feat: Update configuration files for storage path and spam protection settings

fix: Remove invisible character from using directive
feat: Implement spam protection with configurable limits and auto-mute escalation
2026-09-04 08:36:11 +02:00 · 2026-07-17 19:54:30 +02:00 · 2026-07-17 19:49:38 +02:00 · 2026-07-17 19:47:57 +02:00 · 2026-07-17 19:47:57 +02:00 · 2026-07-17 18:01:00 +02:00
94 changed files with 6530 additions and 437 deletions
@@ -6,6 +6,8 @@
 Server__Name=My EchoHub Server
 Server__Description=A self-hosted EchoHub chat server
 Server__PublicServer=false
 # Registration mode: open (default), invite (codes via /invite, Admin+), or closed.
 # Server__Registration=open
 # Hostnames advertised to the EchoHubSpace directory. Index per entry.
 # Server__PublicHosts__0=echohub.example.com
 # Server__PublicHosts__1=alias.example.com
@@ -13,6 +15,8 @@ Server__PublicServer=false
 # Server__Tags__0=community
 # Server__Tags__1=gaming
 # Server__Admins__0=adminUsername
 # Override where the EchoHubSpace claim token file is stored (defaults next to the DB).
 # Server__DirectoryClaimPath=
 # ── JWT ──────────────────────────────────────────────────────────────
 # Auto-generated on first run if left empty. Only set if you need a stable secret across containers.
@@ -27,9 +31,32 @@ Server__PublicServer=false
 # ── Storage ──────────────────────────────────────────────────────────
 # Defaults are set in the Dockerfile to use /app/data for persistence.
 # Storage__Path=
 # Storage__CleanupIntervalHours=1
 # Storage__RetentionDays=30
 # ── Uploads ──────────────────────────────────────────────────────────
 # Uploads__MaxFileSizeMB=100
 # Uploads__MaxImageSizeMB=10
 # Uploads__MaxAudioSizeMB=10
 # Uploads__MaxAvatarSizeMB=2
 # Uploads__MaxAttachmentsPerMessage=10
 # ── Spam protection ──────────────────────────────────────────────────
 # Per-user flood/duplicate limits with auto-mute escalation; Mods and above are exempt.
 # Spam__Enabled=true
 # Spam__MaxMessagesPerWindow=8
 # Spam__WindowSeconds=5
 # Spam__MaxDuplicateMessages=3
 # Spam__AutoMuteMinutes=5
 # Spam__ViolationThreshold=5
 # Spam__ViolationWindowMinutes=5
 # Only first-time channel joins count — keep this above your public channel count.
 # Spam__MaxJoinsPerWindow=25
 # Spam__JoinWindowSeconds=30
 # Spam__MaxChannelCreatesPerWindow=3
 # Spam__ChannelCreateWindowMinutes=10
 # ── IRC Gateway ──────────────────────────────────────────────────────
 Irc__Enabled=false
 # Irc__Port=6667
@@ -39,6 +66,12 @@ Irc__Enabled=false
 # Irc__TlsCertPassword=
 # Irc__ServerName=echohub
 # Irc__Motd=Welcome to EchoHub IRC Gateway!
 # Public base URL used to make attachment links absolute for IRC clients.
 # Irc__PublicBaseUrl=https://chat.example.com
 # ── CORS ─────────────────────────────────────────────────────────────
 # Leave unset to allow all origins. Index per entry to whitelist.
 # Cors__AllowedOrigins__0=https://chat.example.com
 # ── Logging ──────────────────────────────────────────────────────────
 # Serilog__MinimumLevel__Default=Information
@@ -14,6 +14,15 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
      - name: Install pinned linter
        run: npm ci
      - name: Run markdownlint
        run: bash scripts/lint-markdown.sh
@@ -84,10 +84,12 @@ graph TD
 - **JWT auth** with short-lived access tokens and 30-day refresh tokens
 - **Channels** — create, set topics, delete (no 47-step permission wizard required)
 - **Moderation** — ban, mute (timed or permanent), kick, role assignment
 - **Registration control** — open, invite-code-gated (`/invite`), or closed; codes live in your own database
 - **File & image uploads** with actual validation (magic bytes, not just trusting the extension)
 - **Image-to-ASCII** — because images in a terminal is objectively cool
 - **Presence tracking** — online/away/DND/invisible with custom status messages
 - **Rate limiting** — in case someone gets too excited
 - **Spam protection** — per-user flood/duplicate limits with auto-mute escalation, covering TUI and IRC alike; configurable under `Spam`, Mods exempt
 - **Auto-restart** on crash with exponential backoff — it picks itself back up
 - **Serilog logging** — console + rolling file, because `Console.WriteLine` isn't a logging strategy
 - **Zero config first run** — generates its own JWT secret and config on launch
@@ -101,6 +103,8 @@ graph TD
 - **Clickable everything** — usernames, @mentions, #channels — just press Enter
 - **File/image sharing** — local files or URLs; drag & drop a file onto the terminal to send it; save the original behind any ASCII-art image
 - **End-to-end encrypted rooms** — password-protected channels are encrypted with a passphrase-derived key that never reaches the server, so not even the server owner can read messages or files (they can still see counts and storage size)
 - **Replies** — quote a message, jump back to the original; being replied to pings like a mention
 - **Your data is yours** — `/export` everything the server holds about you; `/deleteaccount` removes it
 - **Multi-server** — save and switch between servers
 - **Auto-reconnect** — drops happen, it rejoins your channels automatically
 - **Auto-updater** — updates in-place with automatic rollback if something goes wrong
@@ -198,6 +202,8 @@ Auth works via `PASS`/`NICK`/`USER` or SASL PLAIN. New usernames are auto-regist
 | Feature | How it maps to IRC |
 | ------- | ------------------ |
 | Text messages | Standard `PRIVMSG` (long messages split at ~400 byte chunks) |
 | `/me` actions | Native CTCP ACTION in both directions |
 | Replies | TUI replies arrive as `> nick: snippet \| text` |
 | Images | `[Image: filename]` + download URL + ASCII art line-by-line |
 | File uploads | `[File: filename] /api/files/{id}` |
 | Channels | `JOIN`, `PART`, `NAMES`, `TOPIC`, `LIST` |
@@ -226,6 +232,8 @@ For direct TLS without a reverse proxy, the IRC gateway can terminate TLS itself
 | Command | Description |
 | ------- | ----------- |
 | `/join <channel> [password]` | Join a channel (passphrase for encrypted channels) |
 | `/me <action>` | Action message — `* nick waves` (native CTCP ACTION over IRC) |
 | `/banner <text>` | Render short text as a big ASCII banner |
 | `/passwd <old> <new>` | Change the current encrypted channel's passphrase (creator only) |
 | `/size [s\|m\|l]` | ASCII-art size for attached images (no arg = picker) |
 | `/downloadpath [path]` | Set the download folder (no path = native folder picker) |
@@ -233,17 +241,20 @@ For direct TLS without a reverse proxy, the IRC gateway can terminate TLS itself
 | `/topic <text>` | Set channel topic (creator only) |
 | `/send <file or URL>` | Upload a file or image |
 | `/status <online\|away\|dnd\|invisible>` | Set your status |
-| `/status <message>` | Set a status message |
+| `/status msg <text>` | Set a status message (keeps your status; empty text clears it) |
 | `/nick <name>` | Set display name |
 | `/color <#hex>` | Set nickname color |
 | `/theme <name>` | Switch theme |
 | `/profile` | Open profile editor |
 | `/users` | List online users in channel |
 | `/servers` | Manage saved servers |
 | `/invite [uses] [hours]` | Create a registration invite code (Admin+); also `list` / `revoke <code>` |
 | `/export` | Download everything the server stores about you as JSON |
 | `/deleteaccount` | Permanently delete your account (password re-confirmed) |
 | `/help` | Show help |
 | `/quit` | Exit |
-**Message actions:** **right-click a message** for a context menu — delete, save/download/play its attachment, mention the sender, view their profile, or copy the text. (Keyboard alternative: press <kbd>F6</kbd> to focus the message list, select with the arrow keys, and press <kbd>Delete</kbd>; <kbd>F6</kbd> again returns to the input.) You can always delete your own messages; moderators and above can delete others' messages, but only from users below their own role.
+**Message actions:** **right-click a message** for a context menu — reply (quotes the message; Esc cancels a pending reply), delete, save/download/play its attachment, mention the sender, view their profile, or copy the text. (Keyboard alternative: press <kbd>F6</kbd> to focus the message list, select with the arrow keys, and press <kbd>Delete</kbd>; <kbd>F6</kbd> again returns to the input.) You can always delete your own messages; moderators and above can delete others' messages, but only from users below their own role.
 ## Themes
@@ -277,6 +288,7 @@ For direct TLS without a reverse proxy, the IRC gateway can terminate TLS itself
 | `Jwt:Secret` | *(auto-generated)* | JWT signing key |
 | `Server:Name` | `My EchoHub Server` | Server display name |
 | `Server:Description` | `A self-hosted EchoHub chat server` | Server description |
 | `Server:Registration` | `open` | `open`, `invite` (codes via `/invite`, Admin+), or `closed` |
 | `Server:PublicServer` | `false` | List on the [public directory](https://echohub.voidcube.cloud/servers) |
 | `Server:PublicHost` | *(empty)* | Public hostname for directory listing |
 | `Irc:Enabled` | `false` | Enable the IRC gateway |
@@ -101,6 +101,23 @@ Access tokens expire after 15 minutes, refresh tokens after 30 days with rotatio
 | `Server:PublicHost` | *(empty)* | Public hostname for the directory listing (e.g. `chat.example.com:5000`) |
 | `Server:Admins` | `[]` | Array of admin usernames (e.g. `["alice", "bob"]`) |
 ### Uploads
 Per-attachment size limits by kind (in megabytes) and the per-message attachment cap. An
 absent or partial `Uploads` section keeps the built-in defaults. See
 [Messages & Attachments](messages-and-attachments.md) for how kinds are detected.
 | Key | Default | Description |
 | --- | --- | --- |
 | `Uploads:MaxImageSizeMB` | `10` | Max size for one image attachment |
 | `Uploads:MaxAudioSizeMB` | `10` | Max size for one audio attachment |
 | `Uploads:MaxFileSizeMB` | `100` | Max size for any other attachment |
 | `Uploads:MaxAvatarSizeMB` | `2` | Max avatar upload size |
 | `Uploads:MaxAttachmentsPerMessage` | `10` | Attachments allowed on a single message |
 The server sizes its request-body limits from these values, so raising a limit here is all
 that's needed — no separate Kestrel tuning.
 ### Encryption
 | Key | Default | Description |
@@ -17,7 +17,7 @@ curl -sSfL https://raw.githubusercontent.com/HueByte/EchoHub/master/scripts/inst
 To install a specific version or to a custom directory:
 ```bash
-curl -sSfL .../install.sh | sh -s -- --version 0.2.11
+curl -sSfL .../install.sh | sh -s -- --version 0.2.14
 curl -sSfL .../install.sh | sh -s -- --install-dir /opt/echohub
 ```
@@ -76,11 +76,11 @@ Then connect with any standard IRC client:
 irssi -c localhost -p 6667 -w <password> -n <username>
 ```
-IRC users must have an existing EchoHub account. Authentication works via `PASS`/`NICK`/`USER` or SASL PLAIN. Messages flow bidirectionally between IRC and TUI clients.
+Your nick is your EchoHub username and the server password is your account password (`PASS`/`NICK`/`USER` or SASL PLAIN). Connecting with a new username registers the account. Messages flow bidirectionally between IRC and TUI clients.
 For TLS, set `TlsEnabled: true`, `TlsPort: 6697`, and provide a PKCS#12 certificate path.
-See the [Architecture](architecture.md) page for details on how the IRC gateway integrates with the chat service.
+See the [IRC Gateway guide](irc-gateway.md) for command mapping, attachment rendering, and limitations, or [Architecture](architecture.md) for how the gateway integrates with the chat service.
 ## Configuration
@@ -0,0 +1,103 @@
 # IRC Gateway
 Every EchoHub server can expose a second door: a built-in **IRC gateway** that speaks the
 classic IRC protocol on port 6667. Any standard IRC client — irssi, WeeChat, HexChat,
 Halloy — can join the same channels as TUI users, see the same messages, and chat with the
 same accounts. Under the hood both protocols call the same chat service, so a message sent
 from IRC appears instantly in the TUI and vice versa (see [Architecture](architecture.md)).
 ## Enabling the gateway
 The gateway is off by default. Enable it in `appsettings.json` (or `Irc__Enabled=true` as an
 environment variable):
 ```json
 {
  "Irc": {
    "Enabled": true,
    "Port": 6667,
    "TlsEnabled": false,
    "TlsPort": 6697,
    "TlsCertPath": "",
    "ServerName": "echohub",
    "Motd": "Welcome to EchoHub IRC Gateway!"
  }
 }
 ```
 The plaintext listener always starts on `Port`. The TLS listener on `TlsPort` starts only
 when `TlsEnabled` is `true` **and** `TlsCertPath` points to a PKCS#12 (`.pfx`) certificate.
 See the [configuration reference](configuration.md#irc-gateway) for every option.
 ## Connecting & authentication
 Your IRC **nick is your EchoHub username** and your server password is your **account
 password**. Two flows are supported:
 ```bash
 # classic PASS/NICK/USER — most clients call this the "server password"
 irssi -c chat.example.com -p 6667 -w <password> -n <username>
 ```
 or **SASL PLAIN** (advertised via `CAP LS`), where the SASL username/password are the account
 credentials.
 A few things worth knowing:
 - **Connecting auto-registers.** If the username doesn't exist yet, the gateway creates the
  account with that password (usernames: 3–50 chars of `a-z 0-9 _ -`; passwords: 6+ chars).
  The very first account ever created on a server becomes the **Owner**.
 - Because of that, a typo'd password for an *existing* account fails with
  `Username is already taken` — the gateway tried to log in, couldn't, then tried to register
  the name. If you see that error, re-check your password.
 - Connecting without a password is rejected: `Password required. Use PASS command or SASL PLAIN.`
 ## What maps to what
 | IRC | EchoHub |
 | --- | --- |
 | `JOIN #room` | Join a channel (history is replayed on join) |
 | `JOIN #room <key>` | Join a password-protected (`+k`) channel |
 | `PART` / `QUIT` | Leave channel / disconnect |
 | `LIST` | Public channels only (password-protected ones show a `[+k]` hint) |
 | `TOPIC` | Read or set the channel topic (permission-checked) |
 | `NAMES` / `WHO` | Online users in the channel |
 | `WHOIS` | Profile: display name, channels, idle time, away status |
 | `AWAY [message]` | Sets your EchoHub status to Away / back to Online |
 | `MODE #room +k <key>` / `-k` | Set / clear the channel password |
 Private (unlisted) channels don't appear in `LIST`, but members who know the exact name can
 still `JOIN` them. Channels are not auto-created from IRC — create them from the TUI first.
 ## How messages look
 - **Attachments** arrive as labeled link lines — `[Image: photo.png] https://…`,
  `♪ [Audio: song.mp3] https://…`, `[File: report.pdf] https://…` — and image attachments
  additionally render their **ASCII-art preview** using truecolor ANSI escapes, so a modern
  terminal IRC client shows actual picture previews.
 - **Link embeds** are appended as `│`-prefixed text lines.
 - Long messages are split at word boundaries into IRC-safe lines (~400 bytes each);
  incoming messages may be up to 2,000 characters like any EchoHub message.
 - Your own messages aren't echoed back (standard IRC convention).
 - Moderation actions surface natively: kicks arrive as `KICK`, bans and channel nukes as
  server `NOTICE`s.
 ## Limitations
 The gateway bridges what IRC can express — and deliberately refuses what it can't:
 - **No end-to-end encrypted rooms.** Joining an [encrypted room](encrypted-rooms.md) fails
  with *"Cannot join channel — end-to-end encrypted, use the EchoHub client."* Bridging one
  would require the server to hold the room key, breaking the zero-knowledge design.
 - **No private messages.** `PRIVMSG` to a nick is rejected; EchoHub is channel-based.
 - **Usernames, not display names.** Messages are attributed to the account username;
  a user's display name is visible via `WHOIS`/`WHO` (realname field).
 - **No client features.** Uploading attachments, profiles, themes, and reactions to status
  changes are TUI-client features. Other users' status changes aren't pushed to IRC —
  discover them with `WHOIS`/`WHO`.
 ## How IRC users appear to TUI users
 Users connected *only* through the gateway are tagged `[irc]` in the users panel — a hint
 that they can't receive encrypted content or use client-side features. Someone connected
 with both an IRC client and the TUI shows untagged.
@@ -0,0 +1,109 @@
 # Messages & Attachments
 An EchoHub message is **text content plus up to 10 attachments**, Discord-style. A plain chat
 line is just a message with no attachments; a photo dump is one message with several files and
 an optional caption. This page explains how to attach files, what happens to them on the way to
 the server, and how other clients receive them.
 ## Message basics
 | Limit | Value |
 | --- | --- |
 | Max message length | 2,000 characters |
 | Max newlines per message | 30 (no blank-line runs) |
 | Max attachments per message | 10 |
 | Link embeds per message | first 3 URLs |
 Multiline messages are written with `Ctrl+N` for a newline; `Enter` sends. URLs in a message
 get link embeds (title, description, theme color) fetched by the server.
 ## Attaching files
 All of these end up in the same place — the **staging tray** — and are sent together as one
 message the next time you press `Enter`, with whatever you've typed as the caption:
 - **Paste a copied file** — copy one *or several* files in your file manager and press
  `Ctrl+V` in the input. All of them are staged at once.
 - **Paste an image from the clipboard** — copy an image in a browser (right-click → *Copy
  image*), take a screenshot (`Win+Shift+S`), or copy from an image editor, then `Ctrl+V`.
  The image is attached directly as a PNG named `image.png` — no saving to disk first.
  On Linux this uses `wl-paste` or `xclip`; on macOS it requires
  [`pngpaste`](https://github.com/jcsalterego/pngpaste) (`brew install pngpaste`).
 - **Drag & drop** — drop a file onto the terminal window; the client recognizes the dropped
  path and stages the file.
 - **`/send <filepath>`** — stage a file by path (quote paths containing spaces).
 The input frame's title shows what's currently staged. `/clear` drops all staged attachments
 without sending. Sending with an empty input is fine — the message is just the attachments.
 ```text
 ┌ Message (2 attached: report.pdf, image.png) ──────────────┐
 │ here's the summary and a screenshot_                      │
 └────────────────────────────────────────────────────────────┘
 ```
 **URL sends are different:** `/send <https://…>` sends an image URL immediately as its own
 message — nothing is staged, and it isn't available in end-to-end encrypted rooms (the server
 would have to fetch the image, which would defeat the encryption).
 ## Attachment kinds
 The kind is detected per attachment, not per message:
 | Kind | Detected by | Renders as | Default size limit |
 | --- | --- | --- | --- |
 | **Image** | Magic bytes: JPEG, PNG, GIF, WebP | ASCII-art preview in chat | 10 MB |
 | **Audio** | Extension: `.mp3` `.wav` `.ogg` `.flac` `.aac` `.m4a` `.wma` | Playable row (▶) | 10 MB |
 | **File** | Everything else | Downloadable row | 100 MB |
 Limits are per file and server-configurable — see the `Uploads` section in the
 [configuration guide](configuration.md) (`MaxImageSizeMB`, `MaxAudioSizeMB`, `MaxFileSizeMB`,
 `MaxAttachmentsPerMessage`).
 ## Image previews (ASCII art)
 Images are rendered in chat as half-block ASCII art. You pick the rendering size:
 | Flag | Size | Feel |
 | --- | --- | --- |
 | `-s` / `/size s` | 40 × 40 | compact |
 | `-m` / `/size m` | 80 × 80 | default |
 | `-l` / `/size l` | 120 × 120 | detailed |
 `/size` with no argument opens a picker; the choice persists as your default. A one-off
 `-s|-m|-l` flag on `/send` applies to that message.
 ## Receiving attachments
 Right-click a message (or press `F6` to select one with the arrow keys) for actions:
 - **Images** → save to disk
 - **Audio** → play (in-client playback)
 - **Files** → download
 Downloads go to your configured download folder — set it with `/downloadpath` (no argument
 opens a native folder picker, or pass a path directly).
 ## Attachments in encrypted rooms
 In an [end-to-end encrypted room](encrypted-rooms.md) every attachment is encrypted
 client-side **before** upload:
 ```mermaid
 flowchart LR
    F[File bytes] -->|AES-256-GCM with room key| B[Ciphertext blob]
    F -->|if image: render ASCII locally| A[ASCII preview]
    A -->|room-encrypt| AP["$RC1$… preview"]
    B --> S[Server stores blob + name + size]
    AP --> S
 ```
 The server never sees the file contents or the rendered preview — it stores an opaque blob and
 broadcasts it to members, who decrypt locally. File **names and sizes remain visible** to the
 server so the file list stays usable; don't put secrets in a file name. Pasted clipboard
 images go through exactly the same pipeline.
 ## Deleting messages with attachments
 Deleting a message also removes its uploaded attachment files from the server. You can always
 delete your own messages; moderators can delete others' — see [Moderation & Roles](moderation.md).
@@ -0,0 +1,71 @@
 # Moderation & Roles
 Every EchoHub server has a four-tier role hierarchy. Moderation is **strictly hierarchical**:
 acting on another user requires outranking them — equal rank is never enough — and a few
 invariants protect the server owner from lockouts.
 ## Roles
 | Role | Rank | Users panel glyph | How it's granted |
 | --- | --- | --- | --- |
 | **Owner** | 3 | ★ | The first account ever registered on the server |
 | **Admin** | 2 | ♦ | Assigned by the Owner |
 | **Mod** | 1 | ❀ | Assigned by an Admin or the Owner |
 | **Member** | 0 | — | Everyone else |
 Assign roles with `/role <user> <admin|mod|member>`. Two rules apply:
 - You can only assign roles **strictly below your own** — an Admin can promote to Mod but
  cannot create another Admin; only the Owner can.
 - **Owner is not assignable and not demotable.** There is exactly one Owner (the first
  account), nobody can be promoted to it, and the Owner's role can't be changed.
 ## Actions
 | Command | Minimum role | Effect |
 | --- | --- | --- |
 | `/kick <user> [reason]` | Mod | Disconnects the user. Not persistent — they can reconnect immediately. |
 | `/ban <user> [reason]` | Admin | Persistent: flags the account banned and disconnects it. Banned accounts are rejected at login. |
 | `/unban <user>` | Admin | Lifts a ban. |
 | `/mute <user> [minutes]` | Mod | Blocks the user from sending messages or uploading files. Without a duration the mute is **indefinite**; with one it auto-expires (checked every ~15 seconds). |
 | `/unmute <user>` | Mod | Lifts a mute early. |
 | `/role <user> <role>` | Admin | Assign a role (see rules above). |
 | `/nuke` | Mod | Deletes the **entire history of the current channel**, including all attachment files on disk. Channel-wide — no per-user check. |
 Kick, ban, and mute all enforce the hierarchy: the target's role must be **strictly lower**
 than yours. A Mod cannot kick another Mod; nobody can kick, ban, mute, or demote the Owner.
 ## Deleting messages
 Deletion has its own, slightly different rule set:
 - **Your own messages** — always deletable, whatever your role. Right-click a message →
  *Delete message*, or press `F6`, pick the message, and hit `Delete`.
 - **Someone else's messages** — requires **Mod or higher** *and* strictly outranking the
  author. A Mod can delete a Member's message, but not another Mod's.
 Deleting a message also purges its uploaded attachment blobs from the server's disk, and the
 removal is broadcast live — the message disappears from everyone's chat immediately.
 ## How actions surface
 Everyone in the channel sees moderation happen:
 - **TUI clients** show system messages — *"alice was kicked (reason)"*, *"bob was banned"*,
  *"Channel history has been cleared by a moderator."* The kicked or banned user themselves
  gets a dialog with the reason, then the client disconnects.
 - **IRC clients** get native protocol events: kicks arrive as a real `KICK` command, bans as
  a server `NOTICE`. (See the [IRC Gateway guide](irc-gateway.md).)
 Muted users aren't announced; they simply receive *"You are muted and cannot send messages."*
 when they try to speak.
 ## Design notes
 - All checks run server-side in the moderation API — the client commands are conveniences,
  and the same rules bind IRC users and any direct API caller.
 - Bans are account-level, not IP-level. A banned person can register a fresh account; pair
  bans with registration hygiene on public servers.
 - In [end-to-end encrypted rooms](encrypted-rooms.md) moderation still works at the metadata
  level — messages can be deleted and users muted/kicked by identity — but no moderator can
  *read* the content, including the Owner.
@@ -2,6 +2,14 @@
  items:
    - name: Getting Started
      href: getting-started.md
    - name: TUI Guide
      href: tui-guide.md
    - name: Messages & Attachments
      href: messages-and-attachments.md
    - name: Moderation & Roles
      href: moderation.md
    - name: IRC Gateway
      href: irc-gateway.md
    - name: Docker
      href: docker.md
    - name: Architecture
@@ -0,0 +1,116 @@
 # TUI Guide
 Everything you can do in the EchoHub terminal client: keyboard shortcuts, mouse actions,
 slash commands, themes, and the everyday behaviors (unread markers, auto-join, scrollback)
 that make it feel like a proper IRC-era client with modern comforts.
 ## Layout
 ```text
 ┌ Menu bar ──────────────────────────────────────────────────┐
 │ ┌ Channels ─┐ ┌ Messages ────────────────────┐ ┌ Users ──┐ │
 │ │ #general 3│ │ 12:01 <alice> hi             │ │ ★ alice │ │
 │ │ #dev      │ │ ── new messages ──           │ │ ❀ bob   │ │
 │ │ #random*~ │ │ 12:04 <bob> anyone around?   │ │ carol   │ │
 │ └───────────┘ └──────────────────────────────┘ │ d [irc] │ │
 │ ┌ Message │ Enter=send │ Tab=complete │ … ────┐ └─────────┘ │
 │ │ _                                           │             │
 │ └─────────────────────────────────────────────┘             │
 │ Status: Connected │ v0.2.14 │ alice │ Act: #dev             │
 └─────────────────────────────────────────────────────────────┘
 ```
 Channel list markers: `*` = password-protected, `~` = private (unlisted), plus unread counts
 (orange when you were @mentioned). Users panel glyphs: `★` Owner, `♦` Admin, `❀` Mod,
 `[irc]` for IRC-gateway-only users; status icons `●`/`○`/`◐`/`◌` for online/offline/away/dnd.
 ## Keyboard shortcuts
 ### In the message input
 | Key | Action |
 | --- | --- |
 | `Enter` | Send the message (also sends staged attachments with the text as caption) |
 | `Ctrl+N` | Insert a newline (multiline message) |
 | `Tab` | Autocomplete a slash command (`/th` → `/theme`) |
 | `Ctrl+V` (or `Ctrl+Y`) | Paste — copied files and images become attachments, text pastes normally ([details](messages-and-attachments.md)) |
 | `Ctrl+C` / `Ctrl+X` | Copy / cut in the input |
 | `Ctrl+W` | Delete the word left of the cursor |
 | `Ctrl+K` | Open the search palette |
 | `F6` | Move focus into the message list |
 ### In the message list (after `F6`)
 | Key | Action |
 | --- | --- |
 | `↑` / `↓` | Select a message |
 | `Enter` | Activate: play/download/save an attachment, open an `@mention`'s profile, join a `#channel`, or open the sender's profile |
 | `Delete` / `Backspace` | Delete the selected message (with confirmation; [permission rules](moderation.md)) |
 | `F6` | Return focus to the input |
 ### Anywhere
 | Key | Action |
 | --- | --- |
 | `F2` | Toggle the users panel |
 | `Ctrl+K` | Search palette |
 | `Alt+Q` | Quit |
 ## The search palette (`Ctrl+K`)
 A command-palette that searches **channels and app actions** — type to filter, `↓` to
 navigate, `Enter` to jump. Actions include Connect, Disconnect, Logout, My Profile,
 Set Status, Create/Delete Channel, Saved Servers, Toggle Users Panel, Check for Updates,
 and Quit. `Ctrl+K` again closes it.
 ## Mouse
 - **Right-click a message** for the context menu: save image / play audio / download file
  (depending on the attachment), *Mention @user*, *View profile*, *Copy text*,
  *Copy message ID*, *Delete message*.
 - **Left-click a message** does the most useful thing for that line: attachments
  play/download/save, `@mentions` and the sender open profiles, `#channel` references join
  that channel.
 - **Click a user** in the users panel to open their profile; **click a channel** to switch.
 ## Slash commands
 Type `/help` in any channel for the full list. The highlights:
 | Command | What it does |
 | --- | --- |
 | `/status <online\|away\|dnd\|invisible>` or `/status <message>` | Presence / status message |
 | `/nick <name>`, `/color <#hex>`, `/avatar <url or path>` | Display name, nick color, avatar |
 | `/theme <name>` | Switch theme |
 | `/send`, `/clear`, `/size`, `/downloadpath` | Attachments — see [Messages & Attachments](messages-and-attachments.md) |
 | `/join <channel> [password]`, `/leave`, `/topic <text>` | Channel membership and topic |
 | `/passwd <old> <new>` | Rotate an encrypted room's passphrase |
 | `/profile [user]`, `/users`, `/meta` | Profiles, online users, room info |
 | `/kick`, `/ban`, `/mute`, `/role`, `/nuke`, … | [Moderation](moderation.md) |
 | `/servers`, `/quit` | Saved servers, exit |
 Emoji shortcodes (`:smile:` style) are replaced live as you type.
 ## Themes
 14 built-in themes: **Default, Transparent, TransparentLight, Classic, Light, Hacker,
 Solarized, Dracula, Monokai, Nord, Gruvbox, Ocean, HighContrast, RosePine** — switch from
 the User menu or `/theme <name>`. The two *Transparent* themes use no background color at
 all, so your terminal's own background (and any blur/acrylic) shows through.
 You can add your own: drop a theme JSON into `~/.echohub/themes/` and it appears in the list
 (names that collide with a built-in are skipped).
 ## Everyday behaviors
 - **Unread markers** — a `── new messages ──` rule marks where you left off in each channel,
  irssi-style. Read positions are **persisted per server**, so the marker survives
  reconnects and restarts. The status bar's `Act:` segment lists channels with activity
  (orange when you were @mentioned), and day boundaries draw a date rule.
 - **Auto-join** — connecting joins `#general` plus every channel you're a member of, so
  unread counts and mentions accumulate everywhere. Channels you `/leave` stay left, and
  password-protected or [encrypted rooms](encrypted-rooms.md) are never auto-prompted —
  join those explicitly. `#general` is the home channel and can't be left or deleted.
 - **Scrollback** — history loads 100 messages at a time; scrolling to the top of a channel
  fetches the next page and keeps your position (no jump).
 - **Drag & drop** — dropping a file onto the window stages it as an attachment.
@@ -0,0 +1,20 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>AurionDocs</title>
  <style>
    body { font-family: system-ui, sans-serif; display: grid; place-items: center; min-height: 100vh; margin: 0; background: #1a1a1e; color: #ddd; }
    main { text-align: center; }
    a { color: #7aa2f7; }
  </style>
 </head>
 <body>
  <main>
    <h1>AurionDocs</h1>
    <p>Supplementary documentation for EchoHub.</p>
    <p><a href="../index.html">&larr; Back to EchoHub documentation</a></p>
  </main>
 </body>
 </html>
@@ -4,6 +4,8 @@ Release history for EchoHub.
 ## Releases
 - [v0.2.15](v0.2.15.md) - Invite Codes, Data Export & Deletion, /me, /banner, Replies, Open Images In Browser & IRC Image Links
 - [v0.2.14](v0.2.14.md) - Clipboard Image & Multi-File Paste, E2E Room Unlock Fixes, Encrypted Key Cache & IRC Gateway Polish
 - [v0.2.13](v0.2.13.md) - Chat Visual Overhaul, Auto-Join All Channels & Persistent Read Positions
 - [v0.2.12](v0.2.12.md) - End-to-End Encrypted Channels, IRC Channel Keys, Image Save & Ctrl+W Crash Fix
 - [v0.2.11](v0.2.11.md) - EchoHubSpace Auth, Live Directory Updates & Server Browser Metadata
@@ -1,5 +1,9 @@
 - name: Overview
  href: index.md
 - name: v0.2.15
  href: v0.2.15.md
 - name: v0.2.14
  href: v0.2.14.md
 - name: v0.2.13
  href: v0.2.13.md
 - name: v0.2.12
@@ -0,0 +1,22 @@
 # v0.2.14
 A reliability and security pass over end-to-end encrypted rooms: locked channels now offer the passphrase prompt instead of dead-ending on the "rejoin to unlock" placeholder, the client can no longer be tricked into sending plaintext into an encrypted room, and cached room keys are encrypted at rest instead of sitting in the config as base64. Ctrl+V grows up too — images copied from a browser or screenshot tool paste straight into the chat as attachments, and copying several files pastes them all into one message. Plus a set of IRC gateway fixes — decrypted image previews, display-name plumbing, and user/channel indicators.
