ciphermesh 2.12.0 → 2.14.0

package/src/protocol/validators.js

@@ -2,6 +2,7 @@ import {
   PROTOCOL_VERSION,
   MAX_NICKNAME_LENGTH,
   MAX_PAYLOAD_SIZE,
+  IDENTITY_KEY_SIZE,
   PUBLIC_KEY_SIZE,
   ROOM_AUTH_PK_SIZE,
   ROOM_AUTH_SIG_SIZE,
@@ -131,6 +132,19 @@ export function validateJoin(msg) {
   if (msg.pqPublicKey !== undefined && !isValidBase64(msg.pqPublicKey, PQ_PUBLIC_KEY_SIZE)) {
     return { valid: false, error: 'Invalid post-quantum public key' };
   }
+  // Optional Ed25519 identity key (multi-device). Absent = a client from before
+  // it existed. Checked for shape only: the relay cannot tell whose key it is,
+  // and is not supposed to be able to.
+  if (msg.identityKey !== undefined && !isValidBase64(msg.identityKey, IDENTITY_KEY_SIZE)) {
+    return { valid: false, error: 'Invalid identity key' };
+  }
+  // Optional signed device list, used only to claim a nickname another of your
+  // own devices already holds. Shape here; the signature is checked where the
+  // claim is decided, because only there is it known what identity to check it
+  // against.
+  if (msg.deviceList !== undefined && (typeof msg.deviceList !== 'object' || !msg.deviceList)) {
+    return { valid: false, error: 'Invalid device list' };
+  }
   const capabilities = sanitizeCapabilities(msg.caps);
   if (capabilities === null) {
     return {
@@ -142,6 +156,8 @@ export function validateJoin(msg) {
     valid: true,
     nickname: nick,
     pqPublicKey: msg.pqPublicKey || null,
+    identityKey: msg.identityKey || null,
+    deviceList: msg.deviceList || null,
     capabilities,
   };
 }

package/src/server/SessionManager.js

@@ -5,7 +5,11 @@ const log = createLogger('session');
 
 export class SessionManager {
   #sessions; // Map<sessionId, { ws, nickname, publicKey, connectedAt, rooms: Set }>
-  #nicknames; // Set<nickname> for quick dupe check
+  // lowercased nickname -> the sessions holding it. A Set of names was enough
+  // while a name meant one connection; multi-device means several sessions can
+  // share one, and releasing the name when the *first* of them leaves would
+  // hand it to a stranger while its owner is still in the room.
+  #nicknames; // Map<lowerNickname, Set<sessionId>>
   #recentlyLeft; // Map<sessionId, { nickname, publicKey, leftAt }>
   #rooms; // Map<roomName, Set<sessionId>>
   #roomOwners; // Map<roomName, sessionId>
@@ -15,7 +19,7 @@ export class SessionManager {
 
   constructor() {
     this.#sessions = new Map();
-    this.#nicknames = new Set();
+    this.#nicknames = new Map();
     this.#recentlyLeft = new Map();
     this.#rooms = new Map();
     this.#roomOwners = new Map();
@@ -27,23 +31,68 @@ export class SessionManager {
   }
 
   isNicknameTaken(nickname) {
-    return this.#nicknames.has(nickname.toLowerCase());
+    return (this.#nicknames.get(nickname.toLowerCase())?.size ?? 0) > 0;
   }
 
