ciphermesh 1.2.1 → 2.1.0

package/src/client/UI.js

@@ -19,10 +19,13 @@ const COMMAND_INFO = [
   ['/users', 'List online users'],
   ['/msg', 'Private message (DM)'],
   ['/reply', 'Reply to the last message'],
+  ['/mentions', 'Recent mentions of you'],
+  ['/contacts', 'Contact book — aliases for peers'],
   ['/away', 'Mark yourself as away'],
   ['/back', 'Clear away status'],
   ['/status', 'Set a status'],
-  ['/join', 'Join a room'],
+  ['/join', 'Join a room (password if private)'],
+  ['/create', 'Create a private room with a password'],
   ['/rooms', 'List rooms'],
   ['/room', 'Show the current room'],
   ['/invite', 'Generate an invite with QR'],
@@ -54,6 +57,8 @@ const COMMAND_INFO = [
   ['/receipts', 'Read receipts'],
   ['/cover', 'Cover traffic (anti-metadata)'],
   ['/theme', 'Nick color theme'],
+  ['/lock', 'Lock the screen (session passphrase to unlock)'],
+  ['/autolock', 'Auto-lock on inactivity'],
   ['/panic', 'Wipe everything from disk and exit (duress)'],
   ['/kick', 'Kick a user (owner)'],
   ['/mute', 'Mute a user (owner)'],
@@ -83,6 +88,8 @@ export const COMMANDS = [
   '/sound',
   '/msg',
   '/reply',
+  '/mentions',
+  '/contacts',
   '/away',
   '/back',
   '/autoaway',
@@ -90,6 +97,7 @@ export const COMMANDS = [
   '/notify',
   '/dnd',
   '/join',
+  '/create',
   '/rooms',
   '/room',
   '/invite',
@@ -110,6 +118,8 @@ export const COMMANDS = [
   '/receipts',
   '/cover',
   '/theme',
+  '/lock',
+  '/autolock',
   '/panic',
   '/kick',
   '/mute',
@@ -302,6 +312,23 @@ export function renderMarkdown(text) {
   return out.join('\n');
 }
 
+// Sanitizes pasted text while PRESERVING its line structure — the input box is
+// multi-line and fenced code blocks render in markdown, so pasted code must
+// keep its newlines. Normalizes CRLF/CR, turns tabs into spaces and strips the
+// remaining control chars (incl. stray paste markers). Pure and exported for
+// testing.
+export function cleanPaste(raw) {
+  return (
+    raw
+      // eslint-disable-next-line no-control-regex
+      .replace(/\x1b\[20[01]~/g, '')
+      .replace(/\r\n?/g, '\n')
+      .replace(/\t/g, '  ')
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x00-\x09\x0b-\x1f\x7f]/g, '')
+  );
+}
+
 // Builds the rendered content of the (possibly multi-line) input box with an
 // inverse cursor cell, windowed so the cursor line is always visible. Pure and
 // exported for testing. Returns { content, height } (height includes borders).
@@ -466,6 +493,11 @@ export class UI extends EventEmitter {
   #emojiPicker;
   #emojiOpen;
   #emojiQuery;
+  #locked;
+  #lockBox;
+  #lockInput;
+  #lockError;
+  #lockVerify;
 
   constructor(nickname) {
     super();
@@ -511,6 +543,10 @@ export class UI extends EventEmitter {
     this.#paletteQuery = '';
     this.#emojiOpen = false;
     this.#emojiQuery = '';
+    this.#locked = false;
+    this.#lockInput = '';
+    this.#lockError = false;
+    this.#lockVerify = null;
 
     // blessed's terminfo parser can't compile the modern Setulc (underline
     // colour) capability that terminals like ghostty ship, so it dumps a
@@ -670,6 +706,12 @@ export class UI extends EventEmitter {
       }
       this.#lastKeyEvent = { seq, time: now };
 
+      // Locked screen swallows everything except the passphrase entry.
+      if (this.#locked) {
+        this.#handleLockKey(ch, key);
+        return;
+      }
+
       if (this.#paletteOpen) {
         this.#handlePaletteKey(ch, key);
         return;
@@ -833,6 +875,87 @@ export class UI extends EventEmitter {
     }
   }
 