 ## New Features
 - **Paste images straight from the clipboard** — copy an image from a browser, a screenshot tool (Win+Shift+S), or an image editor and Ctrl+V it into the input: it's attached as a PNG (`image.png`), no saving to disk first, Discord-style. Transparency is preserved when the source provides PNG data; plain clipboard bitmaps are converted automatically. On Linux this uses `wl-paste`/`xclip`; on macOS it requires `pngpaste`. In end-to-end encrypted rooms pasted images go through the same client-side encryption as any other attachment.
 - **Multi-file paste** — copying several files in your file manager and pasting attaches them all to a single message (up to the 10-attachment cap), staged as one batch alongside anything you type as the caption. Previously each pasted file was routed through its own `/send`, which could misbehave on large batches.
 - **Room keys encrypted at rest** — the per-channel room keys cached so you don't retype a passphrase every launch are no longer stored as plain base64 in `config.json`. On Windows they're protected with DPAPI (current-user scope); on Linux/macOS with AES-GCM under a per-user key file created with `0600` permissions next to the config. Existing plain entries migrate to the encrypted format automatically on first load. The passphrase itself is never stored in any form.
 - **`[irc]` tag in the users panel** — users online only through the IRC gateway are tagged `[irc]`, useful context since IRC clients lack encryption, attachments, and profiles. Someone also running the TUI shows untagged.
 - **`~` marker for private channels** — the channel list now marks private (unlisted) channels with a trailing `~`, alongside the existing `*` for password-protected ones (`#room*~` when both apply).
 ## Bug Fixes
 - **Locked encrypted channels now prompt for the passphrase.** Auto-joining your channels at connect silently entered end-to-end encrypted rooms you're a member of without running the unlock flow — on a new device (or after a cancelled prompt) the room showed only `[encrypted — rejoin this channel with its passphrase to unlock]` placeholders, and only a manual `/join` recovered it. Selecting the channel now offers the passphrase prompt; entering it unlocks history and live messages in place. Cancelling is remembered for the session so reselecting the channel doesn't nag — `/join` or trying to send always re-offers the prompt.
 - **A stale cached room key no longer beats a fresh one.** If an encrypted channel was deleted and recreated under the same name, a client that still had the old key cached kept encrypting messages nobody else could read. Typing the passphrase on join now always adopts the key from the server's current envelope, replacing the stale cache.
 - **IRC clients no longer get flooded with ciphertext for image messages.** The gateway forwarded image ASCII previews without stripping transport encryption, spamming IRC clients with one enormous `$ENC$v1$…` line per image. Previews are now decrypted before formatting, and any that still can't be read (e.g. end-to-end room ciphertext the server cannot decrypt) are skipped in favor of the plain `[Image: name] url` line.
 - **Display names now show on chat messages.** Messages only carried the sender's username, so a configured display name appeared in the user list but not on the messages themselves. Live messages, history, and attachment messages now all carry it; mention and profile lookups stay keyed to the username.
 ## Security
 - **No plaintext can leak into an encrypted room.** Previously, a client without the room key silently sent unencrypted text into an end-to-end encrypted channel (and other members saw it as a normal message, none the wiser it went over the wire readable by the server). All send paths — typed messages, staged file attachments, and URL sends — are now blocked while a room is locked: the client offers the unlock prompt, keeps staged files in the tray, and refuses to transmit until the key is present, with a hard guard at the connection layer as backstop.
@@ -0,0 +1,78 @@
 # v0.2.15
 A big one. Server owners can gate registration behind invite codes, users can export or delete
 everything the server holds about them, and chat gets three classics — `/me` actions that
 interop natively with IRC, `/banner` ASCII text, and message replies with quote rendering and
 jump-to-original. Images become properly shareable: every image gets an **[open]** action that
 views it in your browser (or, in end-to-end encrypted rooms, decrypts and opens it locally).
 The IRC gateway stops painting ANSI art nobody asked for and posts plain image links any IRC
 client can open or auto-preview. And a long-standing dual-session annoyance is fixed: messages
 you send from the TUI now reach your own connected IRC client instantly.
 ## New Features
 - **Invite-gated registration** — set `Server:Registration` to `"invite"` (or `"closed"`) in
  `appsettings.json` and new accounts require a valid invite code; the default `"open"` keeps
  today's behavior. Admins mint codes with `/invite [uses] [hours]` (single-use, never-expiring
  by default), list them with `/invite list`, and revoke with `/invite revoke <code>`. Codes are
  unguessable (`K7QM-3XPF` style), stored only in your server's own database, and consumed
  atomically so a code's last use can't be taken twice. The IRC gateway respects the gate too:
  unknown nicknames connecting to an invite-only server get a clear error instead of a silent
  auto-registered account. The very first account (server owner bootstrap) is always allowed.
 - **Data export** — `/export` downloads everything the server stores about you (profile, your
  messages, attachment metadata) as JSON into your download folder. Content from end-to-end
  encrypted rooms appears as ciphertext, because the server never had the plaintext — "you own
  the data", demonstrably.
 - **Account deletion** — `/deleteaccount` permanently removes your account after a typed
  confirmation and password re-check: profile, sessions, and every file you uploaded are
  deleted. Your messages remain (deleting them would gut other people's conversations) but are
  re-attributed to a reserved `deleted-user` name. The last remaining Owner can't self-delete.
 - **`/me` actions** — `/me waves` renders as `* nick waves`. On the wire it's a real CTCP
  ACTION, so irssi/WeeChat users see a native action line, and their `/me` renders properly in
  the TUI. Works in encrypted rooms (the marker encrypts with the text).
 - **`/banner <text>`** — renders short text (up to 20 characters) as a 5-row block-letter
  banner. Rendered locally with a built-in font — no network, no dependencies — and sent as
  plain message content, so it works over IRC and in encrypted rooms.
 - **Message replies** — right-click a message (or F6-select) and pick **Reply**: the input
  shows a "Replying to" strip (Esc cancels), and the sent message renders with a dim
  `┌ nick: snippet` quote line. Activating the quote line jumps to the original message.
  Being replied to lights up the channel like an @mention. IRC clients see the familiar
  `> nick: snippet | text` convention. In encrypted rooms the quoted snippet is decrypted
  client-side with the room key — the server still never reads room content.
 - **`[open]` images without saving them** — every image attachment now shows `[open] [↓ save original]` beneath its preview. Open views the image in your default browser straight from the server; in end-to-end encrypted rooms (where a browser would only see ciphertext) the client downloads, decrypts with the room key, and opens the image in your OS viewer from a temp file instead. Both actions are individually clickable, Enter on the line opens, and the right-click menu carries both.
 - **Attachment links work in a browser** — `GET /api/files/{id}` is now a capability URL: the unguessable GUID in the link is the access token (Discord-CDN style), so attachment links can be opened directly in a browser or shared to IRC without a login token. Images and audio are served inline so the browser displays them instead of forcing a download. Blobs from encrypted rooms remain ciphertext, so their links reveal nothing.
 - **IRC gets image links instead of terminal art** — the gateway no longer floods IRC clients with truecolor-ANSI ASCII art for images. Each attachment is now a single line — `[Image: photo.png] https://your-server/api/files/…` — the convention every IRC client understands, and ones like TheLounge or IRCCloud auto-preview. Set the new `Irc:PublicBaseUrl` option (e.g. `"https://chat.example.com"`) so those links come out absolute; unset, they fall back to relative paths as before.
 - **Spam protection** — per-user message flood and duplicate-message limits, join and
  channel-creation throttles, and automatic escalation: enough rejected sends in a few minutes
  earns a timed auto-mute through the normal mute system (moderators see it, and it expires on
  its own). One guard covers every ingress — TUI and IRC clients hit the same limits. Mods and
  above are exempt, everything is configurable under the new `Spam` section
  (`Spam:Enabled` master switch, lenient defaults a fast typist won't trip), and the guard only
  ever sees stored content — encrypted-room messages stay ciphertext.
 ## Improvements
 - **Strict `/status`** — `/status garbage` is now an error instead of silently becoming your
  status message (and resetting you to Online). Status messages moved to `/status msg <text>`,
  which preserves your current status; `/status msg` with no text clears it. The server also
  rejects out-of-range status values sent by misbehaving clients.
 - **Registration dialog** — gained Invite Code support, and the Display Name field you could
  already type into is now actually sent with registration.
 ## Bug Fixes
 - **Messages sent from the TUI now reach your own IRC session.** With the same account online via both the TUI and an IRC client, messages sent from the TUI never appeared in the IRC client until it reconnected (which replayed history). The gateway suppressed the sender's echo by *nickname*, which swallowed the message for every IRC connection on that account — it now excludes only the exact connection a message originated from, so all your other sessions (a second IRC client included) receive it immediately.
 - **Channel deleted event** — when a channel is deleted, all connected clients are now immediately notified via the new `ChannelDeleted` SignalR event. The channel is removed from the channel list. Previously only the deleting client was able to delete the channel. Other clients would see the channel linger until the next manual refresh.
 - **Deleted accounts don't break history** — channel history now left-joins users, so messages
  from deleted accounts render (as `deleted-user`) instead of silently disappearing.
 ## Notes for server operators
 - New config key: `Server:Registration` — `"open"` (default), `"invite"`, or `"closed"`.
 - New config section: `Spam` — flood/duplicate/join/create thresholds and auto-mute duration;
  see `appsettings.example.json`. On by default with lenient limits; `Spam:Enabled: false`
  turns it all off. Note `Spam:MaxJoinsPerWindow` counts only *first-time* channel joins —
  keep it above your public channel count so a new member's first connect isn't throttled.
 - New REST endpoints: `POST/GET/DELETE /api/invites` (Admin+), `GET /api/users/me/export`,
  `DELETE /api/users/me`.
 - One new database migration (`AddInvitesAndReplies`) applies automatically on startup.
@@ -46,7 +46,7 @@
    "content": [
      {
        "files": ["**/*.{md,yml}"],
-        "exclude": ["_site/**", "_api_meta/**"]
+        "exclude": ["_site/**", "_api_meta/**", "auriondocs/**"]
      },
      {
        "src": "_api_meta/core",
@@ -75,7 +75,7 @@
    ],
    "resource": [
      {
-        "files": ["images/**"]
+        "files": ["images/**", "auriondocs/**"]
      }
    ],
    "output": "_site",
@@ -11,6 +11,10 @@ Welcome to the EchoHub documentation. EchoHub is a decentralized, IRC-style chat
 ## Quick Links
 - [Getting Started](articles/getting-started.md) - Set up and run EchoHub
 - [TUI Guide](articles/tui-guide.md) - Keyboard shortcuts, slash commands, and everyday usage
 - [Messages & Attachments](articles/messages-and-attachments.md) - Attaching, pasting, and receiving files
 - [Encrypted Rooms](articles/encrypted-rooms.md) - End-to-end encrypted channels
 - [IRC Gateway](articles/irc-gateway.md) - Connect with any IRC client
 - [Architecture](articles/architecture.md) - System design and IRC gateway
 - [API Reference](api/index.md) - Generated C# API documentation
 - [Changelog](changelog/index.md) - Release history
@@ -7,3 +7,5 @@
 - name: API
  href: api/
  homepage: api/index.md
 - name: AurionDocs
  href: auriondocs/index.html
@@ -0,0 +1,12 @@
 {
  "name": "echohub",
  "private": true,
  "description": "Repo tooling — markdown linting. Not an npm package.",
  "scripts": {
    "lint:md": "markdownlint-cli2",
    "lint:md:fix": "markdownlint-cli2 --fix"
  },
  "devDependencies": {
    "markdownlint-cli2": "^0.23.0"
  }
 }
@@ -0,0 +1,61 @@
 # EchoHub - Markdown Lint
 #
 # Runs markdownlint-cli2 over the repo. Rules, globs, and ignores all live in
 # .markdownlint-cli2.jsonc; the linter version is pinned in package.json.
 #
 # Usage:
 #   .\scripts\lint-markdown.ps1            # lint-only, exits non-zero on violations
 #   .\scripts\lint-markdown.ps1 -Fix       # auto-fix what markdownlint can
 #
 # Requires: Node + npx on PATH. Prefers the locally installed linter
 # (`npm install` once); otherwise npx fetches the same pinned version.
 param(
    [switch]$Fix
 )
 $ErrorActionPreference = "Stop"
 if (-not (Get-Command npx -ErrorAction SilentlyContinue)) {
    Write-Host "  ERROR: npx not found on PATH. Install Node.js (https://nodejs.org) and retry." -ForegroundColor Red
    exit 1
 }
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $RootDir   = Split-Path -Parent $ScriptDir
 Push-Location $RootDir
 try {
    # Local install is version-pinned via package.json/package-lock.json; the
    # npx fallback pins the same version so CI and local can never drift.
    if (Test-Path "node_modules/.bin/markdownlint-cli2") {
        $npxArgs = @('--no-install', 'markdownlint-cli2')
    } else {
        $npxArgs = @('--yes', '[email protected]')
    }
    if ($Fix) {
        Write-Host "  Auto-fix mode (--fix): markdownlint will rewrite files in place." -ForegroundColor Yellow
        $npxArgs += '--fix'
    }
    Write-Host "  > npx $($npxArgs -join ' ')" -ForegroundColor Gray
    & npx @npxArgs
    $exit = $LASTEXITCODE
    if ($exit -eq 0) {
        Write-Host "  Markdown lint clean." -ForegroundColor Green
    } elseif ($Fix) {
        Write-Host ""
        Write-Host "  Some issues could not be auto-fixed. Review the output above and fix manually." -ForegroundColor Yellow
    } else {
        Write-Host ""
        Write-Host "  Markdown lint failed. Re-run with -Fix to auto-correct the fixable rules:" -ForegroundColor Red
        Write-Host "    .\scripts\lint-markdown.ps1 -Fix" -ForegroundColor Yellow
    }
    exit $exit
 }
 finally {
    Pop-Location
 }
@@ -2,6 +2,8 @@
 #
 # Lint all Markdown files in the repository.
 # Config, globs, and ignores are defined in .markdownlint-cli2.jsonc.
 # The linter version is pinned in package.json — run `npm install` once,
 # or just use `npm run lint:md` / `npm run lint:md:fix` directly.
 #
 # Usage:
 #   ./scripts/lint-markdown.sh          # check
@@ -12,11 +14,12 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$REPO_ROOT"
-# Resolve markdownlint-cli2 binary
+# Prefer the locally installed (version-pinned) linter; fall back to a one-off
-if command -v markdownlint-cli2 &>/dev/null; then
+# npx install of the same version pinned in package.json.
-    LINT_CMD="markdownlint-cli2"
+if [ -x "node_modules/.bin/markdownlint-cli2" ]; then
    LINT_CMD="npx --no-install markdownlint-cli2"
 else
-    LINT_CMD="npx --yes markdownlint-cli2"
+    LINT_CMD="npx --yes markdownlint-cli2@0.23.0"
 fi
 echo "Linting Markdown files..."
@@ -1,6 +1,6 @@
 <Project>
  <PropertyGroup>
-    <Version>0.2.13</Version>
+    <Version>0.2.15</Version>
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <NoWarn>$(NoWarn);CS1591</NoWarn>
  </PropertyGroup>
@@ -35,6 +35,17 @@ public sealed class AppOrchestrator : IDisposable
    private readonly HashSet<string> _channelsLoadingMore = new(StringComparer.OrdinalIgnoreCase);
    private readonly List<string> _stagedAttachments = [];
    // Temp PNGs created for clipboard-image pastes; deleted once their message is sent
    // (or the staging tray is cleared) so pasted screenshots don't pile up in %TEMP%.
    private readonly HashSet<string> _tempPastedFiles = [];
    // E2E channels whose unlock prompt the user cancelled — don't nag on every reselect.
    // Cleared on connect/reconnect; an explicit /join or a send attempt re-offers the prompt.
    private readonly HashSet<string> _declinedUnlocks = new(StringComparer.OrdinalIgnoreCase);
    // Pending reply target — the next text message in that channel is sent as a reply to it.
    private (string Channel, Guid MessageId)? _pendingReply;
    private ClientConfig _config;
    private readonly UserSession _session = new();
@@ -90,6 +101,8 @@ public sealed class AppOrchestrator : IDisposable
        _mainWindow.OnDisconnectRequested += HandleDisconnect;
        _mainWindow.OnLogoutRequested += HandleLogout;
        _mainWindow.OnMessageSubmitted += HandleMessageSubmitted;
        _mainWindow.OnFilesStaged += HandleFilesStaged;
        _mainWindow.OnImagePasted += HandleImagePasted;
        _mainWindow.OnChannelSelected += HandleChannelSelected;
        _mainWindow.OnProfileRequested += HandleProfileRequested;
        _mainWindow.OnStatusRequested += HandleStatusRequested;
@@ -100,6 +113,7 @@ public sealed class AppOrchestrator : IDisposable
        _mainWindow.OnAudioPlayRequested += HandleAudioPlayRequested;
        _mainWindow.OnFileDownloadRequested += HandleFileDownloadRequested;
        _mainWindow.OnImageSaveRequested += HandleImageSaveRequested;
        _mainWindow.OnImageOpenRequested += HandleImageOpenRequested;
        _mainWindow.OnDeleteMessageRequested += HandleDeleteMessageRequested;
        _mainWindow.OnCheckForUpdatesRequested += HandleCheckForUpdatesRequested;
        _mainWindow.OnRollbackRequested += HandleRollbackRequested;
@@ -107,6 +121,8 @@ public sealed class AppOrchestrator : IDisposable
        _mainWindow.OnChannelJoinRequested += HandleChannelJoinFromMessage;
        _mainWindow.OnSearchRequested += HandleSearchRequested;
        _mainWindow.OnLoadMoreRequested += HandleLoadMoreRequested;
        _mainWindow.OnReplyRequested += HandleReplyRequested;
        _mainWindow.OnReplyCancelRequested += HandleReplyCancelRequested;
    }
    // ── Command Handler Wiring ─────────────────────────────────────────────
@@ -139,17 +155,200 @@ public sealed class AppOrchestrator : IDisposable
        _commandHandler.OnNukeChannel += HandleCmdNukeChannel;
        _commandHandler.OnTestSound += HandleCmdTestSound;
        _commandHandler.OnQuit += HandleCmdQuit;
        _commandHandler.OnSendAction += HandleCmdSendAction;
        _commandHandler.OnSendBanner += HandleCmdSendBanner;
        _commandHandler.OnCreateInvite += HandleCmdCreateInvite;
        _commandHandler.OnListInvites += HandleCmdListInvites;
        _commandHandler.OnRevokeInvite += HandleCmdRevokeInvite;
        _commandHandler.OnExportData += HandleCmdExportData;
        _commandHandler.OnDeleteAccount += HandleCmdDeleteAccount;
    }
    // ── Command Handlers ──────────────────────────────────────────────────
-    private async Task HandleCmdSetStatus(UserStatus status, string? message)
+    private async Task HandleCmdSetStatus(UserStatus? status, string? message)
    {
        if (!_conn.IsConnected) return;
-        await _conn.UpdateStatusAsync(status, message);
+        // null status keeps the current one; null message keeps it, empty clears it —
-        _session.Status = status;
+        // so "/status away" no longer wipes your message and "/status msg brb" keeps Away
-        _session.StatusMessage = message;
+        var newStatus = status ?? _session.Status;
        var newMessage = message is null
            ? _session.StatusMessage
            : (message.Length == 0 ? null : message);
        await _conn.UpdateStatusAsync(newStatus, newMessage);
        _session.Status = newStatus;
        _session.StatusMessage = newMessage;
    }
    private Task HandleCmdSendAction(string text)
    {
        if (!_conn.IsConnected) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return Task.CompletedTask;
        // CTCP ACTION content flows through the normal send path — room encryption included
        RunAsync(async () =>
        {
            if (!await EnsureRoomUnlockedForSendAsync(channel))
                return;
            await _conn.SendMessageAsync(channel, MessageConventions.FormatAction(text));
        }, "Send failed");
        return Task.CompletedTask;
    }
    private Task HandleCmdSendBanner(string text)
    {
        if (!_conn.IsConnected) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return Task.CompletedTask;
        var banner = AsciiBannerService.Render(text);
        if (banner is null)
        {
            InvokeUI(() => _mainWindow.ShowError(
                $"Nothing to render — /banner supports letters, digits, and basic punctuation (max {AsciiBannerService.MaxInputLength} chars)."));
            return Task.CompletedTask;
        }
        RunAsync(async () =>
        {
            if (!await EnsureRoomUnlockedForSendAsync(channel))
                return;
            await _conn.SendMessageAsync(channel, banner);
        }, "Send failed");
        return Task.CompletedTask;
    }
    private Task HandleCmdCreateInvite(int? maxUses, int? expiresHours)
    {
        if (!_conn.IsAuthenticated) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return Task.CompletedTask;
        RunAsync(async () =>
        {
            var invite = await _conn.Api!.CreateInviteAsync(maxUses, expiresHours);
            if (invite is null) return;
            var expiry = invite.ExpiresAt is { } exp ? $", expires {exp.ToLocalTime():yyyy-MM-dd HH:mm}" : "";
            InvokeUI(() => _messageManager.AddSystemMessage(channel,
                $"Invite code: {invite.Code} (uses: {invite.MaxUses}{expiry})\n" +
                $"Share it out-of-band. Revoke with: /invite revoke {invite.Code}"));
        }, "Failed to create invite");
        return Task.CompletedTask;
    }
    private Task HandleCmdListInvites()
    {
        if (!_conn.IsAuthenticated) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return Task.CompletedTask;
        RunAsync(async () =>
        {
            var invites = await _conn.Api!.GetInvitesAsync();
            var text = invites.Count == 0
                ? "No invite codes. Create one with /invite [uses] [hours]."
                : string.Join('\n', invites.Select(i =>
                {
                    var state = i.UseCount >= i.MaxUses ? "used up"
                        : i.ExpiresAt is { } exp && exp <= DateTimeOffset.UtcNow ? "expired"
                        : i.ExpiresAt is { } e2 ? $"expires {e2.ToLocalTime():yyyy-MM-dd HH:mm}"
                        : "active";
                    return $"{i.Code}  {i.UseCount}/{i.MaxUses} used  ({state}, by {i.CreatedByUsername})";
                }));
            InvokeUI(() => _messageManager.AddSystemMessage(channel, text));
        }, "Failed to list invites");
        return Task.CompletedTask;
    }
    private Task HandleCmdRevokeInvite(string code)
    {
        if (!_conn.IsAuthenticated) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return Task.CompletedTask;
        RunAsync(async () =>
        {
            await _conn.Api!.RevokeInviteAsync(code);
            InvokeUI(() => _messageManager.AddSystemMessage(channel, $"Invite {code.ToUpperInvariant()} revoked."));
        }, "Failed to revoke invite");
        return Task.CompletedTask;
    }
    private Task HandleCmdExportData()
    {
        if (!_conn.IsAuthenticated) return Task.CompletedTask;
        var channel = _mainWindow.CurrentChannel;
        RunAsync(async () =>
        {
            var json = await _conn.Api!.ExportMyDataAsync();
            var fileName = $"echohub-export-{_session.Username}-{DateTime.Now:yyyyMMdd-HHmmss}.json";
            var destination = DedupPath(GetDownloadDir(), fileName);
            await File.WriteAllTextAsync(destination, json);
            InvokeUI(() =>
            {
                if (!string.IsNullOrEmpty(channel))
                    _messageManager.AddSystemMessage(channel,
                        $"Data export saved to: {destination}\n(Encrypted-room content in it is ciphertext — the server never had the plaintext.)");
            });
        }, "Export failed");
        return Task.CompletedTask;
    }
    private Task HandleCmdDeleteAccount()
    {
        if (!_conn.IsAuthenticated) return Task.CompletedTask;
        InvokeUI(() =>
        {
            var confirm = MessageBox.ErrorQuery(_app, "Delete Account",
                $"This permanently deletes '{_session.Username}' on this server:\n" +
                "profile, sessions, and every file you uploaded.\n" +
                "Your messages remain, attributed to 'deleted-user'.\n\n" +
                "This cannot be undone.",
                "Cancel", "Delete my account");
            if (confirm != 1) return;
            var password = PromptPassword("Enter your password to confirm deletion:");
            if (password is null) return;
            PersistLastReads();
            RunAsync(async () =>
            {
                var baseUrl = _conn.Api!.BaseUrl;
                await _conn.Api!.DeleteMyAccountAsync(password);
                ClearSavedToken(baseUrl);
                await _conn.CleanupAsync();
                InvokeUI(() =>
                {
                    _mainWindow.ClearAll();
                    _mainWindow.UpdateStatusBar("Disconnected");
                    MessageBox.Query(_app, "Account Deleted",
                        "Your account and uploaded files have been deleted from this server.", "OK");
                });
            }, "Account deletion failed", "DeleteAccount");
        });
        return Task.CompletedTask;
    }
    /// <summary>Modal password prompt; returns null when cancelled or empty.</summary>
    private string? PromptPassword(string prompt)
    {
        string? result = null;
        var dialog = new Dialog { Title = "Confirm Password", Width = 56, Height = 8 };
        var label = new Label { Text = prompt, X = 1, Y = 1 };
        var field = new TextField { X = 1, Y = 2, Width = Terminal.Gui.ViewBase.Dim.Fill(2), Secret = true };
        var ok = new Button { Text = "Confirm", IsDefault = true, X = Terminal.Gui.ViewBase.Pos.Center() - 12, Y = 4 };
        var cancel = new Button { Text = "Cancel", X = Terminal.Gui.ViewBase.Pos.Center() + 2, Y = 4 };
        ok.Accepting += (_, e) => { result = field.Text; e.Handled = true; _app.RequestStop(); };
        cancel.Accepting += (_, e) => { result = null; e.Handled = true; _app.RequestStop(); };
        dialog.Add(label, field, ok, cancel);
        field.SetFocus();
        _app.Run(dialog);
        return string.IsNullOrEmpty(result) ? null : result;
    }
    private async Task HandleCmdSetNick(string displayName)
@@ -187,7 +386,8 @@ public sealed class AppOrchestrator : IDisposable
        if (Uri.TryCreate(target, UriKind.Absolute, out var uri)
            && (uri.Scheme == "http" || uri.Scheme == "https"))
        {
-            if (_conn.RoomKeys.HasKey(channel))
+            // Also blocks locked E2E channels (no cached key) — a URL send would be plaintext
            if (_conn.RoomKeys.HasKey(channel) || _conn.RoomKeys.IsChannelEncrypted(channel))
            {
                InvokeUI(() => _mainWindow.ShowError(
                    "Sending by URL isn't available in encrypted channels — download the file and /send it instead."));
@@ -216,11 +416,89 @@ public sealed class AppOrchestrator : IDisposable
    private Task HandleCmdClearAttachments()
    {
        var temps = _stagedAttachments.Where(_tempPastedFiles.Contains).ToList();
        _tempPastedFiles.ExceptWith(temps);
        CleanupPastedTempFiles(temps);
        _stagedAttachments.Clear();
        InvokeUI(RefreshStagingTray);
        return Task.CompletedTask;
    }
    /// <summary>
    /// Stages a batch of local files (multi-file paste or drag-and-drop) as attachments of the
    /// next message. Runs synchronously on the UI thread — unlike routing each file through a
    /// fire-and-forget /send command, a 10-file paste can't race the staging list.
    /// </summary>
    private void HandleFilesStaged(string channel, IReadOnlyList<string> files)
    {
        if (!_conn.IsAuthenticated || !_conn.IsConnected)
            return;
        var slotsLeft = HubConstants.MaxAttachmentsPerMessage - _stagedAttachments.Count;
        _stagedAttachments.AddRange(files.Take(Math.Max(0, slotsLeft)));
        if (files.Count > slotsLeft)
            _mainWindow.ShowError($"You can attach at most {HubConstants.MaxAttachmentsPerMessage} files per message.");
        RefreshStagingTray();
    }
    /// <summary>
    /// Stages an image pasted as raw clipboard data (copied from a browser, a screenshot tool,
    /// or an image editor). The PNG is written to a per-paste temp folder so it flows through
    /// the same path-based staging/encryption pipeline as regular files, and the temp file is
    /// deleted once the message is sent.
    /// </summary>
    private void HandleImagePasted(string channel, byte[] png)
    {
        if (!_conn.IsAuthenticated || !_conn.IsConnected)
            return;
        if (_stagedAttachments.Count >= HubConstants.MaxAttachmentsPerMessage)
        {
            _mainWindow.ShowError($"You can attach at most {HubConstants.MaxAttachmentsPerMessage} files per message.");
            return;
        }
        try
        {
            // A unique folder per paste keeps the Discord-style "image.png" display name
            // while letting several pasted images coexist in one message.
            var dir = Path.Combine(Path.GetTempPath(), "EchoHub", "pasted", Guid.NewGuid().ToString("N")[..8]);
            Directory.CreateDirectory(dir);
            var path = Path.Combine(dir, "image.png");
            File.WriteAllBytes(path, png);
            _tempPastedFiles.Add(path);
            _stagedAttachments.Add(path);
            RefreshStagingTray();
        }
        catch (Exception ex)
        {
            Log.Error(ex, "Staging a pasted clipboard image failed");
            _mainWindow.ShowError($"Pasting image failed: {ex.Message}");
        }
    }
    /// <summary>Best-effort removal of pasted-image temp files and their per-paste folders.</summary>
    private static void CleanupPastedTempFiles(IReadOnlyList<string> files)
    {
        foreach (var file in files)
        {
            try
            {
                File.Delete(file);
                if (Path.GetDirectoryName(file) is { } dir)
                    Directory.Delete(dir);
            }
            catch (Exception ex)
            {
                Log.Debug(ex, "Could not delete pasted-image temp file {File}", file);
            }
        }
    }
    /// <summary>
    /// Opens the ASCII-art size picker (no argument) or sets it directly from "s"/"m"/"l" (or
    /// small/medium/large). The choice is a persistent preference applied to attached images.
@@ -290,24 +568,41 @@ public sealed class AppOrchestrator : IDisposable
    /// </summary>
    private void SendStagedMessage(string channel, string content)
    {
        var staged = _stagedAttachments.ToList();
        _stagedAttachments.Clear();
        InvokeUI(RefreshStagingTray);
        var hasRoomKey = _conn.RoomKeys.TryGetKey(channel, out var roomKey);
        var size = _config.DefaultAsciiSize;
        RunAsync(async () =>
        {
-            var outgoing = new List<OutgoingAttachment>();
+            // Locked E2E channel: block the send and keep the files staged for after the unlock
-            foreach (var path in staged)
+            if (!await EnsureRoomUnlockedForSendAsync(channel))
-                outgoing.Add(await BuildOutgoingAttachmentAsync(path, hasRoomKey ? roomKey : null, size));
+                return;
-            var wireContent = hasRoomKey && !string.IsNullOrEmpty(content)
+            var staged = _stagedAttachments.ToList();
-                ? RoomCrypto.EncryptText(content, roomKey)
+            _stagedAttachments.Clear();
-                : content;
+            InvokeUI(RefreshStagingTray);
-            await _conn.Api!.SendMessageWithAttachmentsAsync(channel, wireContent, outgoing, size);
+            // Pasted clipboard images live in temp files; once this send owns them they are
            // deleted whether the upload succeeds or fails (the tray is already cleared).
            var tempFiles = staged.Where(_tempPastedFiles.Contains).ToList();
            _tempPastedFiles.ExceptWith(tempFiles);
            try
            {
                var hasRoomKey = _conn.RoomKeys.TryGetKey(channel, out var roomKey);
                var outgoing = new List<OutgoingAttachment>();
                foreach (var path in staged)
                    outgoing.Add(await BuildOutgoingAttachmentAsync(path, hasRoomKey ? roomKey : null, size));
                var wireContent = hasRoomKey && !string.IsNullOrEmpty(content)
                    ? RoomCrypto.EncryptText(content, roomKey)
                    : content;
                await _conn.Api!.SendMessageWithAttachmentsAsync(channel, wireContent, outgoing, size);
            }
            finally
            {
                CleanupPastedTempFiles(tempFiles);
            }
        }, "Send failed");
    }
@@ -417,6 +712,8 @@ public sealed class AppOrchestrator : IDisposable
        try
        {
            crypto = await _conn.Api!.GetChannelCryptoAsync(channelName);
            if (crypto is not null)
                _conn.RoomKeys.MarkChannelEncrypted(channelName, crypto.IsEncrypted);
        }
        catch (Exception ex)
        {
@@ -438,16 +735,20 @@ public sealed class AppOrchestrator : IDisposable
            {
                var outcome = await _conn.JoinChannelAsync(channelName, wirePassword);
-                if (outcome.WrappedRoomKey is not null && !_conn.RoomKeys.HasKey(channelName))
+                if (outcome.WrappedRoomKey is not null)
                {
-                    if (kek is not null && RoomCrypto.TryUnwrapRoomKey(outcome.WrappedRoomKey, kek, out var roomKey))
+                    // A typed passphrase always wins over the cache: unwrap the fresh envelope
                    // and overwrite any stale key (e.g. the channel was deleted and recreated
                    // under the same name — the old key would encrypt for nobody).
                    if (kek is not null && _conn.RoomKeys.TryStoreFromEnvelope(channelName, outcome.WrappedRoomKey, kek))
                    {
-                        _conn.RoomKeys.StoreKey(channelName, roomKey);
+                        lock (_declinedUnlocks) _declinedUnlocks.Remove(channelName);
                        // Re-fetch so history decrypts with the now-available room key
                        return await _conn.GetHistoryAsync(channelName);
                    }
-                    return await UnlockRoomKeyAsync(channelName, outcome);
+                    if (!_conn.RoomKeys.HasKey(channelName))
                        return await UnlockRoomKeyAsync(channelName, outcome);
                }
                return outcome.History;
@@ -484,12 +785,17 @@ public sealed class AppOrchestrator : IDisposable
            var passphrase = await prompt.Task;
            if (passphrase is null)
-                return outcome.History; // stays locked; placeholders render instead of content
+            {
                // Stays locked; placeholders render instead of content. Remember the decline
                // so reselecting the channel doesn't nag every time.
                lock (_declinedUnlocks) _declinedUnlocks.Add(channelName);
                return outcome.History;
            }
            var derived = RoomCrypto.DeriveKeys(passphrase, salt);
-            if (RoomCrypto.TryUnwrapRoomKey(outcome.WrappedRoomKey, derived.KeyEncryptionKey, out var roomKey))
+            if (_conn.RoomKeys.TryStoreFromEnvelope(channelName, outcome.WrappedRoomKey, derived.KeyEncryptionKey))
            {
-                _conn.RoomKeys.StoreKey(channelName, roomKey);
+                lock (_declinedUnlocks) _declinedUnlocks.Remove(channelName);
                return await _conn.GetHistoryAsync(channelName);
            }
@@ -497,6 +803,66 @@ public sealed class AppOrchestrator : IDisposable
        }
    }
    /// <summary>
    /// True when a channel is end-to-end encrypted, its room key isn't cached, and the
    /// user hasn't already declined the unlock prompt this session.