-  addSession(ws, nickname, publicKey, room = 'general', pqPublicKey = null, capabilities = []) {
+  /**
+   * The identity key the sessions under this nickname are using, or null.
+   *
+   * Null when they disagree — which should not happen, since a second session
+   * is only admitted after matching, but a name whose holders cannot agree on
+   * an identity is not a name anything else should be admitted to.
+   */
+  identityForNickname(nickname) {
+    const holders = this.#nicknames.get(nickname.toLowerCase());
+    if (!holders || holders.size === 0) {
+      return null;
+    }
+    let identity = null;
+    for (const sessionId of holders) {
+      const key = this.#sessions.get(sessionId)?.identityKey ?? null;
+      if (!key || (identity && identity !== key)) {
+        return null;
+      }
+      identity = key;
+    }
+    return identity;
+  }
+
+  /** How many sessions currently answer to this nickname. */
+  sessionsForNickname(nickname) {
+    return this.#nicknames.get(nickname.toLowerCase())?.size ?? 0;
+  }
+
+  addSession(
+    ws,
+    nickname,
+    publicKey,
+    room = 'general',
+    pqPublicKey = null,
+    capabilities = [],
+    identityKey = null,
+  ) {
     const sessionId = randomUUID();
     const session = {
       ws,
       nickname,
       publicKey,
       pqPublicKey, // ML-KEM-768 key, relayed verbatim (server never uses it)
+      // Ed25519 identity key, relayed verbatim like the rest. The relay cannot
+      // check it belongs to this session and must not pretend to: a client
+      // trusts an identity key because a signed device list says so, never
+      // because a relay repeated it.
+      identityKey,
       capabilities, // advertised in JOIN, relayed verbatim — the relay never acts on these
       connectedAt: Date.now(),
       rooms: new Set(),
     };
 
     this.#sessions.set(sessionId, session);
-    this.#nicknames.add(nickname.toLowerCase());
+    const lower = nickname.toLowerCase();
+    if (!this.#nicknames.has(lower)) {
+      this.#nicknames.set(lower, new Set());
+    }
+    this.#nicknames.get(lower).add(sessionId);
     this.#joinRoom(sessionId, room);
 
     log.info(`${nickname} connected (${sessionId.slice(0, 8)}) in room ${room}`);
@@ -59,7 +108,14 @@ export class SessionManager {
     for (const room of [...session.rooms]) {
       this.#leaveRoom(sessionId, room);
     }
-    this.#nicknames.delete(session.nickname.toLowerCase());
+    const lower = session.nickname.toLowerCase();
+    const holders = this.#nicknames.get(lower);
+    if (holders) {
+      holders.delete(sessionId);
+      if (holders.size === 0) {
+        this.#nicknames.delete(lower);
+      }
+    }
     this.#sessions.delete(sessionId);
     this.#muteState.delete(sessionId);
 
@@ -105,6 +161,7 @@ export class SessionManager {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
           ...(session.capabilities?.length ? { caps: [...session.capabilities] } : {}),
         });
       }

package/src/server/WebSocketServer.js

@@ -44,6 +44,7 @@ import {
   validateBanPeer,
 } from '../protocol/validators.js';
 import { verifyRoomChallenge } from '../crypto/RoomKey.js';
+import { DEVICE_LIMITS, verifyDeviceList } from '../crypto/DeviceIdentity.js';
 import { parseServerConfig, clientAddress, normalizeIp } from './config.js';
 
 const log = createLogger('ws-server');
@@ -281,6 +282,37 @@ export class SecureWSServer {
     }
   }
 
+  /**
+   * May this JOIN share a nickname that is already in use?
+   *
+   * Only if it is another device of whoever holds it. The proof is the signed
+   * device list in the JOIN: it must be signed by the identity the existing
+   * sessions are using, and it must name *this* JOIN's public key.
+   *
+   * No challenge is needed and none is invented. Replaying a list somebody else
+   * published gets you a seat in a room under a name whose messages you cannot
+   * read, because you do not hold the box secret the list names — and the peers,
+   * who do their own checking, learn nothing from the relay having allowed it.
+   * The relay is doing admission control on a nickname here, not attesting to
+   * anyone's identity; clients never take its word for that.
+   */
+  #isAnotherDeviceOf(validation, publicKey) {
+    const identityKey = this.#sessionManager.identityForNickname(validation.nickname);
+    if (!identityKey || !validation.identityKey || validation.identityKey !== identityKey) {
+      return false;
+    }
+    const list = verifyDeviceList(validation.deviceList);
+    if (!list || list.identityPk !== identityKey) {
+      return false;
+    }
+    if (
+      this.#sessionManager.sessionsForNickname(validation.nickname) >= DEVICE_LIMITS.MAX_DEVICES
+    ) {
+      return false;
+    }
+    return list.devices.some((device) => device.boxPk === publicKey);
+  }
+
   #handleJoin(ws, msg) {
     if (ws.hasJoined) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Already in the chat')));
@@ -293,7 +325,10 @@ export class SecureWSServer {
       return;
     }
 
