites that actually want it. The card's own picture escalates to the full profile modal instead of reopening the card. The card also places itself off its measured size via the shared computeFloatingPosition engine, replacing six call sites that each hand-computed coordinates against a guessed 460px card height. Closes #37	2026-08-25 15:51:04 +02:00
TheZwiss	89467d6f93	fix(server): upgrade better-sqlite3 to 12.x for Node 24 compatibility (#41) ... better-sqlite3 11.x removes its environment cleanup hook from Statement::~Statement() after the Node environment is torn down. Node 24.19.0 asserts on the null environment and aborts the worker, so vitest reported 'Worker exited unexpectedly' and exited non-zero on a fully green test run — failing the required check on every PR. 11.x also ships no prebuild for Node 24, so CI compiled it from source on every run. 12.x has prebuilds for that ABI and the V8 13.9 shims 11.x lacks. drizzle-orm declares better-sqlite3 >=7, so the major bump is in range. Supersedes #26.	2026-08-25 15:41:43 +02:00
BadAtCaptchasandJannis Braun	1e6c7c6042	Enhance Windows dev support (#13) ... Makes local dev work on Windows: cross-env for the server dev port, pnpm --parallel to run server+web together (replacing the POSIX-only '&'), PowerShell setup docs, engines widened to Node >=20, and a Node 20 + 24 CI matrix. CI keeps a stable required 'Build & test' status via an aggregate gate job so the matrix rename doesn't drop the context the main ruleset requires. Co-authored-by: BadAtCaptchas <2359196+BadAtCaptchas@users.noreply.github.com> Co-authored-by: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>	2026-07-12 13:10:43 +02:00
TheZwissandBadAtCaptchas	43cab41e60	fix(spaces): clearer 403 for non-members on invite endpoint (#14) ... Non-members already can't mint invite codes (permissions resolve to zero for them since 85e1975f), but hasPermission reports it as a missing CREATE_INVITE permission, which is misleading. Return 'Space membership required' for the non-member case instead. Message wording from #12 by BadAtCaptchas. Co-authored-by: BadAtCaptchas <2359196+BadAtCaptchas@users.noreply.github.com>	2026-07-12 12:51:37 +02:00
TheZwiss	d76e06a023	refactor(federation): consolidate inbound S2S-auth preamble into one helper (#11) ... Six S2S-HMAC endpoints repeated the same inbound-auth preamble verbatim (parse federation headers -> resolve active peer -> optional per-peer rate limit -> verify HMAC signature -> nonce replay protection). Extract it into authenticateS2SPeer() so the trust boundary has a single, tested definition. Adopters (preamble only; every post-auth side effect, body validation, and response is unchanged): - DELETE /api/federation/identity (no rate limiter; warns on missing nonce) - POST /api/federation/relay (relay limiter; warns; keeps in-handler epoch-baseline populate + nonce ratchet) - POST /api/federation/sync (no limiter; warns with the [sync] tag; keeps in-handler nonce ratchet) - POST /api/federation/users/lookup (lookup limiter, Retry-After 60) - POST /api/federation/users/by-home-id (same) - POST /api/federation/verify-attach-proof(shares lookup bucket, Retry-After 60) Deliberate non-adopters, each keeping a load-bearing gate the helper would flatten (documented at each site + in the helper docstring): - POST /api/federation/epoch gates status != 'revoked' (peer recovery), 400 on missing headers, no nonce check - POST /api/federation/peer/rotate active-only but no nonce check - POST /api/federation/peer/denied awaiting_approval gate (404/409), synthetic no-grace secret verify Behavior-preserving. The rate limiter is injected (plain { limited, retryAfter }), so the limit still fires BEFORE signature verification. The only ordering change: /relay's opportunistic epoch-baseline populate now runs just after the shared preamble (i.e. after the nonce check) instead of between signature and nonce. This is provably equivalent for every reachable honest-peer state (a duplicate nonce means the baseline is already non-null; a valid-signature-but-no-nonce request from a nonce-supporting peer is unreachable in transit and carries no security/correctness consequence) and the populate is documented as not affecting relay accept/reject. Adds a dedicated unit test covering the full decision table (headers, peer status, rate-limit + Retry-After, rate-limit-before-signature ordering, signature, nonce duplicate/missing, log flag + context suffix, success). Full server suite green (804 tests).	2026-07-10 03:08:09 +02:00