+  // ── Screen lock ──────────────────────────────────────────────
+  // Fullscreen overlay that hides the chat and swallows all input until the
+  // session passphrase is re-entered. `verify` is a callback so the passphrase
+  // itself never lives in the UI layer.
+  showLock(verify) {
+    if (this.#locked || typeof verify !== 'function') {
+      return;
+    }
+    this.#locked = true;
+    this.#lockVerify = verify;
+    this.#lockInput = '';
+    this.#lockError = false;
+    this.#lockBox = blessed.box({
+      parent: this.#screen,
+      top: 0,
+      left: 0,
+      width: '100%',
+      height: '100%',
+      tags: true,
+      style: { bg: 'black', fg: 'white' },
+    });
+    this.#lockBox.setFront();
+    this.#renderLock();
+  }
+
+  get isLocked() {
+    return this.#locked;
+  }
+
+  #renderLock() {
+    if (!this.#lockBox) {
+      return;
+    }
+    const dots = '●'.repeat(Math.min(this.#lockInput.length, 40));
+    const error = this.#lockError ? '{red-fg}Wrong passphrase — try again{/red-fg}' : '';
+    const pad = '\n'.repeat(Math.max(1, Math.floor((this.#screen.height - 8) / 2)));
+    this.#lockBox.setContent(
+      `${pad}{center}{bold}🔒  Session locked{/bold}{/center}\n` +
+        `{center}{#8888aa-fg}Messages keep arriving encrypted underneath{/#8888aa-fg}{/center}\n\n` +
+        `{center}Passphrase: ${dots}{inverse} {/inverse}{/center}\n` +
+        `{center}${error}{/center}`,
+    );
+    this.#screen.render();
+  }
+
+  #handleLockKey(ch, key) {
+    const name = key.name || '';
+    if (key.ctrl && name === 'c') {
+      this.emit('quit'); // locking is privacy, not a prison
+      return;
+    }
+    if (name === 'return' || name === 'enter') {
+      if (this.#lockVerify(this.#lockInput)) {
+        this.#lockBox.destroy();
+        this.#lockBox = null;
+        this.#locked = false;
+        this.#lockVerify = null;
+        this.#lockInput = '';
+        this.#lockError = false;
+        this.#screen.render();
+        this.emit('unlocked');
+      } else {
+        this.#lockError = true;
+        this.#lockInput = '';
+        this.emit('lock-failed');
+        this.#renderLock();
+      }
+      return;
+    }
+    if (name === 'backspace') {
+      this.#lockInput = this.#lockInput.slice(0, -1);
+      this.#renderLock();
+      return;
+    }
+    const code = ch ? ch.charCodeAt(0) : 0;
+    if (ch && ch.length <= 2 && !key.ctrl && !key.meta && code > 0x1f && code !== 0x7f) {
+      this.#lockInput += ch;
+      this.#renderLock();
+    }
+  }
+
   // Bracketed-paste state machine. Returns true when the sequence is part of a
   // paste (start / content / end) and must not be treated as normal keypresses.
   #handlePaste(seq) {
@@ -870,9 +993,10 @@ export class UI extends EventEmitter {
   }
 
   #insertPaste(raw) {
-    // Strip any stray paste markers and control chars (a message is one line).
-    // eslint-disable-next-line no-control-regex
-    const clean = raw.replace(/\x1b\[20[01]~/g, '').replace(/[\x00-\x1f\x7f]/g, '');
+    if (this.#locked) {
+      return; // no pasting into a locked screen
+    }
+    const clean = cleanPaste(raw);
     if (!clean) {
       return;
     }

package/src/client/index.js

@@ -17,7 +17,9 @@ import { HistoryStore } from '../crypto/HistoryStore.js';
 import { parseInvite } from '../shared/invite.js';
 import { importBackup } from '../crypto/IdentityBackup.js';
 import { questionHidden } from '../shared/prompt.js';
-import { loadConfig, startupCommands } from '../shared/config.js';
+import { loadConfig, hasConfigFile, startupCommands } from '../shared/config.js';
+import { runOnboarding } from '../shared/onboarding.js';
+import { loadLastSession, clearLastSession } from '../shared/lastSession.js';
 import { randomTip } from '../shared/tips.js';
 import { setTheme } from '../shared/themes.js';
 import { Connection } from './Connection.js';
@@ -37,7 +39,31 @@ if (config.theme) {
 // ── Prompt setup ────────────────────────────────────────────────
 const rl = readline.createInterface({ input: stdin, output: stdout });
 
