ciphermesh 1.2.1 → 2.1.0

package/src/client/ChatController.js

@@ -9,14 +9,25 @@ import {
   createJoin,
   createEncryptedMessage,
   createRatchetedMessage,
+  createSealedMessage,
   createKeyUpdate,
   createChangeRoom,
+  createRoomAuth,
   createListRooms,
   createKickPeer,
   createMutePeer,
   createBanPeer,
   ERR,
 } from '../protocol/messages.js';
+import { sealEnvelope, openEnvelope } from '../crypto/SealedSender.js';
+import {
+  deriveRoomSecrets,
+  signRoomChallenge,
+  encryptRoomPayload,
+  decryptRoomPayload,
+  isRoomWrapped,
+  freeRoomSecrets,
+} from '../crypto/RoomKey.js';
 import { KEY_ROTATION_INTERVAL_MS, EMOJI_MAP, COVER_CONSTANT_MS } from '../shared/constants.js';
 import { KeyManager } from '../crypto/KeyManager.js';
 import { Handshake } from '../crypto/Handshake.js';
@@ -41,10 +52,12 @@ import { setTheme, getThemeName, themeNames } from '../shared/themes.js';
 import { panicWipe } from '../shared/panic.js';
 import { farewellBanner } from '../shared/banner.js';
 import { parseDndWindow, shouldNotify, nowMinutes, mentionsMe } from '../shared/dnd.js';
+import { saveLastSession } from '../shared/lastSession.js';
 import { COMMANDS } from './UI.js';
 
 const TYPING_SEND_INTERVAL = 2000; // debounce: max 1 typing event per 2s
 const TYPING_EXPIRE_TIMEOUT = 3000; // hide indicator after 3s of silence
+const MENTIONS_MAX = 50; // session mention log cap (memory only, never persisted)
 
 export class ChatController {
   #nickname;
@@ -96,6 +109,13 @@ export class ChatController {
   #autoAwayMs = 0; // idle timeout in ms (0 = off)
   #autoAwayTimer = null;
   #autoAwaySet = false; // whether the current away was set automatically
+  #mentions = []; // session mention log: { nickname, text, room, at }
+  #awayUnread = 0; // messages received while away
+  #awayMentions = 0; // …of which mentioned me
+  #autoLockMs = 0; // idle screen-lock timeout (0 = off)
+  #autoLockTimer = null;
+  #roomSecrets = null; // active private-room secrets { room, authSecretKey, roomKey, … }
+  #pendingRoomSecrets = null; // derived while joining/creating, promoted on ROOM_CHANGED
 
   constructor(
     nickname,
@@ -237,6 +257,16 @@ export class ChatController {
       this.destroy();
       process.exit(0);
     });
+
+    this.#ui.on('unlocked', () => {
+      this.#auditLog.log(AuditEvent.SCREEN_UNLOCKED, {});
+      this.#ui.addSystemMessage('Screen unlocked');
+      this.#noteActive();
+    });
+
+    this.#ui.on('lock-failed', () => {
+      this.#auditLog.log(AuditEvent.SCREEN_UNLOCK_FAILED, {});
+    });
   }
 
   // ── Auto-away (idle) ────────────────────────────────────────
@@ -248,9 +278,52 @@ export class ChatController {
       this.#autoAwaySet = false;
       this.#ui.removeHeaderIndicator('away');
       this.#ui.addSystemMessage("You're back (auto)");
+      this.#reportAwayUnread();
       this.#broadcastPresence();
     }
     this.#armAutoAway();
+    this.#armAutoLock();
+  }
+
+  // ── Screen lock (privacy, not duress — that's /panic) ────────
+  #lockNow() {
+    if (!this.#passphrase) {
+      this.#ui.addErrorMessage(
+        'No session passphrase — /lock needs one (set it at startup to enable locking)',
+      );
+      return;
+    }
+    if (this.#ui.isLocked) {
+      return;
+    }
+    this.#auditLog.log(AuditEvent.SCREEN_LOCKED, {});
+    this.#ui.showLock((attempt) => attempt === this.#passphrase);
+  }
+
+  #armAutoLock() {
+    if (this.#autoLockTimer) {
+      clearTimeout(this.#autoLockTimer);
+      this.#autoLockTimer = null;
+    }
+    if (this.#autoLockMs > 0) {
+      this.#autoLockTimer = setTimeout(() => this.#lockNow(), this.#autoLockMs);
+      if (this.#autoLockTimer.unref) {
+        this.#autoLockTimer.unref();
+      }
+    }
+  }
+
+  // Summarize what arrived while away, then reset the counters.
+  #reportAwayUnread() {
+    if (this.#awayUnread > 0) {
+      const mentions =
+        this.#awayMentions > 0 ? ` — ${this.#awayMentions} mention(s), see /mentions` : '';
+      this.#ui.addSystemMessage(
+        `While you were away: ${this.#awayUnread} new message(s)${mentions}`,
+      );
+    }
+    this.#awayUnread = 0;
+    this.#awayMentions = 0;
   }
 