-    if (this.#sessionManager.isNicknameTaken(validation.nickname)) {
+    if (
+      this.#sessionManager.isNicknameTaken(validation.nickname) &&
+      !this.#isAnotherDeviceOf(validation, msg.publicKey)
+    ) {
       ws.send(
         JSON.stringify(
           createError(ERR.NICKNAME_TAKEN, `Nickname "${validation.nickname}" is already in use`),
@@ -310,6 +345,7 @@ export class SecureWSServer {
       room,
       validation.pqPublicKey,
       validation.capabilities,
+      validation.identityKey,
     );
     ws.sessionId = sessionId;
     ws.hasJoined = true;
@@ -347,6 +383,7 @@ export class SecureWSServer {
         nickname: validation.nickname,
         publicKey: msg.publicKey,
         ...(validation.pqPublicKey ? { pqPublicKey: validation.pqPublicKey } : {}),
+        ...(validation.identityKey ? { identityKey: validation.identityKey } : {}),
         ...(validation.capabilities.length ? { caps: [...validation.capabilities] } : {}),
       }),
       sessionId,
@@ -665,6 +702,7 @@ export class SecureWSServer {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
         },
         room,
       ),
@@ -821,6 +859,7 @@ export class SecureWSServer {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
         },
         result.newRoom,
       ),

package/src/shared/constants.js

@@ -17,11 +17,15 @@ export const CAP = {
   // and fan-out land a release before anyone sends, so that by the time a sender
   // exists, every advertised room can already read it.
   SENDER_KEYS: 'sk1',
+  // I can read a signed device list handed to me over the pairwise channel.
+  // Client-only: distribution rides the sealed channel the relay already
+  // carries, so unlike sk1 there is nothing for the relay to agree to.
+  DEVICE_LIST: 'dl1',
 };
 
 // What this client advertises. SENDER_KEYS is honest here: the receive path
 // exists. Nothing sends group messages yet.
-export const OWN_CAPABILITIES = [CAP.SENDER_KEYS];
+export const OWN_CAPABILITIES = [CAP.SENDER_KEYS, CAP.DEVICE_LIST];
 
 // What the relay advertises, in join_ack. A client cannot promise this on the
 // relay's behalf — the fan-out is the relay's job — so a sender has to check the
@@ -71,6 +75,10 @@ export const MAX_BYTES_BURST = 4_194_304;
 // Crypto sizes (libsodium Curve25519 + XSalsa20-Poly1305)
 export const NONCE_SIZE = 24;
 export const PUBLIC_KEY_SIZE = 32;
+// Ed25519, and the same 32 bytes as above by coincidence of the curves rather
+// than by anything shared. Named separately so a future change to one does not
+// silently resize the other.
+export const IDENTITY_KEY_SIZE = 32;
 export const SECRET_KEY_SIZE = 32;
 export const MAC_SIZE = 16;
 export const SHARED_KEY_SIZE = 32;

