serverless-ircd 0.8.0 → 0.9.0

package/.github/workflows/ci.yml

@@ -33,6 +33,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # `apps/web` render-docs tests need the docs/ submodule populated.
+          # `apps/web/upstream` (Kiwi SPA) is large and unneeded here.
+          submodules: true
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4

package/CHANGELOG.md

@@ -10,6 +10,251 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.9.0] - 2026-08-10
+
+The main change in this release is **rounding out the integrated IRC
+services surface** that landed in v0.8.0: ChanServ gains the prefix and
+roster mutation verbs operators expect (`OP` / `DEOP` / `VOICE` /
+`DEVOICE` / `KICK` / `BAN` / `UNBAN`), HostServ **auto-applies an
+assigned vhost on identify** (no per-session `HostServ ON`), HostServ
+HELP hides oper-only commands from non-opers, NickServ grows an `ID`
+alias for `IDENTIFY`, and **NickServ `INFO` no longer leaks the
+registrant's email** to non-owners. Alongside it: service **shortcut
+verbs** (`/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS`, …) that the
+daemon rewrites to the equivalent `PRIVMSG <Service>`, `echo-message`
+reflection of `PRIVMSG` to service nicks, and the long-missing **JOIN
+`332`/`333` topic numerics** on reconnect/rejoin (regardless of how the
+topic came to be set). A real PASS-login bug is fixed: a client that
+completes registration before sending `PASS <nick>:<password>` is now
+logged in instead of receiving a silent no-op. The AWS adapter gets
+another round of consistency hardening — every `Connections` `GetCommand`
+now uses `ConsistentRead: true`. The web client renders the `docs/` wiki
+to standalone HTML at `/docs/` and gains a client-specific "how to
+connect" section on the landing page.
+
+### Added — Services surface expansion (`@serverless-ircd/irc-core`)
+
+- **ChanServ `OP` / `DEOP` / `VOICE` / `DEVOICE` / `KICK` / `BAN` /
+  `UNBAN`**: founder-or-`AUTOOP`-level callers can grant/remove prefix
+  modes on demand, kick through ChanServ, and manage channel bans. Each
+  verb emits the corresponding `:ChanServ!ChanServ@services MODE` /
+  `KICK` broadcast and an `ApplyChannelDelta` against the channel
+  authority (the same mechanism MLOCK reasserts use), so the roster
+  and ban list update atomically with the broadcast. A target not on
+  the channel produces a NOTICE and no state change. Privilege gating
+  reuses the existing access-list check — no new store methods.
+- **HostServ auto-applies an assigned vhost on identify.** SASL
+  PLAIN/EXTERNAL, NickServ `IDENTIFY`, and PASS-auth now consult
+  `services.getVhost(account)` on a successful login: when an assigned
+  vhost exists, `applyVhost` runs immediately — `state.host` is set,
+  `state.vhostActive` is stamped, and any currently-joined
+  `chghost`-capable peers see the `CHGHOST` broadcast. At SASL/PASS-auth
+  time (pre-JOIN) there are no peers so no broadcast, but the vhost is
+  visible in the subsequent `001` welcome. Users no longer need to run
+  `HostServ ON` every session.
+- **NickServ `ID` alias for `IDENTIFY`.** `PRIVMSG NickServ :ID <pw>`
+  and `ID <nick> <pw>` behave identically to `IDENTIFY` — the alias
+  is not advertised in HELP (mirrors Atheme's hidden shorthand).
+- **Service shortcut verbs** (`@serverless-ircd/irc-server`):
+  `/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS` (and their long forms)
+  are rewritten at the actor to the equivalent
+  `PRIVMSG <ServiceNick> :<args>`. Clients with a dedicated
+  slash-command UX (WeeChat, HexChat, IRCCloud) now work without a
+  custom alias file. The aliases are case-insensitive and accept both
+  colon-trailing and space-joined arg shapes.
+- **`echo-message` reflection for service PRIVMSG**: a client that
+  has negotiated `echo-message` now sees its own
+  `PRIVMSG NickServ :IDENTIFY hunter2` reflected back before the
+  NickServ NOTICE reply, matching the echo behaviour for every other
+  PRIVMSG target. The echo is emitted before the reply so labeled-
+  response batches wrap both correctly.
+
+### Added — Web client (`apps/web`)
+
+- **`docs/` wiki rendered to `/docs/`.** The Gitea-wiki markdown under
+  the `docs/` submodule is now rendered to standalone HTML at
+  `apps/web/dist/docs/<slug>.html` and served by the existing
+  `[assets]` binding at `/docs/<slug>.html` (with `Home.md` →
+  `/docs/index.html`). Intra-docs Markdown links are rewritten to
+  `.html`, a shared stylesheet is emitted, and an `ADR-Index` page
+  links every ADR. Requires `git submodule update --init docs` before
