- sync: the post-sync toast lumped relay pulls into the CalDAV stats
and always labelled the banner "CalDAV". Split into two separate
toasts (CalDAV cloud-arrow + Relay broadcast icon), each only shown
when its numbers are non-zero. Banners now stack vertically so both
can appear together on a sync that pulled on both sides.
- relay UI: the session chat view was 1:1-only. Group rooms (which
the client API already supports) now surface as first-class threads
in the sidebar — sorted chronologically with 1:1 peers, tagged
"ROOM", with a users-three icon. Sending posts to `room_uid`
instead of `recipient`; history shows the sender name above each
incoming message so it's clear who's talking in the room.
Relay backend: `/api/chat/threads` returns rooms alongside 1:1
threads; `/api/chat/history` accepts `?room_uid=`; `/api/chat/send`
accepts `room_uid` in the body.
- tests: bump "replace all updates card bodies" poll budget from 4s
to 10s and poll both updated cards. Flaky on cold runs because a
fresh PHP worker + SQLite WAL warm-up plus two sequential PATCH
calls can just barely exceed 4 seconds.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.
Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.
App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.
Version bumped to 2.0.0 (protocol-breaking).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
caldav.js was carrying the core sync timer, autosync toggle, relay
settings and every poller hook alongside its actual CalDAV/calendar
config concerns. Split out:
- New sync.js owns the single background timer, header Sync button,
autosync pause toggle, configurable interval, and emits `sync.tick`
so plugins can fan out without their own setIntervals.
- collab-buckets + chat now subscribe to sync.tick instead of running
their own pollers, so the manual Sync button refreshes them too and
the Autosync pause actually pauses everything.
- Replace the number input for sync interval with a stepped slider
(5s..1h snap points) and a live label, bumped to 1.9.2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
thandClaude Opus 4.7