    /// </summary>
    private bool NeedsUnlockPrompt(string channelName)
    {
        if (!_conn.RoomKeys.IsChannelEncrypted(channelName) || _conn.RoomKeys.HasKey(channelName))
            return false;
        lock (_declinedUnlocks) return !_declinedUnlocks.Contains(channelName);
    }
    /// <summary>
    /// Unlock flow for a channel that is already hub-joined (auto-join/reconnect discard
    /// the key envelope): rejoin — members pass the gate without a password and the join
    /// result carries the envelope — then run the passphrase prompt. On success the
    /// decrypted history replaces the locked placeholders. Returns true when unlocked.
    /// </summary>
    private async Task<bool> UnlockTrackedChannelAsync(string channelName)
    {
        try
        {
            var outcome = await _conn.JoinChannelAsync(channelName, null);
            if (outcome.WrappedRoomKey is null)
                return false; // not an E2E channel after all
            var history = await UnlockRoomKeyAsync(channelName, outcome);
            if (!_conn.RoomKeys.HasKey(channelName))
                return false; // cancelled or never unwrapped
            if (history is not null)
                InvokeUI(() => _messageManager.LoadHistory(channelName, history));
            return true;
        }
        catch (Exception ex)
        {
            Log.Warning(ex, "Unlock flow failed for #{Channel}", channelName);
            return false;
        }
    }
    /// <summary>
    /// Send guard for end-to-end encrypted channels: without the cached room key nothing
    /// may leave the client (it would be plaintext in a room others read as encrypted).
    /// Offers the unlock prompt right away — even after an earlier decline, since the user
    /// is actively trying to talk here. Returns true when sending is safe.
    /// </summary>
    private async Task<bool> EnsureRoomUnlockedForSendAsync(string channelName)
    {
        if (!_conn.RoomKeys.IsChannelEncrypted(channelName) || _conn.RoomKeys.HasKey(channelName))
            return true;
        if (await UnlockTrackedChannelAsync(channelName))
            return true;
        InvokeUI(() => _mainWindow.ShowError(
            $"#{channelName} is end-to-end encrypted and locked — nothing was sent. Enter its passphrase to unlock it first."));
        return false;
    }
    /// <summary>
    /// Changes the current encrypted channel's passphrase: re-derives the join credential
    /// and re-wraps the cached room content key under the new passphrase. History is
@@ -894,6 +1260,15 @@ public sealed class AppOrchestrator : IDisposable
        _conn.MessageDeleted += (channelName, messageId) =>
            InvokeUI(() => _messageManager.RemoveMessage(channelName, messageId));
        _conn.ChannelDeleted += channelName =>
        {
            InvokeUI(() =>
            {
                _conn.UntrackChannel(channelName);
                _mainWindow.RemoveChannel(channelName);
            });
        };
        _conn.ChannelNuked += channelName =>
        {
            InvokeUI(() =>
@@ -922,6 +1297,7 @@ public sealed class AppOrchestrator : IDisposable
        _conn.Reconnected += () =>
        {
            lock (_channelUsersLock) _channelUsers.Clear();
            lock (_declinedUnlocks) _declinedUnlocks.Clear();
            RunAsync(
                async () => await _conn.RejoinChannelsAsync(),
                "Failed to rejoin channels after reconnect");
@@ -970,6 +1346,7 @@ public sealed class AppOrchestrator : IDisposable
            }
            _session.Username = result.Login.Username;
            lock (_declinedUnlocks) _declinedUnlocks.Clear();
            // Persisted last-read markers for this server — used to seed unread counts,
            // mention highlights, and "new messages" markers from the fetched histories.
@@ -1004,6 +1381,8 @@ public sealed class AppOrchestrator : IDisposable
    {
        Log.Information("Disconnecting from server");
        lock (_channelUsersLock) _channelUsers.Clear();
        _pendingReply = null;
        InvokeUI(() => _mainWindow.SetReplyingTo(null));
        PersistLastReads();
        RunAsync(async () =>
@@ -1073,9 +1452,38 @@ public sealed class AppOrchestrator : IDisposable
            return;
        }
-        RunAsync(
+        // A pending reply only applies to a plain text message in its own channel
-            async () => await _conn.SendMessageAsync(channelName, content),
+        Guid? replyTo = _pendingReply is { } pending
-            "Send failed");
+            && pending.Channel.Equals(channelName, StringComparison.OrdinalIgnoreCase)
            ? pending.MessageId : null;
        RunAsync(async () =>
        {
            if (!await EnsureRoomUnlockedForSendAsync(channelName))
                return;
            await _conn.SendMessageAsync(channelName, content, replyTo);
            if (replyTo is not null)
                InvokeUI(ClearPendingReply);
        }, "Send failed");
    }
    private void HandleReplyRequested(Guid messageId, string sender, string snippet)
    {
        var channel = _mainWindow.CurrentChannel;
        if (string.IsNullOrEmpty(channel)) return;
        _pendingReply = (channel, messageId);
        if (snippet.Length > 40)
            snippet = snippet[..40] + "…";
        _mainWindow.SetReplyingTo($"{sender}: {snippet}");
    }
    private void HandleReplyCancelRequested() => ClearPendingReply();
    private void ClearPendingReply()
    {
        _pendingReply = null;
        _mainWindow.SetReplyingTo(null);
    }
    private void HandleDeleteMessageRequested(Guid messageId)
@@ -1092,6 +1500,10 @@ public sealed class AppOrchestrator : IDisposable
    {
        if (!_conn.IsConnected) return;
        // A reply pending in the previous channel doesn't carry over
        if (_pendingReply is { } pending && !pending.Channel.Equals(channelName, StringComparison.OrdinalIgnoreCase))
            InvokeUI(ClearPendingReply);
        // Checkpoint read positions — the previous channel was just marked read
        PersistLastReads();
@@ -1112,6 +1524,12 @@ public sealed class AppOrchestrator : IDisposable
                UpdateServerConfig(server =>
                    server.LeftChannels.RemoveAll(c => c.Equals(channelName, StringComparison.OrdinalIgnoreCase)));
            }
            else if (NeedsUnlockPrompt(channelName))
            {
                // Auto-join/reconnect already hub-joined this E2E channel but discarded the
                // key envelope — selecting it is the user's cue to unlock it.
                await UnlockTrackedChannelAsync(channelName);
            }
            try
            {
@@ -1507,6 +1925,62 @@ public sealed class AppOrchestrator : IDisposable
        return tempPath;
    }
    /// <summary>File extensions the "[open]" action will hand to the OS image viewer for E2E rooms.</summary>
    private static readonly HashSet<string> ImageOpenExtensions = new(StringComparer.OrdinalIgnoreCase)
    {
        ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp",
    };
    /// <summary>
    /// Views an image without saving it to the user's downloads. Plain channels open the
    /// file's web URL in the default browser (the server serves files by capability URL, so
    /// no auth token is needed). E2E-encrypted channels would render as ciphertext in a
    /// browser, so the blob is downloaded, decrypted locally, and opened from a temp file.
    /// </summary>
    private void HandleImageOpenRequested(string attachmentUrl, string fileName)
    {
        if (!_conn.IsAuthenticated) return;
        var channel = _mainWindow.CurrentChannel;
        var isEncryptedRoom = !string.IsNullOrEmpty(channel) && _conn.RoomKeys.TryGetKey(channel, out _);
        if (!isEncryptedRoom)
        {
            var webUrl = attachmentUrl.StartsWith("http://", StringComparison.OrdinalIgnoreCase)
                || attachmentUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase)
                ? attachmentUrl
                : $"{_conn.Api!.BaseUrl}/{attachmentUrl.TrimStart('/')}";
            try
            {
                System.Diagnostics.Process.Start(
                    new System.Diagnostics.ProcessStartInfo(webUrl) { UseShellExecute = true });
            }
            catch (Exception ex)
            {
                Log.Warning(ex, "Failed to open image URL in browser: {Url}", webUrl);
                InvokeUI(() => _messageManager.AddSystemMessage(channel, $"Couldn't open a browser — image URL: {webUrl}"));
            }
            return;
        }
        // In E2E rooms the attachment kind is sender-declared, so only hand real image
        // extensions to the OS viewer; anything else goes through the save path instead.
        if (!ImageOpenExtensions.Contains(Path.GetExtension(fileName)))
        {
            HandleImageSaveRequested(attachmentUrl, fileName);
            return;
        }
        RunAsync(async () =>
        {
            InvokeUI(() => _messageManager.AddSystemMessage(channel, $"Decrypting {fileName}..."));
            var tempPath = await DownloadAttachmentAsync(attachmentUrl, fileName);
            var psi = new System.Diagnostics.ProcessStartInfo(tempPath) { UseShellExecute = true };
            System.Diagnostics.Process.Start(psi);
        }, "Failed to open image");
    }
    private void HandleImageSaveRequested(string attachmentUrl, string fileName)
    {
        if (!_conn.IsAuthenticated) return;
@@ -6,7 +6,19 @@ public record CommandResult(bool Handled, string? Message = null, bool IsError =
 public class CommandHandler
 {
-    public event Func<UserStatus, string?, Task>? OnSetStatus;
+    /// <summary>
    /// Status update. A null status means "keep the current status"; a null message means
    /// "keep the current message" and an empty message means "clear it". The orchestrator
    /// resolves both against the session state.
    /// </summary>
    public event Func<UserStatus?, string?, Task>? OnSetStatus;
    public event Func<string, Task>? OnSendAction;
    public event Func<string, Task>? OnSendBanner;
    public event Func<int?, int?, Task>? OnCreateInvite;
    public event Func<Task>? OnListInvites;
    public event Func<string, Task>? OnRevokeInvite;
    public event Func<Task>? OnExportData;
    public event Func<Task>? OnDeleteAccount;
    public event Func<string, Task>? OnSetNick;
    public event Func<string, Task>? OnSetColor;
    public event Func<string, Task>? OnSetTheme;
@@ -48,6 +60,11 @@ public class CommandHandler
        return command switch
        {
            "status" => await HandleStatus(args),
            "me" => await HandleMe(args),
            "banner" => await HandleBanner(args),
            "invite" => await HandleInvite(args),
            "export" => await HandleExport(),
            "deleteaccount" => await HandleDeleteAccount(),
            "nick" => await HandleNick(args),
            "color" => await HandleColor(args),
            "theme" => await HandleTheme(args),
@@ -78,12 +95,28 @@ public class CommandHandler
        };
    }
    private const string StatusUsage =
        "Usage: /status <online|away|dnd|invisible> or /status msg <text> (empty text clears it)";
    private async Task<CommandResult> HandleStatus(string args)
    {
        if (string.IsNullOrWhiteSpace(args))
-            return new CommandResult(true, "Usage: /status <online|away|dnd|invisible> or /status <message>", IsError: true);
+            return new CommandResult(true, StatusUsage, IsError: true);
        var parts = args.Trim().Split(' ', 2, StringSplitOptions.TrimEntries);
        var statusArg = parts[0].ToLowerInvariant();
        // /status msg <text> — set/clear the message, keep the current status
        if (statusArg is "msg" or "message")
        {
            var message = parts.Length > 1 ? parts[1] : string.Empty;
            if (OnSetStatus is not null)
                await OnSetStatus(null, message);
            return new CommandResult(true, message.Length > 0
                ? $"Status message set: {message}"
                : "Status message cleared.");
        }
        var statusArg = args.ToLowerInvariant().Trim();
        UserStatus? status = statusArg switch
        {
            "online" => UserStatus.Online,
@@ -93,17 +126,92 @@ public class CommandHandler
            _ => null,
        };
-        if (status.HasValue)
+        // Strict: anything else is an error — no silent "it became your status message"
        if (!status.HasValue)
            return new CommandResult(true, $"Unknown status '{parts[0]}'. {StatusUsage}", IsError: true);
        if (parts.Length > 1)
            return new CommandResult(true, StatusUsage, IsError: true);
        if (OnSetStatus is not null)
            await OnSetStatus(status.Value, null);
        return new CommandResult(true, $"Status set to {status.Value}");
    }
    private async Task<CommandResult> HandleMe(string args)
    {
        if (string.IsNullOrWhiteSpace(args))
            return new CommandResult(true, "Usage: /me <action> (e.g. /me waves)", IsError: true);
        if (OnSendAction is not null)
            await OnSendAction(args.Trim());
        return new CommandResult(true);
    }
    private async Task<CommandResult> HandleBanner(string args)
    {
        if (string.IsNullOrWhiteSpace(args))
            return new CommandResult(true, "Usage: /banner <text> (letters, digits, basic punctuation)", IsError: true);
        if (OnSendBanner is not null)
            await OnSendBanner(args.Trim());
        return new CommandResult(true);
    }
    private async Task<CommandResult> HandleInvite(string args)
    {
        var parts = args.Split(' ', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
        // /invite list
        if (parts.Length > 0 && parts[0].Equals("list", StringComparison.OrdinalIgnoreCase))
        {
-            if (OnSetStatus is not null)
+            if (OnListInvites is not null)
-                await OnSetStatus(status.Value, null);
+                await OnListInvites();
-            return new CommandResult(true, $"Status set to {status.Value}");
+            return new CommandResult(true);
        }
-        // Treat as custom status message (keep current status)
+        // /invite revoke <code>
-        if (OnSetStatus is not null)
+        if (parts.Length > 0 && parts[0].Equals("revoke", StringComparison.OrdinalIgnoreCase))
-            await OnSetStatus(UserStatus.Online, args);
+        {
-        return new CommandResult(true, $"Status message set: {args}");
+            if (parts.Length < 2)
                return new CommandResult(true, "Usage: /invite revoke <code>", IsError: true);
            if (OnRevokeInvite is not null)
                await OnRevokeInvite(parts[1]);
            return new CommandResult(true);
        }
        // /invite [maxUses] [expiresHours] — defaults to a single-use, never-expiring code
        int? maxUses = null, expiresHours = null;
        if (parts.Length > 0)
        {
            if (!int.TryParse(parts[0], out var uses) || uses < 1)
                return new CommandResult(true, "Usage: /invite [maxUses] [expiresHours] | /invite list | /invite revoke <code>", IsError: true);
            maxUses = uses;
        }
        if (parts.Length > 1)
        {
            if (!int.TryParse(parts[1], out var hours) || hours < 1)
                return new CommandResult(true, "Usage: /invite [maxUses] [expiresHours]", IsError: true);
            expiresHours = hours;
        }
        if (OnCreateInvite is not null)
            await OnCreateInvite(maxUses, expiresHours);
        return new CommandResult(true);
    }
    private async Task<CommandResult> HandleExport()
    {
        if (OnExportData is not null)
            await OnExportData();
        return new CommandResult(true);
    }
    private async Task<CommandResult> HandleDeleteAccount()
    {
        if (OnDeleteAccount is not null)
            await OnDeleteAccount();
        return new CommandResult(true);
    }
    private async Task<CommandResult> HandleNick(string args)
@@ -392,7 +500,9 @@ public class CommandHandler
        return new CommandResult(true, """
            Available commands:
              /status <online|away|dnd|invisible>  - Set your status
-              /status <message>                    - Set status message
+              /status msg <text>                   - Set status message (empty = clear)
              /me <action>                         - Action message (* nick waves)
              /banner <text>                       - Send text as an ASCII banner
              /nick <name>                         - Set display name
              /color <#hex>                        - Set nickname color
              /theme <name>                        - Switch theme
@@ -413,6 +523,9 @@ public class CommandHandler
              /topic <text>                        - Set channel topic
              /users                               - List online users
              /meta                                - Show room info (size, messages, users, created, id)
              /export                              - Download everything the server stores about you
              /deleteaccount                       - Permanently delete your account
            (Tip: right-click a message and pick Reply to quote it; Esc cancels a pending reply.)
            Moderation:
              /kick <user> [reason]                - Kick a user (Mod+)
              /ban <user> [reason]                 - Ban a user (Admin+)
@@ -420,6 +533,8 @@ public class CommandHandler
              /mute <user> [minutes]               - Mute a user (Mod+)
              /unmute <user>                       - Unmute a user (Mod+)
              /role <user> <admin|mod|member>      - Assign role (Admin+)
              /invite [uses] [hours]               - Create a registration invite code (Admin+)
              /invite list | revoke <code>         - Manage invite codes (Admin+)
              /nuke                                - Clear channel history (Mod+)
              /test-sound                          - Play notification sound
              /quit                                - Exit the app
@@ -38,7 +38,8 @@ public class SavedServer
    /// <summary>
    /// Cached room content keys for end-to-end encrypted channels on this server,
-    /// keyed by channel name (base64). Like RefreshToken, these live only on the
+    /// keyed by channel name and encrypted at rest (see RoomKeyProtector; legacy
    /// entries were plain base64). Like RefreshToken, these live only on the
    /// user's machine — the server never sees them.
    /// </summary>
    public Dictionary<string, string> ChannelKeys { get; set; } = [];
@@ -9,6 +9,9 @@ public static class ConfigManager
    private static readonly string ConfigPath = Path.Combine(ConfigDir, "config.json");
    /// <summary>Directory holding the client config and local key material.</summary>
    public static string ConfigDirectory => ConfigDir;
    // Load-mutate-save cycles run from both the UI thread and background tasks
    // (token refresh, room keys, last-read checkpoints) — serialize file access.
    private static readonly Lock FileLock = new();
@@ -12,6 +12,7 @@
    <PackageReference Include="Serilog" Version="4.3.1" />
    <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.0" />
    <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.3" />
    <PackageReference Include="Terminal.Gui" Version="2.0.0-develop.5043" />
  </ItemGroup>
@@ -29,9 +29,9 @@ public sealed class ApiClient : IDisposable
        };
    }
-    public async Task<LoginResponse> RegisterAsync(string username, string password, string? displayName = null)
+    public async Task<LoginResponse> RegisterAsync(string username, string password, string? displayName = null, string? inviteCode = null)
    {
-        var request = new RegisterRequest(username, password, displayName);
+        var request = new RegisterRequest(username, password, displayName, inviteCode);
        using var response = await _http.PostAsJsonAsync("/api/auth/register", request);
        await EnsureSuccessAsync(response);
@@ -312,6 +312,54 @@ public sealed class ApiClient : IDisposable
        await EnsureSuccessAsync(response);
    }
    // ── Invites / Account ─────────────────────────────────────────────────
    public async Task<InviteDto?> CreateInviteAsync(int? maxUses = null, int? expiresInHours = null)
    {
        EnsureAuthenticated();
        using var response = await AuthenticatedRequestAsync(() =>
            _http.PostAsJsonAsync("/api/invites", new CreateInviteRequest(maxUses, expiresInHours)));
        await EnsureSuccessAsync(response);
        return await response.Content.ReadFromJsonAsync<InviteDto>();
    }
    public async Task<List<InviteDto>> GetInvitesAsync()
    {
        EnsureAuthenticated();
        using var response = await AuthenticatedGetAsync("/api/invites");
        await EnsureSuccessAsync(response);
        return await response.Content.ReadFromJsonAsync<List<InviteDto>>() ?? [];
    }
    public async Task RevokeInviteAsync(string code)
    {
        EnsureAuthenticated();
        using var response = await AuthenticatedRequestAsync(() =>
            _http.DeleteAsync($"/api/invites/{Uri.EscapeDataString(code)}"));
        await EnsureSuccessAsync(response);
    }
    /// <summary>Downloads the caller's full data export as raw JSON text.</summary>
    public async Task<string> ExportMyDataAsync()
    {
        EnsureAuthenticated();
        using var response = await AuthenticatedGetAsync("/api/users/me/export");
        await EnsureSuccessAsync(response);
        return await response.Content.ReadAsStringAsync();
    }
    /// <summary>Deletes the caller's account. The password re-confirms intent.</summary>
    public async Task DeleteMyAccountAsync(string password)
    {
        EnsureAuthenticated();
        using var response = await AuthenticatedRequestAsync(() =>
            _http.SendAsync(new HttpRequestMessage(HttpMethod.Delete, "/api/users/me")
            {
                Content = JsonContent.Create(new DeleteAccountRequest(password)),
            }));
        await EnsureSuccessAsync(response);
    }
    // ── Moderation ────────────────────────────────────────────────────────
    public async Task AssignRoleAsync(string username, ServerRole role)
@@ -0,0 +1,257 @@
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Runtime.Versioning;
 using Serilog;
 using SixLabors.ImageSharp;
 namespace EchoHub.Client.Services;
 /// <summary>
 /// Reads raw image data from the OS clipboard (e.g. an image copied from a browser, or a
 /// Win+Shift+S screenshot), which terminals cannot paste as text. Always returns PNG bytes:
 /// clipboard PNG data is passed through, clipboard bitmaps (CF_DIB) are re-encoded.
 /// </summary>
 public static class ClipboardImage
 {
    private static readonly byte[] PngMagic = [0x89, 0x50, 0x4E, 0x47];
    public static bool TryGetPng(out byte[] png)
    {
        png = [];
        try
        {
            if (OperatingSystem.IsWindows())
                return TryGetWindows(out png);
            if (OperatingSystem.IsLinux())
                return TryGetLinux(out png);
            if (OperatingSystem.IsMacOS())
                return TryGetMacOS(out png);
        }
        catch (Exception ex)
        {
            Log.Warning(ex, "Reading an image from the clipboard failed");
        }
        return false;
    }
    private static bool IsPng(byte[] data) =>
        data.Length > PngMagic.Length && data.AsSpan(0, PngMagic.Length).SequenceEqual(PngMagic);
    /// <summary>
    /// Converts clipboard DIB bytes (a BITMAPINFOHEADER/V4/V5 + optional palette/masks + pixel
    /// data, i.e. a .bmp file without its 14-byte file header) to PNG. Returns null when the
    /// data is malformed or not decodable as a bitmap.
    /// </summary>
    public static byte[]? DibToPng(byte[] dib)
    {
        if (dib.Length < 40)
            return null;
        var headerSize = BitConverter.ToInt32(dib, 0);
        if (headerSize < 40 || headerSize > dib.Length)
            return null;
        var bitCount = BitConverter.ToUInt16(dib, 14);
        var compression = BitConverter.ToUInt32(dib, 16);
        var clrUsed = BitConverter.ToUInt32(dib, 32);
        // Pixel data offset: file header + info header + color masks + palette.
        // BI_BITFIELDS masks follow a plain 40-byte header; larger headers embed them.
        var maskBytes = headerSize == 40 && compression == 3 ? 12
                      : headerSize == 40 && compression == 6 ? 16
                      : 0;
        var paletteEntries = clrUsed != 0 ? clrUsed
                           : bitCount <= 8 ? 1u << bitCount
                           : 0u;
        var pixelOffset = (uint)(14 + headerSize + maskBytes) + paletteEntries * 4;
        var bmp = new byte[14 + dib.Length];
        bmp[0] = (byte)'B';
        bmp[1] = (byte)'M';
        BitConverter.TryWriteBytes(bmp.AsSpan(2), (uint)bmp.Length);
        BitConverter.TryWriteBytes(bmp.AsSpan(10), pixelOffset);
        dib.CopyTo(bmp, 14);
        try
        {
            using var image = Image.Load(bmp);
            using var ms = new MemoryStream();
            image.SaveAsPng(ms);
            return ms.ToArray();
        }
        catch (Exception ex) when (ex is ImageFormatException or InvalidOperationException)
        {
            Log.Warning(ex, "Clipboard DIB could not be decoded as a bitmap");
            return null;
        }
    }
    // ── Windows: "PNG" / "image/png" registered formats, then CF_DIB ─────────
    private const uint CfDib = 8;
    [SupportedOSPlatform("windows")]
    private static bool TryGetWindows(out byte[] png)
    {
        png = [];
        // Browsers register a "PNG" (Chromium) or "image/png" (some apps) clipboard format
        // preserving transparency; CF_DIB is synthesized by Windows for everything else
        // (screenshots, image editors), so together these cover all image sources.
        var pngFormat = RegisterClipboardFormatW("PNG");
        var mimeFormat = RegisterClipboardFormatW("image/png");
        var hasAny = (pngFormat != 0 && IsClipboardFormatAvailable(pngFormat))
                  || (mimeFormat != 0 && IsClipboardFormatAvailable(mimeFormat))
                  || IsClipboardFormatAvailable(CfDib);
        if (!hasAny)
            return false;
        var opened = false;
        for (var attempt = 0; attempt < 5 && !opened; attempt++)
            opened = OpenClipboard(IntPtr.Zero);
        if (!opened)
            return false;
        try
        {
            foreach (var format in new[] { pngFormat, mimeFormat })
            {
                if (format == 0 || !IsClipboardFormatAvailable(format))
                    continue;
                var data = ReadHGlobal(GetClipboardData(format));
                if (data is not null && IsPng(data))
                {
                    png = data;
                    return true;
                }
            }
            if (IsClipboardFormatAvailable(CfDib)
                && ReadHGlobal(GetClipboardData(CfDib)) is { } dib
                && DibToPng(dib) is { } converted)
            {
                png = converted;
                return true;
            }
            return false;
        }
        finally
        {
            CloseClipboard();
        }
    }
    [SupportedOSPlatform("windows")]
    private static byte[]? ReadHGlobal(IntPtr handle)
    {
        if (handle == IntPtr.Zero)
            return null;
        var ptr = GlobalLock(handle);
        if (ptr == IntPtr.Zero)
            return null;
        try
        {
            var size = (int)GlobalSize(handle);
            if (size <= 0)
                return null;
            var data = new byte[size];
            Marshal.Copy(ptr, data, 0, size);
            return data;
        }
        finally
        {
            GlobalUnlock(handle);
        }
    }
    [DllImport("user32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool OpenClipboard(IntPtr hWndNewOwner);
    [DllImport("user32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool CloseClipboard();
    [DllImport("user32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool IsClipboardFormatAvailable(uint format);
    [DllImport("user32.dll", SetLastError = true)]
    private static extern IntPtr GetClipboardData(uint uFormat);
    [DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
    private static extern uint RegisterClipboardFormatW(string lpszFormat);
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern IntPtr GlobalLock(IntPtr hMem);
    [DllImport("kernel32.dll", SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool GlobalUnlock(IntPtr hMem);
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern nuint GlobalSize(IntPtr hMem);
    // ── Linux: image/png via wl-paste or xclip ────────────────────────────────
    [SupportedOSPlatform("linux")]
    private static bool TryGetLinux(out byte[] png)
    {
        png = [];
        var data = RunForBytes("wl-paste", ["--type", "image/png"])
                ?? RunForBytes("xclip", ["-selection", "clipboard", "-t", "image/png", "-o"]);
        if (data is null || !IsPng(data))
            return false;
        png = data;
        return true;
    }
    // ── macOS: pngpaste (brew install pngpaste), when present ────────────────
    [SupportedOSPlatform("macos")]
    private static bool TryGetMacOS(out byte[] png)
    {
        png = [];
        var data = RunForBytes("pngpaste", ["-"]);
        if (data is null || !IsPng(data))
            return false;
        png = data;
        return true;
    }
    private static byte[]? RunForBytes(string fileName, IEnumerable<string> args)
    {
        var psi = new ProcessStartInfo(fileName)
        {
            RedirectStandardOutput = true,
            RedirectStandardError = true,
            UseShellExecute = false,
            CreateNoWindow = true,
        };
        foreach (var arg in args)
            psi.ArgumentList.Add(arg);
        try
        {
            using var process = Process.Start(psi);
            if (process is null)
                return null;
            using var ms = new MemoryStream();
            process.StandardOutput.BaseStream.CopyTo(ms);
            process.WaitForExit(2000);
            return process.ExitCode == 0 && ms.Length > 0 ? ms.ToArray() : null;
        }
        catch (Exception ex) when (ex is System.ComponentModel.Win32Exception or FileNotFoundException)
        {
            return null; // tool not installed
        }
    }
 }
@@ -46,6 +46,7 @@ internal sealed class ConnectionManager : IAsyncDisposable
    public event Action<string, string?>? UserBanned;
    public event Action<string>? ForceDisconnected;
    public event Action<string, Guid>? MessageDeleted;
    public event Action<string>? ChannelDeleted;
    public event Action<string>? ChannelNuked;
    public event Action<ChannelDto>? ChannelUpdated;
    public event Action<string>? Error;
@@ -77,7 +78,8 @@ internal sealed class ConnectionManager : IAsyncDisposable
            }
            else if (info.IsRegister)
            {
-                loginResponse = await _apiClient.RegisterAsync(info.Username, info.Password);
+                loginResponse = await _apiClient.RegisterAsync(
                    info.Username, info.Password, info.DisplayName, info.InviteCode);
            }
            else
            {
@@ -112,6 +114,11 @@ internal sealed class ConnectionManager : IAsyncDisposable
            var channels = await _apiClient.GetChannelsAsync();
            // Known E2E channels — senders consult this so a client without the room
            // key never emits plaintext into an encrypted room
            foreach (var channel in channels)
                _roomKeys.MarkChannelEncrypted(channel.Name, channel.IsEncrypted);
            // Join default channel + fetch history
            onStatus("Joining channels...");
            _joinedChannels.Clear();
@@ -238,8 +245,8 @@ internal sealed class ConnectionManager : IAsyncDisposable
    // ── Delegate Operations ───────────────────────────────────────────────
-    public Task SendMessageAsync(string channel, string content) =>
+    public Task SendMessageAsync(string channel, string content, Guid? replyToMessageId = null) =>
-        _connection?.SendMessageAsync(channel, content)
+        _connection?.SendMessageAsync(channel, content, replyToMessageId)
        ?? throw new InvalidOperationException("Not connected");
    public Task<List<MessageDto>> GetHistoryAsync(string channel, int count = HubConstants.DefaultHistoryCount, int offset = 0) =>
@@ -295,8 +302,13 @@ internal sealed class ConnectionManager : IAsyncDisposable
        connection.OnUserBanned += (user, reason) => UserBanned?.Invoke(user, reason);
        connection.OnForceDisconnect += reason => ForceDisconnected?.Invoke(reason);
        connection.OnMessageDeleted += (ch, id) => MessageDeleted?.Invoke(ch, id);
        connection.OnChannelDeleted += ch => ChannelDeleted?.Invoke(ch);
        connection.OnChannelNuked += ch => ChannelNuked?.Invoke(ch);
-        connection.OnChannelUpdated += ch => ChannelUpdated?.Invoke(ch);
+        connection.OnChannelUpdated += ch =>
        {
            _roomKeys.MarkChannelEncrypted(ch.Name, ch.IsEncrypted);
            ChannelUpdated?.Invoke(ch);
        };
        connection.OnError += msg => Error?.Invoke(msg);
        connection.OnConnectionStateChanged += status => ConnectionStatusChanged?.Invoke(status);
        connection.OnReconnected += () => Reconnected?.Invoke();
@@ -26,6 +26,21 @@ public sealed class ChannelPasswordRequiredException : Exception
    }
 }
 /// <summary>
 /// Thrown when sending into an end-to-end encrypted channel whose room key isn't cached:
 /// without the key the message would leave the client as plaintext, which must never happen.