TheZwiss	c79bf91398	refactor(server): dedupe federation rate limiters and response signing (#10) ... Phase C cleanup follow-up to the routes/federation split (#9). Behavior- preserving; full server suite (790 tests) green. A) rateLimits.ts: the four near-identical sliding-window limiters (accept/relay/lookup/ensure) and their duplicated prune loops collapse into one createLimiter(windowMs, max) factory. Per-call and periodic- sweep semantics are preserved exactly, including that lookup buckets are pruned per-call but never swept (unchanged from before). 177 -> 101 lines. B) Extract sendSignedJson(reply, payload, hmacSecret) — the single definition of how this instance signs an S2S JSON response — and use it in the /epoch and /verify-attach-proof|reattach handlers, replacing two copies of the build-headers-and-send boilerplate.	2026-07-10 02:23:14 +02:00
TheZwiss	94fe73522d	refactor(server): split federation routes into cohesive modules (#9) ... routes/federation.ts had grown to 7.6k lines, spanning HTTP route registration, federated identity resolution, ~30 inbound relay event processors, DM reconciliation, and rate-limiting internals — too large to review or hold in context, and awkward to change safely. Split the implementation into 18 focused modules under routes/federation/ (helpers, events/, handlers/) and keep routes/federation.ts as a thin barrel that re-exports the public API and composes the HTTP registrars into federationRoutes(). No import paths change anywhere else. Pure move, no behavior change: - 61/61 named functions byte-identical; only deltas are 2 dynamic-import paths adjusted for the new directory depth - public export surface unchanged (barrel re-exports all 22 symbols) - all 30 endpoints preserved (identical verb+path set) - typecheck, build, and full server suite (790 tests) green Docs: update federation.md source-file map; add split design doc.	2026-07-10 02:08:03 +02:00
TheZwiss	c7d88481ad	test: give federation integration suites a realistic per-test timeout (#7) ... The three test/ files boot real federated instances and drive S2S over HTTP, with several tests deliberately waiting on log matchers (e.g. logMatched(..., 1_000) per remote). Vitest's 5s default per-test timeout is meant for unit tests and is too tight here: under CI load the multi-remote fan-out tests in federation-identity-deletion intermittently timed out (observed on the post-merge main run), producing a flaky red check. Set a file-level testTimeout of 30s in each of the three harness-based suites via vi.setConfig. Scoped per-file so unit tests keep the strict 5s default; a genuine hang still trips the 30s ceiling well before the 90s hook budget. No test logic changed.	2026-07-10 00:51:18 +02:00
BadAtCaptchasandJannis Braun	9b6d1b18eb	Fix federated attachment downloads allowing SSRF via redirects (#1) ... * Backspace — initial public release * chore: pin Node 20 (LTS) and pnpm 10.34.3 Unpinned `pnpm@latest` in the Dockerfile made fresh builds non-reproducible: `latest` now resolves to pnpm 11, but the committed lockfile targets pnpm 10, so `pnpm install --frozen-lockfile` fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on a clean host. Pin pnpm to 10.34.3 across the Dockerfile, the `packageManager` field, and the release workflow; pin Node to 20 (LTS) via `.nvmrc` and `engines` so Docker, CI, and from-source builds all use the same tested toolchain. Also corrects the docs: the lockfile is v9.0 (requires pnpm 10, not "pnpm 8+"), and "Node 20+" implied untested newer majors were supported. * fix(compose): fail fast on missing JWT_SECRET instead of a silent restart loop Without JWT_SECRET the server throws at boot (config.ts) and `restart: