ciphermesh 2.1.0 → 2.3.0

package/README.md

@@ -42,6 +42,7 @@ forwarding, survives CGNAT).
 |-----|---------|----------|
 | 🔐 | **Real E2EE** | Curve25519 + XSalsa20-Poly1305 via libsodium, keys in `sodium_malloc` — never touch disk |
 | 🔄 | **Perfect Forward Secrecy** | Double Ratchet: one key per message, compromise today ≠ read yesterday |
+| 🛡️ | **Hybrid post-quantum** | X25519 **+ ML-KEM-768** folded into the ratchet root — beats "harvest now, decrypt later" while staying ≥ classical security ([details](docs/ARCHITECTURE.md)) |
 | 🕶️ | **Metadata resistance** | **Sealed sender** — the relay never sees who sent a message — plus fixed-bucket length padding on every ciphertext and opt-in cover traffic (`/cover`) |
 | 🕵️ | **TOFU + SAS** | Key-change detection (MITM alarm), 6-digit voice-verifiable codes, and inline **✓/✗** trust badges next to names |
 | 🌐 | **LAN & internet** | Auto-detects Tailscale, shows the reachable address in the banner |
@@ -94,6 +95,13 @@ Prefer a prebuilt image? Pull the relay from GHCR (published on each release):
 docker run -p 3600:3600 ghcr.io/felipekreulich/secret-chat-lan:latest
 ```
 
+**No Node on the host?** Every release ships a standalone relay binary for
+macOS and Linux (arm64/x64) — download it from the
+[releases page](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+`chmod +x`, run. Nothing to install. (The TUI client still needs Node/npx: it
+depends on blessed, which resolves its widgets at runtime and cannot be
+bundled.)
+
 **Everyone** (including the host):
 
 ```bash
@@ -133,13 +141,19 @@ QR code) to whoever you want to pull in.
 
 | Command | Description |
 |---------|-------------|
-| `/join <room> [password]` | Enter/create a room (password if it's private) |
+| `/join <room> [password]` | Open a room as a **new buffer** — you stay in your other rooms (IRC style) |
+| `/leave [room]` | Leave a room; its buffer closes (the last room is protected) |
 | `/create <room> <password>` | Create a **private room** 🔒 — see below |
 | `/rooms` | List rooms (🔒 marks private ones) |
-| `/room` | Current room |
+| `/room` | Current room + your buffer list |
 | `/owner` | Room owner |
 | `/kick` `/mute` `/ban` | Owner moderation |
 
+**Buffers:** be in several rooms at once — **Alt+1..9** switches, and the status
+bar shows `[1:general] [2:dev •3]` with per-room unread badges. Because the
+relay is blind (sealed sender), which room a message belongs to travels
+*inside* the encrypted payload — the server never learns it.
+
 **Private rooms** are zero-knowledge: the password never leaves your machine.
 Joining derives an Ed25519 key from the password (Argon2id) and answers a
 server challenge with a signature — the server stores only a verifier, in

package/README.pt-BR.md

@@ -42,6 +42,7 @@ forwarding, imune a CGNAT).
 |-----|---------|--------|
 | 🔐 | **E2EE de verdade** | Curve25519 + XSalsa20-Poly1305 via libsodium, chaves em `sodium_malloc` — nunca tocam o disco |
 | 🔄 | **Perfect Forward Secrecy** | Double Ratchet: uma chave por mensagem — comprometer hoje ≠ ler ontem |
+| 🛡️ | **Pós-quântico híbrido** | X25519 **+ ML-KEM-768** misturado na raiz do ratchet — vence o "grava hoje, decifra depois" mantendo segurança ≥ à clássica ([detalhes](docs/ARCHITECTURE.md)) |
 | 🕶️ | **Resistência a metadados** | **Sealed sender** — o relay nunca vê quem enviou a mensagem — + padding de comprimento em buckets fixos em todo ciphertext e cover traffic opcional (`/cover`) |
 | 🕵️ | **TOFU + SAS** | Alarme de troca de chave (MITM), código de 6 dígitos verificável por voz e badges de confiança **✓/✗** inline ao lado dos nomes |
 | 🌐 | **LAN e internet** | Detecta Tailscale sozinho e mostra o endereço alcançável no banner |
@@ -94,6 +95,13 @@ Prefere imagem pronta? Baixe o relay do GHCR (publicado a cada release):
 docker run -p 3600:3600 ghcr.io/felipekreulich/secret-chat-lan:latest
 ```
 
+**Sem Node na máquina?** Todo release traz um binário standalone do relay para
+macOS e Linux (arm64/x64) — baixe da
+[página de releases](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+`chmod +x`, rode. Nada para instalar. (O cliente TUI ainda precisa de Node/npx:
+ele depende do blessed, que resolve os widgets em runtime e não pode ser
+empacotado.)
+
 **Todo mundo** (incluindo quem hospeda):
 
 ```bash
@@ -133,13 +141,19 @@ quem você quiser puxar pra conversa.
 
 | Comando | Descrição |
 |---------|-----------|
-| `/join <sala> [senha]` | Entra/cria uma sala (senha se for privada) |
+| `/join <sala> [senha]` | Abre a sala como um **novo buffer** — você continua nas outras (estilo IRC) |
+| `/leave [sala]` | Sai de uma sala; o buffer fecha (a última sala é protegida) |
 | `/create <sala> <senha>` | Cria uma **sala privada** 🔒 — veja abaixo |
 | `/rooms` | Lista salas (🔒 marca as privadas) |
-| `/room` | Sala atual |
+| `/room` | Sala atual + sua lista de buffers |
 | `/owner` | Dono da sala |
 | `/kick` `/mute` `/ban` | Moderação (dono da sala) |
 
