ciphermesh 2.2.0 → 2.4.0

package/README.md

@@ -42,6 +42,7 @@ forwarding, survives CGNAT).
 |-----|---------|----------|
 | 🔐 | **Real E2EE** | Curve25519 + XSalsa20-Poly1305 via libsodium, keys in `sodium_malloc` — never touch disk |
 | 🔄 | **Perfect Forward Secrecy** | Double Ratchet: one key per message, compromise today ≠ read yesterday |
+| 🛡️ | **Hybrid post-quantum** | X25519 **+ ML-KEM-768** folded into the ratchet root — beats "harvest now, decrypt later" while staying ≥ classical security ([details](docs/ARCHITECTURE.md)) |
 | 🕶️ | **Metadata resistance** | **Sealed sender** — the relay never sees who sent a message — plus fixed-bucket length padding on every ciphertext and opt-in cover traffic (`/cover`) |
 | 🕵️ | **TOFU + SAS** | Key-change detection (MITM alarm), 6-digit voice-verifiable codes, and inline **✓/✗** trust badges next to names |
 | 🌐 | **LAN & internet** | Auto-detects Tailscale, shows the reachable address in the banner |
@@ -94,6 +95,19 @@ Prefer a prebuilt image? Pull the relay from GHCR (published on each release):
 docker run -p 3600:3600 ghcr.io/felipekreulich/secret-chat-lan:latest
 ```
 
+**Hosting it publicly?** [`deploy/`](deploy/README.md) has a Caddy + Docker
+setup that gets a Let's Encrypt certificate automatically — clients then verify
+the server against a real CA (no trust-on-first-use window), and a host that
+once served a valid certificate can never be silently downgraded to a
+self-signed one.
+
+**No Node on the host?** Every release ships a standalone relay binary for
+macOS and Linux (arm64/x64) — download it from the
+[releases page](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+`chmod +x`, run. Nothing to install. (The TUI client still needs Node/npx: it
+depends on blessed, which resolves its widgets at runtime and cannot be
+bundled.)
+
 **Everyone** (including the host):
 
 ```bash
@@ -108,7 +122,10 @@ and use the `Internet` address from the banner — full walkthrough in
 Already in the chat? Run `/invite <your-ip>:3600` and send the string (or the
 QR code) to whoever you want to pull in.
 
-**No server at all?** `npm run p2p` — peers find each other via mDNS.
+**No server at all?** `npm run p2p` — peers find each other via mDNS. P2P mode
+now speaks nearly the same command set as the relay client (presence, `/lock`,
+`/contacts`, `/mentions`, `/topic`, encrypted history and more); only
+`/invite`, `/create` and `/nick` are relay-specific by nature.
 
 ## 💬 Commands
 
@@ -122,6 +139,8 @@ QR code) to whoever you want to pull in.
 | `/users` | Who's online (with away/status) |
 | `/msg <nick> <text>` | Private message (DM) |
 | `/reply <text>` | Reply quoting the last received message |
+| `/me <action>` | Third-person action — *«felipe is compiling»* |
+| `/watch [add\|remove\|clear]` | Alert on a keyword in **any** room, like a mention |
 | `/invite [host:port]` | Generate a `ciphermesh://` invite + QR code |
 | `/nick <new>` | Change nickname (before joining — recovers from "nickname taken") |
 | `/quit` | Leave |
@@ -138,6 +157,7 @@ QR code) to whoever you want to pull in.
 | `/create <room> <password>` | Create a **private room** 🔒 — see below |
 | `/rooms` | List rooms (🔒 marks private ones) |
 | `/room` | Current room + your buffer list |
+| `/topic [text\|clear]` | Show or set the room topic — shown in the status bar and synced to whoever joins later |
 | `/owner` | Room owner |
 | `/kick` `/mute` `/ban` | Owner moderation |
 