-let nickname = '';
+// ── First-run onboarding ────────────────────────────────────────
+// Runs once (no config file yet) or on demand with --setup; --no-onboard
+// skips it (scripts/CI). The wizard's answers double as this session's
+// nickname/server, so nothing is asked twice.
+const argvFlags = process.argv.slice(2);
+const forceSetup = argvFlags.includes('--setup');
+const skipOnboard = argvFlags.includes('--no-onboard') || !stdin.isTTY;
+const freshStart = argvFlags.includes('--fresh');
+
+// Last session (server + room) — restored unless --fresh wipes it.
+let lastSession = null;
+if (freshStart) {
+  clearLastSession();
+} else {
+  lastSession = loadLastSession();
+}
+let onboarded = null;
+if (forceSetup || (!hasConfigFile() && !skipOnboard)) {
+  onboarded = await runOnboarding(rl);
+  config.nickname = onboarded.nickname;
+  config.theme = onboarded.theme;
+  config.server = onboarded.server;
+}
+
+let nickname = onboarded?.nickname || '';
 while (!nickname) {
   const hint = config.nickname ? `(${config.nickname})` : '(a-z, 0-9, _, -)';
   const raw = await rl.question(promptLabel(`Nickname ${promptDim(hint)}: `));
@@ -112,11 +138,19 @@ if (!restoredState?.keyManager) {
   }
 }
 
-const defaultServer = config.server || `localhost:${SERVER_PORT}`;
-const serverInput = await rl.question(
-  promptLabel(`Server ${promptDim(`(${defaultServer} or ciphermesh:// invite)`)}: `),
-);
-const serverAddr = serverInput.trim() || defaultServer;
+// Most recent wins: last real session > configured default > localhost.
+const defaultServer = lastSession?.server || config.server || `localhost:${SERVER_PORT}`;
+let serverAddr;
+if (onboarded) {
+  // The wizard just asked — don't ask again this session.
+  serverAddr = onboarded.server;
+} else {
+  const hint = lastSession?.server
+    ? `(Enter = ${defaultServer}, your last session)`
+    : `(${defaultServer} or ciphermesh:// invite)`;
+  const serverInput = await rl.question(promptLabel(`Server ${promptDim(hint)}: `));
+  serverAddr = serverInput.trim() || defaultServer;
+}
 
 let wsUrl;
 let inviteRoom = null;
@@ -131,6 +165,15 @@ if (invite) {
       : `wss://${serverAddr}`;
 }
 
+// Rejoin the last room — only on the same server, and never a private one
+// (those are not saved). An explicit invite room wins.
+if (!inviteRoom && lastSession?.room && lastSession.room !== 'general') {
+  if (serverAddr === lastSession.server) {
+    inviteRoom = lastSession.room;
+    console.log(promptLabel(`Rejoining #${inviteRoom} ${promptDim('(--fresh starts clean)')}`));
+  }
+}
+
 rl.close();
 