   #armAutoAway() {
@@ -273,6 +346,8 @@ export class ChatController {
     this.#away = true;
     this.#awayReason = 'away (idle)';
     this.#autoAwaySet = true;
+    this.#awayUnread = 0;
+    this.#awayMentions = 0;
     this.#ui.setHeaderIndicator('away', '{yellow-fg}[away]{/yellow-fg}');
     this.#ui.addSystemMessage('Auto-away: marked as away due to inactivity');
     this.#broadcastPresence();
@@ -348,6 +423,10 @@ export class ChatController {
         this.#onRoomChanged(msg);
         break;
 
+      case MSG.ROOM_CHALLENGE:
+        this.#onRoomChallenge(msg);
+        break;
+
       case MSG.ROOM_LIST:
         this.#onRoomList(msg);
         break;
@@ -365,6 +444,11 @@ export class ChatController {
           this.#ui.addErrorMessage(
             `${msg.message}. Use /nick <other> to pick a different nickname.`,
           );
+        } else if (msg.code === ERR.ROOM_AUTH_FAILED || msg.code === ERR.ROOM_EXISTS) {
+          // Join/create refused — drop the derived secrets for that attempt.
+          freeRoomSecrets(this.#pendingRoomSecrets);
+          this.#pendingRoomSecrets = null;
+          this.#ui.addErrorMessage(`Error: ${msg.message} (${msg.code})`);
         } else {
           this.#ui.addErrorMessage(`Error: ${msg.message} (${msg.code})`);
         }
@@ -408,6 +492,14 @@ export class ChatController {
     this.#ui.setRoom(this.#currentRoom);
     this.#currentRoomOwner = msg.roomOwner || null;
 
+    // (Re)joining always lands in a public room — drop any private-room keys.
+    if (this.#roomSecrets && this.#roomSecrets.room !== this.#currentRoom) {
+      freeRoomSecrets(this.#roomSecrets);
+      this.#roomSecrets = null;
+      this.#ui.removeHeaderIndicator('private');
+      this.#ui.addInfoMessage('Reconnected outside the private room — /join it again.');
+    }
+
     // Build map of old sessionIds by nickname for ratchet migration
     const oldSessionByNick = new Map();
     for (const [sid, peer] of this.#peers) {
@@ -453,6 +545,17 @@ export class ChatController {
       this.#connection.send(createChangeRoom(this.#inviteRoom));
       this.#inviteRoom = null;
     }
+
+    this.#saveLastSession();
+  }
+
+  // Remember where we are for the next launch. Privacy: in a private room only
+  // the server is written — the room name never touches disk.
+  #saveLastSession(isPrivate = false) {
+    saveLastSession({
+      server: (this.#connection.url || '').replace(/^wss?:\/\//, ''),
+      room: isPrivate || this.#roomSecrets ? undefined : this.#currentRoom,
+    });
   }
 
   // ── New peer arrived ──────────────────────────────────────────
@@ -507,6 +610,19 @@ export class ChatController {
 
