ciphermesh 2.6.0 → 2.7.1

package/CHANGELOG.md

@@ -0,0 +1,69 @@
+# Changelog
+
+Notable changes per release. Older versions are reconstructed from the git
+history — the commit bodies and pull requests remain the fuller record.
+
+## 2.7.1
+
+### Fixed
+
+- The banner no longer reads a font from disk. `figlet.textSync` loads
+  `fonts/ANSI Shadow.flf` at startup — fine under Node, fatal inside a compiled
+  binary, where the file does not exist and the process died before printing
+  anything. The word never changes, so the art is now the constant it always
+  was, pinned against figlet's own output by a test. figlet moved to a
+  devDependency and the 1.11.4 hold is gone (#414).
+
+## 2.7.0
+
+### Added
+
+- **Public hub at [ciphermesh.de](https://ciphermesh.de).** An always-on relay
+  anyone can connect to, so using CipherMesh no longer means already knowing
+  someone who runs one. `general` is the default room. Governed by
+  [TERMS.md](TERMS.md).
+- **The website and the relay share one domain.** Caddy routes WebSocket
+  upgrades to the relay and everything else to the landing page. No client
+  change: the client connects to `/` with no path, so the split is on the
+  `Upgrade` handshake rather than a path.
+- **Presence endpoint** (`PRESENCE_PORT`, off by default). Publishes how busy a
+  relay is as a coarse **range** — `1-5`, `6-20` — never an exact count, a room
+  name or a nickname. An exact live number would let anyone polling it watch
+  people arrive and leave, which is the metadata the relay exists to withhold.
+  Runs on its own listener so it cannot affect chat.
+- **Standalone client binary.** Every release now ships
+  `ciphermesh-<platform>` with the client, relay and P2P, alongside the
+  relay-only `ciphermesh-server-<platform>`. No Node needed. Closes the
+  long-standing bundling blocker (#328).
+- **External hub monitoring.** A scheduled probe checks the WebSocket upgrade,
+  the site and the certificate, and opens an issue when any of them fails.
+
+### Fixed
+
+- A Caddyfile change never reached the running Caddy. `git reset --hard`
+  replaces the file, giving it a new inode, and a file bind-mount follows the
+  inode it was created with — the container kept reading the old, unlinked copy
+  while `docker compose up -d` saw nothing to recreate. `deploy/deploy.sh` is
+  now versioned and recreates Caddy when the file changes.
+- The automatic deploy never fired on a release: GitHub does not trigger
+  workflows from events created by `GITHUB_TOKEN`.
+
+### Changed
+
+- Both READMEs describe the hub and link to the site; `homepage` now points at
+  ciphermesh.de.
+- `bonjour-service` 1.4.3 → 1.4.4.
+- **`figlet` held at 1.11.3.** 1.11.4 reads its `.flf` font from disk at
+  runtime, and that file is not inside a compiled binary, so every standalone
+  build died with `ENOENT` on `/$bunfs/fonts/ANSI Shadow.flf` before printing
+  the banner. The test suite runs under Node, where the font exists, so CI
+  stayed green while the binaries were broken. Tracked in #414.
+- Dependabot now targets `dev`. It was opening PRs straight into `master`,
+  which left `dev` behind and dragged unrelated commits into the next release.
+
+## 2.6.0 and earlier
+
+See the [release history](https://github.com/FelipeKreulich/secret-chat-lan/releases).
+Highlights: hybrid post-quantum handshake (X25519 + ML-KEM-768), sealed sender,
+multi-room buffers, private rooms with zero-knowledge passwords, the plugin API,
+`/doctor`, screen lock, and the standalone relay binary.

package/README.md

@@ -15,8 +15,11 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%E2%89%A5%2020-brightgreen)](package.json)
 [![Crypto](https://img.shields.io/badge/E2EE-libsodium-7b2dff)](docs/ARCHITECTURE.md)
+[![Website](https://img.shields.io/badge/ciphermesh.de-4cc9f0)](https://ciphermesh.de)
 