 // ── Encrypted local history (opt-in, needs passphrase) ─────────

package/src/crypto/RoomKey.js

@@ -0,0 +1,162 @@
+import sodium from 'sodium-native';
+
+// Domain-separation contexts — never reuse across protocols.
+const ROOM_SALT_CONTEXT = 'ciphermesh/room-v1:';
+const ROOM_AUTH_CONTEXT = 'ciphermesh/room-auth-v1';
+
+/**
+ * Derive the secrets of a password-protected room.
+ *
+ * Argon2id(password, salt=BLAKE2b(context + roomName)) → 64 bytes, split into:
+ *  - authSeed (32B) → deterministic Ed25519 keypair. The PUBLIC key is the
+ *    verifier the server stores (in memory only); the secret key signs join
+ *    challenges. The server never sees the password — and cracking the
+ *    verifier costs a full Argon2id derivation per guess.
+ *  - roomKey (32B) → symmetric content key layered UNDER the pairwise E2EE,
+ *    so even a malicious relay that skips verification and injects a member
+ *    cannot read the room without the password.
+ *
+ * Everyone with (roomName, password) derives the same secrets — nothing else
+ * needs to be exchanged.
+ *
+ * @param {string} roomName - Normalized (lowercase) room name
+ * @param {string} password
+ * @returns {{ authPublicKey: Buffer, authSecretKey: Buffer, roomKey: Buffer }}
+ */
+export function deriveRoomSecrets(roomName, password) {
+  const salt = Buffer.alloc(sodium.crypto_pwhash_SALTBYTES);
+  sodium.crypto_generichash(salt, Buffer.from(ROOM_SALT_CONTEXT + roomName, 'utf-8'));
+
+  const seed = sodium.sodium_malloc(
+    sodium.crypto_sign_SEEDBYTES + sodium.crypto_secretbox_KEYBYTES,
+  );
+  sodium.crypto_pwhash(
+    seed,
+    Buffer.from(password, 'utf-8'),
+    salt,
+    sodium.crypto_pwhash_OPSLIMIT_MODERATE,
+    sodium.crypto_pwhash_MEMLIMIT_MODERATE,
+    sodium.crypto_pwhash_ALG_ARGON2ID13,
+  );
+
+  const authSeed = sodium.sodium_malloc(sodium.crypto_sign_SEEDBYTES);
+  seed.copy(authSeed, 0, 0, sodium.crypto_sign_SEEDBYTES);
+  const roomKey = sodium.sodium_malloc(sodium.crypto_secretbox_KEYBYTES);
+  seed.copy(roomKey, 0, sodium.crypto_sign_SEEDBYTES);
+  sodium.sodium_memzero(seed);
+
+  const authPublicKey = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES);
+  const authSecretKey = sodium.sodium_malloc(sodium.crypto_sign_SECRETKEYBYTES);
+  sodium.crypto_sign_seed_keypair(authPublicKey, authSecretKey, authSeed);
+  sodium.sodium_memzero(authSeed);
+
+  return { authPublicKey, authSecretKey, roomKey };
+}
+
+/**
+ * The exact bytes signed in the join challenge. Binds room + server nonce +
+ * the joiner's sessionId, so a captured signature can't be replayed for
+ * another session, room or challenge.
+ */
+function challengeMessage(room, nonceB64, sessionId) {
+  return Buffer.from(`${ROOM_AUTH_CONTEXT}:${room}:${nonceB64}:${sessionId}`, 'utf-8');
+}
+
+export function signRoomChallenge(authSecretKey, room, nonceB64, sessionId) {
+  const signature = Buffer.alloc(sodium.crypto_sign_BYTES);
+  sodium.crypto_sign_detached(
+    signature,
+    challengeMessage(room, nonceB64, sessionId),
+    authSecretKey,
+  );
+  return signature;
+}
+
+export function verifyRoomChallenge(authPublicKey, signature, room, nonceB64, sessionId) {
+  if (
+    !Buffer.isBuffer(authPublicKey) ||
+    authPublicKey.length !== sodium.crypto_sign_PUBLICKEYBYTES ||
+    !Buffer.isBuffer(signature) ||
+    signature.length !== sodium.crypto_sign_BYTES
+  ) {
+    return false;
+  }
+  try {
+    return sodium.crypto_sign_verify_detached(
+      signature,
+      challengeMessage(room, nonceB64, sessionId),
+      authPublicKey,
+    );
+  } catch {
+    return false;
+  }
+}
+
+// ── Room content layer ───────────────────────────────────────────
+// Applied to the payload BEFORE the pairwise encryption (ratchet/sealed
+// sender), which already pads the result — so no extra padding here.
+
+/**
+ * Wrap a payload string in the private-room symmetric layer.
+ * @returns {string} JSON `{ rk: 1, n, c }` to feed the pairwise encryption
+ */
+export function encryptRoomPayload(payloadStr, roomKey) {
+  const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES);
+  sodium.randombytes_buf(nonce);
+  const plaintext = Buffer.from(payloadStr, 'utf-8');
+  const ciphertext = Buffer.alloc(plaintext.length + sodium.crypto_secretbox_MACBYTES);
+  sodium.crypto_secretbox_easy(ciphertext, plaintext, nonce, roomKey);
+  sodium.sodium_memzero(plaintext);
+  return JSON.stringify({ rk: 1, n: nonce.toString('base64'), c: ciphertext.toString('base64') });
+}
+
+/** True if a decrypted payload object is a private-room wrapper. */
+export function isRoomWrapped(data) {
+  return (
+    data !== null &&
+    typeof data === 'object' &&
+    data.rk === 1 &&
+    typeof data.n === 'string' &&
+    typeof data.c === 'string'
+  );
+}
+
+/**
+ * Open the private-room layer. Returns the inner payload string, or null if
+ * the wrapper is malformed or the key doesn't match (wrong/stale room key).
+ */
+export function decryptRoomPayload(data, roomKey) {
+  if (!isRoomWrapped(data)) {
+    return null;
+  }
+  try {
+    const nonce = Buffer.from(data.n, 'base64');
+    const ciphertext = Buffer.from(data.c, 'base64');
+    if (
+      nonce.length !== sodium.crypto_secretbox_NONCEBYTES ||
+      ciphertext.length <= sodium.crypto_secretbox_MACBYTES
+    ) {
+      return null;
+    }
+    const plaintext = Buffer.alloc(ciphertext.length - sodium.crypto_secretbox_MACBYTES);
+    if (!sodium.crypto_secretbox_open_easy(plaintext, ciphertext, nonce, roomKey)) {
+      return null;
+    }
+    return plaintext.toString('utf-8');
+  } catch {
+    return null;
+  }
+}
+
+/** Zero out room secrets when leaving a private room. */
+export function freeRoomSecrets(secrets) {
+  if (!secrets) {
+    return;
+  }
+  if (Buffer.isBuffer(secrets.authSecretKey)) {
+    sodium.sodium_memzero(secrets.authSecretKey);
+  }
+  if (Buffer.isBuffer(secrets.roomKey)) {
+    sodium.sodium_memzero(secrets.roomKey);
+  }
+}

