ciphermesh 2.9.0 → 2.11.0

package/docs/design/sender-keys-on-relay.md

@@ -0,0 +1,118 @@
+# Sender keys on the relay
+
+Status: **design, not implemented.** Written 2026-08-07, straight after
+measuring the problem, so the next session starts from the constraints rather
+than rediscovering them.
+
+## The problem, measured
+
+`ChatController.#broadcastPayload` loops over every peer in the room and seals
+one envelope each:
+
+```js
+for (const [peerId] of this.#peers) {
+  const peerPublicKey = this.#handshake.getPeerPublicKey(peerId);
+  ...
+  this.#sealAndSend(peerPublicKey, msg);
+}
+```
+
+One typed line in a room of N people is **N encryptions and N envelopes on the
+wire**. Cost grows linearly with room size, on the sender's CPU and on the
+sender's uplink — the two places least able to absorb it.
+
+2.10.0 made this a ceiling rather than a slope. `MAX_BYTES_PER_SECOND` bounds a
+connection at 1 MiB/s by default, and messages are padded into buckets of up to
+32 KiB. A 32 KiB bucket sent to fifty people is 1.6 MiB for one line: the sender
+is throttled, or disconnected, for saying one thing.
+
+P2P does not have this problem. `P2PChatController` already uses
+`GroupSession` from `src/crypto/SenderKey.js`, encrypts once, and distributes
+the sender key per member. The code is written and tested; it is only the relay
+path that never adopted it.
+
+## What changes
+
+1. Each member holds a **sender chain** for the room and distributes its
+   `distribution()` to every other member — sealed per member, once, rather
+   than per message.
+2. A message is encrypted **once** with the sender's chain and handed to the
+   relay with a room destination rather than a peer destination.
+3. The relay fans the single ciphertext out to the room's members. It still
+   cannot read anything, and it still never learns the sender under sealed
+   sender.
+4. On any membership change, the leaver's departure triggers `rotate()` and a
+   redistribution — exactly what `P2PChatController` does today at lines 320
+   and 487, with the comment already written there.
+
+Cost per message goes from N encryptions and N envelopes to **one and one**.
+Distribution cost is N, but paid on join and on membership change rather than
+on every line.
+
+## The hard part: two versions in one room
+
+This is a protocol change. A 2.11 client encrypting once to a group and a 2.10
+client expecting an envelope addressed to it **cannot read each other**. The hub
+is public and people upgrade whenever they upgrade, so "everyone updates at
+once" is not available.
+
+Rolling this out badly breaks live conversations for strangers. Options, in the
+order they should be considered:
+
+- **Negotiate, do not assume.** The JOIN acknowledgement already carries each
+  peer's public key; it can carry a capability list too. A sender uses group
+  encryption only when *every* member of the room advertises it, and falls back
+  to the current per-peer loop otherwise. Costs a room-wide check per send,
+  which is cheap and already computed.
+- **Both paths coexist for at least one minor.** Deleting the fan-out in the
+  same release that adds sender keys leaves no way back if the new path has a
+  bug that only shows at scale — which is exactly the kind of bug it would have.
+- **The relay needs a room-addressed message type** that does not exist yet.
+  It must not weaken sealed sender: today the relay learns the recipient and not
+  the sender, and a room-addressed envelope must not accidentally invert that.
+
+## What to be careful about
+
+- **Rotation must be wired to every departure**, not just voluntary leaves.
+  `/kick`, `/mute`, `/ban` and a dropped connection all change membership. The
+  P2P side rotates on `peer_left`; the relay side has more ways to lose a member.
+- **`SenderKey.rotate()` is a caller responsibility** — its own comment says
+  so. The distribution has to follow it or the room silently stops being able to
+  read the rotator.
+- **Private rooms add a second layer** (`encryptRoomPayload` with the
+  password-derived key). Group encryption goes *inside* that, not instead of it.
+- **The offline queue** stores envelopes addressed to a peer. A room-addressed
+  message needs an answer for someone who was offline when it was sent, and
+  "they get the sender key on rejoin but not the backlog" is a decision to make
+  deliberately rather than discover.
+
+  **Decided (2026-08-10): room-addressed messages are not queued.** The reason is
+  not policy but arithmetic — a sender key handed over on someone's return
+  serialises the chain at its *current* counter, so the backlog is unreadable to
+  them whatever the relay does with it. Queueing would hold ciphertext nobody can
+  open: all of the storage and the liability, none of the delivery. The unicast
+  queue survives because an envelope addressed to a peer is still openable when
+  they return with the same key. Pinned in `test/group-receive.test.js`.
+
+- **Sender keys are symmetric, so any member can forge another.** Not in the
+  original list, and it does not matter much in a P2P mesh where membership is
+  small and deliberate. It matters on a public hub. **Closed (2026-08-10)** with
+  an Ed25519 key per sender chain, distributed alongside the chain and verified
+  before the ratchet is touched. Doing it before the send path existed meant it
+  cost a field on a wire nobody was using yet.
+
+## Suggested order
+
+1. Test vectors for `SenderKey` distribution and rotation, so both sides of the
+   change are pinned before either moves.
+2. Capability advertisement in JOIN, with the fallback path left untouched.
+3. Group send/receive behind that capability, both paths live.
+4. Rotation wired to every membership change, with a test per route in.
+5. Only then, consider retiring the per-peer loop — a release later, at least.
+
+## Why it is worth it
+
+It is the one change that is simultaneously a feature, a fix and an
+improvement: it removes a scaling limit the project just made visible to itself,
+it reuses code that already exists and is already tested, and it is the
+difference between the hub holding a room of five and a room of fifty.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciphermesh",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Secure terminal chat for the local network (LAN) with real end-to-end encryption (E2EE) using libsodium",
   "type": "module",
   "main": "src/client/index.js",
@@ -49,7 +49,8 @@
     "docker:build": "docker compose build",
     "docker:up": "docker compose up -d",
     "docker:down": "docker compose down",
-    "docker:logs": "docker compose logs -f"
+    "docker:logs": "docker compose logs -f",
+    "commands:build": "node scripts/generate-commands.mjs"
   },
   "dependencies": {
     "@noble/post-quantum": "0.6.1",