+  build; the build fails loudly with the recovery command if the
+  submodule is missing or empty.
+- **Landing-page "how to connect" section.** The static landing page
+  gains a CSS-only tabbed picker with copy-paste connect snippets for
+  the common stock IRC clients (WeeChat, HexChat, irssi, IRCCloud),
+  replacing the previous per-client static guides. The picker covers
+  both the WebSocket path and the `irc+tls :6697` path.
+
+### Changed — PASS-based account login (`@serverless-ircd/irc-core`)
+
+- **A late `PASS <nick>:<password>` now logs the connection in.**
+  Previously, a client that completed registration (`NICK` + `USER`
+  resolving before `PASS` arrived, or any `PASS` sent after `CAP END`
+  resolved) was silently rejected — the `passReducer` short-circuited
+  at `state.registration === 'registered'` and emitted `462
+  ERR_ALREADYREGISTRED` for any post-registration `PASS`. The shared
+  verify + `applyAccountSuccess` pipeline now runs on a
+  post-registration `PASS <nick>:<password>`: on success it emits
+  `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, stamps `+r`, and runs
+  the read-marker / away / memo replay in-band, exactly like the
+  at-registration path. A bare `PASS <value>` (no colon) is a silent
+  no-op once registration has completed — a server password is
+  meaningless post-registration, and emitting `462` for it was
+  counterproductive. The pre-registration duplicate-PASS `462` (two
+  `PASS`es before `NICK`+`USER`) is preserved unchanged.
+
+### Fixed — Channel correctness (`@serverless-ircd/irc-core`)
+
+- **JOIN now emits `332 RPL_TOPIC` / `333 RPL_TOPICWHOISTIME` from any
+  source of the topic.** The previous JOIN reducer keyed topic
+  emission solely on the ChanServ KEEPTOPIC restore path (an empty
+  channel this join), so reconnecting clients after a deploy saw the
+  NAMES list but no topic — even when the topic survived the deploy
+  in storage. The emission now keys off `state.topic`, so a topic
+  restored from a KEEPTOPIC snapshot, a deploy snapshot with
+  KEEPTOPIC off, or an earlier joiner all produce the correct
+  numerics. The KEEPTOPIC restore path still maintains `state.topic`
+  for an empty channel; only the emission trigger changed.
+- **No auto-op for the first joiner of a registered channel off the
+  access list.** A registered channel that had been emptied (so its
+  roster snapshot was fresh) used to auto-op the first joiner
+  unconditionally as a "founder fallback", which let any client claim
+  `+o` by joining an empty registered channel. The fallback now only
+  fires when the joiner is identified as the founder (or is on the
+  access list); an unidentified first joiner joins without prefix
+  modes.
+
+### Fixed — AWS adapter (`@serverless-ircd/aws-adapter`)
+
+- **Strongly-consistent `Connections` reads across every handler.**
+  `$disconnect`'s `cleanupConnection` and the NLB streaming handler's
+  per-chunk row read were eventually consistent, so under DynamoDB
+  replication lag they could miss the row that was just written (or
+  updated) — dropping the first frame of a raw `:6697` connection or
+  skipping nick release + membership fanout on `$disconnect`. Every
+  `GetCommand` against the `Connections` table in `aws-adapter/src/**`
+  now sets `ConsistentRead: true`, matching the `$default` fix from
+  v0.8.0. A unit test asserts each call site carries the flag.
+- **Bounded `docker info` probe in the test global-setup.** On hosts
+  with Docker Desktop installed but not running, the macOS `docker`
+  CLI hangs indefinitely waiting for the daemon to spin up — and
+  `testcontainers` inherits that hang, stalling the whole `pnpm test`
+  run. The aws-adapter `globalSetup` now pre-probes `docker info`
+  with a 5-second exec timeout; if Docker is not reachable, it logs
+  and falls through to the Java ZIP fallback (or skip) instead of
+  hanging. No behaviour change when Docker is up.
+
+### Fixed — HostServ help leak (`@serverless-ircd/irc-core`)
+
+- **HostServ HELP hides oper-only commands from non-opers.** The
+  help/unknown NOTICE previously listed all seven HostServ commands
+  (`ON, OFF, REQUEST, SET, APPROVE, REJECT, LIST`) to every caller,
+  leaking the existence and names of oper commands. The notice
+  helpers now branch on `state.userModes.oper`: a non-oper sees only
+  `ON, OFF, REQUEST`; an oper sees the full list. The per-handler
+  oper gates are unchanged, so a non-oper who guesses an oper
+  command name still gets the existing permission-denied NOTICE.
+
+### Fixed — NickServ INFO privacy (`@serverless-ircd/irc-core`)