@@ -190,7 +210,8 @@ A green **✓** next to a name marks a SAS-verified peer; a red **✗** flags a
 | `/play [path]` | Play the last received voice note (`afplay`/`sox`/`ffplay`) |
 | `/accept [id]` / `/reject [id]` | Accept / decline an incoming file offer |
 | `/img [path]` | Render the last received image in **full resolution** (kitty/iTerm2) |
-| `/search <term>` | Search the encrypted local history |
+| `/search <term>` | Search the encrypted local history (on disk, across sessions) |
+| `/find [term]` — **Ctrl+F** | Search **this room's scrollback** and press Enter to **jump to the message**, highlighted |
 | `/history [n]` | Last n messages from history |
 | `/retention <7d\|24h\|30m>` | Purge local history older than the given age |
 | `/export [path]` | Export history as .txt or .json (plaintext!) |

package/README.pt-BR.md

@@ -42,6 +42,7 @@ forwarding, imune a CGNAT).
 |-----|---------|--------|
 | 🔐 | **E2EE de verdade** | Curve25519 + XSalsa20-Poly1305 via libsodium, chaves em `sodium_malloc` — nunca tocam o disco |
 | 🔄 | **Perfect Forward Secrecy** | Double Ratchet: uma chave por mensagem — comprometer hoje ≠ ler ontem |
+| 🛡️ | **Pós-quântico híbrido** | X25519 **+ ML-KEM-768** misturado na raiz do ratchet — vence o "grava hoje, decifra depois" mantendo segurança ≥ à clássica ([detalhes](docs/ARCHITECTURE.md)) |
 | 🕶️ | **Resistência a metadados** | **Sealed sender** — o relay nunca vê quem enviou a mensagem — + padding de comprimento em buckets fixos em todo ciphertext e cover traffic opcional (`/cover`) |
 | 🕵️ | **TOFU + SAS** | Alarme de troca de chave (MITM), código de 6 dígitos verificável por voz e badges de confiança **✓/✗** inline ao lado dos nomes |
 | 🌐 | **LAN e internet** | Detecta Tailscale sozinho e mostra o endereço alcançável no banner |
@@ -94,6 +95,19 @@ Prefere imagem pronta? Baixe o relay do GHCR (publicado a cada release):
 docker run -p 3600:3600 ghcr.io/felipekreulich/secret-chat-lan:latest
 ```
 
+**Vai hospedar publicamente?** A pasta [`deploy/`](deploy/README.md) tem um
+setup com Caddy + Docker que pega certificado Let's Encrypt sozinho — aí os
+clientes verificam o servidor contra uma CA de verdade (sem janela de
+trust-on-first-use), e um host que já apresentou certificado válido nunca pode
+ser rebaixado silenciosamente para um self-signed.
+
+**Sem Node na máquina?** Todo release traz um binário standalone do relay para
+macOS e Linux (arm64/x64) — baixe da
+[página de releases](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+`chmod +x`, rode. Nada para instalar. (O cliente TUI ainda precisa de Node/npx:
+ele depende do blessed, que resolve os widgets em runtime e não pode ser
+empacotado.)
+
 **Todo mundo** (incluindo quem hospeda):
 
 ```bash
@@ -108,7 +122,10 @@ em [docs/SETUP.md](docs/SETUP.md).
 Já está no chat? Rode `/invite <seu-ip>:3600` e mande a string (ou o QR) pra
 quem você quiser puxar pra conversa.
 
-**Sem servidor nenhum?** `npm run p2p` — os peers se encontram via mDNS.
+**Sem servidor nenhum?** `npm run p2p` — os peers se encontram via mDNS. O modo
+P2P agora fala quase o mesmo conjunto de comandos do cliente relay (presença,
+`/lock`, `/contacts`, `/mentions`, `/topic`, histórico cifrado e mais); só
+`/invite`, `/create` e `/nick` são específicos do relay por natureza.
 