package/src/client/ChatController.js

@@ -29,7 +29,14 @@ import {
   isRoomWrapped,
   freeRoomSecrets,
 } from '../crypto/RoomKey.js';
-import { KEY_ROTATION_INTERVAL_MS, EMOJI_MAP, COVER_CONSTANT_MS } from '../shared/constants.js';
+import {
+  KEY_ROTATION_INTERVAL_MS,
+  EMOJI_MAP,
+  COVER_CONSTANT_MS,
+  OWN_CAPABILITIES,
+} from '../shared/constants.js';
+import { normalizeCaps, roomSupports } from '../protocol/capabilities.js';
+import { GroupSession } from '../crypto/SenderKey.js';
 import { KeyManager } from '../crypto/KeyManager.js';
 import { Handshake } from '../crypto/Handshake.js';
 import { NonceManager } from '../crypto/NonceManager.js';
@@ -61,6 +68,7 @@ import {
 } from '../shared/dnd.js';
 import { saveLastSession } from '../shared/lastSession.js';
 import { diagnose, formatDiagnosis } from '../shared/doctor.js';
+import { pluginsCommand } from '../shared/pluginCommand.js';
 import { COMMANDS } from './UI.js';
 
 const TYPING_SEND_INTERVAL = 2000; // debounce: max 1 typing event per 2s
@@ -75,7 +83,10 @@ export class ChatController {
   #handshake;
   #nonceManager;
   #sessionId;
-  #peers; // Map<sessionId, { nickname, publicKey }>
+  #peers; // Map<sessionId, { nickname, publicKey, caps }>
+  #groups = new Map(); // room -> GroupSession (sender keys; receive only for now)
+  #groupBuffer = new Map(); // keyId -> group msgs waiting on their sender key
+  #serverCaps = []; // what the relay advertised in join_ack
   #lastTypingSent;
   #peerTypingTimers; // Map<sessionId, timeoutId>
   #fileTransfer;
@@ -219,7 +230,12 @@ export class ChatController {
     this.#reconnectAttempts = 0;
     this.#ui.setConnectionState('online');
     this.#connection.send(
-      createJoin(this.#nickname, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+      createJoin(
+        this.#nickname,
+        this.#keyManager.publicKeyB64,
+        this.#keyManager.pqPublicKeyB64,
+        OWN_CAPABILITIES,
+      ),
     );
   }
 
@@ -453,6 +469,10 @@ export class ChatController {
         this.#onEncryptedMessage(msg);
         break;
 
