ciphermesh 2.7.1 → 2.8.0

package/CHANGELOG.md

@@ -3,6 +3,53 @@
 Notable changes per release. Older versions are reconstructed from the git
 history — the commit bodies and pull requests remain the fuller record.
 
+## 2.8.0
+
+### Added
+
+- **`/block`, `/unblock`, `/blocklist`.** Stop seeing someone, just for you.
+  Entirely local: nothing is sent, the relay never learns, and the other person
+  is not told. That is why everyone gets it — moderating a room acts on
+  everybody and so has to belong to the owner, while refusing to listen acts
+  only on yourself and needs no authority at all.
+
+  It is also the only protection that works in `general`, which has no owner and
+  therefore no moderation. Blocks live in the trust store, so they survive a
+  restart, are stored `0600`, and are wiped by `/panic` along with everything
+  else.
+
+### Fixed
+
+- **A room ban was undone by `/nick`.** Bans were stored against the nickname,
+  and anyone can pick a new one whenever they like: get banned, rename, walk
+  back in. Room owners are the only moderation in the system — the operator
+  cannot read content and deliberately holds no in-chat authority — so their one
+  tool was defeated by a single word. Bans are now bound to the public key
+  (#438).
+
+  The correct pattern was already in the codebase: the offline queue looks up by
+  nickname but verifies the public key before delivering. The ban list was the
+  one place a nickname was treated as an identity.
+
+## 2.7.2
+
+### Fixed
+
+- **The standalone binaries now run on machines other than the one that built
+  them.** `sodium-native` resolves its prebuilt addon at runtime, which bun
+  cannot follow, so the addon was never embedded — the binary kept an absolute
+  path back to the build checkout and died with `Cannot find addon` anywhere
+  else. Every binary published before this, including the relay binaries dating
+  back to 2.3.0, was affected (#427).
+
+  The verification was the deeper problem: it ran the binary _on the runner that
+  built it_, where the addon resolved through `node_modules`, so every check
+  passed while every download was broken. CI now hides the build tree before
+  running anything, and the cross-compiled binary is executed under Rosetta
+  rather than merely asserting its architecture.
+
+  **If you downloaded a binary from an earlier release, replace it.**
+
 ## 2.7.1
 
 ### Fixed

package/README.md

@@ -122,11 +122,15 @@ the server against a real CA (no trust-on-first-use window), and a host that
 once served a valid certificate can never be silently downgraded to a
 self-signed one.
 
-**No Node at all?** Every release ships standalone binaries for macOS and Linux
-(arm64/x64) — download from the
-[releases page](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+**No Node at all?** Standalone binaries for macOS and Linux (arm64/x64) —
+download from the
+[latest release](https://github.com/FelipeKreulich/secret-chat-lan/releases/latest),
 `chmod +x`, run. Nothing to install, not even Node.
 
+> Take the binaries from the **latest** release. Anything published before
+> v2.7.2 never embedded its native addon and only ran on the machine that built
+> it, so those attachments have been removed.
+
 | Binary | What it is |
 |---|---|
 | `ciphermesh-<platform>` | Everything: client, relay and P2P. `ciphermesh server` and `ciphermesh p2p` work exactly as they do on npm. |
@@ -180,6 +184,17 @@ sleep. Use is governed by the **[terms](TERMS.md)**.
 Bring people in: `/invite` prints a joinable string and a QR code, and
 `/rooms` shows what is live.
 
+**What the hub is for.** It exists so anyone can try CipherMesh and find other
+people using it without running a server first. It is a meeting point, not a
+general-purpose communications service — rooms are nobody's home, there are no
+accounts, and nothing is kept between sessions.
+
+**If you need a relay you control, run one.** It answers to you, depends on
+nobody else's uptime, and does not put your conversations through a machine a
+stranger administers. [`deploy/`](deploy/README.md) has the Docker setup ready to
+go. For anything that matters that is the better answer, and it is the one this
+software was built for.
+
 ## 💬 Commands
 
 <details>

package/README.pt-BR.md

@@ -123,11 +123,15 @@ clientes verificam o servidor contra uma CA de verdade (sem janela de
 trust-on-first-use), e um host que já apresentou certificado válido nunca pode
 ser rebaixado silenciosamente para um self-signed.
 