-**[🇧🇷 Leia em Português](README.pt-BR.md)** · [Setup Guide](docs/SETUP.md) · [Architecture](docs/ARCHITECTURE.md) · [Security Policy](SECURITY.md) · [Hub Terms](TERMS.md)
+**[ciphermesh.de](https://ciphermesh.de)** — the website, and the public hub anyone can join.
+
+**[🇧🇷 Leia em Português](README.pt-BR.md)** · [Setup Guide](docs/SETUP.md) · [Architecture](docs/ARCHITECTURE.md) · [Security Policy](SECURITY.md) · [Hub Terms](TERMS.md) · [Contributing](CONTRIBUTING.md)
 
 <img src="docs/demo.svg" alt="CipherMesh terminal demo" width="720">
 
@@ -119,12 +122,15 @@ the server against a real CA (no trust-on-first-use window), and a host that
 once served a valid certificate can never be silently downgraded to a
 self-signed one.
 
-**No Node on the host?** Every release ships a standalone relay binary for
-macOS and Linux (arm64/x64) — download it from the
+**No Node at all?** Every release ships standalone binaries for macOS and Linux
+(arm64/x64) — download from the
 [releases page](https://github.com/FelipeKreulich/secret-chat-lan/releases),
-`chmod +x`, run. Nothing to install. (The TUI client still needs Node/npx: it
-depends on blessed, which resolves its widgets at runtime and cannot be
-bundled.)
+`chmod +x`, run. Nothing to install, not even Node.
+
+| Binary | What it is |
+|---|---|
+| `ciphermesh-<platform>` | Everything: client, relay and P2P. `ciphermesh server` and `ciphermesh p2p` work exactly as they do on npm. |
+| `ciphermesh-server-<platform>` | Relay only, for self-hosters who want nothing else on the machine. |
 
 **Everyone** (including the host):
 
@@ -145,6 +151,35 @@ now speaks nearly the same command set as the relay client (presence, `/lock`,
 `/contacts`, `/mentions`, `/topic`, encrypted history and more); only
 `/invite`, `/create` and `/nick` are relay-specific by nature.
 
+## 🌐 The community lives at ciphermesh.de
+
+For a long time, using CipherMesh meant already knowing someone who ran a relay.
+That is over: **[ciphermesh.de](https://ciphermesh.de)** is a public hub, free
+and open to anyone, always on. Nobody has to coordinate who starts the server.
+
+```bash
+npx ciphermesh@latest
+# Server: ciphermesh.de
+# Room:   general
+```
+
+- **`general` is the front door.** It is the default room — connect and say hello
+  if you just want to see who else is around.
+- **Any room, opened by anyone.** Pick a name, tell the people you want in it,
+  start talking. No account, no invitation, no waiting list.
+- **Private the moment you want it.** Add a password and the room is yours. The
+  password never reaches the server — only an Argon2id-derived verifier it cannot
+  reverse.
+- **Nothing outlives the conversation.** A room exists while someone is inside
+  it. When the last person leaves, the room and everything said in it are gone.
+
+Running the hub does not make its operator a reader: it is zero-knowledge like
+every other CipherMesh relay — the only difference is that this one never goes to
+sleep. Use is governed by the **[terms](TERMS.md)**.
+
+Bring people in: `/invite` prints a joinable string and a QR code, and
+`/rooms` shows what is live.
+
 ## 💬 Commands
 
 <details>

package/README.pt-BR.md

@@ -15,8 +15,11 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%E2%89%A5%2020-brightgreen)](package.json)
 [![Crypto](https://img.shields.io/badge/E2EE-libsodium-7b2dff)](docs/ARCHITECTURE.md)
+[![Site](https://img.shields.io/badge/ciphermesh.de-4cc9f0)](https://ciphermesh.de)
 