 ## 💬 Comandos
 
@@ -122,6 +139,8 @@ quem você quiser puxar pra conversa.
 | `/users` | Quem está online (com away/status) |
 | `/msg <nick> <texto>` | Mensagem privada (DM) |
 | `/reply <texto>` | Responde citando a última mensagem recebida |
+| `/me <ação>` | Ação em terceira pessoa — *«felipe está compilando»* |
+| `/watch [add\|remove\|clear]` | Alerta quando uma palavra aparece em **qualquer** sala, como uma menção |
 | `/invite [host:porta]` | Gera convite `ciphermesh://` + QR code |
 | `/nick <novo>` | Troca de apelido (antes de entrar — recupera de "apelido em uso") |
 | `/quit` | Sair |
@@ -138,6 +157,7 @@ quem você quiser puxar pra conversa.
 | `/create <sala> <senha>` | Cria uma **sala privada** 🔒 — veja abaixo |
 | `/rooms` | Lista salas (🔒 marca as privadas) |
 | `/room` | Sala atual + sua lista de buffers |
+| `/topic [texto\|clear]` | Mostra ou define o assunto da sala — aparece na barra de status e é sincronizado para quem entra depois |
 | `/owner` | Dono da sala |
 | `/kick` `/mute` `/ban` | Moderação (dono da sala) |
 
@@ -191,7 +211,8 @@ Um **✓** verde ao lado de um nome indica um peer verificado por SAS; um **✗*
 | `/accept [id]` / `/reject [id]` | Aceita / recusa uma oferta de arquivo recebida |
 | `/img [caminho]` | Renderiza a última imagem recebida em **alta resolução** (kitty/iTerm2) |
 | `/retention <7d\|24h\|30m>` | Purga o histórico local mais antigo que o tempo dado |
-| `/search <termo>` | Busca no histórico local cifrado |
+| `/search <termo>` | Busca no histórico local cifrado (em disco, entre sessões) |
+| `/find [termo]` — **Ctrl+F** | Busca **no histórico da sala na tela** e, com Enter, **salta para a mensagem** destacada |
 | `/history [n]` | Últimas n mensagens do histórico |
 | `/export [caminho]` | Exporta o histórico em .txt ou .json (texto plano!) |
 

package/bin/server-binary.js

@@ -0,0 +1,7 @@
+// Entry point for the standalone relay binary (`bun build --compile`).
+//
+// Server-only on purpose: the TUI client depends on blessed, which resolves
+// its widgets through dynamic requires that no bundler can follow. The relay
+// has no such dependency, and "run a CipherMesh relay without installing
+// Node" is exactly what self-hosters need.
+import '../src/server/index.js';