 /// </summary>
 public sealed class RoomLockedException : Exception
 {
    public string ChannelName { get; }
    public RoomLockedException(string channelName)
        : base($"#{channelName} is end-to-end encrypted and locked — enter its passphrase to unlock it before sending.")
    {
        ChannelName = channelName;
    }
 }
 public sealed class EchoHubConnection : IAsyncDisposable
 {
    public const string LockedMessagePlaceholder =
@@ -43,6 +58,7 @@ public sealed class EchoHubConnection : IAsyncDisposable
    public event Action<string, string, string?>? OnUserKicked;
    public event Action<string, string?>? OnUserBanned;
    public event Action<string, Guid>? OnMessageDeleted;
    public event Action<string>? OnChannelDeleted;
    public event Action<string>? OnChannelNuked;
    public event Action<string>? OnForceDisconnect;
    public event Action<string>? OnError;
@@ -129,6 +145,11 @@ public sealed class EchoHubConnection : IAsyncDisposable
            OnMessageDeleted?.Invoke(channelName, messageId);
        });
        _connection.On<string>(nameof(Core.Contracts.IEchoHubClient.ChannelDeleted), channelName =>
        {
            OnChannelDeleted?.Invoke(channelName);
        });
        _connection.On<string>(nameof(Core.Contracts.IEchoHubClient.ChannelNuked), channelName =>
        {
            OnChannelNuked?.Invoke(channelName);
@@ -167,6 +188,8 @@ public sealed class EchoHubConnection : IAsyncDisposable
                throw new ChannelPasswordRequiredException(channelName, result.Error ?? "Channel is password protected.");
            throw new InvalidOperationException(result.Error ?? "Failed to join channel.");
        }
        if (result.WrappedRoomKey is not null)
            _roomKeys.MarkChannelEncrypted(channelName, true);
        return new JoinOutcome(DecryptMessages(result.History), result.EncryptionSalt, result.WrappedRoomKey);
    }
@@ -175,14 +198,16 @@ public sealed class EchoHubConnection : IAsyncDisposable
        await _connection.InvokeAsync("LeaveChannel", channelName);
    }
-    public async Task SendMessageAsync(string channelName, string content)
+    public async Task SendMessageAsync(string channelName, string content, Guid? replyToMessageId = null)
    {
        // Room layer first (end-to-end, server can't read), then transport encryption
        if (_roomKeys.TryGetKey(channelName, out var roomKey))
            content = RoomCrypto.EncryptText(content, roomKey);
        else if (_roomKeys.IsChannelEncrypted(channelName))
            throw new RoomLockedException(channelName); // never fall through to plaintext
        var encrypted = _encryption.Encrypt(content);
-        await _connection.InvokeAsync("SendMessage", channelName, encrypted);
+        await _connection.InvokeAsync("SendMessage", channelName, encrypted, replyToMessageId);
    }
    public async Task<List<MessageDto>> GetHistoryAsync(string channelName, int count = HubConstants.DefaultHistoryCount, int offset = 0)
@@ -225,7 +250,12 @@ public sealed class EchoHubConnection : IAsyncDisposable
                .ToList();
        }
-        return message with { Content = content, Attachments = attachments };
+        // Reply snippets are encrypted exactly like message content
        var replyTo = message.ReplyTo is { } reply
            ? reply with { Content = DecryptField(reply.Content, roomKey) ?? LockedMessagePlaceholder }
            : null;
        return message with { Content = content, Attachments = attachments, ReplyTo = replyTo };
    }
    /// <summary>
@@ -0,0 +1,120 @@
 using System.Security.Cryptography;
 using EchoHub.Core.Security;
 using Serilog;
 namespace EchoHub.Client.Services;
 /// <summary>
 /// Encrypts cached room content keys at rest so the client config never holds them as
 /// plain base64. Windows uses DPAPI (current-user scope, format prefix "dp1:"). On other
 /// platforms the keys are AES-GCM encrypted with a per-user master key file stored next
 /// to the config with 0600 permissions (prefix "k1:") — without an OS keychain that is
 /// file-permission-level protection, not zero-knowledge: anyone who can read both the
 /// config and the key file can recover the room keys. Values with no recognized prefix
 /// are legacy plain-base64 keys from older clients; they load once and are re-encrypted.
 /// The room passphrase itself is never stored in any form.
 /// </summary>
 public sealed class RoomKeyProtector
 {
    public const string DpapiPrefix = "dp1:";
    public const string KeyFilePrefix = "k1:";
    private const string KeyFileName = "roomkeys.key";
    private const int MasterKeySizeBytes = 32;
    private const int RoomKeySizeBytes = 32;
    private readonly string _keyFilePath;
    private readonly bool _useDpapi;
    private readonly Lock _lock = new();
    private byte[]? _masterKey;
    /// <param name="keyDirectory">Directory holding the master key file (the client config dir).</param>
    /// <param name="useDpapi">Overrides the platform default (DPAPI on Windows) — for tests.</param>
    public RoomKeyProtector(string keyDirectory, bool? useDpapi = null)
    {
        _keyFilePath = Path.Combine(keyDirectory, KeyFileName);
        _useDpapi = useDpapi ?? OperatingSystem.IsWindows();
    }
    /// <summary>Encrypts a room key for storage in the config file.</summary>
    public string Protect(byte[] roomKey)
    {
        if (_useDpapi && OperatingSystem.IsWindows())
            return DpapiPrefix + Convert.ToBase64String(
                ProtectedData.Protect(roomKey, null, DataProtectionScope.CurrentUser));
        return KeyFilePrefix + Convert.ToBase64String(RoomCrypto.EncryptBytes(roomKey, GetMasterKey()));
    }
    /// <summary>
    /// Decrypts a stored value back into a room key. <paramref name="wasLegacy"/> is true when
    /// the value was an unencrypted legacy entry that should be re-persisted via
    /// <see cref="Protect"/>. Returns false for unreadable values (wrong user/machine, missing
    /// or regenerated key file, malformed data) — the caller drops the entry and the user can
    /// recover it by re-entering the passphrase.
    /// </summary>
    public bool TryUnprotect(string stored, out byte[] roomKey, out bool wasLegacy)
    {
        roomKey = [];
        wasLegacy = false;
        try
        {
            if (stored.StartsWith(DpapiPrefix, StringComparison.Ordinal))
            {
                if (!OperatingSystem.IsWindows())
                    return false; // config copied from a Windows machine
                roomKey = ProtectedData.Unprotect(
                    Convert.FromBase64String(stored[DpapiPrefix.Length..]), null, DataProtectionScope.CurrentUser);
                return roomKey.Length > 0;
            }
            if (stored.StartsWith(KeyFilePrefix, StringComparison.Ordinal))
            {
                if (!File.Exists(_keyFilePath))
                    return false;
                roomKey = RoomCrypto.DecryptBytes(
                    Convert.FromBase64String(stored[KeyFilePrefix.Length..]), GetMasterKey());
                return roomKey.Length > 0;
            }
            // No recognized prefix — legacy plain-base64 room key from a pre-encryption client
            roomKey = Convert.FromBase64String(stored);
            wasLegacy = true;
            return roomKey.Length == RoomKeySizeBytes;
        }
        catch (Exception ex) when (ex is FormatException or CryptographicException
            or IOException or UnauthorizedAccessException)
        {
            return false;
        }
    }
    private byte[] GetMasterKey()
    {
        lock (_lock)
        {
            if (_masterKey is not null)
                return _masterKey;
            if (File.Exists(_keyFilePath))
            {
                var existing = File.ReadAllBytes(_keyFilePath);
                if (existing.Length == MasterKeySizeBytes)
                    return _masterKey = existing;
                Log.Warning("Room-key master key file has unexpected size — regenerating (previously cached keys become unreadable)");
            }
            var key = RandomNumberGenerator.GetBytes(MasterKeySizeBytes);
            Directory.CreateDirectory(Path.GetDirectoryName(_keyFilePath)!);
            File.WriteAllBytes(_keyFilePath, key);
            if (!OperatingSystem.IsWindows())
                File.SetUnixFileMode(_keyFilePath, UnixFileMode.UserRead | UnixFileMode.UserWrite);
            return _masterKey = key;
        }
    }
 }
@@ -1,4 +1,5 @@
 using EchoHub.Client.Config;
 using EchoHub.Core.Security;
 using Serilog;
 namespace EchoHub.Client.Services;
@@ -6,14 +7,28 @@ namespace EchoHub.Client.Services;
 /// <summary>
 /// Holds room content keys for end-to-end encrypted channels: in-memory for the
 /// active session, persisted per-server in the client config (like saved sessions)
-/// so users don't retype the passphrase every launch. Keys never leave this machine.
+/// so users don't retype the passphrase every launch. Keys never leave this machine
 /// and are encrypted at rest by <see cref="RoomKeyProtector"/>. Also tracks which
 /// channels are known to be end-to-end encrypted, so senders can refuse to emit
 /// plaintext into a room whose key isn't cached yet.
 /// </summary>
 public sealed class RoomKeyStore
 {
    private readonly Dictionary<string, byte[]> _keys = new(StringComparer.OrdinalIgnoreCase);
    private readonly HashSet<string> _encryptedChannels = new(StringComparer.OrdinalIgnoreCase);
    private readonly RoomKeyProtector _protector;
    private readonly Lock _lock = new();
    private string? _serverUrl;
    public RoomKeyStore() : this(new RoomKeyProtector(ConfigManager.ConfigDirectory))
    {
    }
    public RoomKeyStore(RoomKeyProtector protector)
    {
        _protector = protector;
    }
    /// <summary>Binds the store to a server and loads that server's cached keys from config.</summary>
    public void LoadForServer(string serverUrl)
    {
@@ -21,21 +36,34 @@ public sealed class RoomKeyStore
        {
            _serverUrl = serverUrl;
            _keys.Clear();
            _encryptedChannels.Clear();
            var server = FindServer(ConfigManager.Load(), serverUrl);
            if (server is null) return;
-            foreach (var (channel, base64) in server.ChannelKeys)
+            var legacyFound = false;
            foreach (var (channel, stored) in server.ChannelKeys)
            {
-                try
+                if (_protector.TryUnprotect(stored, out var key, out var wasLegacy))
                {
-                    _keys[channel] = Convert.FromBase64String(base64);
+                    _keys[channel] = key;
                    legacyFound |= wasLegacy;
                }
-                catch (FormatException)
+                else
                {
-                    Log.Warning("Ignoring malformed cached room key for #{Channel}", channel);
+                    Log.Warning("Ignoring unreadable cached room key for #{Channel}", channel);
                }
            }
            // One-way upgrade: legacy plain-base64 entries get re-persisted encrypted
            // (unreadable entries drop out — the unlock prompt recovers those rooms).
            if (legacyFound)
                Persist(s =>
                {
                    s.ChannelKeys.Clear();
                    foreach (var (channel, key) in _keys)
                        s.ChannelKeys[channel] = _protector.Protect(key);
                });
        }
    }
@@ -62,10 +90,26 @@ public sealed class RoomKeyStore
        lock (_lock)
        {
            _keys[channelName] = key;
-            Persist(server => server.ChannelKeys[channelName] = Convert.ToBase64String(key));
+            _encryptedChannels.Add(channelName);
            Persist(server => server.ChannelKeys[channelName] = _protector.Protect(key));
        }
    }
    /// <summary>
    /// Unwraps a fresh key envelope and caches the key, overwriting any stale cached key
    /// (e.g. the channel was deleted and recreated under the same name, so the old key
    /// would encrypt messages nobody else can read). Returns false when the KEK doesn't
    /// open the envelope — the cache is left untouched.
    /// </summary>
    public bool TryStoreFromEnvelope(string channelName, string wrappedRoomKey, byte[] kek)
    {
        if (!RoomCrypto.TryUnwrapRoomKey(wrappedRoomKey, kek, out var roomKey))
            return false;
        StoreKey(channelName, roomKey);
        return true;
    }
    public void RemoveKey(string channelName)
    {
        lock (_lock)
@@ -75,11 +119,36 @@ public sealed class RoomKeyStore
        }
    }
    /// <summary>
    /// Records whether a channel is end-to-end encrypted (from channel listings, crypto
    /// metadata, or join outcomes). Senders consult this to block plaintext into rooms
    /// whose key isn't cached.
    /// </summary>
    public void MarkChannelEncrypted(string channelName, bool isEncrypted)
    {
        lock (_lock)
        {
            if (isEncrypted)
                _encryptedChannels.Add(channelName);
            else
                _encryptedChannels.Remove(channelName);
        }
    }
    public bool IsChannelEncrypted(string channelName)
    {
        lock (_lock)
        {
            return _encryptedChannels.Contains(channelName);
        }
    }
    public void Clear()
    {
        lock (_lock)
        {
            _keys.Clear();
            _encryptedChannels.Clear();
            _serverUrl = null;
        }
    }
@@ -7,6 +7,16 @@ using Attribute = Terminal.Gui.Drawing.Attribute;
 namespace EchoHub.Client.UI.Chat;
 /// <summary>An action a click on an attachment line can trigger.</summary>
 public enum AttachmentAction
 {
    OpenImage,
    SaveImage,
 }
 /// <summary>Inclusive column range on a chat line that triggers an attachment action when clicked.</summary>
 public readonly record struct AttachmentActionSpan(int StartCol, int EndCol, AttachmentAction Action);
 /// <summary>
 /// A single line in the chat, composed of colored segments.
 /// </summary>
@@ -20,6 +30,20 @@ public partial class ChatLine
    public string? AttachmentFileName { get; set; }
    public AttachmentKind? AttachmentKind { get; set; }
    public string? SenderUsername { get; set; }
    /// <summary>
    /// Set on a reply's quote line: activating the line jumps to this message
    /// if it is in the loaded history.
    /// </summary>
    public Guid? JumpToMessageId { get; set; }
    /// <summary>
    /// Clickable sub-line targets (e.g. the "[open]" and "[save original]" brackets under an
    /// image). Columns are relative to the unwrapped line, so only the first wrapped line
    /// keeps them. Null means the whole line uses the kind's default action.
    /// </summary>
    public List<AttachmentActionSpan>? ActionSpans { get; set; }
    /// <summary>Number of spaces to prepend on continuation lines when this line is word-wrapped.</summary>
    public int ContinuationIndent { get; set; }
@@ -158,8 +182,13 @@ public partial class ChatLine
            wrapped.MessageId = MessageId;
            wrapped.SenderUsername = SenderUsername;
            wrapped.IsMention = IsMention;
            wrapped.JumpToMessageId = JumpToMessageId;
        }
        // Span columns only line up with the first wrapped line; later lines fall
        // back to the kind's default action.
        results[0].ActionSpans = ActionSpans;
        return results;
    }
@@ -1,6 +1,7 @@
 using System.Text;
 using System.Text.RegularExpressions;
 using EchoHub.Client.UI.Helpers;
 using EchoHub.Core.Constants;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using Terminal.Gui.Drawing;
@@ -312,7 +313,9 @@ public sealed class ChatMessageManager
        if (!string.IsNullOrEmpty(_currentUser))
        {
            var pattern = $@"@{Regex.Escape(_currentUser)}\b";
-            if (messages.Skip(firstUnread).Any(m => Regex.IsMatch(m.Content, pattern, RegexOptions.IgnoreCase)))
+            if (messages.Skip(firstUnread).Any(m =>
                    Regex.IsMatch(m.Content, pattern, RegexOptions.IgnoreCase)
                    || (m.ReplyTo is { } reply && reply.SenderUsername.Equals(_currentUser, StringComparison.OrdinalIgnoreCase))))
                _mentionChannels.Add(channelName);
        }
    }
@@ -381,6 +384,9 @@ public sealed class ChatMessageManager
    private List<ChatLine> FormatMessage(MessageDto message)
    {
        var time = FormatTime(message.SentAt);
        // Show the display name, but keep color + click identity keyed to the username
        // so they stay consistent with the user list and profile lookups.
        var senderName = message.SenderDisplayName ?? message.SenderUsername;
        var senderColor = HexColorHelper.ParseHexColor(message.SenderNicknameColor)
            ?? NickColorHelper.GetAttribute(message.SenderUsername);
@@ -388,13 +394,41 @@ public sealed class ChatMessageManager
        var hasContent = !string.IsNullOrWhiteSpace(message.Content);
        var attachments = message.Attachments ?? [];
        // Reply → dim quote line above the message; activating it jumps to the original
        if (message.ReplyTo is { } replyTo)
            lines.Add(ReplyQuoteLine(replyTo));
        // /me action → "* nick waves" (CTCP ACTION content)
        string? actionText = null;
        var isAction = hasContent && MessageConventions.TryParseAction(message.Content, out actionText);
        if (isAction)
        {
            var actionLines = EmojiHelper.ReplaceEmoji(actionText!).Split('\n');
            var header = ActionHeaderSegments(time);
            header.Add(new(senderName, senderColor));
            header.Add(new(" ", null));
            header.AddRange(ChatColors.SplitMentions(actionLines[0].TrimEnd('\r')));
            lines.Add(new ChatLine(header));
            for (int i = 1; i < actionLines.Length; i++)
            {
                var segments = RailPrefix();
                segments.AddRange(ChatColors.SplitMentions(actionLines[i].TrimEnd('\r')));
                lines.Add(new ChatLine(segments));
            }
        }
        // Header line: caption text, or a summary when the message is attachments-only
-        if (hasContent)
+        if (isAction)
        {
            // already rendered above
        }
        else if (hasContent)
        {
            var displayContent = EmojiHelper.ReplaceEmoji(message.Content);
            var contentLines = displayContent.Split('\n');
-            var header = HeaderSegments(time, message.SenderUsername, senderColor);
+            var header = HeaderSegments(time, senderName, senderColor);
            header.AddRange(ChatColors.SplitMentions(contentLines[0].TrimEnd('\r')));
            lines.Add(new ChatLine(header));
@@ -413,7 +447,7 @@ public sealed class ChatMessageManager
                1 => $"[{attachments[0].Kind.ToString().ToLowerInvariant()}]",
                _ => $"[{attachments.Count} attachments]",
            };
-            var header = HeaderSegments(time, message.SenderUsername, senderColor);
+            var header = HeaderSegments(time, senderName, senderColor);
            header.Add(new(summary, null));
            lines.Add(new ChatLine(header));
        }
@@ -440,9 +474,7 @@ public sealed class ChatMessageManager
                            lines.Add(new ChatLine(segments));
                        }
                    }
-                    lines.Add(AttachmentActionLine(
+                    lines.Add(ImageActionLine(attachment));
                        $"[↓ save original] {attachment.FileName} [{FormatFileSize(attachment.FileSize)}]",
                        ChatColors.FileAttr, attachment));
                    break;
                case Core.Models.AttachmentKind.Audio:
@@ -473,10 +505,14 @@ public sealed class ChatMessageManager
            line.SenderUsername = message.SenderUsername;
        }
-        if (hasContent && !string.IsNullOrEmpty(_currentUser))
+        if (!string.IsNullOrEmpty(_currentUser))
        {
            // Being replied to counts as a mention, same as an explicit @nick
            var isReplyToMe = message.ReplyTo is { } reply
                && reply.SenderUsername.Equals(_currentUser, StringComparison.OrdinalIgnoreCase);
            var pattern = $@"@{Regex.Escape(_currentUser)}\b";
-            if (Regex.IsMatch(message.Content, pattern, RegexOptions.IgnoreCase))
+            if (isReplyToMe
                || ((hasContent || isAction) && Regex.IsMatch(message.Content, pattern, RegexOptions.IgnoreCase)))
            {
                foreach (var line in lines)
                    line.IsMention = true;
@@ -486,6 +522,41 @@ public sealed class ChatMessageManager
        return lines;
    }
    /// <summary>
    /// Builds the action line below an image preview: "[open] [↓ save original] name [size]".
    /// Each bracket is an <see cref="AttachmentActionSpan"/> so a mouse click can target it;
    /// keyboard activation (Enter) uses the default action, open.
    /// </summary>
    private static ChatLine ImageActionLine(AttachmentDto attachment)
    {
        var segments = RailPrefix();
        var col = segments.Sum(s => s.Text.GetColumns());
        var spans = new List<AttachmentActionSpan>();
        void AddAction(string text, AttachmentAction action)
        {
            var width = text.GetColumns();
            spans.Add(new AttachmentActionSpan(col, col + width - 1, action));
            segments.Add(new(text, ChatColors.FileAttr));
            col += width;
        }
        AddAction("[open]", AttachmentAction.OpenImage);
        segments.Add(new(" ", null));
        col += 1;
        AddAction("[↓ save original]", AttachmentAction.SaveImage);
        segments.Add(new($" {attachment.FileName} [{FormatFileSize(attachment.FileSize)}]", ChatColors.FileAttr));
        return new ChatLine(segments)
        {
            AttachmentUrl = attachment.Url,
            AttachmentFileName = attachment.FileName,
            AttachmentKind = attachment.Kind,
            ActionSpans = spans,
            ContinuationPrefixSegments = RailPrefix(),
        };
    }
    /// <summary>
    /// Builds a clickable attachment line carrying the metadata the message list uses to
    /// route activation (play audio, download file, save original image).
@@ -522,6 +593,54 @@ public sealed class ChatMessageManager
        new(" │ ", ChatColors.RailAttr),
    ];
    /// <summary>Header variant for /me actions: "*" in the nick column, "* nick text" content.</summary>
    private static List<ChatSegment> ActionHeaderSegments(string time) =>
    [
        new($"{time} ", ChatColors.TimestampAttr),
        new(PadNick("*"), ChatColors.TimestampAttr),
        new(" │ ", ChatColors.RailAttr),
    ];
    /// <summary>
    /// The dim "┌ nick: snippet" line above a reply. Carries the original message id so
    /// activating it jumps there. Room-encrypted snippets arrive already decrypted (or as
    /// the locked placeholder) — this only truncates for display.
    /// </summary>
    private static ChatLine ReplyQuoteLine(ReplyRefDto replyTo)
    {
        const int maxSnippetCols = 60;
        var snippet = replyTo.Content.Replace('\n', ' ').Replace('\r', ' ');
        if (MessageConventions.TryParseAction(snippet, out var actionText))
            snippet = $"* {replyTo.SenderUsername} {actionText}";
        snippet = EmojiHelper.ReplaceEmoji(snippet);
        if (snippet.GetColumns() > maxSnippetCols)
        {
            var sb = new StringBuilder();
            int used = 0;
            foreach (var g in GraphemeHelper.GetGraphemes(snippet))
            {
                var gCols = Math.Max(g.GetColumns(), 1);
                if (used + gCols > maxSnippetCols - 1) break;
                sb.Append(g);
                used += gCols;
            }
            snippet = sb.Append('…').ToString();
        }
        var segments = RailPrefix();
        segments.Add(new("┌ ", ChatColors.RailAttr));
        segments.Add(new($"{replyTo.SenderUsername}: ", NickColorHelper.GetAttribute(replyTo.SenderUsername)));
        segments.Add(new(snippet, ChatColors.SystemAttr));
        return new ChatLine(segments)
        {
            JumpToMessageId = replyTo.MessageId,
            ContinuationPrefixSegments = RailPrefix(),
        };
    }
    /// <summary>
    /// Indent segments aligning continuation/attachment/embed lines under the message
    /// text, extending the │ rail. Returns a fresh mutable list each call.
@@ -11,7 +11,8 @@ namespace EchoHub.Client.UI.Dialogs;
 /// </summary>
 public record ConnectDialogResult(
    string ServerUrl, string Username, string Password,
-    bool IsRegister, bool RememberMe, string? SavedRefreshToken);
+    bool IsRegister, bool RememberMe, string? SavedRefreshToken,
    string? DisplayName = null, string? InviteCode = null);
 /// <summary>
 /// A Terminal.Gui dialog for entering server connection and authentication details.
@@ -29,7 +30,7 @@ public sealed class ConnectDialog
        savedServers ??= [];
        var hasSavedServers = savedServers.Count > 0;
-        var dialogHeight = hasSavedServers ? 22 : 18;
+        var dialogHeight = hasSavedServers ? 24 : 20;
        var dialog = new Dialog { Title = "Connect to Server", Width = 60, Height = dialogHeight };
@@ -153,26 +154,41 @@ public sealed class ConnectDialog
            Width = Dim.Fill(2)
        };
        // Only needed on servers with invite-gated registration; harmless elsewhere
        var inviteLabel = new Label
        {
            Text = "Invite Code:",
            X = 1,
            Y = yOffset + 11
        };
        var inviteField = new TextField
        {
            Text = "",
            X = 15,
            Y = yOffset + 11,
            Width = Dim.Fill(2)
        };
        var loginButton = new Button
        {
            Text = "Login",
            IsDefault = true,
            X = Pos.Center() - 20,
-            Y = yOffset + 11
+            Y = yOffset + 13
        };
        var registerButton = new Button
        {
            Text = "Register",
            X = Pos.Center() - 5,
-            Y = yOffset + 11
+            Y = yOffset + 13
        };
        var cancelButton = new Button
        {
            Text = "Cancel",
            X = Pos.Center() + 10,
-            Y = yOffset + 11
+            Y = yOffset + 13
        };
        // Wire saved server selection to auto-fill fields
@@ -262,7 +278,11 @@ public sealed class ConnectDialog
                return;
            }
-            result = new ConnectDialogResult(url, user, pass, IsRegister: true, rememberMe, SavedRefreshToken: null);
+            var displayName = displayField.Text?.Trim();
            var inviteCode = inviteField.Text?.Trim();
            result = new ConnectDialogResult(url, user, pass, IsRegister: true, rememberMe, SavedRefreshToken: null,
                DisplayName: string.IsNullOrEmpty(displayName) ? null : displayName,
                InviteCode: string.IsNullOrEmpty(inviteCode) ? null : inviteCode);
            e.Handled = true;
            app.RequestStop();
        };
@@ -276,6 +296,7 @@ public sealed class ConnectDialog
        dialog.Add(urlLabel, urlField, userLabel, userField, passLabel, passField,
            tokenHintLabel, rememberMeCheckbox, displayLabel, displayField,
            inviteLabel, inviteField,
            loginButton, registerButton, cancelButton);
        if (hasSavedServers && savedServerList is not null)
@@ -18,6 +18,7 @@ public class ChannelListSource : IListDataSource
    private readonly Dictionary<string, int> _unreadCounts = [];
    private readonly HashSet<string> _protectedChannels = [];
    private readonly HashSet<string> _mentionChannels = [];
    private readonly HashSet<string> _privateChannels = [];
    private string _activeChannel = string.Empty;
    public event NotifyCollectionChangedEventHandler? CollectionChanged;
@@ -32,7 +33,8 @@ public class ChannelListSource : IListDataSource
    private static readonly Attribute MentionAttr = new(new Color(230, 140, 60), Color.None);
    public void Update(List<string> channels, Dictionary<string, int> unread, string activeChannel,
-        IReadOnlySet<string>? protectedChannels = null, IReadOnlySet<string>? mentionChannels = null)
+        IReadOnlySet<string>? protectedChannels = null, IReadOnlySet<string>? mentionChannels = null,
        IReadOnlySet<string>? privateChannels = null)
    {
        _channelNames.Clear();
        _channelNames.AddRange(channels);
@@ -45,6 +47,9 @@ public class ChannelListSource : IListDataSource
        _mentionChannels.Clear();
        if (mentionChannels is not null)
            _mentionChannels.UnionWith(mentionChannels);
        _privateChannels.Clear();
        if (privateChannels is not null)
            _privateChannels.UnionWith(privateChannels);
        _activeChannel = activeChannel;
        MaxItemLength = channels.Count > 0 ? channels.Max(c => c.Length + 6) : 0;
        if (!SuspendCollectionChangedEvent)
@@ -67,8 +72,12 @@ public class ChannelListSource : IListDataSource
        var normalAttr = listView.GetAttributeForRole(VisualRole.Normal);
        var focusAttr = listView.GetAttributeForRole(VisualRole.Focus);
        var prefix = isActive ? "> " : "  ";
-        // Trailing * marks password-protected (+k) channels
+        // Trailing * marks password-protected (+k) channels; ~ marks private (unlisted) ones
-        var channelText = _protectedChannels.Contains(name) ? $"#{name}*" : $"#{name}";
+        var channelText = $"#{name}";
        if (_protectedChannels.Contains(name))
            channelText += "*";
        if (_privateChannels.Contains(name))
            channelText += "~";
        var badge = hasUnread ? $" ({unread})" : "";
        // Resolve Transparent backgrounds to the view's actual background
@@ -11,6 +11,7 @@ using Serilog;
 using Terminal.Gui.App;
 using Terminal.Gui.Configuration;
 using Terminal.Gui.Drawing;
 using Terminal.Gui.Drivers;
 using Terminal.Gui.Input;
 using Terminal.Gui.Text;
 using Terminal.Gui.ViewBase;
@@ -41,31 +42,33 @@ public sealed partial class MainWindow : Runnable
    private bool _usersPanelVisible = true;
    private const int UsersPanelWidth = 22;
    private const string DefaultInputTitle = "Message │ Enter=send │ Tab=complete │ Ctrl+K=search │ F6=pick message";
-    private static readonly Key F2Key = Key.F2;
+    private const KeyCode F2Key = KeyCode.F2;
    private bool _hasStagedAttachments;
    internal static readonly string AppVersion =
        typeof(MainWindow).Assembly.GetName().Version?.ToString(3) ?? "?";
-    // Cached Key constants — compare via .KeyCode to avoid Key.Equals (which also checks Handled)
+    // Key bindings as KeyCode constants: comparing raw KeyCodes avoids Key.Equals (which also
-    private static readonly Key EnterKey = Key.Enter;
+    // checks Handled), and constants make them usable as switch case labels.
-    private static readonly Key NewlineKey = Key.N.WithCtrl;
+    private const KeyCode EnterKey = KeyCode.Enter;
-    private static readonly Key AltQKey = Key.Q.WithAlt;
+    private const KeyCode NewlineKey = KeyCode.N | KeyCode.CtrlMask;
-    private static readonly Key TabKey = Key.Tab;
+    private const KeyCode AltQKey = KeyCode.Q | KeyCode.AltMask;
-    private static readonly Key CtrlKKey = Key.K.WithCtrl;
+    private const KeyCode TabKey = KeyCode.Tab;
-    private static readonly Key CtrlVKey = Key.V.WithCtrl;
+    private const KeyCode CtrlKKey = KeyCode.K | KeyCode.CtrlMask;
-    private static readonly Key CtrlXKey = Key.X.WithCtrl;
+    private const KeyCode CtrlVKey = KeyCode.V | KeyCode.CtrlMask;
-    private static readonly Key CtrlCKey = Key.C.WithCtrl;
+    private const KeyCode CtrlXKey = KeyCode.X | KeyCode.CtrlMask;
-    private static readonly Key CtrlYKey = Key.Y.WithCtrl;
+    private const KeyCode CtrlCKey = KeyCode.C | KeyCode.CtrlMask;
-    private static readonly Key F6Key = Key.F6;
+    private const KeyCode CtrlYKey = KeyCode.Y | KeyCode.CtrlMask;
    private const KeyCode F6Key = KeyCode.F6;
    // Available slash commands for Tab autocomplete
    private static readonly string[] SlashCommands =
    [
-        "/status", "/nick", "/color", "/theme", "/send",
+        "/status", "/nick", "/color", "/theme", "/send", "/me", "/banner",
        "/avatar", "/profile", "/servers", "/join", "/passwd", "/leave", "/clear", "/size", "/downloadpath",
        "/topic", "/users", "/kick", "/ban", "/unban",
-        "/mute", "/unmute", "/role", "/nuke", "/test-sound", "/quit", "/help"
+        "/mute", "/unmute", "/role", "/invite", "/export", "/deleteaccount",
        "/nuke", "/test-sound", "/quit", "/help"
    ];
    private readonly List<string> _channelNames = [];
@@ -87,6 +90,18 @@ public sealed partial class MainWindow : Runnable
    /// </summary>
    public event Action<string, string>? OnMessageSubmitted;
    /// <summary>
    /// Fired when local files arrive via paste or drag-and-drop to be staged as attachments.
    /// Parameters: channel name, absolute paths of existing files.
    /// </summary>
    public event Action<string, IReadOnlyList<string>>? OnFilesStaged;
    /// <summary>
    /// Fired when raw image data is pasted from the clipboard (e.g. copied from a browser or a
    /// screenshot tool). Parameters: channel name, PNG-encoded image bytes.