-**Sem Node nenhum?** Todo release traz binários standalone para macOS e Linux
-(arm64/x64) — baixe da
-[página de releases](https://github.com/FelipeKreulich/secret-chat-lan/releases),
+**Sem Node nenhum?** Binários standalone para macOS e Linux (arm64/x64) — baixe
+do
+[último release](https://github.com/FelipeKreulich/secret-chat-lan/releases/latest),
 `chmod +x`, rode. Nada para instalar, nem Node.
 
+> Pegue os binários do release **mais recente**. Os publicados antes da v2.7.2
+> nunca embutiram o addon nativo e só rodavam na máquina que os construiu, então
+> aqueles anexos foram removidos.
+
 | Binário | O que é |
 |---|---|
 | `ciphermesh-<plataforma>` | Tudo: cliente, relay e P2P. `ciphermesh server` e `ciphermesh p2p` funcionam igual ao npm. |
@@ -182,6 +186,17 @@ uso é regido pelos **[termos](TERMS.md)**.
 Para chamar gente: `/invite` imprime uma string de entrada e um QR code, e
 `/rooms` mostra o que está no ar.
 
+**Para que o hub existe.** Ele existe para qualquer pessoa poder experimentar o
+CipherMesh e encontrar outras pessoas que o usam sem precisar subir um servidor
+antes. É um ponto de encontro, não um serviço de comunicação de uso geral — as
+salas não são casa de ninguém, não há contas, e nada fica entre sessões.
+
+**Se você precisa de um relay que seja seu, suba um.** Ele responde a você, não
+depende da disponibilidade de mais ninguém, e não faz suas conversas passarem por
+uma máquina administrada por um estranho. A pasta [`deploy/`](deploy/README.md)
+tem o setup Docker pronto. Para o que é importante essa é a melhor resposta — e é
+aquela para a qual este software foi feito.
+
 ## 💬 Comandos
 
 <details>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciphermesh",
-  "version": "2.7.1",
+  "version": "2.8.0",
   "description": "Secure terminal chat for the local network (LAN) with real end-to-end encryption (E2EE) using libsodium",
   "type": "module",
   "main": "src/client/index.js",

package/src/client/ChatController.js

@@ -896,6 +896,13 @@ export class ChatController {
       return;
     }
 
+    // Blocked: drop it here, before spending the decryption. Nothing goes back,
+    // so the sender cannot tell — refusing to listen is not a message. This is
+    // also the only protection that works in `general`, which has no owner.
+    if (this.#trustStore.isBlocked(senderPublicKey)) {
+      return;
+    }
+
     const ciphertext = Buffer.from(msg.payload.ciphertext, 'base64');
     const nonce = Buffer.from(msg.payload.nonce, 'base64');
 
@@ -1502,6 +1509,9 @@ export class ChatController {
         this.#ui.addInfoMessage('  /cover [on|constant|off] - Cover traffic (masks timing/volume)');
         this.#ui.addInfoMessage('  /kick <nick> [reason] - Kick a user from the room (owner)');
         this.#ui.addInfoMessage('  /mute <nick> [time]  - Mute a user (owner, default 5m)');
+        this.#ui.addInfoMessage('  /block <nick>        - Stop seeing someone, just for you');
+        this.#ui.addInfoMessage('  /unblock <nick>      - Undo a block');
+        this.#ui.addInfoMessage('  /blocklist           - Who you have blocked');
         this.#ui.addInfoMessage('  /ban <nick> [reason] - Ban a user from the room (owner)');
         this.#ui.addInfoMessage('  /owner               - Show the current room owner');
         this.#ui.addInfoMessage('  /theme [name]        - Nick color theme');
@@ -2501,6 +2511,55 @@ export class ChatController {
         break;
       }
 