unless-stopped` turns that into an endless crash loop that is invisible unless you run `docker compose logs backspace`. Guard it exactly like DOMAIN already is, so `docker compose up` stops immediately with an actionable message. install.sh generates the secret before bringing the stack up, so this only affects the manual `cp .env.example .env && docker compose up` path. * docs(env): make the JWT_SECRET requirement explicit in .env.example Spell out that JWT_SECRET is required and must be a strong 32+ char value, and that the empty default is intentional (docker compose fails fast rather than the server boot-looping). Pairs with the compose-level guard added in 592c23f. * fix(desktop): don't let uiohook-napi rebuild abort the whole workspace install The @backspace/desktop postinstall runs `electron-rebuild -f -w uiohook-napi`, which compiles a native module from source and needs a C++ toolchain (make/g++/python3). On a bare host without those — a typical VPS a self-hoster clones onto — that failure took the ENTIRE `pnpm install` down (exit 255), so the server never installed either, even though uiohook-napi is desktop-only and irrelevant to hosting. Make the rebuild non-fatal: on failure it now prints a clear one-line warning and continues. Machines with build tools (CI, desktop devs) are byte-identical — the fallback never fires; only toolless boxes (which aren't building the desktop app anyway) skip it. Verified on a bare x86 box: full `pnpm install` now exits 0 and the server builds and boots from source. Docs note the build-tool requirement for desktop work and point self-hosters at the Docker installer. * feat(deploy): three deployment modes + prebuilt multi-arch image for robust self-hosting Make Backspace self-hostable in any homelab environment, not just a clean host that owns ports 80/443. install.sh is now mode-aware and auto-detects which fits: - allinone (default): bundled Caddy + auto-HTTPS — unchanged behavior - proxy: behind your own reverse proxy (nginx / Traefik / Caddy / Nginx Proxy Manager / SWAG) — app published on 127.0.0.1:APP_PORT, no bundled Caddy, prints paste-ready proxy snippets - tunnel: behind a tunnel (Cloudflare / Tailscale) — same, plus a 90MB upload cap (under Cloudflare's 100MB body limit) and voice force-disabled (WebRTC over UDP can't traverse a tunnel) Port detection is Docker-aware (consults `docker ps` published ports, not just `ss`), so a host whose proxy already owns 80/443 via iptables DNAT — with no listening socket for `ss` to see — is correctly detected as "taken" instead of dead-ending. docker-compose.proxy.yml is a small overlay, layered via COMPOSE_FILE (written into .env so no `-f` flags are ever needed), that publishes the loopback port and parks Caddy in an inert profile. The base compose file is untouched, so All-in-One behaves exactly as before. Prebuilt image: .github/workflows/docker-publish.yml builds and pushes a multi-arch (linux/amd64 + linux/arm64) image to ghcr.io/thezwiss/backspace on release tags (and manual dispatch), so weak/ARM hosts skip the ~1.6GB local build (the Vite build OOMs small ARM boxes). install.sh and docker-compose.yml default to pulling it, fall back to an image already present on the host, and finally to a from-source build — AGPL §13 commit stamping preserved on every path. Kept deliberately separate from the desktop-installer workflow (release.yml). Docs: README gains a "Deployment modes" section (all three modes, nginx / Caddy / Traefik snippets, GUI-proxy field-by-field, cloudflared ingress, the update path, and voice-per-mode caveats); docs/systems/deployment.md updated to match. Verified live on a throwaway VM: proxy + all-in-one end-to-end through install.sh (with a real Let's Encrypt cert), tunnel config generation, loopback-only binding, and the local-image fallback path. * Fix federation file download SSRF (#1) --------- Co-authored-by: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>	2026-07-10 00:27:05 +02:00