-**[🇺🇸 Read in English](README.md)** · [Guia de Setup](docs/SETUP.md) · [Arquitetura](docs/ARCHITECTURE.md) · [Política de Segurança](SECURITY.md) · [Termos do Hub](TERMS.md)
+**[ciphermesh.de](https://ciphermesh.de)** — o site, e o hub público em que qualquer pessoa pode entrar.
+
+**[🇺🇸 Read in English](README.md)** · [Guia de Setup](docs/SETUP.md) · [Arquitetura](docs/ARCHITECTURE.md) · [Política de Segurança](SECURITY.md) · [Termos do Hub](TERMS.md) · [Como contribuir](CONTRIBUTING.md)
 
 <img src="docs/demo.svg" alt="Demo do CipherMesh no terminal" width="720">
 
@@ -120,12 +123,15 @@ clientes verificam o servidor contra uma CA de verdade (sem janela de
 trust-on-first-use), e um host que já apresentou certificado válido nunca pode
 ser rebaixado silenciosamente para um self-signed.
 
-**Sem Node na máquina?** Todo release traz um binário standalone do relay para
-macOS e Linux (arm64/x64) — baixe da
+**Sem Node nenhum?** Todo release traz binários standalone para macOS e Linux
+(arm64/x64) — baixe da
 [página de releases](https://github.com/FelipeKreulich/secret-chat-lan/releases),
-`chmod +x`, rode. Nada para instalar. (O cliente TUI ainda precisa de Node/npx:
-ele depende do blessed, que resolve os widgets em runtime e não pode ser
-empacotado.)
+`chmod +x`, rode. Nada para instalar, nem Node.
+
+| Binário | O que é |
+|---|---|
+| `ciphermesh-<plataforma>` | Tudo: cliente, relay e P2P. `ciphermesh server` e `ciphermesh p2p` funcionam igual ao npm. |
+| `ciphermesh-server-<plataforma>` | Só o relay, para quem hospeda e não quer mais nada na máquina. |
 
 **Todo mundo** (incluindo quem hospeda):
 
@@ -146,6 +152,36 @@ P2P agora fala quase o mesmo conjunto de comandos do cliente relay (presença,
 `/lock`, `/contacts`, `/mentions`, `/topic`, histórico cifrado e mais); só
 `/invite`, `/create` e `/nick` são específicos do relay por natureza.
 
+## 🌐 A comunidade fica no ciphermesh.de
+
+Durante muito tempo, usar o CipherMesh exigia já conhecer alguém que rodasse um
+relay. Isso acabou: **[ciphermesh.de](https://ciphermesh.de)** é um hub público,
+gratuito, aberto a qualquer pessoa e sempre no ar. Ninguém precisa combinar quem
+vai subir o servidor.
+
+```bash
+npx ciphermesh@latest
+# Server: ciphermesh.de
+# Room:   general
+```
+
+- **A `general` é a porta de entrada.** É a sala padrão — conecte e diga oi se
+  você só quer ver quem está por perto.
+- **Qualquer sala, aberta por qualquer um.** Escolha um nome, avise quem você quer
+  lá dentro e comece a conversar. Sem conta, sem convite, sem lista de espera.
+- **Privada na hora que você quiser.** Ponha uma senha e a sala é sua. A senha
+  nunca chega ao servidor — ele guarda só um verificador derivado com Argon2id,
+  que não dá para reverter.
+- **Nada sobrevive à conversa.** A sala existe enquanto alguém está dentro dela.
+  Quando a última pessoa sai, a sala e tudo o que foi dito nela desaparecem.
+
+Manter o hub não transforma quem o opera em leitor: ele é zero-knowledge como
+qualquer outro relay do CipherMesh — a única diferença é que este nunca dorme. O
+uso é regido pelos **[termos](TERMS.md)**.
+
+Para chamar gente: `/invite` imprime uma string de entrada e um QR code, e
+`/rooms` mostra o que está no ar.
+
 ## 💬 Comandos
 