package/docs/ARCHITECTURE.md

@@ -741,6 +741,42 @@ fingerprint = SHA-256(publicKey)
             = "A1B2:C3D4:E5F6:7890"
 ```
 
+### 6.10 Hybrid Post-Quantum Handshake (X25519 + ML-KEM-768)
+
+Protects against **"harvest now, decrypt later"**: traffic recorded today stays
+unreadable to a future quantum adversary. The construction is **hybrid** — the
+KEM secret is folded INTO the classical root, never replacing it, so security
+is at least that of X25519 even if ML-KEM were broken (`src/crypto/PQHybrid.js`).
+
+```
+Each client publishes an ML-KEM-768 key alongside its X25519 key (join,
+peer lists, peer_joined). Per pair, at ratchet creation:
+
+  initiator (lower sessionId):
+      (ct, ss) = ML-KEM.Encaps(peer.pqPublicKey)
+      root' = BLAKE2b(root ‖ ss ‖ "ciphermesh/pq-hybrid-v3")
+      → ct rides in the message envelope (sealed to the recipient)
+
+  responder, on the first envelope carrying ct:
+      ss = ML-KEM.Decaps(ct, mySecretKey)
+      root' = BLAKE2b(root ‖ ss ‖ "ciphermesh/pq-hybrid-v3")   ← same value
+```
+
+**Why this can't desynchronize:** the mix happens exactly once, at ratchet
+initialization, before any chain key is derived — never mid-stream. There is no
+window in which one side has mixed and the other has not while messages are in
+flight: an envelope without the `ct` simply fails its MAC (fails closed, never
+garbles). Once the peer replies successfully, the initiator stops attaching
+`ct` (~1KB saved per envelope).
+
+**Compatibility:** a peer without `pqPublicKey` (pre-2.3 client) gets a
+classical-only session — same behaviour as before. `/trustlist` shows `[PQ]`
+next to peers whose session is hybrid.
+
+**Not yet hybrid (documented, planned for v3.1):** sealed-sender envelopes and
+the private-room content layer remain classical; they protect metadata and
+room content respectively, not the message stream's forward secrecy.
+
 ### 6.9 Private Rooms (password-protected, zero-knowledge)
 
 `/create <room> <password>` creates a room the server can gate **without ever

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciphermesh",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Secure terminal chat for the local network (LAN) with real end-to-end encryption (E2EE) using libsodium",
   "type": "module",
   "main": "src/client/index.js",
@@ -51,6 +51,7 @@
     "docker:logs": "docker compose logs -f"
   },
   "dependencies": {
+    "@noble/post-quantum": "0.6.1",
     "blessed": "0.1.81",
     "bonjour-service": "1.4.3",
     "boxen": "8.0.1",

package/src/client/ChatController.js

@@ -52,7 +52,13 @@ import { tipAt, TIPS } from '../shared/tips.js';
 import { setTheme, getThemeName, themeNames } from '../shared/themes.js';
 import { panicWipe } from '../shared/panic.js';
 import { farewellBanner } from '../shared/banner.js';
-import { parseDndWindow, shouldNotify, nowMinutes, mentionsMe } from '../shared/dnd.js';
+import {
+  parseDndWindow,
+  shouldNotify,
+  nowMinutes,
+  mentionsMe,
+  matchesKeyword,
+} from '../shared/dnd.js';
 import { saveLastSession } from '../shared/lastSession.js';
 import { COMMANDS } from './UI.js';
 
@@ -111,6 +117,7 @@ export class ChatController {
   #autoAwayTimer = null;
   #autoAwaySet = false; // whether the current away was set automatically
   #mentions = []; // session mention log: { nickname, text, room, at }
+  #watchWords = new Set(); // /watch — keywords that alert like a mention does
   #awayUnread = 0; // messages received while away
   #awayMentions = 0; // …of which mentioned me
   #autoLockMs = 0; // idle screen-lock timeout (0 = off)
@@ -206,7 +213,9 @@ export class ChatController {
   // attached the listener).
   #onConnected() {
     this.#ui.setConnectionState('online');
-    this.#connection.send(createJoin(this.#nickname, this.#keyManager.publicKeyB64));
+    this.#connection.send(
+      createJoin(this.#nickname, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+    );
   }
 
   // ── Connection event handlers ─────────────────────────────────
@@ -230,6 +239,12 @@ export class ChatController {
       this.#ui.addSystemMessage(`Reconnecting in ${delay / 1000}s...`);
     });
 
+    this.#connection.on('cert-ca-valid', ({ issuer }) => {