+
+- **NickServ `INFO` no longer leaks the registrant's email to
+  non-owners.** `handleInfo` previously returned the `Email:` line
+  unconditionally to any caller, identified or not — a remote,
+  unidentified user could enumerate registered nicks and harvest
+  email addresses. The `Email:` line is now gated behind
+  `state.account === rec.account` (the owner) or
+  `state.userModes.oper === true` (an oper). The owner path still
+  shows the full record; `INFO` with no target defaults to the
+  caller's own nick (owner path). The `Nick:` / `Account:` lines
+  remain visible to all callers (consistent with how a WHOIS against
+  a registered nick surfaces the account name).
+
+### Changed — Local CLI (`apps/local-cli`)
+
+- **`operCreds` plumbed through the config schema.** The local CLI's
+  `ServerConfig` now carries `operCreds` end-to-end (was wired ad-hoc
+  through constructor options); OPER auth against configured creds
+  works the same way it does in the cloud adapters. The transport
+  seams (WS / TCP) are also extracted into named helpers for
+  readability.
+
+### Changed — CI / tooling
+
+- CI workflows now explicitly checkout every submodule (`docs/`,
+  `apps/web/upstream/`) so the render-docs and Kiwi build steps run
+  deterministically on every runner, not just maintainer laptops.
+
+### ⚠️ Migration required
+
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The ChanServ roster commands, HostServ auto-vhost, and
+  the JOIN topic-numeric fix are runtime behaviour, not persisted DO
+  fields. **Code rollback across this release is safe.**
+- **No D1 / DynamoDB schema change.** The existing services tables
+  (`nickserv_accounts`, `chanserv_channels`, …) carry the new
+  behaviour unchanged. The `cert_subjects` column flagged for the
+  in-progress services credential consolidation is **not yet
+  present** — operators do not need to run any migration command for
+  this release.
+- **Behaviour change: late `PASS` no longer emits `462`.** A
+  post-registration `PASS <value>` used to reply
+  `462 ERR_ALREADYREGISTRED`; it is now silent. Clients that keyed
+  off the `462` to detect "you already sent PASS" will no longer see
+  it. No client is known to do this (the numeric is informational),
+  but scripted regression tests against this behaviour must be
+  updated (the in-tree `irc-test-support` scenario was updated).
+- **Behaviour change: late `PASS <nick>:<password>` now logs in.**
+  Clients that intentionally sent the colon form post-registration
+  expecting it to be ignored will now be logged in. This is the
+  intended fix; flag it in operator runbooks if the deployment was
+  relying on the silent-reject for some access-control flow.
+
+### Known limitations
+
+- **The `AccountStore` / `ServicesStore` credential drift is still
+  present.** A nick registered via NickServ `REGISTER` after the
+  worker booted still cannot authenticate via SASL PLAIN/EXTERNAL or
+  `PASS <nick>:<password>` against the *fresh* password — those paths
+  consult the SASL `AccountStore` (`accounts` table), which
+  `registerNick` does not write back to. The PASS-login fix above
+  makes the at-registration and post-registration paths symmetric,
+  but the underlying cross-store drift remains tracked for a
+  follow-up release that consolidates the credential into a single
+  store. Operators who need a NickServ-registered nick to work with
+  SASL/PASS immediately should re-seed via
+  `tools/seed-cf-accounts.ts` (D1) / `tools/seed-aws-accounts.ts`
+  (DynamoDB) with the same password.
+- Same transport limits as v0.8.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `irc-core`, `irc-server`, and
+  `in-memory-runtime` sit at 100%; `aws-adapter` and `aws-stack`
+  clear the 90% gate. The remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to full coverage.
+
+### Security
+
+- **NickServ `INFO` email disclosure** (Fixed above): a remote,
+  unidentified client could harvest email addresses from every
+  registered nick. The disclosure is now gated behind owner-or-oper.
+- **First-joiner op-takeover on empty registered channels** (Fixed
+  above): an unidentified client could claim `+o` by being the first
+  to join an empty registered channel. The auto-op fallback now
+  requires founder/access-list identification.
+- No other auth path changed. The scrypt-hashed credential store,
+  server-password gate, and CSWSH defense are unchanged from v0.8.0.
+
+---
+
 ## [0.8.0] - 2026-08-08
 
 The main change in this release is **integrated IRC services**: NickServ,