package/src/crypto/TrustStore.js

@@ -194,6 +194,53 @@ export class TrustStore {
     return this.#store.get(nickname.toLowerCase()) || null;
   }
 
+  // ── Contacts (friendly aliases on top of trust records) ──────
+  // The alias lives on the trust record, so it survives restarts and rides
+  // along in the existing identity backup for free.
+
+  /** Set a friendly alias for an already-seen peer. False if peer unknown. */
+  setAlias(nickname, alias) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record) {
+      return false;
+    }
+    record.alias = String(alias).slice(0, 30);
+    this.#save();
+    return true;
+  }
+
+  /** Remove a peer's alias. False if there was none. */
+  clearAlias(nickname) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record || !record.alias) {
+      return false;
+    }
+    delete record.alias;
+    this.#save();
+    return true;
+  }
+
+  getAlias(nickname) {
+    return this.#store.get(nickname.toLowerCase())?.alias || null;
+  }
+
+  /**
+   * The contact book: aliased peers, or every known peer with `all`.
+   * Sorted by most recently seen.
+   */
+  listContacts(all = false) {
+    return [...this.#store.entries()]
+      .filter(([, r]) => all || r.alias)
+      .map(([nickname, r]) => ({
+        nickname,
+        alias: r.alias || null,
+        verified: r.verified === true,
+        fingerprint: r.fingerprint,
+        lastSeen: r.lastSeen || 0,
+      }))
+      .sort((a, b) => b.lastSeen - a.lastSeen);
+  }
+
   /** Export all trust records as a plain object (for identity backup). */
   exportData() {
     return Object.fromEntries(this.#store);