+      this.#ui.addSystemMessage(
+        `TLS verified against a public CA (${issuer}) — no trust-on-first-use window`,
+      );
+    });
+
     this.#connection.on('cert-pinned', ({ fingerprint }) => {
       const fp = fingerprint ? fingerprint.slice(0, 17) + '...' : '?';
       this.#ui.addSystemMessage(`Server certificate pinned (trust on first use): ${fp}`);
@@ -464,6 +479,13 @@ export class ChatController {
           this.#ui.addErrorMessage(
             `${msg.message}. Use /nick <other> to pick a different nickname.`,
           );
+        } else if (typeof msg.message === 'string' && msg.message.startsWith('Protocol mismatch')) {
+          // Reconnecting cannot fix a version gap — say so instead of letting
+          // the user watch an endless retry loop.
+          this.#ui.addErrorMessage(msg.message);
+          this.#ui.addInfoMessage(
+            'Reconnecting will not help until both sides run the same version.',
+          );
         } else if (msg.code === ERR.ROOM_AUTH_FAILED || msg.code === ERR.ROOM_EXISTS) {
           // Join/create refused — drop the derived secrets for that attempt.
           freeRoomSecrets(this.#pendingRoomSecrets);
@@ -536,7 +558,7 @@ export class ChatController {
         // Migrate ratchet from old sessionId to new sessionId
         this.#handshake.migrateRatchet(oldSid, peer.sessionId);
       } else if (!oldSid) {
-        this.#handshake.registerPeer(peer.sessionId, peer.publicKey);
+        this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
       }
 
       this.#checkTrust(peer.nickname, peer.publicKey);
@@ -590,6 +612,7 @@ export class ChatController {
         owner,
         secrets,
         pins: [],
+        topic: null, // { text, by, at } — E2EE among members, never on the relay
       });
       this.#bufferOrder.push(room);
     }
@@ -643,6 +666,7 @@ export class ChatController {
     this.#currentRoomOwner = buf.owner;
     this.#ui.switchBuffer(room);
     this.#rebuildActivePeers();
+    this.#applyTopicToUI();
     this.#updateBufferBar();
     this.#updatePrivateIndicator();
     this.#saveLastSession(buf.private);
@@ -661,6 +685,11 @@ export class ChatController {
     this.#ui.setPeerNames([...this.#peers.values()].map((p) => p.nickname));
   }
 
+  #applyTopicToUI() {
+    const topic = this.#buffers.get(this.#currentRoom)?.topic;
+    this.#ui.setTopic(topic?.text || null);
+  }
+
   #updateBufferBar() {
     this.#ui.setBufferBar(
       this.#bufferOrder.map((room) => {
@@ -740,7 +769,7 @@ export class ChatController {
         publicKey: peer.publicKey,
         rooms: new Set([room]),
       });
-      this.#handshake.registerPeer(peer.sessionId, peer.publicKey);
+      this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
     }
     this.#checkTrust(peer.nickname, peer.publicKey);
     this.#auditLog.log(AuditEvent.PEER_CONNECTED, { nickname: peer.nickname, room });
@@ -759,6 +788,23 @@ export class ChatController {
     if (this.#away || this.#statusText) {
       this.#sendPayloadToPeer(peer.sessionId, this.#presencePayload());
     }
+
+    // …nor the room topic. Everyone who has it answers; the timestamp settles
+    // any disagreement, and `silent` keeps the sync out of the chat log.
+    const topic = this.#buffers.get(room)?.topic;
+    if (topic) {
+      this.#sendPayloadToPeer(
+        peer.sessionId,
+        JSON.stringify({
+          action: 'set_topic',
+          room,
+          text: topic.text,
+          at: topic.at,
+          silent: true,
+          sentAt: Date.now(),
+        }),
+      );
+    }
   }
 
   // One-time-per-session nudge to verify an unverified peer's identity.
@@ -864,6 +910,7 @@ export class ChatController {
           ephPub,
           msg.payload.counter,
           msg.payload.previousCounter,
+          msg.payload.pqCiphertext ? Buffer.from(msg.payload.pqCiphertext, 'base64') : null,
         );
       }
 
@@ -1141,6 +1188,33 @@ export class ChatController {
         return;
       }
 
+      if (data.action === 'set_topic') {
+        const buf = this.#buffers.get(msgRoom);
+        if (buf && typeof data.text === 'string') {
+          const at = Number(data.at) || 0;
