ciphermesh 2.9.0 → 2.10.0

package/CHANGELOG.md

@@ -3,6 +3,47 @@
 Notable changes per release. Older versions are reconstructed from the git
 history — the commit bodies and pull requests remain the fuller record.
 
+## 2.10.0
+
+### Added
+
+- **\`--check\` for operators.** The deploy guide already explained every
+  footgun here, which is the problem: a document is read once, by whoever set
+  the machine up, while the misconfiguration lasts as long as the machine does.
+  The worst of them — \`TRUST_PROXY\` left off behind a reverse proxy — is
+  invisible from outside, because everything works and the per-IP cap, the rate
+  limit and the banlist simply apply to the proxy and protect nobody.
+
+  \`ciphermesh-server --check\` validates and exits without opening a socket, so
+  it is safe against a live host, and exits non-zero on an error so a deploy
+  script can gate on it. The same findings print at every startup, because a
+  warning you have to ask for is a warning nobody sees.
+
+- **Connection-rate limiting.** The relay capped how many sockets one address
+  could hold, and how many messages a session could send, but nothing capped how
+  fast an address could _open_ connections. Connect, run the hybrid handshake,
+  disconnect, repeat: the concurrency cap never trips because the sockets are
+  never held, and every attempt costs the relay an X25519 and an ML-KEM-768
+  operation while costing the client almost nothing. That asymmetry was the one
+  real denial-of-service route into a public hub.
+
+  An address that exceeds `CONNECTION_RATE_PER_MINUTE` (60 by default, still
+  LAN-friendly) is refused for a minute, then five, then thirty. An hour of
+  behaving clears the record, so a shared NAT gateway cannot accumulate strikes
+  forever, and the refusal says how long to wait so a well-behaved client backs
+  off instead of extending its own ban.
+
+- **A byte budget per connection** (`MAX_BYTES_PER_SECOND`,
+  `MAX_BYTES_BURST`). The message limit counts messages, and messages are padded
+  into buckets of up to 32 KiB, so a session sitting at the limit is a
+  multi-megabit stream. Bytes are the resource that runs out. The burst
+  allowance keeps a legitimate file transfer from looking like an attack.
+
+  Both are continuously refilling token buckets rather than fixed windows: a
+  fixed window lets a caller spend its whole allowance at the end of one window
+  and again at the start of the next, which is twice the intended rate at
+  exactly the moment an attacker aims for.
+
 ## 2.9.0
 
 ### Added

package/README.md

@@ -204,10 +204,11 @@ software was built for.
 | ----------------------------- | ----------------------------------------------------------------- |
 | `/help`                       | All commands                                                      |
 | `/tips`                       | Show a rotating security/UX tip                                   |
+| `/plugins`                    | List loaded plugins and the commands they add                     |
 | `/users`                      | Who's online (with away/status)                                   |
 | `/msg <nick> <text>`          | Private message (DM)                                              |
 | `/reply <text>`               | Reply quoting the last received message                           |
-| `/me <action>`                | Third-person action — _«felipe is compiling»_                     |
+| `/me <action>`                | Third-person action — _«ana is compiling»_                        |
 | `/watch [add\|remove\|clear]` | Alert on a keyword in **any** room, like a mention                |
 | `/invite [host:port]`         | Generate a `ciphermesh://` invite + QR code                       |
 | `/nick <new>`                 | Change nickname (before joining — recovers from "nickname taken") |
@@ -294,6 +295,7 @@ A green **✓** next to a name marks a SAS-verified peer; a red **✗** flags a
 | Command                                 | Description                                                                                                                                                                            |
 | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `/away [reason]` / `/back`              | Mark yourself away — while away, unreads are counted (`[away · N new]`) and `/back` shows a summary                                                                                    |
+| `/autoaway <minutes\|off>`              | Go away by itself after that long without typing (1–240 minutes)                                                                                                                       |
 | `/mentions [n]`                         | Recent mentions of you this session (who, where, when)                                                                                                                                 |
 | `/status <text\|off>`                   | Free-form status — emojis welcome (`/status :fire: coding`)                                                                                                                            |
 | `/react <emoji>`                        | React to the last message — the emoji lands **on the message**, with a count when several people react                                                                                 |
@@ -325,7 +327,7 @@ All keys are optional (unknown keys are ignored):
 
 ```json
 {
-  "nickname": "felipe",
+  "nickname": "ana",
   "server": "wss://100.x.y.z:3600",
   "sound": false,
   "notify": true,

package/README.pt-BR.md

@@ -209,7 +209,7 @@ aquela para a qual este software foi feito.
 | `/users`                      | Quem está online (com away/status)                                      |
 | `/msg <nick> <texto>`         | Mensagem privada (DM)                                                   |
 | `/reply <texto>`              | Responde citando a última mensagem recebida                             |
-| `/me <ação>`                  | Ação em terceira pessoa — _«felipe está compilando»_                    |
+| `/me <ação>`                  | Ação em terceira pessoa — _«ana está compilando»_                    |
 | `/watch [add\|remove\|clear]` | Alerta quando uma palavra aparece em **qualquer** sala, como uma menção |
 | `/invite [host:porta]`        | Gera convite `ciphermesh://` + QR code                                  |
 | `/nick <novo>`                | Troca de apelido (antes de entrar — recupera de "apelido em uso")       |
@@ -328,7 +328,7 @@ mão. Todas as chaves são opcionais (chaves desconhecidas são ignoradas):
 