    /// </summary>
    public event Action<string, byte[]>? OnImagePasted;
    /// <summary>
    /// Fired when the user requests to connect via the menu.
    /// </summary>
@@ -162,11 +177,28 @@ public sealed partial class MainWindow : Runnable
    /// </summary>
    public event Action<string, string>? OnImageSaveRequested;
    /// <summary>
    /// Fired when the user activates an image's "[open]" action to view it without saving.
    /// Parameters: attachmentUrl, fileName.
    /// </summary>
    public event Action<string, string>? OnImageOpenRequested;
    /// <summary>
    /// Fired when the user presses Delete on the selected message. Parameter is the message id.
    /// </summary>
    public event Action<Guid>? OnDeleteMessageRequested;
    /// <summary>
    /// Fired when the user picks "Reply" on a message. Parameters: message id, sender username,
    /// a short plain-text snippet for the reply strip.
    /// </summary>
    public event Action<Guid, string, string>? OnReplyRequested;
    /// <summary>
    /// Fired when the user cancels a pending reply (Esc in the input field).
    /// </summary>
    public event Action? OnReplyCancelRequested;
    /// <summary>
    /// Fired when the user activates a username (in userlist or message). Parameter is the username.
    /// </summary>
@@ -337,6 +369,9 @@ public sealed partial class MainWindow : Runnable
        KeyDown += OnWindowKeyDown;
    }
    private string? _stagedTitleFragment;
    private string? _replyTitleFragment;
    /// <summary>
    /// Updates the attachment staging indicator shown on the input frame's title, including the
    /// current ASCII-art size for images. Passing an empty list restores the default hint.
@@ -346,15 +381,38 @@ public sealed partial class MainWindow : Runnable
        _hasStagedAttachments = fileNames.Count > 0;
        if (fileNames.Count == 0)
        {
-            _inputFrame.Title = DefaultInputTitle;
+            _stagedTitleFragment = null;
        }
        else
        {
            var names = string.Join(", ", fileNames);
            if (names.Length > 45)
                names = names[..42] + "...";
-            _inputFrame.Title = $"📎 {fileNames.Count}: {names} │ art: {asciiSizeLabel} (/size) │ Enter=send │ /clear";
+            _stagedTitleFragment = $"📎 {fileNames.Count}: {names} │ art: {asciiSizeLabel} (/size) │ Enter=send │ /clear";
        }
        UpdateInputTitle();
    }
    /// <summary>
    /// Shows/clears the "replying to" strip on the input frame's title. Pass null to clear.
    /// </summary>
    public void SetReplyingTo(string? label)
    {
        _replyTitleFragment = label is null ? null : $"↩ Replying to {label} │ Esc=cancel";
        UpdateInputTitle();
    }
    public bool HasPendingReplyIndicator => _replyTitleFragment is not null;
    private void UpdateInputTitle()
    {
        _inputFrame.Title = (_replyTitleFragment, _stagedTitleFragment) switch
        {
            (null, null) => DefaultInputTitle,
            ({ } reply, null) => reply,
            (null, { } staged) => staged,
            ({ } reply, { } staged) => $"{reply} │ {staged}",
        };
        _inputFrame.SetNeedsDraw();
    }
@@ -499,6 +557,14 @@ public sealed partial class MainWindow : Runnable
        var line = source.GetLine(index.Value);
        if (line is null) return;
        // A reply's quote line jumps to the original message (if it's in the buffer)
        if (line.JumpToMessageId is { } jumpTarget)
        {
            ScrollToMessage(jumpTarget);
            e.Handled = true;
            return;
        }
        // Audio/file attachments take priority
        if (line.AttachmentUrl is not null && line.AttachmentFileName is not null)
        {
@@ -518,7 +584,9 @@ public sealed partial class MainWindow : Runnable
            if (line.AttachmentKind == AttachmentKind.Image)
            {
-                OnImageSaveRequested?.Invoke(line.AttachmentUrl, line.AttachmentFileName);
+                // Keyboard/default activation opens the image for viewing;
                // saving is the mouse span or the context menu.
                OnImageOpenRequested?.Invoke(line.AttachmentUrl, line.AttachmentFileName);
                e.Handled = true;
                return;
            }
@@ -557,7 +625,7 @@ public sealed partial class MainWindow : Runnable
    private void OnMessageListKeyDown(object? sender, Key e)
    {
        // F6 returns focus to the input box.
-        if (e.KeyCode == F6Key.KeyCode)
+        if (e.KeyCode == F6Key)
        {
            _inputField.SetFocus();
            e.Handled = true;
@@ -586,7 +654,8 @@ public sealed partial class MainWindow : Runnable
    private void OnMessageListMouseEvent(object? sender, Mouse e)
    {
-        if (!e.Flags.HasFlag(MouseFlags.RightButtonClicked))
+        var leftClick = e.Flags.HasFlag(MouseFlags.LeftButtonClicked);
        if (!leftClick && !e.Flags.HasFlag(MouseFlags.RightButtonClicked))
            return;
        if (_messageList.Source is not ChatListSource source || source.Count == 0 || e.Position is not { } pos)
@@ -596,6 +665,30 @@ public sealed partial class MainWindow : Runnable
        if (index < 0 || index >= source.Count)
            return;
        // Left-click only activates the "[open]" / "[save original]" brackets on an
        // attachment action line; anywhere else it falls through to normal selection.
        if (leftClick)
        {
            var clicked = source.GetLine(index);
            if (clicked?.ActionSpans is { } spans
                && clicked.AttachmentUrl is { } url && clicked.AttachmentFileName is { } name)
            {
                foreach (var span in spans)
                {
                    if (pos.X < span.StartCol || pos.X > span.EndCol)
                        continue;
                    if (span.Action == AttachmentAction.OpenImage)
                        OnImageOpenRequested?.Invoke(url, name);
                    else
                        OnImageSaveRequested?.Invoke(url, name);
                    e.Handled = true;
                    return;
                }
            }
            return;
        }
        // Select the right-clicked row (so the menu acts on it and it highlights), then show the menu.
        _messageList.SelectedItem = index;
        _messageList.SetFocus();
@@ -622,6 +715,7 @@ public sealed partial class MainWindow : Runnable
            switch (kind)
            {
                case AttachmentKind.Image:
                    items.Add(new MenuItem("Open image", "", () => OnImageOpenRequested?.Invoke(url, name), Key.Empty));
                    items.Add(new MenuItem("Save original image", "", () => OnImageSaveRequested?.Invoke(url, name), Key.Empty));
                    break;
                case AttachmentKind.Audio:
@@ -633,6 +727,20 @@ public sealed partial class MainWindow : Runnable
            }
        }
        if (sender is not null && line.MessageId is { } replyTargetId)
        {
            items.Add(new MenuItem("Reply", "", () =>
            {
                // Strip the "HH:mm nick │ " header so the strip shows just the text
                var snippet = line.ToString();
                var railIdx = snippet.IndexOf(" │ ", StringComparison.Ordinal);
                if (railIdx >= 0)
                    snippet = snippet[(railIdx + 3)..];
                OnReplyRequested?.Invoke(replyTargetId, sender, snippet.Trim());
                _inputField.SetFocus();
            }, Key.Empty));
        }
        if (sender is not null)
        {
            items.Add(new MenuItem($"Mention @{sender}", "", () => MentionUser(sender), Key.Empty));
@@ -674,6 +782,30 @@ public sealed partial class MainWindow : Runnable
        }
    }
    /// <summary>
    /// Scrolls the message list to a message's first line (used by reply quote lines).
    /// No-op when the message isn't in the loaded buffer.
    /// </summary>
    private void ScrollToMessage(Guid messageId)
    {
        if (_messageList.Source is not ChatListSource source)
            return;
        for (int i = 0; i < source.Count; i++)
        {
            var line = source.GetLine(i);
            // Match the message's own lines, not other replies' quote lines pointing at it
            if (line?.MessageId == messageId && line.JumpToMessageId is null)
            {
                _messageList.SelectedItem = i;
                _messageList.TopItem = Math.Max(0, i - 3);
                _messageList.SetFocus();
                _messageList.SetNeedsDraw();
                return;
            }
        }
    }
    private void ConfirmDeleteMessage(Guid messageId)
    {
        var confirm = MessageBox.Query(_app, "Delete Message", "Delete this message?", "Delete", "Cancel");
@@ -703,66 +835,73 @@ public sealed partial class MainWindow : Runnable
    private void OnInputKeyDown(object? sender, Key e)
    {
-        if (e.KeyCode == TabKey.KeyCode)
+        switch (e.KeyCode)
        {
-            TryAutocompleteCommand();
+            case TabKey:
-            e.Handled = true;
+                TryAutocompleteCommand();
-        }
+                break;
-        else if (e.KeyCode == NewlineKey.KeyCode)
+
-        {
+            case KeyCode.Esc when HasPendingReplyIndicator:
-            _inputField.InsertText("\n");
+                OnReplyCancelRequested?.Invoke();
-            e.Handled = true;
+                break;
-        }
+
-        else if (e.KeyCode == EnterKey.KeyCode)
+            case NewlineKey:
-        {
+                _inputField.InsertText("\n");
-            var text = _inputField.Text?.Trim() ?? string.Empty;
+                break;
-            // Send when there's text, or when only attachments are staged (empty caption).
+
-            if ((!string.IsNullOrEmpty(text) || _hasStagedAttachments)
+            case EnterKey:
-                && !string.IsNullOrEmpty(_messageManager.CurrentChannel))
+                var text = _inputField.Text?.Trim() ?? string.Empty;
-            {
+                // Send when there's text, or when only attachments are staged (empty caption).
-                OnMessageSubmitted?.Invoke(_messageManager.CurrentChannel, text);
+                if ((!string.IsNullOrEmpty(text) || _hasStagedAttachments)
-                _inputField.Text = string.Empty;
+                    && !string.IsNullOrEmpty(_messageManager.CurrentChannel))
-            }
+                {
-            e.Handled = true;
+                    OnMessageSubmitted?.Invoke(_messageManager.CurrentChannel, text);
-        }
+                    _inputField.Text = string.Empty;
-        else if (e.KeyCode == AltQKey.KeyCode)
+                }
-        {
+                break;
-            _app.RequestStop();
+
-            e.Handled = true;
+            case AltQKey:
-        }
+                _app.RequestStop();
-        else if (e.KeyCode == CtrlKKey.KeyCode)
+                break;
-        {
+
-            ShowSearchDialog();
+            case CtrlKKey:
-            e.Handled = true;
+                ShowSearchDialog();
-        }
+                break;
-        else if (e.KeyCode == F6Key.KeyCode)
+
-        {
+            case F6Key:
-            // Move focus into the message list so you can select a message (arrows) and
+                // Move focus into the message list so you can select a message (arrows) and
-            // delete it (Delete). F6 again returns focus here. (Esc is the app quit key.)
+                // delete it (Delete). F6 again returns focus here. (Esc is the app quit key.)
-            FocusMessageList();
+                FocusMessageList();
-            e.Handled = true;
+                break;
-        }
+
-        else if (e.KeyCode == CtrlVKey.KeyCode || e.KeyCode == CtrlYKey.KeyCode)
+            case CtrlVKey:
-        {
+            case CtrlYKey:
-            // If a file was copied in the OS file manager, the clipboard holds a file list
+                // Discord-style paste priority. Copied files in the OS file manager put a file
-            // (not text) — attach it. Otherwise paste text. This is the reliable path on
+                // list (not text) on the clipboard — attach them all. Copied image data (browser
-            // Windows Terminal, which never pastes copied files as text.
+                // right-click copy, screenshot tools) is attached as a PNG. Otherwise paste text.
-            if (ClipboardFiles.TryGetFiles(out var pastedFiles))
+                // Terminals never deliver either of the first two as text, so this is the only path.
-                StageFiles(pastedFiles);
+                if (ClipboardFiles.TryGetFiles(out var pastedFiles))
-            else
+                    StageFiles(pastedFiles);
-                GuardedClipboardAction(() => _inputField.Paste(), "paste");
+                else if (!string.IsNullOrEmpty(_messageManager.CurrentChannel)
-            e.Handled = true;
+                         && ClipboardImage.TryGetPng(out var pastedPng))
-        }
+                    OnImagePasted?.Invoke(_messageManager.CurrentChannel, pastedPng);
-        else if (e.KeyCode == CtrlXKey.KeyCode)
+                else
-        {
+                    GuardedClipboardAction(() => _inputField.Paste(), "paste");
-            GuardedClipboardAction(() => _inputField.Cut(), "cut");
+                break;
-            e.Handled = true;
+
-        }
+            case CtrlXKey:
-        else if (e.KeyCode == CtrlCKey.KeyCode)
+                GuardedClipboardAction(() => _inputField.Cut(), "cut");
-        {
+                break;
-            GuardedClipboardAction(() => _inputField.Copy(), "copy");
+
-            e.Handled = true;
+            case CtrlCKey:
                GuardedClipboardAction(() => _inputField.Copy(), "copy");
                break;
            default:
                return; // not one of ours — leave e.Handled false so the key types normally
        }
        e.Handled = true;
    }
    /// <summary>
@@ -872,17 +1011,16 @@ public sealed partial class MainWindow : Runnable
    }
    /// <summary>
-    /// Routes files (from a drop or a file-clipboard paste) through the /send pipeline, which
+    /// Stages files (from a drop or a file-clipboard paste) as attachments in one batch; the
-    /// stages them; the next Enter sends them with any typed caption.
+    /// next Enter sends them with any typed caption.
    /// </summary>
-    private void StageFiles(IEnumerable<string> files)
+    private void StageFiles(IReadOnlyList<string> files)
    {
        var channel = _messageManager.CurrentChannel;
        if (string.IsNullOrEmpty(channel))
            return;
-        foreach (var file in files)
+        OnFilesStaged?.Invoke(channel, files);
            OnMessageSubmitted?.Invoke(channel, $"/send \"{file}\"");
    }
    private void OnChatViewportChanged()
@@ -898,21 +1036,25 @@ public sealed partial class MainWindow : Runnable
    private void OnWindowKeyDown(object? sender, Key e)
    {
-        if (e.KeyCode == AltQKey.KeyCode)
+        switch (e.KeyCode)
        {
-            _app.RequestStop();
+            case AltQKey:
-            e.Handled = true;
+                _app.RequestStop();
-        }
+                break;
-        else if (e.KeyCode == F2Key.KeyCode)
+
-        {
+            case F2Key:
-            ToggleUsersPanel();
+                ToggleUsersPanel();
-            e.Handled = true;
+                break;
-        }
+
-        else if (e.KeyCode == CtrlKKey.KeyCode)
+            case CtrlKKey:
-        {
+                ShowSearchDialog();
-            ShowSearchDialog();
+                break;
-            e.Handled = true;
+
            default:
                return;
        }
        e.Handled = true;
    }
    private void ShowSearchDialog()
@@ -1317,8 +1459,11 @@ public sealed partial class MainWindow : Runnable
    /// </summary>
    private void RefreshChannelList()
    {
        var privateChannels = _channelNames
            .Where(n => _channelPublic.TryGetValue(n, out var isPublic) && !isPublic)
            .ToHashSet();
        _channelListSource.Update(_channelNames, _messageManager.GetUnreadCounts(), _messageManager.CurrentChannel,
-            _channelProtected, _messageManager.MentionChannels);
+            _channelProtected, _messageManager.MentionChannels, privateChannels);
        _channelList.Source = _channelListSource;
        // Restore selection to current channel
@@ -1394,6 +1539,10 @@ public sealed partial class MainWindow : Runnable
            var text = roleTag.Length > 0
                ? $"{statusIcon} {roleTag} {name}"
                : $"{statusIcon} {name}";
            // Users connected only via the IRC gateway get a tag — they lack client features
            // (encryption, attachments, profiles), which is useful context in conversation.
            if (u.IsIrc)
                text += " [irc]";
            // Fall back to the deterministic per-nick palette so user-list colors
            // match the same user's messages in chat.
            var nameColor = HexColorHelper.ParseHexColor(u.NicknameColor)
@@ -4,6 +4,12 @@ public static class HubConstants
 {
    public const string ChatHubPath = "/hubs/chat";
    public const string DefaultChannel = "general";
    /// <summary>
    /// Connection-id prefix for IRC gateway connections. The presence tracker uses it to
    /// tell IRC-only users apart from native (SignalR) clients.
    /// </summary>
    public const string IrcConnectionIdPrefix = "irc-";
    public const int DefaultHistoryCount = 100;
    public const int MaxMessageLength = 2000;
    public const int MaxImageSizeBytes = 10 * 1024 * 1024; // 10 MB
@@ -0,0 +1,31 @@
 using System.Diagnostics.CodeAnalysis;
 namespace EchoHub.Core.Constants;
 /// <summary>
 /// Cross-protocol message conventions. Action messages (<c>/me</c>) use the IRC CTCP ACTION
 /// wire format 0x01 + "ACTION " + text + 0x01 as the stored content, so IRC clients
 /// interoperate natively (irssi's /me arrives in exactly this shape) and the TUI renders
 /// "* nick text". In end-to-end encrypted rooms the marker encrypts along with the text.
 /// </summary>
 public static class MessageConventions
 {
    public const string ActionPrefix = "\u0001ACTION ";
    public const string ActionSuffix = "\u0001";
    public static string FormatAction(string text) => $"{ActionPrefix}{text}{ActionSuffix}";
    public static bool TryParseAction(string content, [NotNullWhen(true)] out string? actionText)
    {
        if (content.Length > ActionPrefix.Length + ActionSuffix.Length
            && content.StartsWith(ActionPrefix, StringComparison.Ordinal)
            && content.EndsWith(ActionSuffix, StringComparison.Ordinal))
        {
            actionText = content[ActionPrefix.Length..^ActionSuffix.Length];
            return actionText.Length > 0;
        }
        actionText = null;
        return false;
    }
 }
@@ -4,7 +4,14 @@ namespace EchoHub.Core.Contracts;
 public interface IChatBroadcaster
 {
-    Task SendMessageToChannelAsync(string channelName, MessageDto message);
+    /// <summary>
    /// Broadcast a chat message to a channel. <paramref name="excludeConnectionId"/> is the
    /// connection the message originated from (IRC convention: never echo a message back to
    /// the connection that sent it — its client already displayed it locally). Other
    /// connections of the same user (e.g. an IRC session alongside a TUI session) still
    /// receive the message.
    /// </summary>
    Task SendMessageToChannelAsync(string channelName, MessageDto message, string? excludeConnectionId = null);
    Task SendUserJoinedAsync(string channelName, string username, UserPresenceDto? presence, string? excludeConnectionId = null);
    Task SendUserLeftAsync(string channelName, string username);
    Task SendChannelUpdatedAsync(ChannelDto channel, string? channelName = null);
@@ -12,6 +19,7 @@ public interface IChatBroadcaster
    Task SendUserKickedAsync(string channelName, string username, string? reason);
    Task SendUserBannedAsync(string username, string? reason);
    Task SendMessageDeletedAsync(string channelName, Guid messageId);
    Task SendChannelDeletedAsync(string channelName);
    Task SendChannelNukedAsync(string channelName);
    Task SendErrorAsync(string connectionId, string message);
    Task ForceDisconnectUserAsync(List<string> connectionIds, string reason);
@@ -13,8 +13,11 @@ public interface IChatService
    Task<(List<MessageDto> History, string? Error, bool PasswordRequired)> JoinChannelAsync(string connectionId, Guid userId, string username, string channelName, string? password = null);
    Task LeaveChannelAsync(string connectionId, string username, string channelName);
-    // Messaging
+    // Messaging. originConnectionId identifies the connection the message came from so
-    Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content);
+    // broadcasters can avoid echoing it back to that one connection (IRC convention);
    // the sender's other sessions still receive it. replyToMessageId references the message
    // being replied to; it must exist in the same channel.
    Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content, string? originConnectionId = null, Guid? replyToMessageId = null);
    Task<List<MessageDto>> GetChannelHistoryAsync(string channelName, int count, int offset = 0);
    // Presence
@@ -24,6 +27,7 @@ public interface IChatService
    // Broadcasting (used by controllers and IRC gateway)
    Task BroadcastMessageAsync(string channelName, MessageDto message);
    Task BroadcastChannelUpdatedAsync(ChannelDto channel, string? channelName = null);
    Task BroadcastChannelDeletedAsync(string channelName);
    // Query operations (used by IRC gateway for WHOIS)
    Task<List<string>> GetChannelsForUserAsync(string username);
@@ -15,6 +15,7 @@ public interface IEchoHubClient
    Task UserKicked(string channelName, string username, string? reason);
    Task UserBanned(string username, string? reason);
    Task MessageDeleted(string channelName, Guid messageId);
    Task ChannelDeleted(string channelName);
    Task ChannelNuked(string channelName);
    Task ForceDisconnect(string reason);
    Task Error(string message);
@@ -4,7 +4,9 @@ namespace EchoHub.Core.Contracts;
 public interface IUserService
 {
-    Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null);
+    // inviteCode is required when the server runs with Server:Registration = "invite";
    // "closed" refuses all new accounts. Both REST and the IRC gateway funnel through here.
    Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null, string? inviteCode = null);
    Task<UserOperationResult> AuthenticateUserAsync(string username, string password);
    Task<UserProfileDto?> GetUserProfileAsync(string username);
    Task<UserProfileDto?> GetUserByIdAsync(Guid userId);
@@ -0,0 +1,30 @@
 namespace EchoHub.Core.DTOs;
 /// <summary>Password re-confirmation for destructive self-service account actions.</summary>
 public record DeleteAccountRequest(string Password);
 /// <summary>
 /// Everything the server holds about a user, as stored. For end-to-end encrypted rooms the
 /// message content in here is room ciphertext — the server cannot include plaintext it never had.
 /// </summary>
 public record UserDataExportDto(
    DateTimeOffset ExportedAt,
    string ServerName,
    UserProfileDto Profile,
    List<ExportedMessageDto> Messages,
    List<ExportedAttachmentDto> Attachments);
 public record ExportedMessageDto(
    Guid Id,
    string ChannelName,
    DateTimeOffset SentAt,
    string Content,
    Guid? ReplyToMessageId);
 public record ExportedAttachmentDto(
    string FileName,
    string Url,
    long FileSize,
    string Kind,
    string ChannelName,
    DateTimeOffset SentAt);
@@ -1,6 +1,6 @@
 namespace EchoHub.Core.DTOs;
-public record RegisterRequest(string Username, string Password, string? DisplayName = null);
+public record RegisterRequest(string Username, string Password, string? DisplayName = null, string? InviteCode = null);
 public record LoginRequest(string Username, string Password);
@@ -10,7 +10,20 @@ public record MessageDto(
    string ChannelName,
    DateTimeOffset SentAt,
    List<AttachmentDto>? Attachments = null,
-    List<EmbedDto>? Embeds = null);
+    List<EmbedDto>? Embeds = null,
    string? SenderDisplayName = null,
    ReplyRefDto? ReplyTo = null);
 /// <summary>
 /// Reference to the message a reply targets. <see cref="Content"/> is treated exactly like
 /// message content on the wire: transport-encrypted, and for end-to-end encrypted rooms it is
 /// room ciphertext the client must decrypt (the server truncates only plaintext snippets).
 /// Null on a <see cref="MessageDto"/> when the original message no longer exists.
 /// </summary>
 public record ReplyRefDto(
    Guid MessageId,
    string SenderUsername,
    string Content);
 /// <summary>
 /// A file attached to a message. <see cref="AsciiPreview"/> holds the color-tag art for
@@ -0,0 +1,11 @@
 namespace EchoHub.Core.DTOs;
 public record CreateInviteRequest(int? MaxUses = null, int? ExpiresInHours = null);
 public record InviteDto(
    string Code,
    string CreatedByUsername,
    DateTimeOffset CreatedAt,
    DateTimeOffset? ExpiresAt,
    int MaxUses,
    int UseCount);
@@ -30,6 +30,7 @@ public record UserPresenceDto(
    string? NicknameColor,
    UserStatus Status,
    string? StatusMessage,
-    ServerRole Role);
+    ServerRole Role,
    bool IsIrc = false);
 public record AvatarUploadResponse(string AvatarAscii);
@@ -1,5 +1,10 @@
 namespace EchoHub.Core.DTOs;
-public record ServerStatusDto(string Name, string? Description, int OnlineUsers, int TotalChannels);
+public record ServerStatusDto(
    string Name,
    string? Description,
    int OnlineUsers,
    int TotalChannels,
    string RegistrationMode = "open");
 public record EncryptionKeyResponse(string Key);
@@ -0,0 +1,20 @@
 namespace EchoHub.Core.Models;
 /// <summary>
 /// A registration invite code. When the server runs with <c>Server:Registration = "invite"</c>,
 /// new accounts (REST and IRC alike) require a valid, unexpired, not-fully-used code.
 /// </summary>
 public class InviteCode
 {
    public Guid Id { get; set; }
    public required string Code { get; set; }
    public Guid CreatedByUserId { get; set; }
    public string CreatedByUsername { get; set; } = string.Empty;
    public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
    /// <summary>Null means the code never expires.</summary>
    public DateTimeOffset? ExpiresAt { get; set; }
    public int MaxUses { get; set; } = 1;
    public int UseCount { get; set; }
 }
@@ -16,6 +16,9 @@ public class Message
    public Guid SenderUserId { get; set; }
    public required string SenderUsername { get; set; }
    /// <summary>Message this one replies to, if any. The target may since have been deleted.</summary>
    public Guid? ReplyToMessageId { get; set; }
    /// <summary>Files attached to this message. Empty for a plain text message.</summary>
    public List<Attachment> Attachments { get; set; } = [];
@@ -0,0 +1,104 @@
 using System.Text;
 namespace EchoHub.Core.Services;
 /// <summary>
 /// Renders short text as a 5-row block-character banner (the <c>/banner</c> command).
 /// Entirely local — a hand-rolled figlet-style font, no dependencies, no network.
 /// Output is plain message content, so it travels (and encrypts) like any other text.
 /// </summary>
 public static class AsciiBannerService
 {
    public const int MaxInputLength = 20;
    private const int Rows = 5;
    /// <summary>
    /// Renders <paramref name="text"/> as banner lines joined with '\n'.
    /// Returns null when the input is empty or contains no renderable characters.
    /// Characters outside the font (letters, digits, and basic punctuation) are skipped.
    /// </summary>
    public static string? Render(string text)
    {
        if (string.IsNullOrWhiteSpace(text))
            return null;
        text = text.Trim();
        if (text.Length > MaxInputLength)
            text = text[..MaxInputLength];
        var glyphs = new List<string[]>();
        foreach (var ch in text.ToUpperInvariant())
        {
            if (Font.TryGetValue(ch, out var glyph))
                glyphs.Add(glyph);
        }
        if (glyphs.Count == 0 || glyphs.All(g => g == Font[' ']))
            return null;
        var lines = new StringBuilder();
        for (var row = 0; row < Rows; row++)
        {
            if (row > 0)
                lines.Append('\n');
            for (var i = 0; i < glyphs.Count; i++)
            {
                if (i > 0)
                    lines.Append(' ');
                lines.Append(glyphs[i][row].Replace('#', '█').Replace('.', ' '));
            }
        }
        // Trim trailing spaces per line — cheaper payload, identical rendering
        return string.Join('\n', lines.ToString().Split('\n').Select(l => l.TrimEnd()));
    }
    // Glyphs are authored with '#' (ink) and '.' (blank); all rows of a glyph share one width.
    private static readonly Dictionary<char, string[]> Font = new()
    {
        [' '] = ["..", "..", "..", "..", ".."],
        ['A'] = [".##.", "#..#", "####", "#..#", "#..#"],
        ['B'] = ["###.", "#..#", "###.", "#..#", "###."],
        ['C'] = [".###", "#...", "#...", "#...", ".###"],
        ['D'] = ["###.", "#..#", "#..#", "#..#", "###."],
        ['E'] = ["####", "#...", "###.", "#...", "####"],
        ['F'] = ["####", "#...", "###.", "#...", "#..."],
        ['G'] = [".###", "#...", "#.##", "#..#", ".###"],
        ['H'] = ["#..#", "#..#", "####", "#..#", "#..#"],
        ['I'] = ["###", ".#.", ".#.", ".#.", "###"],
        ['J'] = ["..##", "...#", "...#", "#..#", ".##."],
        ['K'] = ["#..#", "#.#.", "##..", "#.#.", "#..#"],
        ['L'] = ["#...", "#...", "#...", "#...", "####"],
        ['M'] = ["#...#", "##.##", "#.#.#", "#...#", "#...#"],
        ['N'] = ["#...#", "##..#", "#.#.#", "#..##", "#...#"],
        ['O'] = [".##.", "#..#", "#..#", "#..#", ".##."],
        ['P'] = ["###.", "#..#", "###.", "#...", "#..."],
        ['Q'] = [".##.", "#..#", "#..#", "#.##", ".###"],
        ['R'] = ["###.", "#..#", "###.", "#.#.", "#..#"],
        ['S'] = [".###", "#...", ".##.", "...#", "###."],
        ['T'] = ["###", ".#.", ".#.", ".#.", ".#."],
        ['U'] = ["#..#", "#..#", "#..#", "#..#", ".##."],
        ['V'] = ["#...#", "#...#", "#...#", ".#.#.", "..#.."],
        ['W'] = ["#...#", "#...#", "#.#.#", "##.##", "#...#"],
        ['X'] = ["#...#", ".#.#.", "..#..", ".#.#.", "#...#"],
        ['Y'] = ["#...#", ".#.#.", "..#..", "..#..", "..#.."],
        ['Z'] = ["####", "...#", "..#.", ".#..", "####"],
        ['0'] = [".##.", "#.##", "##.#", "#..#", ".##."],
        ['1'] = [".#.", "##.", ".#.", ".#.", "###"],
        ['2'] = [".##.", "#..#", "..#.", ".#..", "####"],
        ['3'] = ["###.", "...#", ".##.", "...#", "###."],
        ['4'] = ["#..#", "#..#", "####", "...#", "...#"],
        ['5'] = ["####", "#...", "###.", "...#", "###."],
        ['6'] = [".##.", "#...", "###.", "#..#", ".##."],
        ['7'] = ["####", "...#", "..#.", ".#..", ".#.."],
        ['8'] = [".##.", "#..#", ".##.", "#..#", ".##."],
        ['9'] = [".##.", "#..#", ".###", "...#", ".##."],
        ['!'] = ["#", "#", "#", ".", "#"],
        ['?'] = [".##.", "#..#", "..#.", "....", "..#."],
        ['.'] = [".", ".", ".", ".", "#"],
        [','] = ["..", "..", "..", ".#", "#."],
        ['-'] = ["....", "....", "####", "....", "...."],
        ['\''] = ["#", "#", ".", ".", "."],
        [':'] = [".", "#", ".", "#", "."],
    };
 }
@@ -14,24 +14,24 @@ public class IrcBroadcaster : IChatBroadcaster
        _encryption = encryption;
    }
-    public async Task SendMessageToChannelAsync(string channelName, MessageDto message)
+    public async Task SendMessageToChannelAsync(string channelName, MessageDto message, string? excludeConnectionId = null)
    {
-        // Decrypt content and attachment previews for IRC clients (they can't handle
+        // Decrypt transport-encrypted content for IRC clients (they can't handle
-        // app-layer encryption). E2E room ciphertext ($RC1$) passes through untouched;
+        // app-layer encryption). E2E room ciphertext ($RC1$) passes through untouched.
        // the formatter drops previews that are still ciphertext.
        var decryptedMessage = message with
        {
            Content = _encryption.Decrypt(message.Content),
-            Attachments = message.Attachments?