   // ── Received encrypted message ────────────────────────────────
   #onEncryptedMessage(msg) {
+    // Sealed sender: the relay handed us only `to` + an opaque blob. Open it
+    // with our identity key to recover the real sender + payload; from here the
+    // rest of the handler is unchanged. A blob that isn't for us (or is tampered)
+    // simply fails to open and is dropped.
+    if (typeof msg.sealed === 'string') {
+      const opened = this.#openSealed(msg.sealed);
+      if (!opened || typeof opened.from !== 'string' || !opened.payload) {
+        return;
+      }
+      // Rebind to a fresh object — never mutate the received message.
+      msg = { ...msg, from: opened.from, payload: opened.payload };
+    }
+
     const peer = this.#peers.get(msg.from);
     if (!peer) {
       this.#ui.addErrorMessage('Message from unknown peer');
@@ -597,7 +713,20 @@ export class ChatController {
     }
 
     try {
-      const data = JSON.parse(plaintext.toString('utf-8'));
+      let data = JSON.parse(plaintext.toString('utf-8'));
+
+      // Private-room layer: unwrap with the room key. Content we can't read
+      // (no key, or stale key after a room switch) is dropped silently.
+      if (isRoomWrapped(data)) {
+        if (!this.#roomSecrets) {
+          return;
+        }
+        const inner = decryptRoomPayload(data, this.#roomSecrets.roomKey);
+        if (!inner) {
+          return;
+        }
+        data = JSON.parse(inner);
+      }
 
       // Cover traffic: a decoy — drop it silently (no UI, no history, no receipt).
       if (isCover(data)) {
@@ -828,6 +957,28 @@ export class ChatController {
       }
 
       const mentioned = this.#mentionsMe(data.text) && !data.isDM;
+      if (mentioned) {
+        this.#mentions.push({
+          nickname: peer.nickname,
+          text: data.text,
+          room: this.#currentRoom,
+          at: Date.now(),
+        });
+        if (this.#mentions.length > MENTIONS_MAX) {
+          this.#mentions.shift();
+        }
+      }
+      // Away: count what's arriving and keep the header badge live.
+      if (this.#away) {
+        this.#awayUnread++;
+        if (mentioned) {
+          this.#awayMentions++;
+        }
+        this.#ui.setHeaderIndicator(
+          'away',
+          `{yellow-fg}[away · ${this.#awayUnread} new]{/yellow-fg}`,
+        );
+      }
       const ephLabel = data.ephemeral ? this.#formatDuration(data.ephemeral) : null;
       const trust = trustBadge(this.#trustStore.getPeerRecord(peer.nickname), peer.publicKey);
       const { lineIndex } = this.#ui.addMessage(
@@ -912,11 +1063,18 @@ export class ChatController {
         this.#ui.addInfoMessage('  /users               - List online users');
         this.#ui.addInfoMessage('  /msg <nick> <text>   - Send a private message (DM)');
         this.#ui.addInfoMessage('  /reply <text>        - Reply to the last received message');
-        this.#ui.addInfoMessage('  /away [reason]       - Mark yourself as away');
+        this.#ui.addInfoMessage('  /mentions [n]        - Recent mentions of you (this session)');
+        this.#ui.addInfoMessage('  /contacts [add|remove|all] - Contact book (aliases for peers)');
+        this.#ui.addInfoMessage(
+          '  /away [reason]       - Mark yourself as away (unreads are counted)',
+        );
         this.#ui.addInfoMessage('  /back                - Clear the away status');
         this.#ui.addInfoMessage('  /autoaway <min|off>  - Auto-away on inactivity');
+        this.#ui.addInfoMessage('  /lock                - Lock the screen (session passphrase)');
+        this.#ui.addInfoMessage('  /autolock <min|off>  - Auto-lock on inactivity');
         this.#ui.addInfoMessage('  /status <text|off>   - Set a status (accepts :emoji:)');
-        this.#ui.addInfoMessage('  /join <room>         - Join a room');
+        this.#ui.addInfoMessage('  /join <room> [pass]  - Join a room (password if private)');
+        this.#ui.addInfoMessage('  /create <room> <pass> - Create a private room 🔒');
         this.#ui.addInfoMessage('  /invite [host:port]  - Generate an invite with QR code');
         this.#ui.addInfoMessage('  /rooms               - List available rooms');
         this.#ui.addInfoMessage('  /room                - Show the current room');
@@ -969,6 +1127,10 @@ export class ChatController {
       case '/users': {
         const names = [...this.#peers.values()].map((p) => {
           let label = p.nickname;
+          const alias = this.#trustStore.getAlias(p.nickname);
+          if (alias) {
+            label += ` (${alias})`;
+          }
           if (p.away) {
             label += ` [away${p.awayReason ? `: ${p.awayReason}` : ''}]`;
           }
@@ -1179,10 +1341,38 @@ export class ChatController {
       case '/join': {
         const roomName = parts[1];
         if (!roomName) {
-          this.#ui.addErrorMessage('Usage: /join <room>');
+          this.#ui.addErrorMessage('Usage: /join <room> [password]');
           break;
         }
-        this.#connection.send(createChangeRoom(roomName));
+        const joinPassword = parts.slice(2).join(' ');
+        if (joinPassword) {
+          // Derive now so we can answer the server's challenge immediately.
+          this.#prepareRoomSecrets(roomName, joinPassword, () => {
+            this.#connection.send(createChangeRoom(roomName));
+          });
+        } else {
+          this.#connection.send(createChangeRoom(roomName));
+        }
+        break;
+      }
+
+      case '/create': {
+        const roomName = parts[1];
+        if (!roomName) {
+          this.#ui.addErrorMessage('Usage: /create <room> <password>');
+          break;
+        }
+        const createPassword = parts.slice(2).join(' ');
+        if (!createPassword) {
+          // No password — same as joining/creating a public room.
+          this.#connection.send(createChangeRoom(roomName));
+          break;
+        }
+        this.#prepareRoomSecrets(roomName, createPassword, (secrets) => {
+          this.#connection.send(
+            createChangeRoom(roomName, secrets.authPublicKey.toString('base64')),
+          );
+        });
         break;
       }
 