+      case MSG.GROUP_MESSAGE:
+        this.#onGroupMessage(msg);
+        break;
+
       case MSG.PEER_KEY_UPDATED:
         this.#onPeerKeyUpdated(msg);
         break;
@@ -541,6 +561,10 @@ export class ChatController {
   // ── JOIN_ACK: registered with server ──────────────────────────
   #onJoinAck(msg) {
     this.#sessionId = msg.sessionId;
+    // What the relay itself can do. No client can advertise this on its behalf,
+    // and the fan-out for a room-addressed message is the relay's job — so a
+    // capable room on an older hub is still not a room that can switch paths.
+    this.#serverCaps = normalizeCaps(msg.serverCaps);
     const room = msg.room || 'general';
     const hadPrivateBuffers = [...this.#buffers.values()].some((b) => b.secrets);
 
@@ -561,6 +585,7 @@ export class ChatController {
       this.#allPeers.set(peer.sessionId, {
         nickname: peer.nickname,
         publicKey: peer.publicKey,
+        caps: normalizeCaps(peer.caps),
         rooms: new Set([room]),
       });
 
@@ -698,13 +723,33 @@ export class ChatController {
     this.#peers.clear();
     for (const [sid, p] of this.#allPeers) {
       if (p.rooms.has(this.#currentRoom)) {
-        this.#peers.set(sid, { nickname: p.nickname, publicKey: p.publicKey });
+        this.#peers.set(sid, {
+          nickname: p.nickname,
+          publicKey: p.publicKey,
+          caps: p.caps || [],
+        });
       }
     }
     this.#ui.setOnlineCount(this.#peers.size + 1);
     this.#ui.setPeerNames([...this.#peers.values()].map((p) => p.nickname));
   }
 
+  // Can every member of the active room speak `cap`? Nothing calls this on a
+  // send path yet — group send/receive is the next step, and this is the switch
+  // it will be gated on. Kept here so the negotiation is testable before the
+  // feature that depends on it exists; `own` is overridable for exactly that,
+  // since this build advertises nothing yet.
+  roomSupportsCapability(cap, own = OWN_CAPABILITIES) {
+    return roomSupports(this.#peers.values(), cap, own);
+  }
+
+  // Did the relay say it can do this? Separate from the room check on purpose:
+  // both have to hold before a send path may switch, and they fail for
+  // different reasons — an old peer versus an old hub.
+  relaySupportsCapability(cap) {
+    return this.#serverCaps.includes(cap);
+  }
+
   #applyTopicToUI() {
     const topic = this.#buffers.get(this.#currentRoom)?.topic;
     this.#ui.setTopic(topic?.text || null);
@@ -787,6 +832,7 @@ export class ChatController {
       this.#allPeers.set(peer.sessionId, {
         nickname: peer.nickname,
         publicKey: peer.publicKey,
+        caps: normalizeCaps(peer.caps),
         rooms: new Set([room]),
       });
       this.#handshake.registerPeer(peer.sessionId, peer.publicKey, peer.pqPublicKey);
@@ -850,11 +896,21 @@ export class ChatController {
     }
     const goneEntirely = !entry || !room || entry.rooms.size === 0;
 
+    // Drop their sender chain for the room they left. Their own rotation is what
+    // gives forward secrecy — this only stops us holding a key we can no longer
+    // be sent anything on.
+    if (room) {
+      this.#groups.get(room)?.removeMember(msg.sessionId);
+    }
+
     if (goneEntirely) {
       this.#hidePeerTyping(msg.sessionId, nickname);
       this.#handshake.removePeer(msg.sessionId);
       this.#nonceManager.removePeer(msg.sessionId);
       this.#allPeers.delete(msg.sessionId);
+      for (const group of this.#groups.values()) {
+        group.removeMember(msg.sessionId);
+      }
     }
 
     if (!room || room === this.#currentRoom) {
@@ -868,8 +924,101 @@ export class ChatController {
     this.#auditLog.log(AuditEvent.PEER_DISCONNECTED, { nickname });
   }
 