package/src/shared/desktopNotify.js

@@ -0,0 +1,204 @@
+// Desktop notifications, kept away from the chat UI.
+//
+// node-notifier drives SnoreToast on Windows. When notifications are disabled
+// for the application, SnoreToast ignores the stdio pipes node-notifier gives
+// it and writes its diagnostics to the *attached console* instead — the very
+// console blessed is drawing the chat on. The result is unreadable: raw
+// "Notifications are disabled / Reason: DisabledForApplication / Command Line:
+// …snoretoast-x64.exe…" text smeared across the message log, once per message.
+//
+// Three guards, in order of importance:
+//   1. On Windows every notification is delivered by a detached, console-less
+//      helper process, so nothing the notifier prints can reach our terminal.
+//   2. The first failure trips a breaker: desktop notifications go quiet for
+//      the rest of the session and the caller is told once, in-app.
+//   3. Notifications are throttled, so a burst of messages can't flood the
+//      desktop (or, on the broken path, the terminal).
+
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// Exit code the helper uses for "the OS refused to show the notification".
+export const NOTIFY_FAILED_EXIT = 3;
+
+// Minimum gap between two desktop notifications. Sound alerts and the unread
+// pill are unthrottled — this only rate-limits the OS-level popup.
+export const NOTIFY_MIN_INTERVAL_MS = 3000;
+
+const WORKER_PATH = fileURLToPath(new URL('./notifyWorker.js', import.meta.url));
+
+/**
+ * True when the platform needs the out-of-process delivery path. Only Windows
+ * has a notifier that writes to the console behind our back; macOS and Linux
+ * back-ends stay in-process (spawning a Node runtime per message would be far
+ * more expensive than the notification itself).
+ */
+export function needsIsolation(platform = process.platform) {
+  return platform === 'win32';
+}
+
+/**
+ * Desktop notifier with a breaker and a throttle.
+ *
+ * @param {object}   [opts]
+ * @param {Function} [opts.onUnavailable] called once, with a human-readable
+ *   reason, the first time the OS refuses a notification.
+ * @param {number}   [opts.minIntervalMs] throttle window.
+ * @param {Function} [opts.now] clock, for tests.
+ */
+export class DesktopNotifier {
+  #available = true;
+  #reported = false;
+  #lastSentAt = 0;
+  #onUnavailable;
+  #minIntervalMs;
+  #now;
+  #isolate;
+  #send;
+
+  constructor({
+    onUnavailable = null,
+    minIntervalMs = NOTIFY_MIN_INTERVAL_MS,
+    now = Date.now,
+    isolate = needsIsolation(),
+    send = null,
+  } = {}) {
+    this.#onUnavailable = onUnavailable;
+    this.#minIntervalMs = minIntervalMs;
+    this.#now = now;
+    this.#isolate = isolate;
+    this.#send = send; // injected transport, for tests
+  }
+
+  /** False once the OS has told us notifications are not going to work. */
+  get available() {
+    return this.#available;
+  }
+
+  /**
+   * Fire a desktop notification. Never throws, never blocks, and never lets the
+   * platform notifier write to our terminal.
+   *
+   * @returns {boolean} true if the notification was handed to the OS.
+   */
+  notify({ title, message, sound = false }) {
+    if (!this.#available) {
+      return false;
+    }
+    const at = this.#now();
+    if (at - this.#lastSentAt < this.#minIntervalMs) {
+      return false; // throttled — the sound alert already fired
+    }
+    this.#lastSentAt = at;
+
+    const options = { title: String(title ?? ''), message: String(message ?? ''), sound: !!sound };
+    try {
+      if (this.#send) {
+        this.#send(options, (err) => this.#onResult(err));
+      } else if (this.#isolate) {
+        this.#sendIsolated(options);
+      } else {
+        this.#sendInProcess(options);
+      }
+    } catch (err) {
+      this.#onResult(err);
+      return false;
+    }
+    return true;
+  }
+
+  /** Stop trying for the rest of the session (used by `/notify off`). */
+  disable() {
+    this.#available = false;
+  }
+
+  /**
+   * Re-arm the breaker. `/notify on` means the user believes they fixed the OS
+   * setting we tripped on, so give the platform another chance — including the
+   * one-off in-app warning if it fails again.
+   */
+  reset() {
+    this.#available = true;
+    this.#reported = false;
+    this.#lastSentAt = 0;
+  }
+
+  // Windows: a detached, hidden helper with no stdio and no console of its own.
+  // Anything SnoreToast decides to print goes nowhere near the chat.
+  #sendIsolated(options) {
+    const child = spawn(process.execPath, [WORKER_PATH, JSON.stringify(options)], {
+      detached: true,
+      windowsHide: true,
+      stdio: 'ignore',
+    });
+    child.on('error', (err) => this.#onResult(err));
+    child.on('exit', (code) => {
+      if (code === NOTIFY_FAILED_EXIT) {
+        this.#onResult(new Error('the operating system refused the notification'));
+      }
+    });
+    child.unref();
+  }
+
+  // macOS / Linux: in-process, but always with a callback so a failure is
+  // handled instead of surfacing as an unhandled 'error' event.
+  #sendInProcess(options) {
+    import('node-notifier')
+      .then(({ default: notifier }) => {
+        notifier.notify(options, (err) => this.#onResult(err));
+      })
+      .catch((err) => this.#onResult(err));
+  }
+
+  #onResult(err) {
+    if (!isFailure(err)) {
+      return;
+    }
+    this.#available = false;
+    if (this.#reported) {
+      return;
+    }
+    this.#reported = true;
+    this.#onUnavailable?.(describeFailure(err));
+  }
+}
+
+/**
+ * Whether what the notifier handed back is a real failure.
+ *
+ * node-notifier's `fileCommand` reports a non-zero exit as an Error but also
+ * passes plain stderr through as the "error" argument on success — a chatty
+ * `notify-send` or `terminal-notifier` build would otherwise mute notifications
+ * for the whole session. Errors always count; loose text only when it names a
+ * failure. Pure, exported for testing.
+ */
+export function isFailure(err) {
+  if (!err) {
+    return false;
+  }
+  if (err instanceof Error) {
+    return true;
+  }
+  const text = String(err).trim();
+  return (
+    text !== '' && /\b(disabled|denied|not found|no such|fail|error|refus|invalid)/i.test(text)
+  );
+}
+
+/**
+ * Turn whatever the platform notifier reported into one short sentence. The raw
+ * text is multi-line and full of absolute paths — exactly what we don't want in
+ * the chat log. Pure, exported for testing.
+ */
+export function describeFailure(err) {
+  const raw = String(err?.message ?? err ?? '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (/disabledforapplication|notifications are disabled/i.test(raw)) {
+    return 'the OS has notifications turned off for this app';
+  }
+  if (/not found on system|enoent/i.test(raw)) {
+    return 'no notification backend is installed';
+  }
+  return raw.slice(0, 120) || 'the OS rejected it';
+}