 <details>

package/bin/cli-binary.js

@@ -0,0 +1,42 @@
+// Entry point for the standalone CipherMesh binary (`bun build --compile`).
+//
+// Separate from bin/ciphermesh.js because that one dispatches through
+// `await import(new URL(target, import.meta.url))` — a computed specifier no
+// bundler can follow, which is why the binary used to contain nothing but the
+// launcher. Here the three specifiers are literal, so the bundler pulls in all
+// three modes and the branch picks one at runtime.
+//
+// The version is injected at build time: reading package.json off disk does not
+// work once everything lives inside the binary.
+const VERSION = process.env.CIPHERMESH_VERSION || 'unknown';
+
+const HELP = `CipherMesh — end-to-end encrypted terminal chat
+
+Usage:
+  ciphermesh [client]   connect to a relay server (default)
+  ciphermesh server     run the zero-knowledge relay server
+  ciphermesh p2p        serverless mode (mDNS peer discovery on the LAN)
+
+Options:
+  -h, --help            show this help
+  -v, --version         show the version
+
+Client options:
+  --setup               re-run the first-run setup wizard
+  --no-onboard          skip the first-run wizard (scripts/CI)
+  --fresh               forget the last session (server/room) and start clean
+`;
+
+const arg = process.argv[2];
+
+if (arg === '-h' || arg === '--help' || arg === 'help') {
+  process.stdout.write(HELP);
+} else if (arg === '-v' || arg === '--version') {
+  process.stdout.write(`${VERSION}\n`);
+} else if (arg === 'server') {
+  await import('../src/server/index.js');
+} else if (arg === 'p2p') {
+  await import('../src/p2p/index.js');
+} else {
+  await import('../src/client/index.js');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciphermesh",
-  "version": "2.6.0",
+  "version": "2.7.1",
   "description": "Secure terminal chat for the local network (LAN) with real end-to-end encryption (E2EE) using libsodium",
   "type": "module",
   "main": "src/client/index.js",
@@ -14,7 +14,8 @@
     "examples",
     "README.md",
     "README.pt-BR.md",
-    "LICENSE"
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=20.0.0"
@@ -26,7 +27,7 @@
     "type": "git",
     "url": "git+https://github.com/FelipeKreulich/secret-chat-lan.git"
   },
-  "homepage": "https://github.com/FelipeKreulich/secret-chat-lan#readme",
+  "homepage": "https://ciphermesh.de",
   "bugs": {
     "url": "https://github.com/FelipeKreulich/secret-chat-lan/issues"
   },
@@ -53,10 +54,9 @@
   "dependencies": {
     "@noble/post-quantum": "0.6.1",
     "blessed": "0.1.81",
-    "bonjour-service": "1.4.3",
+    "bonjour-service": "1.4.4",
     "boxen": "8.0.1",
     "chalk": "^5.4.1",
-    "figlet": "1.11.3",
     "gradient-string": "3.0.0",
     "jimp": "1.6.1",
     "node-notifier": "10.0.1",
@@ -67,6 +67,7 @@
   "devDependencies": {
     "@eslint/js": "10.0.1",
     "eslint": "10.8.0",
+    "figlet": "^1.11.4",
     "globals": "^17.7.0",
     "prettier": "^3.9.5"
   },

package/src/server/index.js

@@ -9,6 +9,7 @@ import { SessionManager } from './SessionManager.js';
 import { MessageRouter } from './MessageRouter.js';
 import { OfflineQueue } from './OfflineQueue.js';
 import { SecureWSServer } from './WebSocketServer.js';
+import { startPresenceServer } from './presence.js';
 import { loadOrGenerateCerts } from './CertManager.js';
 
 const log = createLogger('server');
@@ -55,6 +56,12 @@ function getLocalIPs() {
 // ── Bootstrap ──────────────────────────────────────────────────
 const port = parseInt(process.env.PORT, 10) || SERVER_PORT;
 