 ```json
 {
-  "nickname": "felipe",
+  "nickname": "ana",
   "server": "wss://100.x.y.z:3600",
   "sound": false,
   "notify": true,

package/docs/PLUGINS.md

@@ -1,7 +1,12 @@
 # CipherMesh Plugin API
 
-CipherMesh loads user plugins at startup from `~/.ciphermesh/plugins/*.js` and
-routes unknown slash-commands to them. Plugins work in both relay and P2P mode.
+CipherMesh loads user plugins from `~/.ciphermesh/plugins/*.js` and routes
+unknown slash-commands to them. Plugins work in both relay and P2P mode.
+
+**Nothing there runs until you say so.** A file in that directory is found, not
+loaded. Run `/plugins` to see what is waiting and `/plugins allow <file>` to
+approve it — the approval is remembered in `~/.ciphermesh/config.json` under
+`pluginsAllowed`, so you are asked once per file.
 
 ## Quick start
 
@@ -10,8 +15,15 @@ mkdir -p ~/.ciphermesh/plugins
 cp examples/plugins/roll.js examples/plugins/poll.js ~/.ciphermesh/plugins/
 ```
 
-Restart the client — `/plugins` lists what loaded, and `/roll 2d20+3` /
-`/poll Pizza tonight? | yes | obviously` just work.
+Then in the client:
+
+```
+/plugins              → shows roll.js and poll.js waiting
+/plugins allow roll   → approved, loaded, and remembered
+/plugins allow poll
+```
+
+Now `/roll 2d20+3` and `/poll Pizza tonight? | yes | obviously` work.
 
 ## Plugin format
 
@@ -19,8 +31,8 @@ A plugin is an ES module whose **default export** is:
 
 ```js
 export default {
-  name: 'roll',                       // required, unique
-  description: 'Roll dice',           // optional, shown by /plugins
+  name: 'roll', // required, unique
+  description: 'Roll dice', // optional, shown by /plugins
   commands: {
     // key = command name (with or without the leading slash)
     roll(args) {
@@ -31,16 +43,18 @@ export default {
 };
 ```
 
-Files that fail to import, or lack `name`/`commands`, are skipped silently.
+A file that fails to import, or lacks `name`/`commands`, is skipped — but if you
+approved it, `/plugins` says so. A plugin you asked for and did not get should
+not disappear without a word.
 
 ## Handler return values
 
-| Return | Effect |
-|--------|--------|
-| `{ send: '<text>' }` | The text is **sent to the current room** as a normal end-to-end-encrypted message (and echoed locally). Markdown and multi-line text work. |
-| `{ info: '<text>' }` | Shown **only locally** as an info line. |
-| `'<text>'` (plain string) | Same as `{ info }` — the original API, still supported. |
-| `null` / `undefined` / throw | Treated as "not handled": the user sees *Unknown command*. |
+| Return                       | Effect                                                                                                                                     |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `{ send: '<text>' }`         | The text is **sent to the current room** as a normal end-to-end-encrypted message (and echoed locally). Markdown and multi-line text work. |
+| `{ info: '<text>' }`         | Shown **only locally** as an info line.                                                                                                    |
+| `'<text>'` (plain string)    | Same as `{ info }` — the original API, still supported.                                                                                    |
+| `null` / `undefined` / throw | Treated as "not handled": the user sees _Unknown command_.                                                                                 |
 
 Handlers are synchronous — return the final value directly.
 
@@ -54,13 +68,38 @@ directory listing).
 ## Security model — read this
 
 A plugin is **arbitrary JavaScript running inside your chat process**, with
-your privileges and full access to your keys in memory. There is no sandbox.
+your privileges and full access to your keys in memory. There is no sandbox,
+and approving one does not create one.
 
 - Only install plugins you wrote or read line-by-line.
 - Treat a plugin file like you treat `curl | sh`.
 - Plugins are never synced, auto-updated or downloaded by CipherMesh — the
   only way code gets into `~/.ciphermesh/plugins/` is you putting it there.
 
+### What approval actually buys
+
+Before, any `.js` file appearing in that directory ran at the next start. The
+warning above protected only the people who had already read it, and anything
+able to write one file into a known path had code execution.
+
+Now the file is listed and left alone until you approve it. That is the whole
+guarantee, and it is worth being precise about its edges:
+
+- **It is a consent step, not a sandbox.** An approved plugin can do everything
+  the client can do. Approve for the same reasons you would run a script.
+- **Approval is per _file name_, not per plugin name.** That is forced, not
+  chosen: a plugin's own `name` lives inside the module, and reading it means
+  importing the module, and importing it is already running it. The check has
+  to work from the directory listing alone.
+- **Replacing an approved file is not a new decision.** `roll.js` stays
+  approved even if its contents change completely. If you did not put the new
+  contents there, you have a bigger problem than plugins — but do not read the
+  approval as a promise about what the file contains.
+
+There is no capability system, deliberately. Declaring what a plugin may do
+without being able to enforce it would make the risk look bounded when it is
+not, which is worse than the plain warning above.
+
 ## Included examples
 
 - [`examples/plugins/roll.js`](../examples/plugins/roll.js) — dice roller,