+            ReplyTo = message.ReplyTo is { } reply ? reply with { Content = _encryption.Decrypt(reply.Content) } : null,
                .Select(a => a with { AsciiPreview = _encryption.DecryptNullable(a.AsciiPreview) })
                .ToList(),
        };
-        var lines = IrcMessageFormatter.FormatMessage(decryptedMessage);
+        var lines = IrcMessageFormatter.FormatMessage(decryptedMessage, _gateway.Options.PublicBaseUrl);
        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
        {
-            // IRC convention: don't echo sender's own message
+            // IRC convention: don't echo a message back to the connection that sent it
-            if (conn.Nickname == message.SenderUsername)
+            // (its client already displayed it locally). Match by connection id, not
            // nickname — the same account may also be online via the TUI or a second
            // IRC client, and those sessions must still receive the message.
            if (conn.ConnectionId == excludeConnectionId)
                continue;
            foreach (var line in lines)
@@ -101,6 +101,14 @@ public class IrcBroadcaster : IChatBroadcaster
        }
    }
    public async Task SendChannelDeletedAsync(string channelName)
    {
        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
        {
            await conn.SendAsync($":{_gateway.Options.ServerName} NOTICE {conn.Nickname ?? "*"} :Channel #{channelName} has been deleted");
        }
    }
    public async Task SendChannelNukedAsync(string channelName)
    {
        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
@@ -1,5 +1,6 @@
 using System.Net.Sockets;
 using System.Text;
 using EchoHub.Core.Constants;
 namespace EchoHub.Server.Irc;
@@ -14,7 +15,7 @@ public sealed class IrcClientConnection : IAsyncDisposable
    private readonly SemaphoreSlim _writeLock = new(1, 1);
    // Connection identity
-    public string ConnectionId { get; } = $"irc-{Guid.NewGuid()}";
+    public string ConnectionId { get; } = $"{HubConstants.IrcConnectionIdPrefix}{Guid.NewGuid()}";
    // Registration state
    public string? Nickname { get; set; }
@@ -432,8 +432,12 @@ public sealed class IrcCommandHandler
            // Replay history (decrypt — history is encrypted for SignalR transport)
            foreach (var m in history)
            {
-                var decrypted = m with { Content = _encryption.Decrypt(m.Content) };
+                var decrypted = m with
-                var lines = IrcMessageFormatter.FormatMessage(decrypted);
+                {
                    Content = _encryption.Decrypt(m.Content),
                    ReplyTo = m.ReplyTo is { } reply ? reply with { Content = _encryption.Decrypt(reply.Content) } : null,
                };
                var lines = IrcMessageFormatter.FormatMessage(decrypted, _options.PublicBaseUrl);
                foreach (var line in lines)
                    await _conn.SendAsync(line);
            }
@@ -486,7 +490,7 @@ public sealed class IrcCommandHandler
        if (channelName is null) return;
        var error = await _chatService.SendMessageAsync(
-            _conn.UserId!.Value, _conn.Nickname!, channelName, content);
+            _conn.UserId!.Value, _conn.Nickname!, channelName, content, _conn.ConnectionId);
        if (error is not null)
        {
@@ -1,60 +1,69 @@
 using System.Text;
-using System.Text.RegularExpressions;
+using EchoHub.Core.Constants;
 using EchoHub.Core.Contracts;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using EchoHub.Core.Security;
 namespace EchoHub.Server.Irc;
-public static partial class IrcMessageFormatter
+public static class IrcMessageFormatter
 {
    private const int MaxIrcLineContentBytes = 400;
    private const int MaxReplySnippetLength = 80;
    /// <summary>
    /// Format a MessageDto as one or more IRC PRIVMSG lines.
    /// Attachments are rendered as single link lines \u2014 the widely-supported IRC convention
    /// (clients auto-preview or open plain http(s) URLs) \u2014 never as terminal color art.
    /// <paramref name="publicBaseUrl"/> makes the links absolute so any IRC client can open them.
    /// </summary>
-    public static List<string> FormatMessage(MessageDto message)
+    public static List<string> FormatMessage(MessageDto message, string? publicBaseUrl = null)
    {
        var lines = new List<string>();
        var ircChannel = $"#{message.ChannelName}";
        var prefix = $":{message.SenderUsername}!{message.SenderUsername}@echohub";
        // Reply reference → the "> nick: snippet" quoting convention IRC users know
        var replyPrefix = FormatReplyPrefix(message.ReplyTo);
        // Caption text first (may be empty when the message is attachments-only)
        if (!string.IsNullOrEmpty(message.Content))
        {
-            foreach (var chunk in SplitMessage(message.Content, MaxIrcLineContentBytes))
+            // /me actions arrive as CTCP ACTION content; each chunk must stay a
-                lines.Add($"{prefix} PRIVMSG {ircChannel} :{chunk}");
+            // well-formed CTCP message (\x01ACTION …\x01) or clients render garbage.
            if (MessageConventions.TryParseAction(message.Content, out var actionText))
            {
                if (replyPrefix is not null)
                    lines.Add($"{prefix} PRIVMSG {ircChannel} :{replyPrefix.TrimEnd(' ', '|', ' ')}");
                foreach (var chunk in SplitMessage(actionText, MaxIrcLineContentBytes))
                    lines.Add($"{prefix} PRIVMSG {ircChannel} :{MessageConventions.FormatAction(chunk)}");
            }
            else
            {
                var content = replyPrefix is not null ? replyPrefix + message.Content : message.Content;
                foreach (var chunk in SplitMessage(content, MaxIrcLineContentBytes))
                    lines.Add($"{prefix} PRIVMSG {ircChannel} :{chunk}");
            }
        }
        else if (replyPrefix is not null)
        {
            lines.Add($"{prefix} PRIVMSG {ircChannel} :{replyPrefix.TrimEnd(' ', '|', ' ')}");
        }
-        // One block per attachment
+        // One link line per attachment
        if (message.Attachments is { Count: > 0 })
        {
            foreach (var attachment in message.Attachments)
            {
-                switch (attachment.Kind)
+                var url = ToAbsoluteUrl(attachment.Url, publicBaseUrl);
                var tag = attachment.Kind switch
                {
-                    case AttachmentKind.Image:
+                    AttachmentKind.Image => $"[Image: {attachment.FileName}]",
-                        lines.Add($"{prefix} PRIVMSG {ircChannel} :[Image: {attachment.FileName}] {attachment.Url}");
+                    AttachmentKind.Audio => $"\u266a [Audio: {attachment.FileName}]",
-                        if (attachment.AsciiPreview is not null && !IsCiphertext(attachment.AsciiPreview))
+                    _ => $"[File: {attachment.FileName}]",
-                        {
+                };
-                            foreach (var line in attachment.AsciiPreview.Split('\n'))
+                lines.Add($"{prefix} PRIVMSG {ircChannel} :{tag} {url}");
                            {
                                var trimmed = line.TrimEnd('\r');
                                if (trimmed.Length > 0)
                                    lines.Add($"{prefix} PRIVMSG {ircChannel} :{ColorTagsToAnsi(trimmed)}");
                            }
                        }
                        break;
                    case AttachmentKind.Audio:
                        lines.Add($"{prefix} PRIVMSG {ircChannel} :\u266a [Audio: {attachment.FileName}] {attachment.Url}");
                        break;
                    default:
                        lines.Add($"{prefix} PRIVMSG {ircChannel} :[File: {attachment.FileName}] {attachment.Url}");
                        break;
                }
            }
        }
@@ -69,13 +78,37 @@ public static partial class IrcMessageFormatter
    }
    /// <summary>
-    /// True when a preview is still encrypted — transport ($ENC$v1$) if a broadcast path
+    /// "&gt; nick: snippet | " prefix for replies. Room ciphertext can't be rendered
-    /// forgot to decrypt it, or E2E room ciphertext ($RC1$) the server cannot decrypt.
+    /// (IRC can't join encrypted rooms anyway) and is shown as a placeholder.
    /// Emitting it would flood IRC clients with a multi-KB base64 blob.
    /// </summary>
-    private static bool IsCiphertext(string text) =>
+    private static string? FormatReplyPrefix(ReplyRefDto? replyTo)
-        text.StartsWith(IMessageEncryptionService.CiphertextPrefix, StringComparison.Ordinal)
+    {
-        || text.StartsWith(RoomCrypto.CiphertextPrefix, StringComparison.Ordinal);
+        if (replyTo is null)
            return null;
        var snippet = RoomCrypto.IsRoomCiphertext(replyTo.Content)
            ? "[encrypted]"
            : replyTo.Content.Replace('\n', ' ').Replace('\r', ' ');
        if (MessageConventions.TryParseAction(snippet, out var actionText))
            snippet = $"* {replyTo.SenderUsername} {actionText}";
        if (snippet.Length > MaxReplySnippetLength)
            snippet = snippet[..MaxReplySnippetLength] + "…";
        return $"> {replyTo.SenderUsername}: {snippet} | ";
    }
    /// <summary>
    /// Joins a relative attachment path onto the configured public base URL.
    /// Already-absolute URLs and unset base URLs pass through unchanged.
    /// </summary>
    public static string ToAbsoluteUrl(string url, string? publicBaseUrl)
    {
        if (string.IsNullOrWhiteSpace(publicBaseUrl) || Uri.IsWellFormedUriString(url, UriKind.Absolute))
            return url;
        return $"{publicBaseUrl.TrimEnd('/')}/{url.TrimStart('/')}";
    }
    /// <summary>
    /// Format a link embed as IRC PRIVMSG lines (text-only, no ASCII thumbnail).
@@ -104,35 +137,6 @@ public static partial class IrcMessageFormatter
        return lines;
    }
    /// <summary>
    /// Convert printable color tags ({F:RRGGBB}, {B:RRGGBB}, {X}) to ANSI escape codes for IRC clients.
    /// Also passes through content that already uses ANSI codes unchanged.
    /// </summary>
    public static string ColorTagsToAnsi(string text)
    {
        if (!text.Contains('{'))
            return text;
        return ColorTagRegex().Replace(text, match =>
        {
            if (match.Groups[1].Success) // {X} reset
                return "\x1b[0m";
            if (match.Groups[2].Success) // {F:RRGGBB} or {B:RRGGBB}
            {
                var hex = match.Groups[3].Value;
                var r = Convert.ToInt32(hex[..2], 16);
                var g = Convert.ToInt32(hex[2..4], 16);
                var b = Convert.ToInt32(hex[4..6], 16);
                var code = match.Groups[2].Value == "F" ? "38" : "48";
                return $"\x1b[{code};2;{r};{g};{b}m";
            }
            return match.Value;
        });
    }
    [GeneratedRegex(@"\{(?:(X)|(?:(F|B):([0-9A-Fa-f]{6})))\}")]
    private static partial Regex ColorTagRegex();
    /// <summary>
    /// Split a message into chunks of approximately maxBytes (UTF-8), at word boundaries.
    /// </summary>
@@ -12,4 +12,11 @@ public sealed class IrcOptions
    public string? TlsCertPassword { get; set; }
    public string ServerName { get; set; } = "echohub";
    public string? Motd { get; set; }
    /// <summary>
    /// Public HTTP(S) base of this EchoHub server (e.g. "https://chat.example.com"),
    /// used to turn relative attachment URLs into absolute links IRC clients can open.
    /// When unset, attachment lines fall back to the relative path.
    /// </summary>
    public string? PublicBaseUrl { get; set; }
 }
@@ -0,0 +1,50 @@
 namespace EchoHub.Server.Config;
 /// <summary>
 /// Anti-spam thresholds, bound from the "Spam" config section. Defaults are lenient enough
 /// that a fast typist never trips them; Mods and above are always exempt.
 /// </summary>
 public sealed class SpamOptions
 {
    /// <summary>Master switch for all spam protection.</summary>
    public bool Enabled { get; set; } = true;
    /// <summary>Max messages a user may send per <see cref="WindowSeconds"/> window.</summary>
    public int MaxMessagesPerWindow { get; set; } = 8;
    public int WindowSeconds { get; set; } = 5;
    /// <summary>
    /// How many identical messages in a row are tolerated; the next one is rejected.
    /// (End-to-end encrypted rooms are naturally exempt — identical plaintext produces
    /// different ciphertext per message, so repeats never look identical to the server.)
    /// </summary>
    public int MaxDuplicateMessages { get; set; } = 3;
    /// <summary>
    /// Auto-mute duration once a user accumulates <see cref="ViolationThreshold"/> rejected
    /// sends within <see cref="ViolationWindowMinutes"/>. 0 disables auto-mute (rejections
    /// still apply). The mute uses the normal timed-mute machinery, so moderators see it
    /// and <c>MuteExpirationService</c> lifts it.
    /// </summary>
    public int AutoMuteMinutes { get; set; } = 5;
    public int ViolationThreshold { get; set; } = 5;
    public int ViolationWindowMinutes { get; set; } = 5;
    /// <summary>
    /// Max *first-time* channel joins per <see cref="JoinWindowSeconds"/> window. Joins of
    /// channels the user already belongs to (reconnect/auto-join) never count, but a brand-new
    /// user's first connect joins every public channel at once — keep this above your public
    /// channel count.
    /// </summary>
    public int MaxJoinsPerWindow { get; set; } = 25;
    public int JoinWindowSeconds { get; set; } = 30;
    /// <summary>Max channel creations per <see cref="ChannelCreateWindowMinutes"/> window.</summary>
    public int MaxChannelCreatesPerWindow { get; set; } = 3;
    public int ChannelCreateWindowMinutes { get; set; } = 10;
 }
@@ -28,7 +28,7 @@ public class AuthController : ControllerBase
    [HttpPost("register")]
    public async Task<IActionResult> Register([FromBody] RegisterRequest request)
    {
-        var result = await _userService.RegisterUserAsync(request.Username, request.Password, request.DisplayName);
+        var result = await _userService.RegisterUserAsync(request.Username, request.Password, request.DisplayName, request.InviteCode);
        if (!result.IsSuccess)
            return MapUserError(result);
@@ -162,6 +162,8 @@ public class ChannelsController : ControllerBase
        if (!result.IsSuccess)
            return MapChannelError(result);
        await _chatService.BroadcastChannelDeletedAsync(channel.ToLowerInvariant().Trim());
        return NoContent();
    }
@@ -308,7 +310,8 @@ public class ChannelsController : ControllerBase
            sender?.NicknameColor,
            channelName,
            message.SentAt,
-            attachmentDtos);
+            attachmentDtos,
            SenderDisplayName: sender?.DisplayName);
        await _chatService.BroadcastMessageAsync(channelName, messageDto);
@@ -444,7 +447,8 @@ public class ChannelsController : ControllerBase
            sender?.NicknameColor,
            channelName,
            message.SentAt,
-            [new AttachmentDto(AttachmentKind.Image, attachmentUrl, fileName, imageBytes.Length, _encryption.Encrypt(preview))]);
+            [new AttachmentDto(AttachmentKind.Image, attachmentUrl, fileName, imageBytes.Length, _encryption.Encrypt(preview))],
            SenderDisplayName: sender?.DisplayName);
        await _chatService.BroadcastMessageAsync(channelName, messageDto);
@@ -19,7 +19,14 @@ public class FilesController : ControllerBase
        _fileStorage = fileStorage;
    }
    /// <summary>
    /// Serves an uploaded file. Anonymous by design: the unguessable GUID in the URL is the
    /// access token (Discord-CDN-style capability URL), so attachment links can be opened
    /// directly in a browser and shared to IRC clients. E2E-encrypted room blobs are
    /// ciphertext at rest, so anonymous access reveals nothing for those channels.
    /// </summary>
    [HttpGet("{fileId}")]
    [AllowAnonymous]
    public IActionResult GetFile(string fileId)
    {
        if (!Guid.TryParse(fileId, out _))
@@ -48,6 +55,11 @@ public class FilesController : ControllerBase
            _ => "application/octet-stream"
        };
        // Images and audio render inline so a browser displays them instead of
        // downloading; everything else keeps the attachment disposition.
        if (contentType.StartsWith("image/") || contentType.StartsWith("audio/"))
            return PhysicalFile(filePath, contentType);
        var fileName = Path.GetFileName(filePath);
        return PhysicalFile(filePath, contentType, fileName);
    }
@@ -0,0 +1,129 @@
 using System.Security.Claims;
 using System.Security.Cryptography;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using EchoHub.Server.Data;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 namespace EchoHub.Server.Controllers;
 /// <summary>
 /// Invite-code management for invite-gated registration (Admin+ only).
 /// Codes live in this server's own database — there is no central service.
 /// </summary>
 [ApiController]
 [Route("api/invites")]
 [Authorize]
 [EnableRateLimiting("general")]
 public class InvitesController : ControllerBase
 {
    private const int MaxActiveInvites = 200;
    private readonly EchoHubDbContext _db;
    private readonly ILogger<InvitesController> _logger;
    public InvitesController(EchoHubDbContext db, ILogger<InvitesController> logger)
    {
        _db = db;
        _logger = logger;
    }
    [HttpPost]
    public async Task<IActionResult> Create([FromBody] CreateInviteRequest request)
    {
        var (caller, error) = await GetCallerAsync(ServerRole.Admin);
        if (error is not null) return error;
        var maxUses = request.MaxUses ?? 1;
        if (maxUses is < 1 or > 1000)
            return BadRequest(new ErrorResponse("MaxUses must be between 1 and 1000."));
        if (request.ExpiresInHours is < 1 or > 24 * 365)
            return BadRequest(new ErrorResponse("ExpiresInHours must be between 1 and 8760."));
        if (await _db.InviteCodes.CountAsync(i => i.UseCount < i.MaxUses) >= MaxActiveInvites)
            return BadRequest(new ErrorResponse($"Too many active invites (max {MaxActiveInvites}). Revoke unused ones first."));
        var invite = new InviteCode
        {
            Id = Guid.NewGuid(),
            Code = GenerateCode(),
            CreatedByUserId = caller!.Id,
            CreatedByUsername = caller.Username,
            CreatedAt = DateTimeOffset.UtcNow,
            ExpiresAt = request.ExpiresInHours is { } hours ? DateTimeOffset.UtcNow.AddHours(hours) : null,
            MaxUses = maxUses,
        };
        _db.InviteCodes.Add(invite);
        await _db.SaveChangesAsync();
        _logger.LogInformation("Invite code created by {User} (uses: {MaxUses}, expires: {Expires})",
            caller.Username, invite.MaxUses, invite.ExpiresAt?.ToString("u") ?? "never");
        return Ok(ToDto(invite));
    }
    [HttpGet]
    public async Task<IActionResult> List()
    {
        var (_, error) = await GetCallerAsync(ServerRole.Admin);
        if (error is not null) return error;
        var invites = await _db.InviteCodes
            .OrderByDescending(i => i.CreatedAt)
            .ToListAsync();
        return Ok(invites.Select(ToDto).ToList());
    }
    [HttpDelete("{code}")]
    public async Task<IActionResult> Revoke(string code)
    {
        var (caller, error) = await GetCallerAsync(ServerRole.Admin);
        if (error is not null) return error;
        var normalized = code.Trim().ToUpperInvariant();
        var invite = await _db.InviteCodes.FirstOrDefaultAsync(i => i.Code == normalized);
        if (invite is null)
            return NotFound(new ErrorResponse("Invite code not found."));
        _db.InviteCodes.Remove(invite);
        await _db.SaveChangesAsync();
        _logger.LogInformation("Invite code revoked by {User}", caller!.Username);
        return Ok();
    }
    /// <summary>Unguessable, unambiguous code like "K7QM-3XPF" (no 0/O/1/I).</summary>
    private static string GenerateCode()
    {
        const string alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
        Span<char> chars = stackalloc char[8];
        for (var i = 0; i < chars.Length; i++)
            chars[i] = alphabet[RandomNumberGenerator.GetInt32(alphabet.Length)];
        return $"{new string(chars[..4])}-{new string(chars[4..])}";
    }
    private static InviteDto ToDto(InviteCode i) =>
        new(i.Code, i.CreatedByUsername, i.CreatedAt, i.ExpiresAt, i.MaxUses, i.UseCount);
    private async Task<(User? Caller, IActionResult? Error)> GetCallerAsync(ServerRole minimumRole)
    {
        var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
        if (userIdClaim is null)
            return (null, Unauthorized(new ErrorResponse("Authentication required.")));
        var caller = await _db.Users.FindAsync(Guid.Parse(userIdClaim));
        if (caller is null)
            return (null, Unauthorized(new ErrorResponse("User not found.")));
        if (caller.Role < minimumRole)
            return (null, StatusCode(403, new ErrorResponse($"Requires {minimumRole} role or higher.")));
        return (caller, null);
    }
 }
@@ -31,11 +31,19 @@ public class ServerController : ControllerBase
        var userCount = await _db.Users.CountAsync();
        var channelCount = await _db.Channels.CountAsync();
        var registrationMode = (_config["Server:Registration"] ?? "open").Trim().ToLowerInvariant() switch
        {
            "invite" => "invite",
            "closed" => "closed",
            _ => "open",
        };
        var status = new ServerStatusDto(
            _config["Server:Name"] ?? "EchoHub Server",
            _config["Server:Description"],
            userCount,
-            channelCount);
+            channelCount,
            registrationMode);
        return Ok(status);
    }
@@ -1,13 +1,16 @@
 using System.Security.Claims;
 using EchoHub.Core.Constants;
 using EchoHub.Core.Contracts;
 using EchoHub.Core.Models;
 using EchoHub.Core.Services;
 using EchoHub.Core.DTOs;
 using EchoHub.Server.Config;
 using EchoHub.Server.Data;
 using EchoHub.Server.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 namespace EchoHub.Server.Controllers;
@@ -17,15 +20,45 @@ namespace EchoHub.Server.Controllers;
 [EnableRateLimiting("general")]
 public class UsersController : ControllerBase
 {
    /// <summary>
    /// Username tombstoned messages are re-attributed to after account deletion.
    /// Reserved — <see cref="UserService"/> refuses to register it.
    /// </summary>
    public const string DeletedUserName = "deleted-user";
    private readonly IUserService _userService;
    private readonly ImageToAsciiService _asciiService;
    private readonly UploadLimits _uploadLimits;
    private readonly EchoHubDbContext _db;
    private readonly IMessageEncryptionService _encryption;
    private readonly FileStorageService _fileStorage;
    private readonly PresenceTracker _presenceTracker;
    private readonly IEnumerable<IChatBroadcaster> _broadcasters;
    private readonly IConfiguration _config;
    private readonly ILogger<UsersController> _logger;
-    public UsersController(IUserService userService, ImageToAsciiService asciiService, UploadLimits uploadLimits)
+    public UsersController(
        IUserService userService,
        ImageToAsciiService asciiService,
        UploadLimits uploadLimits,
        EchoHubDbContext db,
        IMessageEncryptionService encryption,
        FileStorageService fileStorage,
        PresenceTracker presenceTracker,
        IEnumerable<IChatBroadcaster> broadcasters,
        IConfiguration config,
        ILogger<UsersController> logger)
    {
        _userService = userService;
        _asciiService = asciiService;
        _uploadLimits = uploadLimits;
        _db = db;
        _encryption = encryption;
        _fileStorage = fileStorage;
        _presenceTracker = presenceTracker;
        _broadcasters = broadcasters;
        _config = config;
        _logger = logger;
    }
    [HttpGet("{username}/profile")]
@@ -85,6 +118,139 @@ public class UsersController : ControllerBase
        return Ok(new AvatarUploadResponse(asciiArt));
    }
    /// <summary>
    /// Everything the server stores about the caller, as stored: profile, their messages
    /// (end-to-end encrypted room content stays ciphertext — the server never had plaintext),
    /// and metadata of their uploaded attachments. "You own the data" made demonstrable.
    /// </summary>
    [HttpGet("me/export")]
    public async Task<IActionResult> ExportMyData()
    {
        var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
        if (userIdClaim is null)
            return Unauthorized(new ErrorResponse("Authentication required."));
        var userId = Guid.Parse(userIdClaim);
        var profile = await _userService.GetUserByIdAsync(userId);
        if (profile is null)
            return Unauthorized(new ErrorResponse("User not found."));
        var messages = await _db.Messages
            .Where(m => m.SenderUserId == userId)
            .OrderBy(m => m.SentAt)
            .Join(_db.Channels, m => m.ChannelId, c => c.Id, (m, c) => new { m, ChannelName = c.Name })
            .ToListAsync();
        var messageIds = messages.Select(x => x.m.Id).ToList();
        var attachments = await _db.Attachments
            .Where(a => messageIds.Contains(a.MessageId))
            .ToListAsync();
        var messageById = messages.ToDictionary(x => x.m.Id, x => x);
        var export = new UserDataExportDto(
            DateTimeOffset.UtcNow,
            _config["Server:Name"] ?? "EchoHub Server",
            profile,
            messages.Select(x => new ExportedMessageDto(
                x.m.Id,
                x.ChannelName,
                x.m.SentAt,
                // Strip only the server's at-rest layer; room ciphertext passes through as-is
                _encryption.Decrypt(x.m.Content),
                x.m.ReplyToMessageId)).ToList(),
            attachments.Select(a =>
            {
                var owner = messageById[a.MessageId];
                return new ExportedAttachmentDto(
                    a.FileName, a.Url, a.FileSize, a.Kind.ToString(),
                    owner.ChannelName, owner.m.SentAt);
            }).ToList());
        _logger.LogInformation("{User} exported their data ({Messages} messages, {Attachments} attachments)",
            profile.Username, export.Messages.Count, export.Attachments.Count);
        return Ok(export);
    }
    /// <summary>
    /// Self-service account deletion (password re-confirmed). Removes the account, its refresh
    /// tokens and memberships (FK cascade), and every attachment blob the user uploaded.
    /// Their messages are kept but tombstoned to <see cref="DeletedUserName"/> — deleting them
    /// outright would silently gut other people's conversations.