+/** A port number, or 0 meaning "do not listen". */
+function positivePort(value) {
+  const n = parseInt(value, 10);
+  return Number.isInteger(n) && n > 0 && n < 65536 ? n : 0;
+}
+
 const useTls = process.env.TLS !== 'false'; // default: true
 const tlsOptions = useTls ? loadOrGenerateCerts() : null;
 
@@ -63,6 +70,11 @@ const offlineQueue = new OfflineQueue();
 const messageRouter = new MessageRouter(sessionManager, offlineQueue);
 const server = new SecureWSServer(sessionManager, messageRouter, offlineQueue, port, tlsOptions);
 
+// Optional, off unless PRESENCE_PORT is set. Publishes how busy the hub is as a
+// bucket — never a count, never a room name. Runs on its own listener so a
+// problem here cannot reach the chat.
+startPresenceServer(sessionManager, positivePort(process.env.PRESENCE_PORT));
+
 // Cleanup offline queue and recently left peers every 5 minutes
 setInterval(
   () => {

package/src/server/presence.js

@@ -0,0 +1,79 @@
+import { createServer } from 'node:http';
+import { createLogger } from '../shared/logger.js';
+
+const log = createLogger('presence');
+
+/**
+ * Buckets, not counts.
+ *
+ * A live "3 people online" would let anyone with a polling script watch people
+ * arrive and leave — exactly the metadata the relay is built not to hand out.
+ * Bucketing hides that: within a bucket, joins and leaves are invisible, and the
+ * only thing an observer learns is roughly how busy the hub is.
+ *
+ * Crossing a boundary is still observable (5 → 6 says somebody joined). That is
+ * inherent to publishing anything at all, and it is a far smaller disclosure
+ * than an exact number. Wider buckets would leak less and say less; this is the
+ * trade-off, stated out loud rather than hidden.
+ */
+const BUCKETS = [
+  { max: 0, label: '0' },
+  { max: 5, label: '1-5' },
+  { max: 20, label: '6-20' },
+  { max: 50, label: '21-50' },
+  { max: Infinity, label: '50+' },
+];
+
+export function bucketFor(count) {
+  const n = Number.isFinite(count) && count > 0 ? Math.floor(count) : 0;
+  return BUCKETS.find((b) => n <= b.max).label;
+}
+
+/**
+ * A tiny HTTP listener that publishes how busy the hub is, and nothing else.
+ *
+ * Deliberately a SEPARATE server from the WebSocket one: if anything here
+ * misbehaves, chat is untouched. It is meant to be reachable only from the
+ * internal network (the landing page's container asks it), never published to
+ * the host — see deploy/docker-compose.public.yml.
+ *
+ * What it will never expose: room names, nicknames, addresses, or an exact
+ * count. Those are the things the relay's whole design refuses to hand over,
+ * and a convenience endpoint is not a good reason to start.
+ *
+ * @param {{ size: number }} sessionManager
+ * @param {number} port - 0 or unset disables the listener entirely
+ */
+export function startPresenceServer(sessionManager, port) {
+  if (!port) {
+    return null;
+  }
+
+  const server = createServer((req, res) => {
+    if (req.method !== 'GET' || !req.url.startsWith('/presence')) {
+      res.writeHead(404).end();
+      return;
+    }
+
+    const body = JSON.stringify({ online: bucketFor(sessionManager.size) });
+    res.writeHead(200, {
+      'content-type': 'application/json',
+      // The caller caches; this only stops an intermediary from serving a
+      // stale bucket for longer than the bucket is meaningful.
+      'cache-control': 'public, max-age=30',
+      'content-length': Buffer.byteLength(body),
+    });
+    res.end(body);
+  });
+
+  server.on('error', (err) => {
+    // Presence is a nice-to-have. It must never take the relay down with it.
+    log.error(`Presence server error: ${err.message}`);
+  });
+
+  // Bind to all interfaces so the site's container can reach it over the Docker
+  // network. The port is never published to the host.
+  server.listen(port, () => log.info(`Presence endpoint on port ${port}`));
+
+  return server;
+}