+          // Last write wins. On join everyone who knows the topic answers, so
+          // the timestamp is what keeps those replies from fighting.
+          if (!buf.topic || at >= buf.topic.at) {
+            const text = data.text.slice(0, 200);
+            const changed = buf.topic?.text !== text;
+            buf.topic = { text, by: peer.nickname, at };
+            if (msgRoom === this.#currentRoom) {
+              this.#applyTopicToUI();
+            }
+            if (changed && !data.silent) {
+              this.#ui.toBuffer(msgRoom, () => {
+                this.#ui.addSystemMessage(
+                  text
+                    ? `📋 ${peer.nickname} set the topic of #${msgRoom}: ${text}`
+                    : `📋 ${peer.nickname} cleared the topic of #${msgRoom}`,
+                );
+              });
+            }
+          }
+        }
+        return;
+      }
+
       if (data.action === 'pin_message') {
         const pins = roomActive ? this.#pinnedMessages : this.#buffers.get(msgRoom)?.pins;
         pins?.push({
@@ -1191,7 +1265,14 @@ export class ChatController {
         });
       }
 
-      const mentioned = this.#mentionsMe(data.text) && !data.isDM;
+      const watchHit = this.#matchedWatch(data.text);
+      // A watched keyword deserves the same attention a mention gets.
+      const mentioned = (this.#mentionsMe(data.text) || !!watchHit) && !data.isDM;
+      if (watchHit) {
+        this.#ui.toBuffer(msgRoom, () => {
+          this.#ui.addSystemMessage(`👁 "${watchHit}" mentioned by ${peer.nickname} in #${msgRoom}`);
+        });
+      }
       if (mentioned) {
         this.#mentions.push({
           nickname: peer.nickname,
@@ -1222,15 +1303,17 @@ export class ChatController {
         if (data.replyTo?.nickname && typeof data.replyTo.excerpt === 'string') {
           this.#ui.addQuoteLine(String(data.replyTo.nickname), data.replyTo.excerpt.slice(0, 80));
         }
-        ({ lineIndex } = this.#ui.addMessage(
-          peer.nickname,
-          data.text,
-          !!data.isDM,
-          ephLabel,
-          isDeniable || !!data.deniable,
-          mentioned,
-          trust,
-        ));
+        ({ lineIndex } = data.isAction
+          ? this.#ui.addActionMessage(peer.nickname, data.text)
+          : this.#ui.addMessage(
+              peer.nickname,
+              data.text,
+              !!data.isDM,
+              ephLabel,
+              isDeniable || !!data.deniable,
+              mentioned,
+              trust,
+            ));
       });
       this.#noteBufferUnread(msgRoom, mentioned);
       const notify = shouldNotify(this.#dndMode, this.#dndWindow, nowMinutes(), mentioned);
@@ -1285,6 +1368,16 @@ export class ChatController {
     return mentionsMe(text, this.#nickname);
   }
 
+  // The first /watch keyword present in the text, or null.
+  #matchedWatch(text) {
+    for (const word of this.#watchWords) {
+      if (matchesKeyword(text, word)) {
+        return word;
+      }
+    }
+    return null;
+  }
+
   // ── User input handling ───────────────────────────────────────
   #handleUserInput(text) {
     this.#noteActive();
@@ -1308,7 +1401,9 @@ export class ChatController {
         this.#ui.addInfoMessage('  /users               - List online users');
         this.#ui.addInfoMessage('  /msg <nick> <text>   - Send a private message (DM)');
         this.#ui.addInfoMessage('  /reply <text>        - Reply to the last received message');
+        this.#ui.addInfoMessage('  /me <action>         - Third-person action message');
         this.#ui.addInfoMessage('  /mentions [n]        - Recent mentions of you (this session)');
+        this.#ui.addInfoMessage('  /watch [add|remove|clear] - Alert on a keyword in any room');
         this.#ui.addInfoMessage('  /contacts [add|remove|all] - Contact book (aliases for peers)');
         this.#ui.addInfoMessage(
           '  /away [reason]       - Mark yourself as away (unreads are counted)',
@@ -1320,6 +1415,7 @@ export class ChatController {
         this.#ui.addInfoMessage('  /status <text|off>   - Set a status (accepts :emoji:)');
         this.#ui.addInfoMessage('  /join <room> [pass]  - Join a room as a new buffer (Alt+1..9)');