+**Buffers:** esteja em várias salas ao mesmo tempo — **Alt+1..9** alterna, e a
+barra de status mostra `[1:general] [2:dev •3]` com não-lidas por sala. Como o
+relay é cego (sealed sender), a qual sala cada mensagem pertence viaja *dentro*
+do payload cifrado — o servidor nunca fica sabendo.
+
 **Salas privadas** são zero-knowledge: a senha nunca sai da sua máquina. Ao
 entrar, o cliente deriva uma chave Ed25519 da senha (Argon2id) e responde um
 desafio do servidor com uma assinatura — o servidor guarda só um verificador,

package/bin/server-binary.js

@@ -0,0 +1,7 @@
+// Entry point for the standalone relay binary (`bun build --compile`).
+//
+// Server-only on purpose: the TUI client depends on blessed, which resolves
+// its widgets through dynamic requires that no bundler can follow. The relay
+// has no such dependency, and "run a CipherMesh relay without installing
+// Node" is exactly what self-hosters need.
+import '../src/server/index.js';

package/docs/ARCHITECTURE.md

@@ -448,8 +448,11 @@ Types:
 | `peer_left` | Server -> Clients | A peer left |
 | `key_exchange` | Client -> Server -> Client | Public key exchange between peers |
 | `encrypted_message` | Client -> Server -> Client | Encrypted message |
-| `change_room` | Client -> Server | Enter/create a room (+ optional `roomAuthPk` verifier when creating a private room) |
+| `change_room` | Client -> Server | Legacy single-room switch: leave every room, enter one (+ optional `roomAuthPk` when creating a private room) |
 | `room_changed` | Server -> Client | Room switch confirmed (+ `private` flag) |
+| `join_room` | Client -> Server | Multi-room: join an ADDITIONAL room, keeping current ones (same `roomAuthPk` option) |
+| `room_joined` | Server -> Client | Additive join confirmed (`room`, `peers`, `private`, `roomOwner`) |
+| `leave_room` / `room_left` | Client <-> Server | Leave one room (the last one is refused — a session is always somewhere) |
 | `list_rooms` / `room_list` | Client <-> Server | Room list (each room carries a `private` flag) |
 | `room_challenge` | Server -> Client | Target room is private — sign this nonce (see 6.9) |
 | `room_auth` | Client -> Server | Ed25519 signature proving password knowledge (see 6.9) |
@@ -738,6 +741,42 @@ fingerprint = SHA-256(publicKey)
             = "A1B2:C3D4:E5F6:7890"
 ```
 
+### 6.10 Hybrid Post-Quantum Handshake (X25519 + ML-KEM-768)
+
+Protects against **"harvest now, decrypt later"**: traffic recorded today stays
+unreadable to a future quantum adversary. The construction is **hybrid** — the
+KEM secret is folded INTO the classical root, never replacing it, so security
+is at least that of X25519 even if ML-KEM were broken (`src/crypto/PQHybrid.js`).
+
+```
+Each client publishes an ML-KEM-768 key alongside its X25519 key (join,
+peer lists, peer_joined). Per pair, at ratchet creation:
+
+  initiator (lower sessionId):
+      (ct, ss) = ML-KEM.Encaps(peer.pqPublicKey)
+      root' = BLAKE2b(root ‖ ss ‖ "ciphermesh/pq-hybrid-v3")
+      → ct rides in the message envelope (sealed to the recipient)
+
+  responder, on the first envelope carrying ct:
+      ss = ML-KEM.Decaps(ct, mySecretKey)
+      root' = BLAKE2b(root ‖ ss ‖ "ciphermesh/pq-hybrid-v3")   ← same value
+```
+
+**Why this can't desynchronize:** the mix happens exactly once, at ratchet
+initialization, before any chain key is derived — never mid-stream. There is no
+window in which one side has mixed and the other has not while messages are in
+flight: an envelope without the `ct` simply fails its MAC (fails closed, never
+garbles). Once the peer replies successfully, the initiator stops attaching
+`ct` (~1KB saved per envelope).
+
+**Compatibility:** a peer without `pqPublicKey` (pre-2.3 client) gets a
+classical-only session — same behaviour as before. `/trustlist` shows `[PQ]`
+next to peers whose session is hybrid.
+
+**Not yet hybrid (documented, planned for v3.1):** sealed-sender envelopes and
+the private-room content layer remain classical; they protect metadata and
+room content respectively, not the message stream's forward secrecy.
+
 ### 6.9 Private Rooms (password-protected, zero-knowledge)
 
 `/create <room> <password>` creates a room the server can gate **without ever

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciphermesh",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Secure terminal chat for the local network (LAN) with real end-to-end encryption (E2EE) using libsodium",
   "type": "module",
   "main": "src/client/index.js",
@@ -51,11 +51,12 @@
     "docker:logs": "docker compose logs -f"
   },
   "dependencies": {
+    "@noble/post-quantum": "0.6.1",
     "blessed": "0.1.81",
     "bonjour-service": "1.4.3",
     "boxen": "8.0.1",
     "chalk": "^5.4.1",
-    "figlet": "1.11.2",
+    "figlet": "1.11.3",
     "gradient-string": "3.0.0",
     "jimp": "1.6.1",
     "node-notifier": "10.0.1",
@@ -65,7 +66,7 @@
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "eslint": "10.7.0",
+    "eslint": "10.8.0",
     "globals": "^17.7.0",
     "prettier": "^3.9.5"
   },