package/src/shared/deviceProvisioning.js

@@ -0,0 +1,112 @@
+// ── Provisioning a second device ────────────────────────────────
+//
+// Step 5 of multi-device (docs/design/multi-device.md, item 4 of #481).
+//
+// **The identity secret never moves.** A second device generates its own box
+// keypair and receives only the identity's *public* key plus a device list
+// signed by it. That costs one thing and buys two: a secondary cannot add or
+// revoke devices — only the device holding the identity secret can — and a
+// stolen phone is a stolen phone rather than a stolen identity. Today's
+// `/backup` does the opposite, copying the whole identity, which is the
+// configuration this arc exists to replace.
+//
+// Because neither side can sign for the other, provisioning is two hops and
+// there is no way around that: the new device has to say what its key is before
+// the identity can sign for it, and it has to be told what identity it now
+// belongs to afterwards.
+//
+//   B: /device request        → ciphermesh-device://request/…   (~150 bytes)
+//   A: /device add <request>  → ciphermesh-device://grant/…     (~740 bytes)
+//   B: /device accept <grant>
+//
+// A byte-mode QR code holds about 2 200 characters, so both fit with room for
+// more devices. Neither is secret: a request is a public key, and a grant is a signed statement that
+// was going to be broadcast to every peer anyway. Interception achieves
+// nothing; substitution is caught, because a grant only applies if it names the
+// exact device that asked.
+
+const SCHEME = 'ciphermesh-device://';
+const MAX_ENCODED = 8192; // a grant with the maximum eight devices, with room
+
+const DEVICE_ID = /^[0-9a-f]{32}$/;
+
+function encode(kind, body) {
+  const json = Buffer.from(JSON.stringify(body), 'utf-8');
+  return `${SCHEME}${kind}/${json.toString('base64url')}`;
+}
+
+function decode(kind, text) {
+  if (typeof text !== 'string') {
+    return null;
+  }
+  const prefix = `${SCHEME}${kind}/`;
+  if (!text.startsWith(prefix) || text.length > MAX_ENCODED) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(
+      Buffer.from(text.slice(prefix.length), 'base64url').toString('utf-8'),
+    );
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What a new device says about itself: the two fields the identity has to sign
+ * over. Nothing secret, and nothing the peer could not have learned anyway.
+ */
+export function buildDeviceRequest({ deviceId, boxPk, label = '' }) {
+  if (!DEVICE_ID.test(deviceId ?? '') || typeof boxPk !== 'string' || boxPk.length === 0) {
+    return null;
+  }
+  return encode('request', { deviceId, boxPk, label: String(label).slice(0, 32) });
+}
+
+/** @returns {{deviceId: string, boxPk: string, label: string}|null} */
+export function parseDeviceRequest(text) {
+  const body = decode('request', text);
+  if (!body || !DEVICE_ID.test(body.deviceId ?? '')) {
+    return null;
+  }
+  if (typeof body.boxPk !== 'string' || body.boxPk.length === 0) {
+    return null;
+  }
+  if (body.label !== undefined && typeof body.label !== 'string') {
+    return null;
+  }
+  return { deviceId: body.deviceId, boxPk: body.boxPk, label: body.label ?? '' };
+}
+
+/**
+ * What the identity hands back: which identity this device now belongs to, and
+ * the signed list saying so.
+ *
+ * The identity key is in here as well as inside the list because the receiving
+ * device has no other way to learn it — and it is checked against the list's
+ * own `identityPk` on the way in, so the two cannot disagree.
+ */
+export function buildDeviceGrant({ identityPk, list }) {
+  if (typeof identityPk !== 'string' || !list || typeof list !== 'object') {
+    return null;
+  }
+  return encode('grant', { identityPk, list });
+}
+
+/** @returns {{identityPk: string, list: object}|null} */
+export function parseDeviceGrant(text) {
+  const body = decode('grant', text);
+  if (!body || typeof body.identityPk !== 'string') {
+    return null;
+  }
+  if (!body.list || typeof body.list !== 'object' || Array.isArray(body.list)) {
+    return null;
+  }
+  // A grant whose envelope disagrees with the list it carries is malformed, not
+  // a decision to make later.
+  if (body.list.identityPk !== body.identityPk) {
+    return null;
+  }
+  return { identityPk: body.identityPk, list: body.list };
+}