@@ -1219,7 +1409,9 @@ export class ChatController {
       }
 
       case '/room':
-        this.#ui.addInfoMessage(`Current room: #${this.#currentRoom}`);
+        this.#ui.addInfoMessage(
+          `Current room: #${this.#currentRoom}${this.#roomSecrets ? ' 🔒 (private)' : ''}`,
+        );
         break;
 
       case '/tips': {
@@ -1250,6 +1442,8 @@ export class ChatController {
       case '/away': {
         this.#away = true;
         this.#autoAwaySet = false; // an explicit /away is not auto
+        this.#awayUnread = 0;
+        this.#awayMentions = 0;
         this.#awayReason = applyShortcodes(parts.slice(1).join(' ')).slice(0, 60) || null;
         this.#ui.setHeaderIndicator('away', '{yellow-fg}[away]{/yellow-fg}');
         this.#ui.addInfoMessage(
@@ -1269,10 +1463,124 @@ export class ChatController {
         this.#autoAwaySet = false;
         this.#ui.removeHeaderIndicator('away');
         this.#ui.addInfoMessage("You're back");
+        this.#reportAwayUnread();
         this.#broadcastPresence();
         break;
       }
 
+      case '/contacts': {
+        const sub = (parts[1] || 'list').toLowerCase();
+
+        if (sub === 'add') {
+          const nick = parts[2];
+          const alias = parts.slice(3).join(' ').trim();
+          if (!nick || !alias) {
+            this.#ui.addErrorMessage('Usage: /contacts add <nick> <alias>');
+            break;
+          }
+          if (this.#trustStore.setAlias(nick, alias)) {
+            this.#ui.addInfoMessage(`Contact saved: ${nick} → "${alias.slice(0, 30)}"`);
+          } else {
+            this.#ui.addErrorMessage(
+              `"${nick}" was never seen on this identity — no trust record to alias`,
+            );
+          }
+          break;
+        }
+
+        if (sub === 'remove') {
+          const nick = parts[2];
+          if (!nick) {
+            this.#ui.addErrorMessage('Usage: /contacts remove <nick>');
+            break;
+          }
+          if (this.#trustStore.clearAlias(nick)) {
+            this.#ui.addInfoMessage(`Alias removed from ${nick}`);
+          } else {
+            this.#ui.addErrorMessage(`${nick} has no alias`);
+          }
+          break;
+        }
+
+        if (sub !== 'list' && sub !== 'all') {
+          this.#ui.addErrorMessage('Usage: /contacts [add <nick> <alias> | remove <nick> | all]');
+          break;
+        }
+
+        const contacts = this.#trustStore.listContacts(sub === 'all');
+        if (contacts.length === 0) {
+          this.#ui.addInfoMessage(
+            sub === 'all'
+              ? 'No peers known yet.'
+              : 'No contacts yet. Use /contacts add <nick> <alias>',
+          );
+          break;
+        }
+        this.#ui.addInfoMessage(sub === 'all' ? 'Known peers:' : 'Contacts:');
+        for (const c of contacts) {
+          const badge = c.verified ? ' ✓' : '';
+          const alias = c.alias ? ` (${c.alias})` : '';
+          const seen = c.lastSeen
+            ? ` — last seen ${new Date(c.lastSeen).toLocaleString('en-US', {
+                day: '2-digit',