TheZwiss	628e4dec3e	ci: run typecheck, build & tests on PRs and main (#6) ... * ci: run typecheck, build & tests on PRs and main Add a GitHub Actions workflow (.github/workflows/ci.yml) that installs on Node 20 (the pinned runtime), builds shared/server/web, typechecks desktop, and runs the full vitest suite across all packages on every pull request and push to main. The repo already had 500+ tests but only ever ran them locally. Also wires up the missing test/typecheck plumbing this exposed: - web package had 55 test files but no test script — add test/test:watch/typecheck - add root-level test and typecheck aggregate scripts - fix a latent web type error the new typecheck surfaced: reference vite-plugin-pwa/react types so virtual:pwa-register/react is typed (useRegisterSW callback params were implicit any; the tsc half of the web build script has been failing, masked by vite build ignoring type errors) * test: fix two latent failures surfaced by CI on Node 20 - server: exclude dist/** from vitest. Vitest 4's default exclude dropped dist/, so after `pnpm build` emits compiled .test.js files, vitest ran those stale copies alongside src/*.test.ts and they failed (compiled vi.mock paths resolve differently). - web: polyfill Blob.prototype.stream in the jsdom test setup. jsdom's Blob has no .stream() on Node 20 (Node 25 provided one, masking this locally); undici's Response constructor calls blob.stream(), so new Response(blob) threw 'object.stream is not a function'.	2026-07-10 00:15:41 +02:00
Jannis Braun	85e1975fa5	fix(permissions): deny space permissions to non-members (invite-bypass) ... computePermissions() returned the space @everyone role's permissions without verifying the caller had joined the space. Because CREATE_INVITE is in DEFAULT_EVERYONE_PERMISSIONS, any authenticated user could mint an invite code for a request-only space — whose id is listed by /api/spaces/explore — and then self-join via /api/spaces/:id/join, bypassing the join-request approval flow. The same gap let non-members read message history and search default channels. Root cause: - computePermissions now returns 0n for non-members (space owner and instance admin still short-circuit first, so they are unaffected). Defense in depth (request-only spaces are approval-gated, never invite-joinable): - both invite-code join endpoints reject visibility='request' (private stays invite-joinable — its only entry path; public too). - POST /api/spaces/:id/invite refuses to hand out a code for request spaces. - POST /api/dm/space-invite refuses to card a local request space, checked by space id against the local table so a spoofed spaceInstanceOrigin can't slip past it. - InviteModal hides the invite affordances for request spaces. Also removes the unused computeCategoryPermissions(), which duplicated the resolution algorithm without the membership gate. Adds unit + route + component tests covering non-member/member/owner/admin resolution and the request/private/public visibility matrix. Reported-by: BadAtCaptchas (#2)	2026-07-07 19:45:51 +02:00
Jannis Braun	e7f41b5609	fix(desktop): don't let uiohook-napi rebuild abort the whole workspace install ... The @backspace/desktop postinstall runs `electron-rebuild -f -w uiohook-napi`, which compiles a native module from source and needs a C++ toolchain (make/g++/python3). On a bare host without those — a typical VPS a self-hoster clones onto — that failure took the ENTIRE `pnpm install` down (exit 255), so the server never installed either, even though uiohook-napi is desktop-only and irrelevant to hosting. Make the rebuild non-fatal: on failure it now prints a clear one-line warning and continues. Machines with build tools (CI, desktop devs) are byte-identical — the fallback never fires; only toolless boxes (which aren't building the desktop app anyway) skip it. Verified on a bare x86 box: full `pnpm install` now exits 0 and the server builds and boots from source. Docs note the build-tool requirement for desktop work and point self-hosters at the Docker installer.	2026-07-06 01:52:06 +02:00
Jannis Braun	21c8731f3a	feat(web): refetch DM list after re-attach so reconciled conversation replaces the split (reattach-dm-reconcile spec §3.4)	2026-07-03 12:44:00 +02:00