package/src/shared/notifyWorker.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// One-shot desktop-notification helper.
+//
+// Spawned detached, hidden and with stdio ignored (see desktopNotify.js), so it
+// owns no console: when SnoreToast writes its "Notifications are disabled"
+// diagnostics past the stdio pipes, they land in this process's void instead of
+// on top of the chat UI.
+//
+// Reads a single JSON argument ({ title, message, sound }) and exits 0 on
+// success, NOTIFY_FAILED_EXIT when the OS refused the notification.
+
+import notifier from 'node-notifier';
+import { NOTIFY_FAILED_EXIT } from './desktopNotify.js';
+
+// The platform callback only fires when the toast is dismissed or times out on
+// screen, which can be tens of seconds — so this cap is a leak guard, not a
+// verdict. Exiting 0 here means "handed over, outcome unknown"; only an actual
+// error from the notifier is allowed to trip the caller's breaker.
+const TIMEOUT_MS = 8000;
+
+function main() {
+  let options;
+  try {
+    options = JSON.parse(process.argv[2] || '{}');
+  } catch {
+    process.exit(NOTIFY_FAILED_EXIT);
+  }
+
+  const timer = setTimeout(() => process.exit(0), TIMEOUT_MS);
+  timer.unref();
+
+  try {
+    notifier.notify(
+      {
+        title: String(options.title ?? ''),
+        message: String(options.message ?? ''),
+        sound: !!options.sound,
+      },
+      (err) => process.exit(err ? NOTIFY_FAILED_EXIT : 0),
+    );
+  } catch {
+    process.exit(NOTIFY_FAILED_EXIT);
+  }
+}
+
+main();

package/src/shared/tips.js

@@ -9,6 +9,7 @@ export const TIPS = [
   '/panic wipes every on-disk secret and exits — for a lost or seized device.',
   '/backup saves your identity + verified peers as an encrypted file.',
   'Ctrl+K opens the command palette; Ctrl+E the emoji picker; PgUp/PgDn scrolls.',
+  'Shift+Enter starts a new line without sending; Alt+Enter and Ctrl+J do too.',
   'A ✗ next to a name means their key changed since you last saw it — verify before trusting.',
   '/deniable on switches to plausibly-deniable messages (no cryptographic proof you sent them).',
   'No server? Run it in P2P mode — peers find each other on the LAN via mDNS, no relay at all.',