+      // /block is nothing like /kick, /ban or /mute: those need to be the room
+      // owner because they act on everyone, and this acts only on me. Nothing
+      // is sent, the relay never learns, and the other person cannot tell.
+      // That is why everybody gets it — and why it is the only protection that
+      // works in `general`, which has no owner at all.
+      case '/block': {
+        const blockNick = parts[1];
+        if (!blockNick) {
+          this.#ui.addErrorMessage('Usage: /block <nick>');
+          break;
+        }
+        if (this.#trustStore.blockPeer(blockNick)) {
+          this.#ui.addInfoMessage(
+            `Blocked ${blockNick}. You will not see their messages; they are not told.`,
+          );
+        } else {
+          this.#ui.addErrorMessage(`No record of "${blockNick}" — you can only block someone seen`);
+        }
+        break;
+      }
+
+      case '/unblock': {
+        const unblockNick = parts[1];
+        if (!unblockNick) {
+          this.#ui.addErrorMessage('Usage: /unblock <nick>');
+          break;
+        }
+        if (this.#trustStore.unblockPeer(unblockNick)) {
+          this.#ui.addInfoMessage(`Unblocked ${unblockNick}`);
+        } else {
+          this.#ui.addErrorMessage(`"${unblockNick}" was not blocked`);
+        }
+        break;
+      }
+
+      case '/blocklist': {
+        const blocked = this.#trustStore.listBlocked();
+        if (blocked.length === 0) {
+          this.#ui.addInfoMessage('Nobody blocked');
+          break;
+        }
+        this.#ui.addInfoMessage(`Blocked (${blocked.length}):`);
+        for (const entry of blocked) {
+          const label = entry.alias ? `${entry.nickname} (${entry.alias})` : entry.nickname;
+          this.#ui.addInfoMessage(`  ${label}  ${entry.fingerprint}`);
+        }
+        break;
+      }
+
       case '/mute': {
         const muteNick = parts[1];
         if (!muteNick) {

package/src/crypto/TrustStore.js

@@ -241,6 +241,73 @@ export class TrustStore {
       .sort((a, b) => b.lastSeen - a.lastSeen);
   }
 
+  // ── Blocking ─────────────────────────────────────────────────
+  // Entirely local: nothing is sent, the relay never learns, and blocking
+  // someone affects only the person who did it. That is what makes it safe to
+  // give to everyone — moderation needs authority and so has to be limited to
+  // room owners, but refusing to listen needs none.
+  //
+  // It is also the only protection available in `general`, which has no owner
+  // and therefore no moderation at all.
+  //
+  // Matched on the public key, never the nickname: /nick would otherwise undo a
+  // block the same way it used to undo a ban.
+
+  /** Block an already-seen peer. False if we have never seen them. */
+  blockPeer(nickname) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record) {
+      return false;
+    }
+    record.blocked = true;
+    this.#save();
+    return true;
+  }
+
+  /** Unblock a peer. False if they were not blocked. */
+  unblockPeer(nickname) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record?.blocked) {
+      return false;
+    }
+    delete record.blocked;
+    this.#save();
+    return true;
+  }
+
+  /**
+   * Is this key blocked?
+   *
+   * Records are filed under the nickname they were first seen with, so a
+   * rename leaves the record where it was — the key is what has to match.
+   *
+   * @param {string} publicKeyB64
+   */
+  isBlocked(publicKeyB64) {
+    if (!publicKeyB64) {
+      return false;
+    }
+    for (const record of this.#store.values()) {
+      if (record.blocked && record.publicKey === publicKeyB64) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /** Everyone currently blocked, most recently seen first. */
+  listBlocked() {
+    return [...this.#store.entries()]
+      .filter(([, r]) => r.blocked)
+      .map(([nickname, r]) => ({
+        nickname,
+        alias: r.alias || null,
+        fingerprint: r.fingerprint,
+        lastSeen: r.lastSeen || 0,
+      }))
+      .sort((a, b) => b.lastSeen - a.lastSeen);
+  }
+
   /** Export all trust records as a plain object (for identity backup). */
   exportData() {
     return Object.fromEntries(this.#store);