+                month: '2-digit',
+                hour: '2-digit',
+                minute: '2-digit',
+              })}`
+            : '';
+          this.#ui.addInfoMessage(`  ${c.nickname}${alias}${badge}${seen}`);
+        }
+        break;
+      }
+
+      case '/mentions': {
+        if (this.#mentions.length === 0) {
+          this.#ui.addInfoMessage('No mentions in this session yet.');
+          break;
+        }
+        const count = Math.min(parseInt(parts[1], 10) || 10, this.#mentions.length);
+        this.#ui.addInfoMessage(`Last ${count} mention(s) of you:`);
+        for (const m of this.#mentions.slice(-count)) {
+          const when = new Date(m.at).toLocaleString('en-US', {
+            hour: '2-digit',
+            minute: '2-digit',
+          });
+          this.#ui.addInfoMessage(`  [${when}] [#${m.room}] ${m.nickname}: ${m.text.slice(0, 80)}`);
+        }
+        break;
+      }
+
+      case '/lock':
+        this.#lockNow();
+        break;
+
+      case '/autolock': {
+        const alArg = parts[1]?.toLowerCase();
+        if (alArg === 'off' || alArg === '0') {
+          this.#autoLockMs = 0;
+          this.#armAutoLock();
+          this.#ui.addInfoMessage('Auto-lock disabled');
+          break;
+        }
+        const alMin = parseInt(alArg, 10);
+        if (!Number.isInteger(alMin) || alMin < 1 || alMin > 240) {
+          this.#ui.addInfoMessage(
+            `Auto-lock: ${this.#autoLockMs ? `${this.#autoLockMs / 60000}min` : 'off'}. Usage: /autolock <minutes|off>`,
+          );
+          break;
+        }
+        if (!this.#passphrase) {
+          this.#ui.addErrorMessage(
+            'No session passphrase — auto-lock needs one (set it at startup)',
+          );
+          break;
+        }
+        this.#autoLockMs = alMin * 60_000;
+        this.#armAutoLock();
+        this.#ui.addInfoMessage(`Auto-lock after ${alMin}min of inactivity`);
+        break;
+      }
+
       case '/autoaway': {
         const aaArg = parts[1]?.toLowerCase();
         if (aaArg === 'off' || aaArg === '0') {
@@ -1900,7 +2208,15 @@ export class ChatController {
         if (this.#pluginManager) {
           const result = this.#pluginManager.handleCommand(cmd, parts.slice(1));
           if (result) {
-            this.#ui.addInfoMessage(result);
+            // Plugin API: `{ send }` goes to the room as a normal E2EE
+            // message; `{ info }` or a plain string stays local.
+            if (typeof result === 'object' && typeof result.send === 'string' && result.send) {
+              this.#sendMessageToAll(result.send);
+            } else if (typeof result === 'object' && typeof result.info === 'string') {
+              this.#ui.addInfoMessage(result.info);
+            } else if (typeof result === 'string') {
+              this.#ui.addInfoMessage(result);
+            }
             break;
           }
         }
@@ -1989,12 +2305,68 @@ export class ChatController {
     this.#ui.addSystemMessage(`${peer.nickname} updated key (via server — unauthenticated)`);
   }
 