package/src/shared/banner.js

@@ -1,4 +1,3 @@
-import figlet from 'figlet';
 import gradient from 'gradient-string';
 import chalk from 'chalk';
 import boxen from 'boxen';
@@ -7,8 +6,36 @@ const neon = gradient(['#00ff9f', '#00b8ff', '#7b2dff', '#ff2dff']);
 const cyber = gradient(['#f72585', '#7209b7', '#3a0ca3', '#4361ee', '#4cc9f0']);
 const mint = gradient(['#00ff9f', '#00b8ff']);
 
+/**
+ * "CipherMesh" in figlet's ANSI Shadow, rendered once and kept.
+ *
+ * It used to be generated at startup with `figlet.textSync`, which reads the
+ * font file from disk — fine under Node, fatal inside a compiled binary, where
+ * `fonts/ANSI Shadow.flf` does not exist and the process dies before printing
+ * anything (issue #414). The word never changes, so there is nothing to
+ * generate: the art is the constant it always was.
+ *
+ * `test/banner.test.js` pins it against figlet's own output, so a change here
+ * has to be deliberate.
+ */
+const ART = [
+  ' ██████╗██╗██████╗ ██╗  ██╗███████╗██████╗ ███╗   ███╗███████╗███████╗██╗  ██╗',
+  '██╔════╝██║██╔══██╗██║  ██║██╔════╝██╔══██╗████╗ ████║██╔════╝██╔════╝██║  ██║',
+  '██║     ██║██████╔╝███████║█████╗  ██████╔╝██╔████╔██║█████╗  ███████╗███████║',
+  '██║     ██║██╔═══╝ ██╔══██║██╔══╝  ██╔══██╗██║╚██╔╝██║██╔══╝  ╚════██║██╔══██║',
+  '╚██████╗██║██║     ██║  ██║███████╗██║  ██║██║ ╚═╝ ██║███████╗███████║██║  ██║',
+  ' ╚═════╝╚═╝╚═╝     ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚══════╝╚═╝  ╚═╝',
+  // figlet pads the block to a seventh, blank line. It is not decoration: the
+  // animations count lines to move the cursor back up (`\x1b[${N + 1}A`), so
+  // dropping it would shift every redraw by one row.
+  ' '.repeat(78),
+].join('\n');
+
+/** Byte-for-byte what `figlet.textSync('CipherMesh', { font: 'ANSI Shadow' })` returns. */
+export const LOGO_ART = ART;
+
 function logo() {
-  return neon(figlet.textSync('CipherMesh', { font: 'ANSI Shadow' }));
+  return neon(LOGO_ART);
 }
 
 export function serverBanner(port, network, tls = false) {
@@ -80,7 +107,7 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // Animated splash: the neon gradient "flows" through the ANSI-Shadow logo for
 // ~1s, then settles. Runs before the TUI (plain terminal output).
 export async function animatedBanner(subtitle = '  ░▒▓  End-to-End Encrypted Chat  ▓▒░') {
-  const art = figlet.textSync('CipherMesh', { font: 'ANSI Shadow' }).replace(/\n+$/, '');
+  const art = ART;
   const artLines = art.split('\n');
   const N = artLines.length;
 
@@ -132,7 +159,7 @@ function mixHex(a, b, t) {
 // Goodbye animation on /quit: the neon logo fades to black over ~0.8s while a
 // farewell line shows, then the process exits. Static fallback on non-TTY.
 export async function farewellBanner(message = '  🔒 Session ended — keys wiped from memory') {
-  const art = figlet.textSync('CipherMesh', { font: 'ANSI Shadow' }).replace(/\n+$/, '');
+  const art = ART;
   const N = art.split('\n').length;
 
   if (!process.stdout.isTTY) {