    /// </summary>
    [HttpDelete("me")]
    public async Task<IActionResult> DeleteMyAccount([FromBody] DeleteAccountRequest request)
    {
        var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
        if (userIdClaim is null)
            return Unauthorized(new ErrorResponse("Authentication required."));
        var user = await _db.Users.FindAsync(Guid.Parse(userIdClaim));
        if (user is null)
            return Unauthorized(new ErrorResponse("User not found."));
        if (string.IsNullOrEmpty(request.Password) || !BCrypt.Net.BCrypt.Verify(request.Password, user.PasswordHash))
            return Unauthorized(new ErrorResponse("Password is incorrect."));
        if (user.Role == ServerRole.Owner
            && !await _db.Users.AnyAsync(u => u.Role == ServerRole.Owner && u.Id != user.Id))
        {
            return BadRequest(new ErrorResponse(
                "You are the only Owner of this server. Promote another Owner (or shut the server down) before deleting this account."));
        }
        var username = user.Username;
        // Their uploaded blobs: attachments hanging off their messages
        var attachmentInfo = await _db.Messages
            .Where(m => m.SenderUserId == user.Id)
            .SelectMany(m => m.Attachments)
            .Select(a => new { a.Id, a.Url })
            .ToListAsync();
        foreach (var fileId in attachmentInfo
                     .Select(a => a.Url.Split('/').LastOrDefault())
                     .Where(id => !string.IsNullOrEmpty(id)))
        {
            try { _fileStorage.DeleteFile(fileId!); }
            catch (Exception ex) { _logger.LogWarning(ex, "Failed to delete blob {FileId} during account deletion", fileId); }
        }
        var attachmentIds = attachmentInfo.Select(a => a.Id).ToList();
        await _db.Attachments.Where(a => attachmentIds.Contains(a.Id)).ExecuteDeleteAsync();
        // Tombstone their messages, then remove the account (cascades tokens + memberships)
        await _db.Messages
            .Where(m => m.SenderUserId == user.Id)
            .ExecuteUpdateAsync(s => s
                .SetProperty(m => m.SenderUserId, Guid.Empty)
                .SetProperty(m => m.SenderUsername, DeletedUserName));
        _db.Users.Remove(user);
        await _db.SaveChangesAsync();
        // Kick their live sessions and clear them from user lists everywhere
        var (connectionIds, channels) = _presenceTracker.ForceRemoveUser(username);
        foreach (var channel in channels)
            await BroadcastToAllAsync(b => b.SendUserLeftAsync(channel, username));
        if (connectionIds.Count > 0)
            await BroadcastToAllAsync(b => b.ForceDisconnectUserAsync(connectionIds, "Account deleted."));
        _logger.LogInformation("Account '{User}' self-deleted ({Attachments} attachment blobs removed)",
            username, attachmentIds.Count);
        return Ok();
    }
    private async Task BroadcastToAllAsync(Func<IChatBroadcaster, Task> action)
    {
        foreach (var broadcaster in _broadcasters)
        {
            try { await action(broadcaster); }
            catch { /* logged by broadcaster */ }
        }
    }
    private IActionResult MapUserError(UserOperationResult result) => result.Error switch
    {
        UserError.ValidationFailed => BadRequest(new ErrorResponse(result.ErrorMessage!)),
@@ -13,6 +13,7 @@ public class EchoHubDbContext : DbContext
    public DbSet<Attachment> Attachments => Set<Attachment>();
    public DbSet<RefreshToken> RefreshTokens => Set<RefreshToken>();
    public DbSet<ChannelMembership> ChannelMemberships => Set<ChannelMembership>();
    public DbSet<InviteCode> InviteCodes => Set<InviteCode>();
    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
    {
@@ -98,6 +99,14 @@ public class EchoHubDbContext : DbContext
                  .OnDelete(DeleteBehavior.Cascade);
        });
        modelBuilder.Entity<InviteCode>(entity =>
        {
            entity.HasKey(i => i.Id);
            entity.HasIndex(i => i.Code).IsUnique();
            entity.Property(i => i.Code).IsRequired().HasMaxLength(32);
            entity.Property(i => i.CreatedByUsername).IsRequired().HasMaxLength(50);
        });
        modelBuilder.Entity<RefreshToken>(entity =>
        {
            entity.HasKey(r => r.Id);
@@ -0,0 +1,373 @@
 // <auto-generated />
 using System;
 using EchoHub.Server.Data;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Infrastructure;
 using Microsoft.EntityFrameworkCore.Migrations;
 using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
 #nullable disable
 namespace EchoHub.Server.Data.Migrations
 {
    [DbContext(typeof(EchoHubDbContext))]
    [Migration("20260717165218_AddInvitesAndReplies")]
    partial class AddInvitesAndReplies
    {
        /// <inheritdoc />
        protected override void BuildTargetModel(ModelBuilder modelBuilder)
        {
 #pragma warning disable 612, 618
            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
            modelBuilder.Entity("EchoHub.Core.Models.Attachment", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<string>("AsciiPreview")
                        .HasMaxLength(64000)
                        .HasColumnType("TEXT");
                    b.Property<string>("FileName")
                        .IsRequired()
                        .HasMaxLength(255)
                        .HasColumnType("TEXT");
                    b.Property<long>("FileSize")
                        .HasColumnType("INTEGER");
                    b.Property<int>("Kind")
                        .HasColumnType("INTEGER");
                    b.Property<Guid>("MessageId")
                        .HasColumnType("TEXT");
                    b.Property<string>("Url")
                        .IsRequired()
                        .HasMaxLength(500)
                        .HasColumnType("TEXT");
                    b.HasKey("Id");
                    b.HasIndex("MessageId");
                    b.ToTable("Attachments");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<long>("CreatedAt")
                        .HasColumnType("INTEGER");
                    b.Property<Guid>("CreatedByUserId")
                        .HasColumnType("TEXT");
                    b.Property<string>("EncryptionSalt")
                        .HasMaxLength(64)
                        .HasColumnType("TEXT");
                    b.Property<bool>("IsPublic")
                        .HasColumnType("INTEGER");
                    b.Property<string>("Name")
                        .IsRequired()
                        .HasMaxLength(100)
                        .HasColumnType("TEXT");
                    b.Property<string>("PasswordHash")
                        .HasMaxLength(100)
                        .HasColumnType("TEXT");
                    b.Property<string>("Topic")
                        .HasMaxLength(500)
                        .HasColumnType("TEXT");
                    b.Property<string>("WrappedRoomKey")
                        .HasMaxLength(200)
                        .HasColumnType("TEXT");
                    b.HasKey("Id");
                    b.HasIndex("Name")
                        .IsUnique();
                    b.ToTable("Channels");
                });
            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
                {
                    b.Property<Guid>("UserId")
                        .HasColumnType("TEXT");
                    b.Property<Guid>("ChannelId")
                        .HasColumnType("TEXT");
                    b.Property<long>("JoinedAt")
                        .HasColumnType("INTEGER");
                    b.HasKey("UserId", "ChannelId");
                    b.HasIndex("ChannelId");
                    b.HasIndex("UserId");
                    b.ToTable("ChannelMemberships");
                });
            modelBuilder.Entity("EchoHub.Core.Models.InviteCode", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<string>("Code")
                        .IsRequired()
                        .HasMaxLength(32)
                        .HasColumnType("TEXT");
                    b.Property<long>("CreatedAt")
                        .HasColumnType("INTEGER");
                    b.Property<Guid>("CreatedByUserId")
                        .HasColumnType("TEXT");
                    b.Property<string>("CreatedByUsername")
                        .IsRequired()
                        .HasMaxLength(50)
                        .HasColumnType("TEXT");
                    b.Property<long?>("ExpiresAt")
                        .HasColumnType("INTEGER");
                    b.Property<int>("MaxUses")
                        .HasColumnType("INTEGER");
                    b.Property<int>("UseCount")
                        .HasColumnType("INTEGER");
                    b.HasKey("Id");
                    b.HasIndex("Code")
                        .IsUnique();
                    b.ToTable("InviteCodes");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<string>("AttachmentFileName")
                        .HasMaxLength(255)
                        .HasColumnType("TEXT");
                    b.Property<long?>("AttachmentFileSize")
                        .HasColumnType("INTEGER");
                    b.Property<string>("AttachmentUrl")
                        .HasMaxLength(500)
                        .HasColumnType("TEXT");
                    b.Property<Guid>("ChannelId")
                        .HasColumnType("TEXT");
                    b.Property<string>("Content")
                        .IsRequired()
                        .HasMaxLength(16000)
                        .HasColumnType("TEXT");
                    b.Property<string>("EmbedJson")
                        .HasMaxLength(32000)
                        .HasColumnType("TEXT");
                    b.Property<Guid?>("ReplyToMessageId")
                        .HasColumnType("TEXT");
                    b.Property<Guid>("SenderUserId")
                        .HasColumnType("TEXT");
                    b.Property<string>("SenderUsername")
                        .IsRequired()
                        .HasMaxLength(50)
                        .HasColumnType("TEXT");
                    b.Property<long>("SentAt")
                        .HasColumnType("INTEGER");
                    b.Property<int>("Type")
                        .HasColumnType("INTEGER");
                    b.HasKey("Id");
                    b.HasIndex("ChannelId");
                    b.HasIndex("SentAt");
                    b.ToTable("Messages");
                });
            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<long>("CreatedAt")
                        .HasColumnType("INTEGER");
                    b.Property<long>("ExpiresAt")
                        .HasColumnType("INTEGER");
                    b.Property<long?>("RevokedAt")
                        .HasColumnType("INTEGER");
                    b.Property<string>("TokenHash")
                        .IsRequired()
                        .HasMaxLength(128)
                        .HasColumnType("TEXT");
                    b.Property<Guid>("UserId")
                        .HasColumnType("TEXT");
                    b.HasKey("Id");
                    b.HasIndex("TokenHash");
                    b.HasIndex("UserId");
                    b.ToTable("RefreshTokens");
                });
            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<string>("AvatarAscii")
                        .HasMaxLength(10000)
                        .HasColumnType("TEXT");
                    b.Property<string>("Bio")
                        .HasMaxLength(500)
                        .HasColumnType("TEXT");
                    b.Property<long>("CreatedAt")
                        .HasColumnType("INTEGER");
                    b.Property<string>("DisplayName")
                        .HasMaxLength(100)
                        .HasColumnType("TEXT");
                    b.Property<bool>("IsBanned")
                        .HasColumnType("INTEGER");
                    b.Property<bool>("IsMuted")
                        .HasColumnType("INTEGER");
                    b.Property<long>("LastSeenAt")
                        .HasColumnType("INTEGER");
                    b.Property<long?>("MutedUntil")
                        .HasColumnType("INTEGER");
                    b.Property<string>("NicknameColor")
                        .HasMaxLength(7)
                        .HasColumnType("TEXT");
                    b.Property<string>("PasswordHash")
                        .IsRequired()
                        .HasColumnType("TEXT");
                    b.Property<int>("Role")
                        .HasColumnType("INTEGER");
                    b.Property<int>("Status")
                        .HasColumnType("INTEGER");
                    b.Property<string>("StatusMessage")
                        .HasMaxLength(100)
                        .HasColumnType("TEXT");
                    b.Property<string>("Username")
                        .IsRequired()
                        .HasMaxLength(50)
                        .HasColumnType("TEXT");
                    b.HasKey("Id");
                    b.HasIndex("Username")
                        .IsUnique();
                    b.ToTable("Users");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Attachment", b =>
                {
                    b.HasOne("EchoHub.Core.Models.Message", "Message")
                        .WithMany("Attachments")
                        .HasForeignKey("MessageId")
                        .OnDelete(DeleteBehavior.Cascade)
                        .IsRequired();
                    b.Navigation("Message");
                });
            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
                {
                    b.HasOne("EchoHub.Core.Models.Channel", null)
                        .WithMany()
                        .HasForeignKey("ChannelId")
                        .OnDelete(DeleteBehavior.Cascade)
                        .IsRequired();
                    b.HasOne("EchoHub.Core.Models.User", null)
                        .WithMany()
                        .HasForeignKey("UserId")
                        .OnDelete(DeleteBehavior.Cascade)
                        .IsRequired();
                });
            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                {
                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
                        .WithMany("Messages")
                        .HasForeignKey("ChannelId")
                        .OnDelete(DeleteBehavior.Cascade)
                        .IsRequired();
                    b.Navigation("Channel");
                });
            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
                {
                    b.HasOne("EchoHub.Core.Models.User", "User")
                        .WithMany()
                        .HasForeignKey("UserId")
                        .OnDelete(DeleteBehavior.Cascade)
                        .IsRequired();
                    b.Navigation("User");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
                {
                    b.Navigation("Messages");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                {
                    b.Navigation("Attachments");
                });
 #pragma warning restore 612, 618
        }
    }
 }
@@ -0,0 +1,56 @@
 using System;
 using Microsoft.EntityFrameworkCore.Migrations;
 #nullable disable
 namespace EchoHub.Server.Data.Migrations
 {
    /// <inheritdoc />
    public partial class AddInvitesAndReplies : Migration
    {
        /// <inheritdoc />
        protected override void Up(MigrationBuilder migrationBuilder)
        {
            migrationBuilder.AddColumn<Guid>(
                name: "ReplyToMessageId",
                table: "Messages",
                type: "TEXT",
                nullable: true);
            migrationBuilder.CreateTable(
                name: "InviteCodes",
                columns: table => new
                {
                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
                    Code = table.Column<string>(type: "TEXT", maxLength: 32, nullable: false),
                    CreatedByUserId = table.Column<Guid>(type: "TEXT", nullable: false),
                    CreatedByUsername = table.Column<string>(type: "TEXT", maxLength: 50, nullable: false),
                    CreatedAt = table.Column<long>(type: "INTEGER", nullable: false),
                    ExpiresAt = table.Column<long>(type: "INTEGER", nullable: true),
                    MaxUses = table.Column<int>(type: "INTEGER", nullable: false),
                    UseCount = table.Column<int>(type: "INTEGER", nullable: false)
                },
                constraints: table =>
                {
                    table.PrimaryKey("PK_InviteCodes", x => x.Id);
                });
            migrationBuilder.CreateIndex(
                name: "IX_InviteCodes_Code",
                table: "InviteCodes",
                column: "Code",
                unique: true);
        }
        /// <inheritdoc />
        protected override void Down(MigrationBuilder migrationBuilder)
        {
            migrationBuilder.DropTable(
                name: "InviteCodes");
            migrationBuilder.DropColumn(
                name: "ReplyToMessageId",
                table: "Messages");
        }
    }
 }
@@ -117,6 +117,45 @@ namespace EchoHub.Server.Data.Migrations
                    b.ToTable("ChannelMemberships");
                });
            modelBuilder.Entity("EchoHub.Core.Models.InviteCode", b =>
                {
                    b.Property<Guid>("Id")
                        .ValueGeneratedOnAdd()
                        .HasColumnType("TEXT");
                    b.Property<string>("Code")
                        .IsRequired()
                        .HasMaxLength(32)
                        .HasColumnType("TEXT");
                    b.Property<long>("CreatedAt")
                        .HasColumnType("INTEGER");
                    b.Property<Guid>("CreatedByUserId")
                        .HasColumnType("TEXT");
                    b.Property<string>("CreatedByUsername")
                        .IsRequired()
                        .HasMaxLength(50)
                        .HasColumnType("TEXT");
                    b.Property<long?>("ExpiresAt")
                        .HasColumnType("INTEGER");
                    b.Property<int>("MaxUses")
                        .HasColumnType("INTEGER");
                    b.Property<int>("UseCount")
                        .HasColumnType("INTEGER");
                    b.HasKey("Id");
                    b.HasIndex("Code")
                        .IsUnique();
                    b.ToTable("InviteCodes");
                });
            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                {
                    b.Property<Guid>("Id")
@@ -146,6 +185,9 @@ namespace EchoHub.Server.Data.Migrations
                        .HasMaxLength(32000)
                        .HasColumnType("TEXT");
                    b.Property<Guid?>("ReplyToMessageId")
                        .HasColumnType("TEXT");
                    b.Property<Guid>("SenderUserId")
                        .HasColumnType("TEXT");
@@ -99,11 +99,11 @@ public class ChatHub : Hub<IEchoHubClient>
        }
    }
-    public async Task SendMessage(string channelName, string content)
+    public async Task SendMessage(string channelName, string content, Guid? replyToMessageId = null)
    {
        try
        {
-            var error = await _chatService.SendMessageAsync(CurrentUserId, CurrentUsername, channelName, content);
+            var error = await _chatService.SendMessageAsync(CurrentUserId, CurrentUsername, channelName, content, Context.ConnectionId, replyToMessageId);
            if (error is not null)
                await Clients.Caller.Error(error);
        }
@@ -106,6 +106,11 @@ while (true)
        // ── Upload limits (admin-configurable via the "Uploads" section) ─────
        var uploadLimits = builder.Configuration.GetSection("Uploads").Get<UploadLimits>() ?? new UploadLimits();
        builder.Services.AddSingleton(uploadLimits);
        // ── Spam protection (admin-configurable via the "Spam" section) ──────
        var spamOptions = builder.Configuration.GetSection("Spam").Get<SpamOptions>() ?? new SpamOptions();
        builder.Services.AddSingleton(spamOptions);
        builder.Services.AddSingleton<SpamGuard>();
        // Raise the multipart form ceiling to match the configured limits; per-endpoint
        // request-body limits are applied at the action from the same values.
        builder.Services.Configure<Microsoft.AspNetCore.Http.Features.FormOptions>(o =>
@@ -13,15 +13,18 @@ public class ChannelService : IChannelService
 {
    private readonly IServiceScopeFactory _scopeFactory;
    private readonly PresenceTracker _presenceTracker;
    private readonly SpamGuard _spamGuard;
    private readonly ILogger<ChannelService> _logger;
    public ChannelService(
        IServiceScopeFactory scopeFactory,
        PresenceTracker presenceTracker,
        SpamGuard spamGuard,
        ILogger<ChannelService> logger)
    {
        _scopeFactory = scopeFactory;
        _presenceTracker = presenceTracker;
        _spamGuard = spamGuard;
        _logger = logger;
    }
@@ -74,6 +77,16 @@ public class ChannelService : IChannelService
        using var scope = _scopeFactory.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
        // Channel-creation throttle (spam guard; Mods and above are exempt)
        if (_spamGuard.Enabled)
        {
            var creator = await db.Users.FindAsync(creatorUserId);
            var verdict = _spamGuard.CheckChannelCreate(creatorUserId, creator?.Role ?? ServerRole.Member);
            if (verdict.Kind != SpamVerdictKind.Allowed)
                return ChannelOperationResult.Fail(ChannelError.ValidationFailed,
                    verdict.Reason ?? "You're creating channels too fast.");
        }
        if (await db.Channels.AnyAsync(c => c.Name == channelName))
            return ChannelOperationResult.Fail(ChannelError.AlreadyExists, $"Channel '{channelName}' already exists.");
@@ -3,6 +3,7 @@ using EchoHub.Core.Constants;
 using EchoHub.Core.Contracts;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using EchoHub.Core.Security;
 using EchoHub.Server.Data;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
@@ -19,6 +20,7 @@ public class ChatService : IChatService
    private readonly IMessageEncryptionService _encryption;
    private readonly IChannelService _channelService;
    private readonly FileStorageService _fileStorage;
    private readonly SpamGuard _spamGuard;
    private readonly ILogger<ChatService> _logger;
    public ChatService(
@@ -29,6 +31,7 @@ public class ChatService : IChatService
        IMessageEncryptionService encryption,
        IChannelService channelService,
        FileStorageService fileStorage,
        SpamGuard spamGuard,
        ILogger<ChatService> logger)
    {
        _scopeFactory = scopeFactory;
@@ -38,6 +41,7 @@ public class ChatService : IChatService
        _encryption = encryption;
        _channelService = channelService;
        _fileStorage = fileStorage;
        _spamGuard = spamGuard;
        _logger = logger;
    }
@@ -101,6 +105,27 @@ public class ChatService : IChatService
    {
        channelName = channelName.ToLowerInvariant().Trim();
        // Join throttle — stops channel-cycling spam from any protocol. Only *first-time*
        // joins (no membership yet) count: the client auto-joins every known channel on
        // connect/reconnect, and that burst must never trip the guard.
        if (_spamGuard.Enabled)
        {
            using var guardScope = _scopeFactory.CreateScope();
            var guardDb = guardScope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
            var isExistingMember = await guardDb.Channels
                .Where(c => c.Name == channelName)
                .AnyAsync(c => guardDb.ChannelMemberships.Any(m => m.ChannelId == c.Id && m.UserId == userId));
            if (!isExistingMember)
            {
                var joiner = await guardDb.Users.FindAsync(userId);
                var joinVerdict = _spamGuard.CheckJoin(userId, joiner?.Role ?? ServerRole.Member);
                if (joinVerdict.Kind != SpamVerdictKind.Allowed)
                    return ([], joinVerdict.Reason, false);
            }
        }
        // Delegate channel validation + membership (incl. password gate) to ChannelService
        var (success, error, passwordRequired) = await _channelService.EnsureChannelMembershipAsync(userId, channelName, password);
        if (!success)
@@ -121,7 +146,8 @@ public class ChatService : IChatService
                {
                    presence = new UserPresenceDto(
                        user.Username, user.DisplayName, user.NicknameColor,
-                        user.Status, user.StatusMessage, user.Role);
+                        user.Status, user.StatusMessage, user.Role,
                        _presenceTracker.IsIrcOnly(user.Username));
                }
            }
            catch (Exception ex)
@@ -150,7 +176,7 @@ public class ChatService : IChatService
        _logger.LogInformation("{User} left channel '{Channel}'", username, channelName);
    }
-    public async Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content)
+    public async Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content, string? originConnectionId = null, Guid? replyToMessageId = null)
    {
        channelName = channelName.ToLowerInvariant().Trim();
@@ -197,6 +223,36 @@ public class ChatService : IChatService
            }
        }
        // Spam guard — operates on the stored content (ciphertext for E2E rooms), never decrypts
        if (sender is not null)
        {
            var verdict = _spamGuard.CheckMessage(userId, sender.Role, plaintext);
            switch (verdict.Kind)
            {
                case SpamVerdictKind.AutoMute:
                    // Escalate through the normal timed-mute machinery: moderation endpoints
                    // list it and MuteExpirationService lifts it. Issued by the server itself.
                    sender.IsMuted = true;
                    sender.MutedUntil = DateTimeOffset.UtcNow.Add(verdict.MuteDuration);
                    await db.SaveChangesAsync();
                    _logger.LogWarning("Spam protection auto-muted {User} for {Minutes} minutes in '{Channel}'",
                        username, (int)verdict.MuteDuration.TotalMinutes, channelName);
                    return $"You have been automatically muted for {(int)verdict.MuteDuration.TotalMinutes} minutes (spam protection).";
                case SpamVerdictKind.Rejected:
                    return verdict.Reason;
            }
        }
        // Replies must target an existing message in the same channel
        Message? replyTarget = null;
        if (replyToMessageId is { } replyId)
        {
            replyTarget = await db.Messages.FirstOrDefaultAsync(m => m.Id == replyId && m.ChannelId == channel.Id);
            if (replyTarget is null)
                return "The message you're replying to no longer exists.";
        }
        // Attempt to fetch link embeds for URLs in the plaintext message
        List<EmbedDto>? embeds = null;
        try
@@ -222,6 +278,7 @@ public class ChatService : IChatService
            SenderUserId = userId,
            SenderUsername = username,
            EmbedJson = dbEmbedJson,
            ReplyToMessageId = replyTarget?.Id,
        };
        db.Messages.Add(message);
@@ -236,9 +293,11 @@ public class ChatService : IChatService
            sender?.NicknameColor,
            channelName,
            message.SentAt,
-            Embeds: embeds);
+            Embeds: embeds,
            SenderDisplayName: sender?.DisplayName,
            ReplyTo: replyTarget is null ? null : BuildReplyRef(replyTarget));
-        await BroadcastToAllAsync(b => b.SendMessageToChannelAsync(channelName, messageDto));
+        await BroadcastToAllAsync(b => b.SendMessageToChannelAsync(channelName, messageDto, originConnectionId));
        _logger.LogDebug("{User} sent message in '{Channel}'", username, channelName);
        return null;
@@ -256,8 +315,29 @@ public class ChatService : IChatService
        return await GetChannelHistoryInternalAsync(db, channelName, count, offset);
    }
    /// <summary>
    /// Builds the wire reference for a reply target. Plaintext snippets are truncated
    /// server-side; end-to-end room ciphertext must pass through whole (a truncated blob
    /// can't be decrypted), so the client truncates those after decrypting.
    /// </summary>
    private ReplyRefDto BuildReplyRef(Message target)
    {
        const int maxSnippetLength = 120;
        // Strip the at-rest layer; E2E room content stays $RC1$ ciphertext
        var plain = _encryption.Decrypt(target.Content);
        if (!RoomCrypto.IsRoomCiphertext(plain) && plain.Length > maxSnippetLength)
            plain = plain[..maxSnippetLength] + "…";
        return new ReplyRefDto(target.Id, target.SenderUsername, _encryption.Encrypt(plain));
    }
    public async Task<string?> UpdateStatusAsync(Guid userId, string username, UserStatus status, string? statusMessage)
    {
        // SignalR happily binds any int to the enum parameter — reject undefined values
        if (!Enum.IsDefined(status))
            return "Invalid status. Use online, away, dnd, or invisible.";
        if (statusMessage is not null && statusMessage.Length > ValidationConstants.MaxStatusMessageLength)
            return $"Status message must not exceed {ValidationConstants.MaxStatusMessageLength} characters.";
@@ -279,7 +359,8 @@ public class ChatService : IChatService
            user.NicknameColor,
            status,
            statusMessage,
-            user.Role);
+            user.Role,
            _presenceTracker.IsIrcOnly(user.Username));
        var channels = _presenceTracker.GetChannelsForUser(username);
        await BroadcastToAllAsync(b => b.SendUserStatusChangedAsync(channels, presence));
@@ -295,16 +376,20 @@ public class ChatService : IChatService
        using var scope = _scopeFactory.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
-        return await db.Users
+        var users = await db.Users
            .Where(u => onlineUsernames.Contains(u.Username) && u.Status != UserStatus.Invisible)
-            .Select(u => new UserPresenceDto(
+            .ToListAsync();
        // IsIrcOnly comes from the in-memory tracker, so map outside the EF query
        return users.Select(u => new UserPresenceDto(
                u.Username,
                u.DisplayName,
                u.NicknameColor,
                u.Status,
                u.StatusMessage,
-                u.Role))
+                u.Role,
-            .ToListAsync();
+                _presenceTracker.IsIrcOnly(u.Username)))
            .ToList();
    }
    public Task BroadcastMessageAsync(string channelName, MessageDto message)
@@ -313,6 +398,9 @@ public class ChatService : IChatService
    public Task BroadcastChannelUpdatedAsync(ChannelDto channel, string? channelName = null)
        => BroadcastToAllAsync(b => b.SendChannelUpdatedAsync(channel, channelName));
    public Task BroadcastChannelDeletedAsync(string channelName)
        => BroadcastToAllAsync(b => b.SendChannelDeletedAsync(channelName));
    private async Task BroadcastToAllAsync(Func<IChatBroadcaster, Task> action)
    {
        foreach (var broadcaster in _broadcasters)
@@ -372,19 +460,33 @@ public class ChatService : IChatService
        if (channel is null)
            return [];
        // Left join: tombstoned messages (deleted accounts, SenderUserId cleared) must
        // still appear in history — an inner join would silently drop them.
        var raw = await db.Messages
            .Where(m => m.ChannelId == channel.Id)
            .OrderByDescending(m => m.SentAt)
            .Skip(offset)
            .Take(count)
-            .Join(db.Users,
+            .GroupJoin(db.Users,
                m => m.SenderUserId,
                u => u.Id,
-                (m, u) => new { m, u.NicknameColor })
+                (m, users) => new { m, users })
            .SelectMany(x => x.users.DefaultIfEmpty(),
                (x, u) => new { x.m, NicknameColor = u != null ? u.NicknameColor : null, DisplayName = u != null ? u.DisplayName : null })
            .ToListAsync();
        raw.Reverse();
        // Reply targets referenced by this batch, for quote snippets
        var replyIds = raw
            .Where(x => x.m.ReplyToMessageId.HasValue)
            .Select(x => x.m.ReplyToMessageId!.Value)
            .Distinct()
            .ToList();
        var replyTargets = replyIds.Count > 0
            ? (await db.Messages.Where(m => replyIds.Contains(m.Id)).ToListAsync()).ToDictionary(m => m.Id)
            : new Dictionary<Guid, Message>();
        var messageIds = raw.Select(x => x.m.Id).ToList();
        var attachmentsByMessage = (await db.Attachments
                .Where(a => messageIds.Contains(a.MessageId))
@@ -448,7 +550,11 @@ public class ChatService : IChatService
                channelName,
                x.m.SentAt,
                attachments,
-                embeds));
+                embeds,
                x.DisplayName,
                x.m.ReplyToMessageId is { } rid && replyTargets.TryGetValue(rid, out var replyTarget)
                    ? BuildReplyRef(replyTarget)
                    : null));
        }
        // Lazily delete the pruned messages (+ their attachment rows) as they're encountered.
@@ -15,8 +15,10 @@ public sealed class FileCleanupService : BackgroundService
    {
        var intervalHours = _configuration.GetValue("Storage:CleanupIntervalHours", 1);
        var retentionDays = _configuration.GetValue("Storage:RetentionDays", 30);
-        var storagePath = _configuration["Storage:Path"]
+        var configuredPath = _configuration["Storage:Path"];
-            ?? Path.Combine(AppContext.BaseDirectory, "uploads");
+        var storagePath = !string.IsNullOrWhiteSpace(configuredPath)
            ? configuredPath
            : Path.Combine(AppContext.BaseDirectory, "uploads");
        _logger.LogInformation(
            "File cleanup service started — interval: {Hours}h, retention: {Days}d, path: {Path}",
@@ -6,8 +6,11 @@ public class FileStorageService
    public FileStorageService(IConfiguration configuration)
    {
-        _storagePath = configuration["Storage:Path"]
+        // Empty string (example config placeholder) means "unset", same as missing
-            ?? Path.Combine(AppContext.BaseDirectory, "uploads");
+        var configured = configuration["Storage:Path"];
        _storagePath = !string.IsNullOrWhiteSpace(configured)
            ? configured
            : Path.Combine(AppContext.BaseDirectory, "uploads");
        if (!Directory.Exists(_storagePath))
        {
@@ -1,4 +1,5 @@
 using System.Collections.Concurrent;
 using EchoHub.Core.Constants;
 namespace EchoHub.Server.Services;
@@ -174,6 +175,20 @@ public class PresenceTracker
        return _userConnections.TryGetValue(username, out var connections) && connections.Count > 0;
    }
    /// <summary>
    /// True when the user is online exclusively through the IRC gateway. A user who also has a
    /// native client connected has full features, so they don't count as IRC-only.
    /// </summary>
    public bool IsIrcOnly(string username)
    {
        lock (_lock)
        {
            return _userConnections.TryGetValue(username, out var connections)
                && connections.Count > 0
                && connections.All(c => c.StartsWith(HubConstants.IrcConnectionIdPrefix, StringComparison.Ordinal));
        }
    }
    public int GetOnlineUserCount()
    {
        return _userConnections.Count;
@@ -20,7 +20,9 @@ public class SignalRBroadcaster : IChatBroadcaster
        _presenceTracker = presenceTracker;
    }
-    public Task SendMessageToChannelAsync(string channelName, MessageDto message)
+    // The exclusion only applies to the IRC gateway (SignalR clients render their own
    // message from the broadcast echo), so the id is ignored here.
    public Task SendMessageToChannelAsync(string channelName, MessageDto message, string? excludeConnectionId = null)
        => HubContext.Clients.Group(channelName).ReceiveMessage(message);
    public Task SendUserJoinedAsync(string channelName, string username, UserPresenceDto? presence, string? excludeConnectionId = null)
@@ -63,6 +65,9 @@ public class SignalRBroadcaster : IChatBroadcaster
    public Task SendMessageDeletedAsync(string channelName, Guid messageId)
        => HubContext.Clients.Group(channelName).MessageDeleted(channelName, messageId);
    public Task SendChannelDeletedAsync(string channelName)
        => HubContext.Clients.All.ChannelDeleted(channelName);
    public Task SendChannelNukedAsync(string channelName)
        => HubContext.Clients.Group(channelName).ChannelNuked(channelName);
@@ -0,0 +1,187 @@
 using EchoHub.Core.Models;
 using EchoHub.Server.Config;
 namespace EchoHub.Server.Services;
 public enum SpamVerdictKind
 {
    Allowed,
    Rejected,
    /// <summary>The user crossed the violation threshold — the caller should apply a timed mute.</summary>
    AutoMute,
 }
 public readonly record struct SpamVerdict(SpamVerdictKind Kind, string? Reason = null, TimeSpan MuteDuration = default)
 {
    public static readonly SpamVerdict Allowed = new(SpamVerdictKind.Allowed);
 }
 /// <summary>
 /// In-memory, per-user spam protection consulted from <see cref="ChatService"/> (messages,
 /// joins) and <see cref="ChannelService"/> (channel creation), so every ingress protocol —
 /// SignalR and IRC alike — shares the same limits. State is per-process and never persisted;
 /// auto-mutes land in the normal mute store. Operates only on content the server already
 /// stores (for end-to-end encrypted rooms that is ciphertext) — nothing is decrypted.
 /// </summary>
 public sealed class SpamGuard
 {
    private readonly SpamOptions _options;
    private readonly Lock _lock = new();
    private readonly Dictionary<Guid, UserState> _users = [];
    // Lazy stale-state pruning so the dictionary can't grow unbounded on busy servers
    private const int PruneThreshold = 512;
    private static readonly TimeSpan StaleAfter = TimeSpan.FromMinutes(30);
    public SpamGuard(SpamOptions options)
    {
        _options = options;
    }
    public bool Enabled => _options.Enabled;
    private sealed class UserState
    {
        public readonly Queue<DateTimeOffset> MessageTimes = new();
        public readonly Queue<DateTimeOffset> JoinTimes = new();
        public readonly Queue<DateTimeOffset> CreateTimes = new();
        public readonly Queue<DateTimeOffset> Violations = new();
        public string? LastContent;
        public int RepeatCount;
        public DateTimeOffset LastSeen;
    }
    /// <summary>
    /// Checks a message send. Rejections count as violations; enough violations inside the
    /// violation window escalate to <see cref="SpamVerdictKind.AutoMute"/> (evaluated only on
    /// rejected messages, so a clean message never mutes anyone).
    /// </summary>
    public SpamVerdict CheckMessage(Guid userId, ServerRole role, string content, DateTimeOffset? nowOverride = null)
    {
        if (!_options.Enabled || role >= ServerRole.Mod)
            return SpamVerdict.Allowed;
        var now = nowOverride ?? DateTimeOffset.UtcNow;
        lock (_lock)
        {
            var state = GetState(userId, now);
            // Flood: attempts count too — a client hammering retries must actually pause
            Prune(state.MessageTimes, now - TimeSpan.FromSeconds(_options.WindowSeconds));
            state.MessageTimes.Enqueue(now);
            if (state.MessageTimes.Count > _options.MaxMessagesPerWindow)
                return Reject(state, now, "You're sending messages too fast — slow down.");
            // Duplicates: identical (trimmed, case-insensitive) content repeated back-to-back
            var normalized = content.Trim().ToLowerInvariant();
            if (normalized == state.LastContent)
            {
                if (state.RepeatCount >= _options.MaxDuplicateMessages)
                    return Reject(state, now, "Duplicate message — say something new.");
                state.RepeatCount++;
            }
            else
            {
                state.LastContent = normalized;
                state.RepeatCount = 1;
            }
            return SpamVerdict.Allowed;
        }
    }
    /// <summary>Checks a channel join. Rejections count as violations but never auto-mute.</summary>
    public SpamVerdict CheckJoin(Guid userId, ServerRole role, DateTimeOffset? nowOverride = null)
    {
        return CheckWindow(userId, role, nowOverride,
            s => s.JoinTimes,
            TimeSpan.FromSeconds(_options.JoinWindowSeconds),
            _options.MaxJoinsPerWindow,
            "You're joining channels too fast — slow down.");
    }
    /// <summary>Checks a channel creation. Rejections count as violations but never auto-mute.</summary>
    public SpamVerdict CheckChannelCreate(Guid userId, ServerRole role, DateTimeOffset? nowOverride = null)
    {
        return CheckWindow(userId, role, nowOverride,
            s => s.CreateTimes,
            TimeSpan.FromMinutes(_options.ChannelCreateWindowMinutes),
            _options.MaxChannelCreatesPerWindow,
            "You're creating channels too fast — try again later.");
    }
    private SpamVerdict CheckWindow(Guid userId, ServerRole role, DateTimeOffset? nowOverride,
        Func<UserState, Queue<DateTimeOffset>> queueSelector, TimeSpan window, int max, string reason)
    {
        if (!_options.Enabled || role >= ServerRole.Mod)
            return SpamVerdict.Allowed;
        var now = nowOverride ?? DateTimeOffset.UtcNow;
        lock (_lock)
        {
            var state = GetState(userId, now);
            var queue = queueSelector(state);
            Prune(queue, now - window);
            queue.Enqueue(now);
            if (queue.Count > max)
            {
                RecordViolation(state, now);
                return new SpamVerdict(SpamVerdictKind.Rejected, reason);
            }
            return SpamVerdict.Allowed;
        }
    }
    /// <summary>
    /// Records a violation and decides between plain rejection and auto-mute escalation.
    /// On escalation the violation history is cleared so the user starts fresh post-mute.
    /// </summary>
    private SpamVerdict Reject(UserState state, DateTimeOffset now, string reason)
    {
        RecordViolation(state, now);
        if (_options.AutoMuteMinutes > 0 && state.Violations.Count >= _options.ViolationThreshold)
        {
            state.Violations.Clear();
            return new SpamVerdict(SpamVerdictKind.AutoMute, reason,
                TimeSpan.FromMinutes(_options.AutoMuteMinutes));
        }
        return new SpamVerdict(SpamVerdictKind.Rejected, reason);
    }
    private void RecordViolation(UserState state, DateTimeOffset now)
    {
        Prune(state.Violations, now - TimeSpan.FromMinutes(_options.ViolationWindowMinutes));
        state.Violations.Enqueue(now);
    }
    private UserState GetState(Guid userId, DateTimeOffset now)
    {
        if (_users.Count > PruneThreshold)
        {
            foreach (var stale in _users.Where(kv => now - kv.Value.LastSeen > StaleAfter).Select(kv => kv.Key).ToList())
                _users.Remove(stale);
        }
        if (!_users.TryGetValue(userId, out var state))
        {
            state = new UserState();
            _users[userId] = state;
        }
        state.LastSeen = now;
        return state;
    }
    private static void Prune(Queue<DateTimeOffset> queue, DateTimeOffset cutoff)
    {
        while (queue.Count > 0 && queue.Peek() < cutoff)
            queue.Dequeue();
    }
 }
@@ -11,13 +11,24 @@ namespace EchoHub.Server.Services;
 public class UserService : IUserService
 {
    private readonly IServiceScopeFactory _scopeFactory;
    private readonly IConfiguration _configuration;
-    public UserService(IServiceScopeFactory scopeFactory)
+    public UserService(IServiceScopeFactory scopeFactory, IConfiguration configuration)
    {
        _scopeFactory = scopeFactory;
        _configuration = configuration;
    }
-    public async Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null)
+    /// <summary>Registration mode from config: "open" (default), "invite", or "closed".</summary>
    public string RegistrationMode =>
        (_configuration["Server:Registration"] ?? "open").Trim().ToLowerInvariant() switch
        {
            "invite" => "invite",
            "closed" => "closed",
            _ => "open",
        };
    public async Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null, string? inviteCode = null)
    {
        if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
            return UserOperationResult.Fail(UserError.ValidationFailed, "Username and password are required.");
@@ -35,6 +46,10 @@ public class UserService : IUserService
        var normalizedUsername = username.ToLowerInvariant().Trim();
        // Reserved: deleted accounts' messages are re-attributed to this name
        if (normalizedUsername == Controllers.UsersController.DeletedUserName)
            return UserOperationResult.Fail(UserError.ValidationFailed, "This username is reserved.");
        using var scope = _scopeFactory.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
@@ -43,6 +58,24 @@ public class UserService : IUserService
        var isFirstUser = !await db.Users.AnyAsync();
        // Registration gate. The very first account (server owner bootstrap) is always allowed —
        // otherwise a fresh invite/closed server could never mint its first admin.
        if (!isFirstUser)
        {
            switch (RegistrationMode)
            {
                case "closed":
                    return UserOperationResult.Fail(UserError.ValidationFailed,
                        "Registration is closed on this server.");
                case "invite":
                    var inviteError = await TryConsumeInviteAsync(db, inviteCode);
                    if (inviteError is not null)
                        return UserOperationResult.Fail(UserError.ValidationFailed, inviteError);
                    break;
            }
        }
        var user = new User
        {
            Id = Guid.NewGuid(),
@@ -58,6 +91,32 @@ public class UserService : IUserService
        return UserOperationResult.Success(ToProfileDto(user));
    }
    /// <summary>
    /// Validates and consumes one use of an invite code. Returns an error message, or null on
    /// success. The increment is a guarded UPDATE so two racing registrations can't both take
    /// a code's last use.