+  // ── Sender keys on the relay: the receive half ────────────────
+  //
+  // Sending is deliberately absent — #broadcastPayload still seals one envelope
+  // per peer. This is the half that has to be in the field first: a room only
+  // switches to group sending once every member advertises it, so the ability to
+  // read one must ship a release before the ability to write one, or the switch
+  // never becomes true for anybody.
+
+  #getGroup(room) {
+    let group = this.#groups.get(room);
+    if (!group) {
+      group = new GroupSession();
+      this.#groups.set(room, group);
+    }
+    return group;
+  }
+
+  // A member handed us their sender key. This arrives over the pairwise sealed
+  // channel, so `fromSessionId` was authenticated by opening the envelope —
+  // never asserted by the relay, which is the whole reason distribution does not
+  // ride on the group path itself.
+  #onSenderKeyDistribution(fromSessionId, data) {
+    if (typeof data.room !== 'string' || !data.dist || typeof data.dist !== 'object') {
+      return;
+    }
+    this.#getGroup(data.room).addMember(fromSessionId, data.dist);
+    this.#flushGroupBuffer(data.dist.keyId);
+  }
+
+  #onGroupMessage(msg) {
+    const group = this.#groups.get(msg.room);
+    const from = group ? group.memberForKeyId(msg.keyId) : null;
+
+    // A label we hold no distribution for. Usually a race — the fan-out beat the
+    // sender key through a different path — so hold it rather than drop it.
+    if (!from || !this.#allPeers.has(from)) {
+      this.#bufferGroupMessage(msg);
+      return;
+    }
+
+    const plaintext = group.decrypt(from, {
+      keyId: msg.keyId,
+      counter: msg.counter,
+      ciphertext: msg.ciphertext,
+      nonce: msg.nonce,
+      signature: msg.signature,
+    });
+    if (!plaintext) {
+      // A replayed counter, a chain that rotated without us being told yet, or a
+      // signature that does not check out. The first two resolve on the next
+      // distribution; the third never will, and buffering it costs one slot in a
+      // bounded map rather than a decision made on too little information here.
+      this.#bufferGroupMessage(msg);
+      return;
+    }
+
+    // Hand it to the one path that knows what a payload means. `payload` is
+    // empty because there was no pairwise envelope: the group chain replaced it.
+    this.#onEncryptedMessage({ from, payload: {} }, plaintext);
+  }
+
+  #bufferGroupMessage(msg) {
+    // Bounded twice over: a hostile relay can invent keyIds all day, and each
+    // one must not become a place to park memory.
+    if (!this.#groupBuffer.has(msg.keyId) && this.#groupBuffer.size >= 32) {
+      return;
+    }
+    let buf = this.#groupBuffer.get(msg.keyId);
+    if (!buf) {
+      buf = [];
+      this.#groupBuffer.set(msg.keyId, buf);
+    }
+    if (buf.length < 20) {
+      buf.push(msg);
+    }
+  }
+
+  #flushGroupBuffer(keyId) {
+    const buf = this.#groupBuffer.get(keyId);
+    if (!buf) {
+      return;
+    }
+    this.#groupBuffer.delete(keyId);
+    for (const msg of buf) {
+      this.#onGroupMessage(msg);
+    }
+  }
+
   // ── Received encrypted message ────────────────────────────────
-  #onEncryptedMessage(msg) {
+  // `preDecrypted` is the group path handing over plaintext it already opened
+  // with a sender chain (see #onGroupMessage). Everything after the decryption
+  // step is shared on purpose: a group message must land in history, buffers,
+  // receipts and the action dispatch exactly like a pairwise one, and the way to
+  // guarantee that is for there to be only one copy of it.
+  #onEncryptedMessage(msg, preDecrypted = null) {
     // Sealed sender: the relay handed us only `to` + an opaque blob. Open it
     // with our identity key to recover the real sender + payload; from here the
     // rest of the handler is unchanged. A blob that isn't for us (or is tampered)
@@ -903,51 +1052,74 @@ export class ChatController {
       return;
     }
 
-    const ciphertext = Buffer.from(msg.payload.ciphertext, 'base64');
-    const nonce = Buffer.from(msg.payload.nonce, 'base64');
+    let plaintext = preDecrypted;
+    // A group message is never deniable — deniable sends stay pairwise, as they
+    // do in P2P — and carries no pairwise envelope to inspect.
+    const isDeniable = !preDecrypted && !!msg.payload.deniable;
 
-    let plaintext = null;
-    const isDeniable = !!msg.payload.deniable;
+    if (!plaintext) {
+      const ciphertext = Buffer.from(msg.payload.ciphertext, 'base64');
+      const nonce = Buffer.from(msg.payload.nonce, 'base64');
 