         this.#ui.addInfoMessage('  /leave [room]        - Leave a room (its buffer closes)');
+        this.#ui.addInfoMessage('  /topic [text|clear]  - Show or set the room topic');
         this.#ui.addInfoMessage('  /create <room> <pass> - Create a private room 🔒');
         this.#ui.addInfoMessage('  /invite [host:port]  - Generate an invite with QR code');
         this.#ui.addInfoMessage('  /rooms               - List available rooms');
@@ -1343,6 +1439,7 @@ export class ChatController {
           '  /dnd [on|off|mentions|HH:MM-HH:MM] - Do not disturb / mentions only',
         );
         this.#ui.addInfoMessage('  /search <term>       - Search the encrypted local history');
+        this.#ui.addInfoMessage('  /find [term]         - Find in this room and jump (Ctrl+F)');
         this.#ui.addInfoMessage('  /history [n]         - Last n messages from history');
         this.#ui.addInfoMessage('  /export [path]       - Export the history (.txt or .json)');
         this.#ui.addInfoMessage('  /audit [N]           - Show the last N audit events');
@@ -1516,7 +1613,7 @@ export class ChatController {
           break;
         }
         this.#ui.addInfoMessage('Trust status:');
-        for (const p of peerList) {
+        for (const [sid, p] of this.#peers) {
           const record = this.#trustStore.getPeerRecord(p.nickname);
           let status;
           if (!record) {
@@ -1526,8 +1623,11 @@ export class ChatController {
           } else {
             status = 'trusted (TOFU)';
           }
-          this.#ui.addInfoMessage(`  ${p.nickname}: ${status}`);
+          // [PQ] = this session's ratchet root also includes an ML-KEM secret.
+          const pq = this.#handshake.isHybrid(sid) ? ' {green-fg}[PQ]{/green-fg}' : '';
+          this.#ui.addInfoMessage(`  ${p.nickname}: ${status}${pq}`);
         }
+        this.#ui.addInfoMessage('  [PQ] = hybrid post-quantum session (X25519 + ML-KEM-768)');
         break;
       }
 
@@ -1812,6 +1912,83 @@ export class ChatController {
         break;
       }
 
+      case '/topic': {
+        const buf = this.#buffers.get(this.#currentRoom);
+        const newTopic = parts.slice(1).join(' ').trim();
+
+        if (!newTopic) {
+          const t = buf?.topic;
+          this.#ui.addInfoMessage(
+            t?.text
+              ? `Topic of #${this.#currentRoom}: ${t.text}  (set by ${t.by})`
+              : `#${this.#currentRoom} has no topic. Set one with /topic <text>`,
+          );
+          break;
+        }
+
+        const text = newTopic === 'clear' ? '' : applyShortcodes(newTopic).slice(0, 200);
+        const at = Date.now();
+        if (buf) {
+          buf.topic = { text, by: this.#nickname, at };
+        }
+        this.#applyTopicToUI();
+        this.#paceOrSend(
+          JSON.stringify({ action: 'set_topic', room: this.#currentRoom, text, at, sentAt: at }),
+        );
+        this.#ui.addSystemMessage(
+          text ? `📋 You set the topic: ${text}` : '📋 You cleared the topic',
+        );
+        break;
+      }
+
+      case '/me': {
+        const actionText = parts.slice(1).join(' ').trim();
+        if (!actionText) {
+          this.#ui.addErrorMessage('Usage: /me <action>  — e.g. /me is compiling');
+          break;
+        }
+        this.#sendMessageToAll(actionText, null, true);
+        break;
+      }
+
+      case '/watch': {
+        const sub = (parts[1] || 'list').toLowerCase();
+        if (sub === 'add') {
+          const word = parts.slice(2).join(' ').trim();
+          if (!word) {
+            this.#ui.addErrorMessage('Usage: /watch add <keyword>');
+            break;
+          }
+          this.#watchWords.add(word.toLowerCase());
+          this.#ui.addInfoMessage(`Watching for "${word.toLowerCase()}" in every room`);
+          break;
+        }
+        if (sub === 'remove' || sub === 'rm') {
+          const word = parts.slice(2).join(' ').trim().toLowerCase();
+          if (this.#watchWords.delete(word)) {
+            this.#ui.addInfoMessage(`No longer watching "${word}"`);
+          } else {
+            this.#ui.addErrorMessage(`"${word}" is not being watched`);
+          }
+          break;
+        }
+        if (sub === 'clear') {