+  // ── Private rooms: derive secrets off the input handler ─────
+  // Argon2id (MODERATE) blocks for ~1s — let the UI paint the notice first.
+  #prepareRoomSecrets(roomName, password, onReady) {
+    const room = roomName.toLowerCase();
+    this.#ui.addInfoMessage('Deriving room key (Argon2id)…');
+    setImmediate(() => {
+      freeRoomSecrets(this.#pendingRoomSecrets);
+      const secrets = deriveRoomSecrets(room, password);
+      this.#pendingRoomSecrets = { room, ...secrets };
+      onReady(secrets);
+    });
+  }
+
+  // ── Handle ROOM_CHALLENGE (target room is private) ──────────
+  #onRoomChallenge(msg) {
+    const pending = this.#pendingRoomSecrets;
+    if (!pending || pending.room !== msg.room) {
+      this.#ui.addErrorMessage(`Room #${msg.room} is private. Usage: /join ${msg.room} <password>`);
+      return;
+    }
+    const signature = signRoomChallenge(
+      pending.authSecretKey,
+      msg.room,
+      msg.nonce,
+      this.#sessionId,
+    );
+    this.#connection.send(createRoomAuth(msg.room, msg.nonce, signature.toString('base64')));
+  }
+
   // ── Handle ROOM_CHANGED (after /join) ──────────────────────
   #onRoomChanged(msg) {
     this.#currentRoom = msg.room;
     this.#ui.setRoom(this.#currentRoom);
     this.#currentRoomOwner = msg.roomOwner || null;
 
+    // Rotate private-room secrets: drop the old room's, promote the pending
+    // ones when the server confirms the new room is private.
+    if (this.#roomSecrets) {
+      freeRoomSecrets(this.#roomSecrets);
+      this.#roomSecrets = null;
+    }
+    if (this.#pendingRoomSecrets?.room === msg.room) {
+      if (msg.private) {
+        this.#roomSecrets = this.#pendingRoomSecrets;
+      } else {
+        // Old server without private-room support silently made it public.
+        freeRoomSecrets(this.#pendingRoomSecrets);
+        this.#ui.addErrorMessage(
+          'WARNING: this server does not support private rooms — the room is PUBLIC and anyone can join.',
+        );
+      }
+      this.#pendingRoomSecrets = null;
+    } else if (this.#pendingRoomSecrets) {
+      freeRoomSecrets(this.#pendingRoomSecrets);
+      this.#pendingRoomSecrets = null;
+    }
+    if (this.#roomSecrets) {
+      this.#ui.setHeaderIndicator('private', '{green-fg}[🔒]{/green-fg}');
+    } else {
+      this.#ui.removeHeaderIndicator('private');
+    }
+
     // Clear old peers and pins
     this.#peers.clear();
     this.#pinnedMessages = [];
@@ -2018,7 +2390,12 @@ export class ChatController {
     this.#ui.setOnlineCount(this.#peers.size + 1);
     this.#ui.setPeerNames(peerNames);
     this.#auditLog.log(AuditEvent.ROOM_CHANGED, { room: msg.room });
-    this.#ui.addSystemMessage(`You joined room #${msg.room}`);
+    if (this.#roomSecrets) {
+      this.#ui.addSystemMessage(`You joined private room #${msg.room} 🔒`);
+      this.#ui.addInfoMessage('Messages here get an extra layer encrypted with the room key.');
+    } else {
+      this.#ui.addSystemMessage(`You joined room #${msg.room}`);
+    }
 
     if (peerNames.length > 0) {
       this.#ui.addSystemMessage(`Online: ${peerNames.join(', ')}`);
@@ -2028,6 +2405,8 @@ export class ChatController {
     if (this.#away || this.#statusText) {
       this.#broadcastPresence();
     }
+
+    this.#saveLastSession(!!msg.private);
   }
 
   // ── Handle ROOM_LIST ───────────────────────────────────────
@@ -2035,7 +2414,8 @@ export class ChatController {
     this.#ui.addInfoMessage('Available rooms:');
     for (const room of msg.rooms) {
       const current = room.name === this.#currentRoom ? ' (current)' : '';
-      this.#ui.addInfoMessage(`  #${room.name} — ${room.memberCount} member(s)${current}`);
+      const lock = room.private ? ' 🔒' : '';
+      this.#ui.addInfoMessage(`  #${room.name}${lock} — ${room.memberCount} member(s)${current}`);
     }
   }
 