-    // Deniable message path (symmetric crypto_secretbox)
-    if (isDeniable) {
-      // Anti-replay: deniable sends already use a structured NonceManager nonce.
-      if (!this.#nonceManager.validate(msg.from, nonce)) {
-        this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname, deniable: true });
-        this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
-        return;
-      }
-      const sharedKey = deriveSharedKey(this.#handshake.secretKey, senderPublicKey);
-      plaintext = decryptDeniable(ciphertext, nonce, sharedKey);
-      if (!plaintext) {
-        this.#auditLog.log(AuditEvent.DECRYPT_FAILURE, { nickname: peer.nickname, deniable: true });
-        this.#ui.addErrorMessage(`Failed to decrypt deniable message from ${peer.nickname}`);
-        return;
+      // Deniable message path (symmetric crypto_secretbox)
+      if (isDeniable) {
+        // Anti-replay: deniable sends already use a structured NonceManager nonce.
+        if (!this.#nonceManager.validate(msg.from, nonce)) {
+          this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname, deniable: true });
+          this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
+          return;
+        }
+        const sharedKey = deriveSharedKey(this.#handshake.secretKey, senderPublicKey);
+        plaintext = decryptDeniable(ciphertext, nonce, sharedKey);
+        if (!plaintext) {
+          this.#auditLog.log(AuditEvent.DECRYPT_FAILURE, {
+            nickname: peer.nickname,
+            deniable: true,
+          });
+          this.#ui.addErrorMessage(`Failed to decrypt deniable message from ${peer.nickname}`);
+          return;
+        }
       }
-    }
 
-    // Ratcheted message path (has ephemeralPublicKey)
-    if (!isDeniable && msg.payload.ephemeralPublicKey) {
-      const ratchet = this.#handshake.getRatchet(msg.from);
-      if (ratchet) {
-        const ephPub = Buffer.from(msg.payload.ephemeralPublicKey, 'base64');
-        plaintext = ratchet.decrypt(
-          ciphertext,
-          nonce,
-          ephPub,
-          msg.payload.counter,
-          msg.payload.previousCounter,
-          msg.payload.pqCiphertext ? Buffer.from(msg.payload.pqCiphertext, 'base64') : null,
-        );
-      }
+      // Ratcheted message path (has ephemeralPublicKey)
+      if (!isDeniable && msg.payload.ephemeralPublicKey) {
+        const ratchet = this.#handshake.getRatchet(msg.from);
+        if (ratchet) {
+          const ephPub = Buffer.from(msg.payload.ephemeralPublicKey, 'base64');
+          plaintext = ratchet.decrypt(
+            ciphertext,
+            nonce,
+            ephPub,
+            msg.payload.counter,
+            msg.payload.previousCounter,
+            msg.payload.pqCiphertext ? Buffer.from(msg.payload.pqCiphertext, 'base64') : null,
+          );
+        }
 
-      // Fallback to static decrypt if ratchet failed
-      if (!plaintext) {
+        // Fallback to static decrypt if ratchet failed
+        if (!plaintext) {
+          if (!this.#nonceManager.validate(msg.from, nonce)) {
+            this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
+            this.#ui.addErrorMessage(`Failed to decrypt message from ${peer.nickname}`);
+            return;
+          }
+          plaintext = MessageCrypto.decryptWithFallback(
+            ciphertext,
+            nonce,
+            senderPublicKey,
+            this.#handshake.secretKey,
+            this.#handshake.getPreviousPeerPublicKey(msg.from),
+            this.#handshake.previousSecretKey,
+          );
+        }
+      } else if (!isDeniable) {
+        // Static message path (no ephemeralPublicKey)
         if (!this.#nonceManager.validate(msg.from, nonce)) {
           this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
-          this.#ui.addErrorMessage(`Failed to decrypt message from ${peer.nickname}`);
+          this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
           return;
         }
+
         plaintext = MessageCrypto.decryptWithFallback(
           ciphertext,
           nonce,
@@ -957,22 +1129,6 @@ export class ChatController {
           this.#handshake.previousSecretKey,
         );
       }
-    } else if (!isDeniable) {
-      // Static message path (no ephemeralPublicKey)
-      if (!this.#nonceManager.validate(msg.from, nonce)) {
-        this.#auditLog.log(AuditEvent.NONCE_REPLAY, { nickname: peer.nickname });
-        this.#ui.addErrorMessage(`Invalid nonce from ${peer.nickname} (possible replay)`);
-        return;
-      }
-
-      plaintext = MessageCrypto.decryptWithFallback(
-        ciphertext,
-        nonce,
-        senderPublicKey,
-        this.#handshake.secretKey,
-        this.#handshake.getPreviousPeerPublicKey(msg.from),
-        this.#handshake.previousSecretKey,
-      );
     }
 
     if (!plaintext) {
@@ -1011,6 +1167,14 @@ export class ChatController {
         return;
       }
 