package/src/p2p/P2PChatController.js

@@ -1368,7 +1368,15 @@ export class P2PChatController {
         if (this.#pluginManager) {
           const result = this.#pluginManager.handleCommand(cmd, parts.slice(1));
           if (result) {
-            this.#ui.addInfoMessage(result);
+            // Plugin API: `{ send }` goes to the room as a normal E2EE
+            // message; `{ info }` or a plain string stays local.
+            if (typeof result === 'object' && typeof result.send === 'string' && result.send) {
+              this.#sendMessageToAll(result.send);
+            } else if (typeof result === 'object' && typeof result.info === 'string') {
+              this.#ui.addInfoMessage(result.info);
+            } else if (typeof result === 'string') {
+              this.#ui.addInfoMessage(result);
+            }
             break;
           }
         }

package/src/protocol/messages.js

@@ -14,6 +14,8 @@ export const MSG = {
   ROOM_CHANGED: 'room_changed',
   LIST_ROOMS: 'list_rooms',
   ROOM_LIST: 'room_list',
+  ROOM_CHALLENGE: 'room_challenge',
+  ROOM_AUTH: 'room_auth',
   KICK_PEER: 'kick_peer',
   MUTE_PEER: 'mute_peer',
   BAN_PEER: 'ban_peer',
@@ -30,6 +32,8 @@ export const ERR = {
   PEER_NOT_FOUND: 'PEER_NOT_FOUND',
   RATE_LIMITED: 'RATE_LIMITED',
   PAYLOAD_TOO_LARGE: 'PAYLOAD_TOO_LARGE',
+  ROOM_AUTH_FAILED: 'ROOM_AUTH_FAILED',
+  ROOM_EXISTS: 'ROOM_EXISTS',
 };
 
 // ── Factory helpers ────────────────────────────────────────────
@@ -81,6 +85,13 @@ export function createRatchetedMessage(from, to, payload) {
   };
 }
 
+// Sealed-sender envelope (protocol v2): the relay sees only the recipient and an
+// opaque blob. The sender's identity + the inner payload are sealed to the
+// recipient's key (see crypto/SealedSender.js). There is deliberately no `from`.
+export function createSealedMessage(to, sealedB64) {
+  return { ...base(MSG.ENCRYPTED_MESSAGE), to, sealed: sealedB64 };
+}
+
 export function createError(code, message) {
   return { ...base(MSG.ERROR), code, message };
 }
@@ -101,12 +112,35 @@ export function createPong() {
   return base(MSG.PONG);
 }
 
-export function createChangeRoom(room) {
-  return { ...base(MSG.CHANGE_ROOM), room };
+// roomAuthPk (optional): Ed25519 verifier public key — present only when
+// CREATING a private room; the server stores it in memory as the room's
+// password verifier (see crypto/RoomKey.js).
+export function createChangeRoom(room, roomAuthPkB64 = null) {
+  const msg = { ...base(MSG.CHANGE_ROOM), room };
+  if (roomAuthPkB64) {
+    msg.roomAuthPk = roomAuthPkB64;
+  }
+  return msg;
+}
+
+export function createRoomChanged(room, peers, isPrivate = false) {
+  const msg = { ...base(MSG.ROOM_CHANGED), room, peers };
+  if (isPrivate) {
+    msg.private = true;
+  }
+  return msg;
+}
+
+// Server → client: the target room is private; prove password knowledge by
+// signing this nonce. The password itself never travels.
+export function createRoomChallenge(room, nonceB64) {
+  return { ...base(MSG.ROOM_CHALLENGE), room, nonce: nonceB64 };
 }
 
-export function createRoomChanged(room, peers) {
-  return { ...base(MSG.ROOM_CHANGED), room, peers };
+// Client → server: Ed25519 signature over (room, nonce, sessionId) with the
+// password-derived key (see crypto/RoomKey.js#signRoomChallenge).
+export function createRoomAuth(room, nonceB64, signatureB64) {
+  return { ...base(MSG.ROOM_AUTH), room, nonce: nonceB64, signature: signatureB64 };
 }
 
 export function createListRooms() {

package/src/protocol/validators.js

@@ -3,6 +3,9 @@ import {
   MAX_NICKNAME_LENGTH,
   MAX_PAYLOAD_SIZE,
   PUBLIC_KEY_SIZE,
+  ROOM_AUTH_PK_SIZE,
+  ROOM_AUTH_SIG_SIZE,
+  ROOM_CHALLENGE_NONCE_SIZE,
 } from '../shared/constants.js';
 