@@ -2121,6 +2501,28 @@ export class ChatController {
     }
   }
 
+  // Sealed sender: wrap an outgoing wire message so the relay sees only `to` and
+  // an opaque blob. The sender identity (`from`) + the payload are sealed to the
+  // recipient's key — only they can open it.
+  #sealAndSend(recipientPublicKey, wireMsg) {
+    const sealed = sealEnvelope(wireMsg.from, wireMsg.payload, recipientPublicKey);
+    this.#connection.send(createSealedMessage(wireMsg.to, sealed));
+  }
+
+  // Open a sealed envelope with our identity key, falling back to the previous
+  // key during the post-rotation grace window. Returns { from, payload } or null.
+  #openSealed(sealedB64) {
+    let opened = openEnvelope(sealedB64, this.#keyManager.publicKey, this.#keyManager.secretKey);
+    if (!opened && this.#keyManager.previousPublicKey) {
+      opened = openEnvelope(
+        sealedB64,
+        this.#keyManager.previousPublicKey,
+        this.#keyManager.previousSecretKey,
+      );
+    }
+    return opened;
+  }
+
   // ── Send encrypted payload to a single peer ────────────────────
   #sendPayloadToPeer(peerId, payload) {
     const peerPublicKey = this.#handshake.getPeerPublicKey(peerId);
@@ -2128,11 +2530,16 @@ export class ChatController {
       return;
     }
 
+    // Private room: extra symmetric layer under the pairwise encryption.
+    if (this.#roomSecrets) {
+      payload = encryptRoomPayload(payload, this.#roomSecrets.roomKey);
+    }
+
     const ratchet = this.#handshake.getRatchet(peerId);
     if (ratchet && ratchet.isInitialized) {
       try {
         const result = ratchet.encrypt(payload);
-        this.#connection.send(createRatchetedMessage(this.#sessionId, peerId, result));
+        this.#sealAndSend(peerPublicKey, createRatchetedMessage(this.#sessionId, peerId, result));
         return;
       } catch {
         // Fall through to static path
@@ -2146,7 +2553,8 @@ export class ChatController {
       peerPublicKey,
       this.#handshake.secretKey,
     );
-    this.#connection.send(
+    this.#sealAndSend(
+      peerPublicKey,
       createEncryptedMessage(
         this.#sessionId,
         peerId,
@@ -2244,6 +2652,12 @@ export class ChatController {
 
   // ── Broadcast encrypted payload to all peers ───────────────────
   #broadcastPayload(payload, deniable = false) {
+    // Private room: extra symmetric layer under the pairwise encryption, so
+    // even a relay-injected member can't read the room without the password.
+    if (this.#roomSecrets) {
+      payload = encryptRoomPayload(payload, this.#roomSecrets.roomKey);
+    }
+
     for (const [peerId] of this.#peers) {
       const peerPublicKey = this.#handshake.getPeerPublicKey(peerId);
       if (!peerPublicKey) {
@@ -2262,7 +2676,7 @@ export class ChatController {
           nonce.toString('base64'),
         );
         msg.payload.deniable = true;
-        this.#connection.send(msg);
+        this.#sealAndSend(peerPublicKey, msg);
         continue;
       }
 
@@ -2271,7 +2685,7 @@ export class ChatController {
       if (ratchet && ratchet.isInitialized) {
         try {
           const result = ratchet.encrypt(payload);
-          this.#connection.send(createRatchetedMessage(this.#sessionId, peerId, result));
+          this.#sealAndSend(peerPublicKey, createRatchetedMessage(this.#sessionId, peerId, result));
           continue;
         } catch {
           // Ratchet failed — fall through to static path
@@ -2287,7 +2701,8 @@ export class ChatController {
         this.#handshake.secretKey,
       );
 
-      this.#connection.send(
+      this.#sealAndSend(
+        peerPublicKey,
         createEncryptedMessage(
           this.#sessionId,
           peerId,