+      // A sender key. Never surfaced to the user and never carried on the group
+      // path itself — it has to arrive pairwise, where the envelope proves who
+      // sent it.
+      if (data.action === 'sk_dist') {
+        this.#onSenderKeyDistribution(msg.from, data);
+        return;
+      }
+
       // Which buffer this belongs to (the tag rides inside the E2EE envelope).
       const msgRoom = this.#roomForIncoming(data, msg.from);
       const roomActive = msgRoom === this.#currentRoom;
@@ -1518,7 +1682,9 @@ export class ChatController {
         this.#ui.addInfoMessage(
           '  /panic [yes]         - Wipe EVERYTHING from disk and exit (duress)',
         );
-        this.#ui.addInfoMessage('  /plugins             - List loaded plugins');
+        this.#ui.addInfoMessage(
+          '  /plugins [allow <file>] - List plugins; approve one before it runs',
+        );
         this.#ui.addInfoMessage('  /quit                - Leave the chat');
         this.#ui.addInfoMessage('Tip: PageUp/PageDown scroll the chat history');
         this.#ui.addInfoMessage('Tip: shortcodes like :fire: become emoji — Tab autocompletes');
@@ -2603,16 +2769,17 @@ export class ChatController {
       }
 
       case '/plugins': {
-        if (!this.#pluginManager || this.#pluginManager.pluginCount === 0) {
-          this.#ui.addInfoMessage('No plugins loaded. Place .js files in ~/.ciphermesh/plugins/');
-        } else {
-          const names = this.#pluginManager.getPluginNames();
-          this.#ui.addInfoMessage(`Plugins loaded (${names.length}): ${names.join(', ')}`);
-          const cmds = this.#pluginManager.getCommandNames();
-          if (cmds.length > 0) {
-            this.#ui.addInfoMessage(`Commands: ${cmds.join(', ')}`);
+        pluginsCommand(this.#pluginManager, parts.slice(1)).then((lines) => {
+          for (const { kind, text } of lines) {
+            if (kind === 'error') {
+              this.#ui.addErrorMessage(text);
+            } else if (kind === 'system') {
+              this.#ui.addSystemMessage(text);
+            } else {
+              this.#ui.addInfoMessage(text);
+            }
           }
-        }
+        });
         break;
       }
 
@@ -2772,7 +2939,12 @@ export class ChatController {
         this.#nickname = newNick;
         this.#ui.setNickname(newNick);
         this.#connection.send(
-          createJoin(newNick, this.#keyManager.publicKeyB64, this.#keyManager.pqPublicKeyB64),
+          createJoin(
+            newNick,
+            this.#keyManager.publicKeyB64,
+            this.#keyManager.pqPublicKeyB64,
+            OWN_CAPABILITIES,
+          ),
         );
         this.#ui.addSystemMessage(`Trying to join as ${newNick}...`);
         break;
@@ -3638,6 +3810,11 @@ export class ChatController {
       this.#historyStore.destroy();
     }
     this.#fileTransfer.destroy();
+    for (const group of this.#groups.values()) {
+      group.destroy();
+    }
+    this.#groups.clear();
+    this.#groupBuffer.clear();
     this.#handshake.destroy();
     this.#keyManager.destroy();
     this.#connection.close();

package/src/client/UI.js

@@ -1798,7 +1798,10 @@ export class UI extends EventEmitter {
     this.#lines.push(line);
     this.#chatLog.log(line);
     this.#screen.render();
-    this.#lastSender = isSelfNow ? 'self' : nickname;
+    // The sentinel is written as an escape, not typed as a raw byte: a bare
+    // NUL anywhere in the source makes this entire file count as binary, and
+    // a binary file is skipped by grep and shown without a diff on GitHub.
+    this.#lastSender = isSelfNow ? '\u0000self' : nickname;
     if (!isSelfNow) {
       this.#noteIncoming(mentioned || isDM);
     }

package/src/client/index.js

@@ -210,7 +210,12 @@ await bootSequence([
   'XSalsa20-Poly1305 cipher',
   'Double Ratchet — forward secrecy',
   'TOFU trust store',
-  { label: 'Loading plugins', task: () => pluginManager.loadAll() },
+  {
+    label: 'Loading plugins',
+    // Only what the user approved. An unapproved file is left alone —
+    // importing it would already be running it.
+    task: () => pluginManager.loadAll(undefined, config.pluginsAllowed),
+  },
   {
     label: 'Connecting to relay',
     timeoutMs: 3500,