+          this.#watchWords.clear();
+          this.#ui.addInfoMessage('Watch list cleared');
+          break;
+        }
+        if (sub !== 'list') {
+          this.#ui.addErrorMessage('Usage: /watch [add <word> | remove <word> | clear]');
+          break;
+        }
+        if (this.#watchWords.size === 0) {
+          this.#ui.addInfoMessage('Not watching any keyword. Use /watch add <word>');
+          break;
+        }
+        this.#ui.addInfoMessage(`Watching: ${[...this.#watchWords].join(', ')}`);
+        break;
+      }
+
       case '/mentions': {
         if (this.#mentions.length === 0) {
           this.#ui.addInfoMessage('No mentions in this session yet.');
@@ -1994,6 +2171,13 @@ export class ChatController {
         break;
       }
 
+      case '/find': {
+        const term = parts.slice(1).join(' ').trim();
+        // Opens the same overlay as Ctrl+F, pre-filled when a term is given.
+        this.#ui.openFinder(term);
+        break;
+      }
+
       case '/search': {
         if (!this.#historyStore?.isOpen) {
           this.#ui.addErrorMessage('History disabled — start the client with a passphrase');
@@ -2013,6 +2197,11 @@ export class ChatController {
         for (const e of results) {
           this.#ui.addInfoMessage(`  ${this.#formatHistoryEntry(e)}`);
         }
+        // /search reads the on-disk history (possibly from other sessions);
+        // point at the navigable finder for what is actually on screen.
+        this.#ui.addInfoMessage(
+          `Tip: /find ${term} (or Ctrl+F) searches this room's scrollback and jumps to the message.`,
+        );
         break;
       }
 
@@ -2440,7 +2629,9 @@ export class ChatController {
         // "nickname taken"): the server still accepts a JOIN on this socket.
         this.#nickname = newNick;
         this.#ui.setNickname(newNick);
-        this.#connection.send(createJoin(newNick, this.#keyManager.publicKeyB64));
+        this.#connection.send(
+          createJoin(newNick, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+        );
         this.#ui.addSystemMessage(`Trying to join as ${newNick}...`);
         break;
       }
@@ -2668,7 +2859,7 @@ export class ChatController {
         rooms: new Set([msg.room]),
       });
       if (!this.#handshake.getRatchet(peer.sessionId)) {
-        this.#handshake.registerPeer(peer.sessionId, peer.publicKey);
+        this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
       }
       this.#checkTrust(peer.nickname, peer.publicKey);
     }
@@ -2703,7 +2894,7 @@ export class ChatController {
           rooms: new Set([msg.room]),
         });
         if (!this.#handshake.getRatchet(peer.sessionId)) {
-          this.#handshake.registerPeer(peer.sessionId, peer.publicKey);
+          this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
         }
       }
       this.#checkTrust(peer.nickname, peer.publicKey);
@@ -3082,7 +3273,7 @@ export class ChatController {
   }
 
   // ── Send encrypted message to all peers ───────────────────────
-  #sendMessageToAll(text, replyTo = null) {
+  #sendMessageToAll(text, replyTo = null, isAction = false) {
     if (!this.#connection.connected) {
       this.#ui.addErrorMessage('No connection to the server — message not sent');
       return;
@@ -3099,6 +3290,9 @@ export class ChatController {
       sentAt: Date.now(),
       messageId,
     };
+    if (isAction) {
+      msgObj.isAction = true;
+    }
     if (replyTo) {
       msgObj.replyTo = replyTo;
     }
@@ -3127,13 +3321,9 @@ export class ChatController {
       this.#ui.addQuoteLine(replyTo.nickname, replyTo.excerpt, true);
     }
     const ephLabel = this.#ephemeralMode ? this.#formatDuration(this.#ephemeralDurationMs) : null;
-    const { lineIndex } = this.#ui.addMessage(
-      this.#nickname,
-      text,
-      false,
-      ephLabel,
-      this.#deniableMode,
-    );
+    const { lineIndex } = isAction
+      ? this.#ui.addActionMessage(this.#nickname, text)
+      : this.#ui.addMessage(this.#nickname, text, false, ephLabel, this.#deniableMode);
 
     if (this.#ephemeralMode) {
       this.#scheduleEphemeralRemoval(lineIndex, this.#ephemeralDurationMs, this.#nickname);