package/src/server/SessionManager.js

@@ -394,16 +394,38 @@ export class SessionManager {
     this.#muteState.set(sessionId, { until: Date.now() + durationMs });
   }
 
-  banPeer(room, nickname) {
+  /**
+   * Ban someone from a room.
+   *
+   * Keyed on the public key, never the nickname: /nick lets anyone pick a new
+   * name whenever they like, so a nickname ban was undone by typing one word.
+   * The public key is what an identity actually is here — the offline queue
+   * already binds delivery to it, and this was the one place that did not.
+   *
+   * A new keypair still gets you back in, but it costs the verified status you
+   * had with every contact and shows up as unverified under TOFU. That is a
+   * real price; a new nickname is not.
+   *
+   * @param {string} room
+   * @param {string} publicKey - base64, as the session carries it
+   */
+  banPeer(room, publicKey) {
+    if (!publicKey) {
+      return;
+    }
     if (!this.#banList.has(room)) {
       this.#banList.set(room, new Set());
     }
-    this.#banList.get(room).add(nickname.toLowerCase());
+    this.#banList.get(room).add(publicKey);
   }
 
-  isBanned(room, nickname) {
+  /**
+   * @param {string} room
+   * @param {string} publicKey - base64
+   */
+  isBanned(room, publicKey) {
     const banned = this.#banList.get(room);
-    return banned ? banned.has(nickname.toLowerCase()) : false;
+    return !!publicKey && !!banned && banned.has(publicKey);
   }
 
   findSessionByNickname(nickname) {

package/src/server/WebSocketServer.js

@@ -381,7 +381,7 @@ export class SecureWSServer {
     const session = this.#sessionManager.getSession(ws.sessionId);
 
     // Check if user is banned from target room
-    if (this.#sessionManager.isBanned(validation.room, session.nickname)) {
+    if (this.#sessionManager.isBanned(validation.room, session.publicKey)) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are banned from this room')));
       return;
     }
@@ -474,7 +474,7 @@ export class SecureWSServer {
     }
 
     const session = this.#sessionManager.getSession(ws.sessionId);
-    if (this.#sessionManager.isBanned(validation.room, session.nickname)) {
+    if (this.#sessionManager.isBanned(validation.room, session.publicKey)) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are banned from this room')));
       return;
     }
@@ -655,7 +655,7 @@ export class SecureWSServer {
     }
 
     const session = this.#sessionManager.getSession(ws.sessionId);
-    if (this.#sessionManager.isBanned(validation.room, session.nickname)) {
+    if (this.#sessionManager.isBanned(validation.room, session.publicKey)) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are banned from this room')));
       return;
     }
@@ -914,13 +914,12 @@ export class SecureWSServer {
       return;
     }
 
-    // Ban + kick to general
-    this.#sessionManager.banPeer(room, validation.targetNickname);
+    // Ban the key, not the name: /nick would otherwise undo this in one word.
+    const targetSession = this.#sessionManager.getSession(targetSessionId);
+    this.#sessionManager.banPeer(room, targetSession?.publicKey);
 
     const result = this.#sessionManager.switchRoom(targetSessionId, 'general');
     if (result) {
-      const targetSession = this.#sessionManager.getSession(targetSessionId);
-
       this.#sessionManager.broadcastToRoom(
         room,
         createPeerKicked(validation.targetNickname, validation.reason || 'banned'),