 // ── Helpers ────────────────────────────────────────────────────
@@ -86,33 +89,18 @@ export function validateJoin(msg) {
   return { valid: true, nickname: nick };
 }
 
+// Sealed sender (protocol v2): the relay only ever sees the recipient and an
+// opaque sealed blob — never the sender or the inner payload. So there is
+// nothing to validate here beyond routing target + a non-empty base64 envelope
+// (the overall size is already capped in validateMessage). The recipient's
+// unseal is fail-safe on garbage, so the relay needn't inspect further.
 export function validateEncryptedMessage(msg) {
-  if (!isString(msg.from) || !isString(msg.to)) {
-    return { valid: false, error: 'Missing from/to fields' };
+  if (!isString(msg.to)) {
+    return { valid: false, error: 'Missing to field' };
   }
-  if (!isObject(msg.payload)) {
-    return { valid: false, error: 'Missing payload' };
+  if (!isValidBase64(msg.sealed)) {
+    return { valid: false, error: 'Missing or invalid sealed envelope' };
   }
-  if (!isString(msg.payload.ciphertext) || !isString(msg.payload.nonce)) {
-    return { valid: false, error: 'Invalid payload structure' };
-  }
-  if (!isValidBase64(msg.payload.nonce, 24)) {
-    return { valid: false, error: 'Invalid nonce' };
-  }
-
-  // Ratcheted message: validate extra fields
-  if (msg.payload.ephemeralPublicKey !== undefined) {
-    if (!isValidBase64(msg.payload.ephemeralPublicKey, PUBLIC_KEY_SIZE)) {
-      return { valid: false, error: 'Invalid ephemeral public key' };
-    }
-    if (!Number.isInteger(msg.payload.counter) || msg.payload.counter < 0) {
-      return { valid: false, error: 'Invalid counter' };
-    }
-    if (!Number.isInteger(msg.payload.previousCounter) || msg.payload.previousCounter < 0) {
-      return { valid: false, error: 'Invalid previousCounter' };
-    }
-  }
-
   return { valid: true };
 }
 
@@ -130,7 +118,25 @@ export function validateChangeRoom(msg) {
   if (!/^[a-zA-Z0-9_-]+$/.test(msg.room)) {
     return { valid: false, error: 'Room name must be alphanumeric, dash or underscore' };
   }
-  return { valid: true, room: msg.room.toLowerCase() };
+  // Optional: Ed25519 verifier public key, present only when creating a
+  // private room.
+  if (msg.roomAuthPk !== undefined && !isValidBase64(msg.roomAuthPk, ROOM_AUTH_PK_SIZE)) {
+    return { valid: false, error: 'Invalid room verifier key' };
+  }
+  return { valid: true, room: msg.room.toLowerCase(), roomAuthPk: msg.roomAuthPk || null };
+}
+
+export function validateRoomAuth(msg) {
+  if (!isString(msg.room) || msg.room.length === 0 || msg.room.length > 30) {
+    return { valid: false, error: 'Invalid room name (1-30 chars)' };
+  }
+  if (!isValidBase64(msg.nonce, ROOM_CHALLENGE_NONCE_SIZE)) {
+    return { valid: false, error: 'Invalid challenge nonce' };
+  }
+  if (!isValidBase64(msg.signature, ROOM_AUTH_SIG_SIZE)) {
+    return { valid: false, error: 'Invalid challenge signature' };
+  }
+  return { valid: true, room: msg.room.toLowerCase(), nonce: msg.nonce, signature: msg.signature };
 }
 
 export function validateListRooms() {

package/src/server/MessageRouter.js

@@ -53,7 +53,9 @@ export class MessageRouter {
 
     if (recipientSession.ws.readyState === 1) {
       recipientSession.ws.send(JSON.stringify(msg));
-      log.debug(`${senderSessionId.slice(0, 8)} -> ${msg.to.slice(0, 8)}`);
+      // Sealed sender: never log who sent it — only that something was routed to
+      // the recipient. Correlating sender->recipient in logs would defeat it.
+      log.debug(`routed -> ${msg.to.slice(0, 8)}`);
     }
   }