    /// </summary>
    private static async Task<string?> TryConsumeInviteAsync(EchoHubDbContext db, string? inviteCode)
    {
        if (string.IsNullOrWhiteSpace(inviteCode))
            return "Registration is invite-only on this server. An invite code is required.";
        var code = inviteCode.Trim().ToUpperInvariant();
        var invite = await db.InviteCodes.FirstOrDefaultAsync(i => i.Code == code);
        if (invite is null || invite.UseCount >= invite.MaxUses)
            return "Invalid invite code.";
        if (invite.ExpiresAt.HasValue && invite.ExpiresAt.Value <= DateTimeOffset.UtcNow)
            return "This invite code has expired.";
        var consumed = await db.InviteCodes
            .Where(i => i.Id == invite.Id && i.UseCount < i.MaxUses)
            .ExecuteUpdateAsync(s => s.SetProperty(i => i.UseCount, i => i.UseCount + 1));
        return consumed == 1 ? null : "Invalid invite code.";
    }
    public async Task<UserOperationResult> AuthenticateUserAsync(string username, string password)
    {
        if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
@@ -14,9 +14,12 @@
    "PublicServer": false,
    "PublicHosts": [],
    "Tags": [],
-    "Admins": []
+    "Admins": [],
    "Registration": "open",
    "DirectoryClaimPath": ""
  },
  "Storage": {
    "Path": "",
    "CleanupIntervalHours": 1,
    "RetentionDays": 30
  },
@@ -27,6 +30,19 @@
    "MaxAvatarSizeMB": 2,
    "MaxAttachmentsPerMessage": 10
  },
  "Spam": {
    "Enabled": true,
    "MaxMessagesPerWindow": 8,
    "WindowSeconds": 5,
    "MaxDuplicateMessages": 3,
    "AutoMuteMinutes": 5,
    "ViolationThreshold": 5,
    "ViolationWindowMinutes": 5,
    "MaxJoinsPerWindow": 25,
    "JoinWindowSeconds": 30,
    "MaxChannelCreatesPerWindow": 3,
    "ChannelCreateWindowMinutes": 10
  },
  "Encryption": {
    "Key": "",
    "EncryptDatabase": false
@@ -39,7 +55,11 @@
    "TlsCertPath": "",
    "TlsCertPassword": "",
    "ServerName": "echohub",
-    "Motd": "Welcome to EchoHub IRC Gateway!"
+    "Motd": "Welcome to EchoHub IRC Gateway!",
    "PublicBaseUrl": ""
  },
  "Cors": {
    "AllowedOrigins": []
  },
  "Serilog": {
    "MinimumLevel": {
@@ -0,0 +1,73 @@
 using EchoHub.Core.Services;
 using Xunit;
 namespace EchoHub.Tests;
 public class AsciiBannerServiceTests
 {
    [Fact]
    public void Render_SimpleText_ProducesFiveRows()
    {
        var banner = AsciiBannerService.Render("hi");
        Assert.NotNull(banner);
        Assert.Equal(5, banner!.Split('\n').Length);
        Assert.Contains("█", banner);
    }
    [Fact]
    public void Render_IsCaseInsensitive()
    {
        Assert.Equal(AsciiBannerService.Render("abc"), AsciiBannerService.Render("ABC"));
    }
    [Fact]
    public void Render_Empty_ReturnsNull()
    {
        Assert.Null(AsciiBannerService.Render(""));
        Assert.Null(AsciiBannerService.Render("   "));
    }
    [Fact]
    public void Render_OnlyUnsupportedChars_ReturnsNull()
    {
        Assert.Null(AsciiBannerService.Render("🦆🦆🦆"));
    }
    [Fact]
    public void Render_UnsupportedCharsSkipped_SupportedRemain()
    {
        var mixed = AsciiBannerService.Render("a🦆b");
        var plain = AsciiBannerService.Render("ab");
        Assert.Equal(plain, mixed);
    }
    [Fact]
    public void Render_InputLongerThanCap_IsTruncatedNotRejected()
    {
        var banner = AsciiBannerService.Render(new string('a', AsciiBannerService.MaxInputLength + 30));
        Assert.NotNull(banner);
        // 20 glyphs of 'A' (4 cols) + 19 separators — sane width, not 50 glyphs
        var firstRow = banner!.Split('\n')[0];
        Assert.True(firstRow.Length <= AsciiBannerService.MaxInputLength * 6);
    }
    [Fact]
    public void Render_DigitsAndPunctuation_Supported()
    {
        Assert.NotNull(AsciiBannerService.Render("42!"));
        Assert.NotNull(AsciiBannerService.Render("v0.2"));
    }
    [Fact]
    public void Render_FitsMessageLimits()
    {
        // Worst case must stay under the server's message length cap
        var banner = AsciiBannerService.Render(new string('w', AsciiBannerService.MaxInputLength));
        Assert.NotNull(banner);
        Assert.True(banner!.Length <= EchoHub.Core.Constants.HubConstants.MaxMessageLength);
    }
 }
@@ -0,0 +1,78 @@
 using EchoHub.Client.Services;
 using EchoHub.Core.Services;
 using SixLabors.ImageSharp;
 using SixLabors.ImageSharp.Formats.Bmp;
 using SixLabors.ImageSharp.PixelFormats;
 using Xunit;
 namespace EchoHub.Tests;
 public class ClipboardImageTests
 {
    /// <summary>
    /// Encodes an image as BMP and strips the 14-byte BITMAPFILEHEADER, producing exactly what
    /// the Windows clipboard hands out as CF_DIB.
    /// </summary>
    private static byte[] MakeDib(Image<Rgba32> image, BmpBitsPerPixel bpp)
    {
        using var ms = new MemoryStream();
        image.Save(ms, new BmpEncoder { BitsPerPixel = bpp });
        return ms.ToArray()[14..];
    }
    private static Image<Rgba32> MakeTestImage()
    {
        var image = new Image<Rgba32>(4, 3);
        image[0, 0] = new Rgba32(255, 0, 0);
        image[3, 2] = new Rgba32(0, 0, 255);
        return image;
    }
    [Theory]
    [InlineData(BmpBitsPerPixel.Pixel24)]
    [InlineData(BmpBitsPerPixel.Pixel32)]
    [InlineData(BmpBitsPerPixel.Pixel8)] // palette-based: exercises the palette offset math
    public void DibToPng_ConvertsDibToValidPng(BmpBitsPerPixel bpp)
    {
        using var original = MakeTestImage();
        var dib = MakeDib(original, bpp);
        var png = ClipboardImage.DibToPng(dib);
        Assert.NotNull(png);
        using var pngStream = new MemoryStream(png);
        Assert.True(FileValidationHelper.IsValidImage(pngStream));
        using var decoded = Image.Load<Rgba32>(png);
        Assert.Equal(original.Width, decoded.Width);
        Assert.Equal(original.Height, decoded.Height);
    }
    [Fact]
    public void DibToPng_PreservesPixels_For24Bpp()
    {
        using var original = MakeTestImage();
        var dib = MakeDib(original, BmpBitsPerPixel.Pixel24);
        var png = ClipboardImage.DibToPng(dib);
        Assert.NotNull(png);
        using var decoded = Image.Load<Rgba32>(png);
        Assert.Equal(new Rgba32(255, 0, 0), decoded[0, 0]);
        Assert.Equal(new Rgba32(0, 0, 255), decoded[3, 2]);
    }
    [Fact]
    public void DibToPng_ReturnsNull_ForTruncatedData()
    {
        Assert.Null(ClipboardImage.DibToPng([0x28, 0x00, 0x00]));
    }
    [Fact]
    public void DibToPng_ReturnsNull_ForGarbageData()
    {
        var garbage = new byte[256];
        new Random(42).NextBytes(garbage);
        Assert.Null(ClipboardImage.DibToPng(garbage));
    }
 }
@@ -83,17 +83,48 @@ public class CommandHandlerTests
    }
    [Fact]
-    public async Task HandleAsync_StatusCustomMessage_SetsStatusMessage()
+    public async Task HandleAsync_StatusMsg_SetsStatusMessageAndKeepsStatus()
    {
        var handler = CreateHandler();
        UserStatus? capturedStatus = UserStatus.Online;
        string? capturedMessage = null;
-        handler.OnSetStatus += (status, msg) => { capturedMessage = msg; return Task.CompletedTask; };
+        handler.OnSetStatus += (status, msg) => { capturedStatus = status; capturedMessage = msg; return Task.CompletedTask; };
-        var result = await handler.HandleAsync("/status brb lunch");
+        var result = await handler.HandleAsync("/status msg brb lunch");
        Assert.True(result.Handled);
        Assert.False(result.IsError);
        Assert.Contains("brb lunch", result.Message);
        Assert.Equal("brb lunch", capturedMessage);
        Assert.Null(capturedStatus); // null = keep the current status
    }
    [Fact]
    public async Task HandleAsync_StatusMsgNoText_ClearsMessage()
    {
        var handler = CreateHandler();
        string? capturedMessage = "sentinel";
        handler.OnSetStatus += (status, msg) => { capturedMessage = msg; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/status msg");
        Assert.False(result.IsError);
        Assert.Contains("cleared", result.Message, StringComparison.OrdinalIgnoreCase);
        Assert.Equal(string.Empty, capturedMessage); // empty = clear
    }
    [Fact]
    public async Task HandleAsync_StatusUnknownValue_IsErrorAndDoesNotFire()
    {
        var handler = CreateHandler();
        var fired = false;
        handler.OnSetStatus += (_, _) => { fired = true; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/status garbage");
        Assert.True(result.IsError);
        Assert.Contains("Unknown status", result.Message);
        Assert.False(fired);
    }
    [Fact]
@@ -106,6 +137,128 @@ public class CommandHandlerTests
        Assert.Contains("Usage", result.Message);
    }
    // ── /me ───────────────────────────────────────────────────────────
    [Fact]
    public async Task HandleAsync_Me_FiresActionEvent()
    {
        var handler = CreateHandler();
        string? captured = null;
        handler.OnSendAction += text => { captured = text; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/me waves at everyone");
        Assert.True(result.Handled);
        Assert.False(result.IsError);
        Assert.Equal("waves at everyone", captured);
    }
    [Fact]
    public async Task HandleAsync_MeNoArgs_ReturnsError()
    {
        var handler = CreateHandler();
        var result = await handler.HandleAsync("/me");
        Assert.True(result.IsError);
        Assert.Contains("Usage", result.Message);
    }
    // ── /banner ───────────────────────────────────────────────────────
    [Fact]
    public async Task HandleAsync_Banner_FiresBannerEvent()
    {
        var handler = CreateHandler();
        string? captured = null;
        handler.OnSendBanner += text => { captured = text; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/banner hi");
        Assert.True(result.Handled);
        Assert.Equal("hi", captured);
    }
    // ── /invite ───────────────────────────────────────────────────────
    [Fact]
    public async Task HandleAsync_Invite_DefaultsFireCreateWithNulls()
    {
        var handler = CreateHandler();
        (int? Uses, int? Hours)? captured = null;
        handler.OnCreateInvite += (uses, hours) => { captured = (uses, hours); return Task.CompletedTask; };
        var result = await handler.HandleAsync("/invite");
        Assert.True(result.Handled);
        Assert.False(result.IsError);
        Assert.Equal((null, null), captured);
    }
    [Fact]
    public async Task HandleAsync_InviteWithArgs_ParsesUsesAndHours()
    {
        var handler = CreateHandler();
        (int? Uses, int? Hours)? captured = null;
        handler.OnCreateInvite += (uses, hours) => { captured = (uses, hours); return Task.CompletedTask; };
        await handler.HandleAsync("/invite 5 48");
        Assert.Equal((5, 48), captured);
    }
    [Fact]
    public async Task HandleAsync_InviteRevoke_FiresRevokeWithCode()
    {
        var handler = CreateHandler();
        string? captured = null;
        handler.OnRevokeInvite += code => { captured = code; return Task.CompletedTask; };
        await handler.HandleAsync("/invite revoke K7QM-3XPF");
        Assert.Equal("K7QM-3XPF", captured);
    }
    [Fact]
    public async Task HandleAsync_InviteBadArgs_ReturnsError()
    {
        var handler = CreateHandler();
        var fired = false;
        handler.OnCreateInvite += (_, _) => { fired = true; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/invite zero");
        Assert.True(result.IsError);
        Assert.False(fired);
    }
    // ── /export, /deleteaccount ───────────────────────────────────────
    [Fact]
    public async Task HandleAsync_Export_FiresExportEvent()
    {
        var handler = CreateHandler();
        var fired = false;
        handler.OnExportData += () => { fired = true; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/export");
        Assert.True(result.Handled);
        Assert.True(fired);
    }
    [Fact]
    public async Task HandleAsync_DeleteAccount_FiresDeleteEvent()
    {
        var handler = CreateHandler();
        var fired = false;
        handler.OnDeleteAccount += () => { fired = true; return Task.CompletedTask; };
        var result = await handler.HandleAsync("/deleteaccount");
        Assert.True(result.Handled);
        Assert.True(fired);
    }
    // ── /nick ─────────────────────────────────────────────────────────
    [Fact]
@@ -62,13 +62,11 @@ public class DataMigrationServiceTests
    }
    [Fact]
-    public void AnsiToColorTags_RoundTrip_WithColorTagsToAnsi()
+    public void AnsiToColorTags_ForegroundBackgroundAndReset_AllConverted()
    {
-        // AnsiToColorTags and IrcMessageFormatter.ColorTagsToAnsi should be inverses
+        var ansi = "\x1b[38;2;255;0;0mred\x1b[48;2;0;255;0mgreen\x1b[0m";
        var original = "{F:FF0000}red{B:00FF00}green{X}";
        var ansi = EchoHub.Server.Irc.IrcMessageFormatter.ColorTagsToAnsi(original);
        var backToTags = DataMigrationService.AnsiToColorTags(ansi);
-        Assert.Equal(original, backToTags);
+        Assert.Equal("{F:FF0000}red{B:00FF00}green{X}", backToTags);
    }
 }
@@ -90,7 +90,7 @@ public class IrcBroadcasterTests
    }
    [Fact]
-    public async Task SendMessage_DecryptsAttachmentAsciiPreview()
+    public async Task SendMessage_ImageAttachment_SendsLinkLineOnly()
    {
        var (_, stream) = AddConnectionWithCapture("bob", "general");
@@ -104,30 +104,47 @@ public class IrcBroadcasterTests
        await _broadcaster.SendMessageToChannelAsync("general", message);
        var output = stream.GetOutputLines();
-        Assert.Contains(output, l => l.Contains("[Image: photo.png]"));
+        Assert.Contains(output, l => l.Contains("[Image: photo.png]") && l.Contains("/api/files/abc"));
-        Assert.Contains(output, l => l.Contains("line1"));
+        // ASCII preview art is never sent to IRC clients — images are links only
-        Assert.Contains(output, l => l.Contains("line2"));
+        Assert.DoesNotContain(output, l => l.Contains("line1"));
        Assert.DoesNotContain(output, l => l.Contains("$ENC$"));
    }
    [Fact]
-    public async Task SendMessage_SkipsSender()
+    public async Task SendMessage_SkipsOnlyOriginConnection()
    {
-        var (_, aliceStream) = AddConnectionWithCapture("alice", "general");
+        var (aliceConn, aliceStream) = AddConnectionWithCapture("alice", "general");
        var (_, bobStream) = AddConnectionWithCapture("bob", "general");
        var message = new MessageDto(
            Guid.NewGuid(), _encryption.Encrypt("Hi"), "alice", null, "general", DateTimeOffset.UtcNow);
-        await _broadcaster.SendMessageToChannelAsync("general", message);
+        await _broadcaster.SendMessageToChannelAsync("general", message, aliceConn.ConnectionId);
-        // Alice (sender) should NOT receive the message
+        // The connection that sent it should NOT get an echo
        Assert.Empty(aliceStream.GetOutputLines());
        // Bob should receive it
        Assert.NotEmpty(bobStream.GetOutputLines());
    }
    [Fact]
    public async Task SendMessage_SendersOtherSessionsStillReceive()
    {
        // Same account online twice (e.g. TUI + IRC, or two IRC clients): a message sent
        // from one session must still reach the other — skipping by nickname used to
        // swallow these until the IRC client reconnected.
        var (_, ircStream) = AddConnectionWithCapture("alice", "general");
        var message = new MessageDto(
            Guid.NewGuid(), _encryption.Encrypt("sent from the TUI"), "alice", null, "general", DateTimeOffset.UtcNow);
        // Origin is a SignalR connection, not this IRC one
        await _broadcaster.SendMessageToChannelAsync("general", message, "signalr-conn-123");
        Assert.Contains(ircStream.GetOutputLines(), l => l.Contains("sent from the TUI"));
    }
    [Fact]
    public async Task SendMessage_OnlySendsToChannelMembers()
    {
@@ -118,37 +118,50 @@ public class IrcMessageFormatterTests
    }
    [Fact]
-    public void FormatMessage_ImageMessage_IncludesAsciiArt()
+    public void FormatMessage_ImageMessage_NeverEmitsAsciiArt()
    {
-        var msg = CreateImageMessage("line1\nline2");
+        // Images are shared as plain links (the common IRC practice) — never color art,
        // regardless of what the preview contains.
        var msg = CreateImageMessage("{F:FF0000}█{X}\nline2");
        var lines = IrcMessageFormatter.FormatMessage(msg);
-        Assert.Contains(lines, l => l.Contains("line1"));
+        Assert.Single(lines);
-        Assert.Contains(lines, l => l.Contains("line2"));
+        Assert.Contains("[Image: image.png]", lines[0]);
        Assert.DoesNotContain(lines, l => l.Contains("line2"));
    }
    [Fact]
-    public void FormatMessage_ImageMessage_SkipsEmptyAsciiLines()
+    public void FormatMessage_RelativeUrl_JoinedWithPublicBaseUrl()
    {
-        var msg = CreateImageMessage("line1\n\nline2");
+        var msg = CreateImageMessage("art", "photo.jpg", "/api/files/abc");
-        var lines = IrcMessageFormatter.FormatMessage(msg);
+        var lines = IrcMessageFormatter.FormatMessage(msg, "https://chat.example.com");
-        // Empty lines should be skipped
+        Assert.Single(lines);
-        var asciiLines = lines.Where(l => !l.Contains("[Image:") && !l.Contains("Download:")).ToList();
+        Assert.Contains("https://chat.example.com/api/files/abc", lines[0]);
        Assert.Equal(2, asciiLines.Count);
    }
-    [Theory]
+    [Fact]
-    [InlineData("$ENC$v1$abc123$def456")] // transport ciphertext a broadcast path forgot to decrypt
+    public void FormatMessage_AbsoluteUrl_NotRewrittenByPublicBaseUrl()
    [InlineData("$RC1$abc123def456")]     // E2E room ciphertext the server cannot decrypt
    public void FormatMessage_ImageMessage_SkipsCiphertextPreview(string ciphertextPreview)
    {
-        var msg = CreateImageMessage(ciphertextPreview, "photo.jpg", "https://example.com/photo.jpg");
+        var msg = CreateImageMessage("art", "photo.jpg", "https://cdn.example.com/photo.jpg");
-        var lines = IrcMessageFormatter.FormatMessage(msg);
+        var lines = IrcMessageFormatter.FormatMessage(msg, "https://chat.example.com");
-        // Only the [Image: ...] header line — never the ciphertext blob
+        Assert.Contains("https://cdn.example.com/photo.jpg", lines[0]);
-        Assert.Single(lines);
+        Assert.DoesNotContain("https://chat.example.com", lines[0]);
-        Assert.Contains("[Image: photo.jpg]", lines[0]);
+    }
    [Fact]
    public void ToAbsoluteUrl_NoBaseUrl_ReturnsRelativeUnchanged()
    {
        Assert.Equal("/api/files/abc", IrcMessageFormatter.ToAbsoluteUrl("/api/files/abc", null));
        Assert.Equal("/api/files/abc", IrcMessageFormatter.ToAbsoluteUrl("/api/files/abc", "  "));
    }
    [Fact]
    public void ToAbsoluteUrl_TrailingSlashBase_JoinsWithoutDoubleSlash()
    {
        Assert.Equal("https://x.example/api/files/1",
            IrcMessageFormatter.ToAbsoluteUrl("/api/files/1", "https://x.example/"));
    }
    [Fact]
@@ -244,62 +257,4 @@ public class IrcMessageFormatterTests
        }
    }
    // ── ColorTagsToAnsi ──────────────────────────────────────────────────
    [Fact]
    public void ColorTagsToAnsi_NoTags_ReturnsUnchanged()
    {
        Assert.Equal("Hello world", IrcMessageFormatter.ColorTagsToAnsi("Hello world"));
    }
    [Fact]
    public void ColorTagsToAnsi_ForegroundTag_ConvertsToAnsi()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:FF0000}Red text");
        Assert.Equal("\x1b[38;2;255;0;0mRed text", result);
    }
    [Fact]
    public void ColorTagsToAnsi_BackgroundTag_ConvertsToAnsi()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{B:00FF00}Green bg");
        Assert.Equal("\x1b[48;2;0;255;0mGreen bg", result);
    }
    [Fact]
    public void ColorTagsToAnsi_ResetTag_ConvertsToReset()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:FF0000}Red{X} Normal");
        Assert.Equal("\x1b[38;2;255;0;0mRed\x1b[0m Normal", result);
    }
    [Fact]
    public void ColorTagsToAnsi_MultipleTags_ConvertsAll()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:FF0000}Red {F:0000FF}Blue{X}");
        Assert.Contains("\x1b[38;2;255;0;0m", result);
        Assert.Contains("\x1b[38;2;0;0;255m", result);
        Assert.Contains("\x1b[0m", result);
    }
    [Fact]
    public void ColorTagsToAnsi_LowercaseHex_ConvertsCorrectly()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:ff8800}text");
        Assert.Equal("\x1b[38;2;255;136;0mtext", result);
    }
    [Fact]
    public void ColorTagsToAnsi_NoBraces_SkipsProcessing()
    {
        var text = "plain text without braces";
        Assert.Equal(text, IrcMessageFormatter.ColorTagsToAnsi(text));
    }
    [Fact]
    public void ColorTagsToAnsi_ExistingAnsiCodes_PreservesUnchanged()
    {
        var text = "\x1b[31mAlready colored\x1b[0m";
        Assert.Equal(text, IrcMessageFormatter.ColorTagsToAnsi(text));
    }
 }
@@ -188,7 +188,7 @@ internal sealed class FakeChatService : IChatService
        return Task.CompletedTask;
    }
-    public Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content)
+    public Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content, string? originConnectionId = null, Guid? replyToMessageId = null)
    {
        SentMessages.Add((channelName, content));
        return Task.FromResult(SendMessageError);
@@ -212,6 +212,9 @@ internal sealed class FakeChatService : IChatService
    public Task BroadcastChannelUpdatedAsync(ChannelDto channel, string? channelName = null) =>
        Task.CompletedTask;
    public Task BroadcastChannelDeletedAsync(string channelName) =>
        Task.CompletedTask;
    public Task<List<string>> GetChannelsForUserAsync(string username) =>
        Task.FromResult(ChannelsForUserToReturn);
 }
@@ -302,9 +305,14 @@ internal sealed class FakeUserService : IUserService
        Task.FromResult(AuthResult
            ?? UserOperationResult.Fail(UserError.InvalidCredentials, "Invalid username or password."));
-    public Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null) =>
+    public List<string?> RegisterInviteCodes { get; } = [];
-        Task.FromResult(RegisterResult
+
    public Task<UserOperationResult> RegisterUserAsync(string username, string password, string? displayName = null, string? inviteCode = null)
    {
        RegisterInviteCodes.Add(inviteCode);
        return Task.FromResult(RegisterResult
            ?? UserOperationResult.Fail(UserError.AlreadyExists, "Username is already taken."));
    }
    public Task<UserProfileDto?> GetUserProfileAsync(string username) =>
        Task.FromResult(ProfileToReturn);
@@ -12,7 +12,8 @@ public class IrcMessageFormatterTests
        string sender = "alice",
        string channel = "general",
        List<AttachmentDto>? attachments = null,
-        List<EmbedDto>? embeds = null) => new(
+        List<EmbedDto>? embeds = null,
        ReplyRefDto? replyTo = null) => new(
        Id: Guid.NewGuid(),
        Content: content,
        SenderUsername: sender,
@@ -20,7 +21,81 @@ public class IrcMessageFormatterTests
        ChannelName: channel,
        SentAt: DateTimeOffset.UtcNow,
        Attachments: attachments,
-        Embeds: embeds);
+        Embeds: embeds,
        ReplyTo: replyTo);
    // ── CTCP ACTION (/me) ───────────────────────────────────
    [Fact]
    public void FormatMessage_ActionContent_EmitsCtcpAction()
    {
        var msg = CreateMessage(content: "\u0001ACTION waves at everyone\u0001");
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.Single(lines);
        Assert.Contains("PRIVMSG #general :\u0001ACTION waves at everyone\u0001", lines[0]);
    }
    [Fact]
    public void FormatMessage_LongActionContent_EachChunkIsWellFormedCtcp()
    {
        var longText = string.Join(' ', Enumerable.Repeat("wordyword", 80));
        var msg = CreateMessage(content: "\u0001ACTION " + longText + "\u0001");
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.True(lines.Count > 1);
        foreach (var line in lines)
        {
            var payload = line[(line.IndexOf(" :", StringComparison.Ordinal) + 2)..];
            Assert.StartsWith("\u0001ACTION ", payload);
            Assert.EndsWith("\u0001", payload);
        }
    }
    // ── Replies ───────────────────────────────────────────
    [Fact]
    public void FormatMessage_Reply_PrefixesQuoteConvention()
    {
        var reply = new ReplyRefDto(Guid.NewGuid(), "bob", "the original text");
        var msg = CreateMessage(content: "I agree", replyTo: reply);
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.Single(lines);
        Assert.Contains("PRIVMSG #general :> bob: the original text | I agree", lines[0]);
    }
    [Fact]
    public void FormatMessage_ReplyToLongMessage_SnippetTruncated()
    {
        var reply = new ReplyRefDto(Guid.NewGuid(), "bob", new string('x', 300));
        var msg = CreateMessage(content: "ok", replyTo: reply);
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.Single(lines);
        Assert.Contains("… | ok", lines[0]);
        Assert.DoesNotContain(new string('x', 100), lines[0]);
    }
    [Fact]
    public void FormatMessage_ReplyToEncryptedContent_ShowsPlaceholder()
    {
        var reply = new ReplyRefDto(Guid.NewGuid(), "bob", "$RC1$AAAA$BBBB$CCCC");
        var msg = CreateMessage(content: "ok", replyTo: reply);
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.Contains("> bob: [encrypted] | ok", lines[0]);
    }
    [Fact]
    public void FormatMessage_ReplyToAction_SnippetRendersAsAction()
    {
        var reply = new ReplyRefDto(Guid.NewGuid(), "bob", "\u0001ACTION waves\u0001");
        var msg = CreateMessage(content: "nice wave", replyTo: reply);
        var lines = IrcMessageFormatter.FormatMessage(msg);
        Assert.Contains("> bob: * bob waves | nice wave", lines[0]);
    }
    // ── FormatMessage ─────────────────────────────────────────────────
@@ -59,11 +134,24 @@ public class IrcMessageFormatterTests
            attachments: [new AttachmentDto(AttachmentKind.Image, "/api/files/abc", "photo.png", 0, "{F:FF0000}█{X}")]);
        var lines = IrcMessageFormatter.FormatMessage(msg);
-        Assert.True(lines.Count >= 2);
+        // Images are a single link line — the ASCII preview is never sent to IRC clients
        Assert.Single(lines);
        Assert.Contains("[Image: photo.png]", lines[0]);
        Assert.Contains("/api/files/abc", lines[0]);
    }
    [Fact]
    public void FormatMessage_WithPublicBaseUrl_EmitsAbsoluteAttachmentLinks()
    {
        var msg = CreateMessage(
            content: "",
            attachments: [new AttachmentDto(AttachmentKind.Image, "/api/files/abc", "photo.png", 0, null)]);
        var lines = IrcMessageFormatter.FormatMessage(msg, "https://chat.example.com/");
        Assert.Single(lines);
        Assert.Contains("https://chat.example.com/api/files/abc", lines[0]);
    }
    [Fact]
    public void FormatMessage_FileAttachment_IncludesFileTag()
    {
@@ -121,48 +209,6 @@ public class IrcMessageFormatterTests
        Assert.Contains(lines, l => l.Contains("[File: c.pdf]"));
    }
    // ── ColorTagsToAnsi ───────────────────────────────────────────────
    [Fact]
    public void ColorTagsToAnsi_ForegroundTag_ConvertsToAnsiEscape()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:FF0000}text");
        Assert.Contains("\x1b[38;2;255;0;0m", result);
        Assert.Contains("text", result);
    }
    [Fact]
    public void ColorTagsToAnsi_BackgroundTag_ConvertsToAnsiEscape()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{B:00FF00}text");
        Assert.Contains("\x1b[48;2;0;255;0m", result);
    }
    [Fact]
    public void ColorTagsToAnsi_ResetTag_ConvertsToAnsiReset()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{X}");
        Assert.Equal("\x1b[0m", result);
    }
    [Fact]
    public void ColorTagsToAnsi_NoTags_ReturnsUnchanged()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("plain text");
        Assert.Equal("plain text", result);
    }
    [Fact]
    public void ColorTagsToAnsi_MultipleTags_ConvertsAll()
    {
        var result = IrcMessageFormatter.ColorTagsToAnsi("{F:FF0000}red{F:0000FF}blue{X}");
        Assert.Contains("\x1b[38;2;255;0;0m", result);
        Assert.Contains("\x1b[38;2;0;0;255m", result);
        Assert.Contains("\x1b[0m", result);
        Assert.Contains("red", result);
        Assert.Contains("blue", result);
    }
    // ── SplitMessage ──────────────────────────────────────────────────
    [Fact]
@@ -0,0 +1,44 @@
 using EchoHub.Core.Constants;
 using Xunit;
 namespace EchoHub.Tests;
 public class MessageConventionsTests
 {
    [Fact]
    public void FormatAction_RoundTripsThroughTryParse()
    {
        var wire = MessageConventions.FormatAction("waves at everyone");
        Assert.True(MessageConventions.TryParseAction(wire, out var text));
        Assert.Equal("waves at everyone", text);
    }
    [Fact]
    public void FormatAction_UsesCtcpDelimiters()
    {
        var wire = MessageConventions.FormatAction("waves");
        // Exact IRC CTCP ACTION wire shape: \x01ACTION waves\x01
        Assert.Equal("\u0001ACTION waves\u0001", wire);
    }
    [Fact]
    public void TryParseAction_PlainText_ReturnsFalse()
    {
        Assert.False(MessageConventions.TryParseAction("hello world", out _));
    }
    [Fact]
    public void TryParseAction_TextStartingWithWordAction_ReturnsFalse()
    {
        // A user typing "ACTION stations!" is not a /me
        Assert.False(MessageConventions.TryParseAction("ACTION stations!", out _));
    }
    [Fact]
    public void TryParseAction_EmptyAction_ReturnsFalse()
    {
        Assert.False(MessageConventions.TryParseAction("\u0001ACTION \u0001", out _));
    }
 }
@@ -1,3 +1,4 @@
 using EchoHub.Core.Constants;
 using EchoHub.Server.Services;
 using Xunit;
@@ -65,4 +66,48 @@ public class PresenceTrackerTests
        Assert.Contains("general", channels);
        Assert.Contains("random", channels);
    }
    [Fact]
    public void IsIrcOnly_AllConnectionsIrc_ReturnsTrue()
    {
        var tracker = new PresenceTracker();
        tracker.UserConnected($"{HubConstants.IrcConnectionIdPrefix}conn1", Guid.NewGuid(), "alice");
        Assert.True(tracker.IsIrcOnly("alice"));
    }
    [Fact]
    public void IsIrcOnly_NativeConnection_ReturnsFalse()
    {
        var tracker = new PresenceTracker();
        tracker.UserConnected("conn1", Guid.NewGuid(), "alice");
        Assert.False(tracker.IsIrcOnly("alice"));
    }
    [Fact]
    public void IsIrcOnly_MixedConnections_ReturnsFalse()
    {
        var tracker = new PresenceTracker();
        var userId = Guid.NewGuid();
        tracker.UserConnected($"{HubConstants.IrcConnectionIdPrefix}conn1", userId, "alice");
        tracker.UserConnected("conn2", userId, "alice");
        Assert.False(tracker.IsIrcOnly("alice"));
    }
    [Fact]
    public void IsIrcOnly_OfflineUser_ReturnsFalse()
    {
        var tracker = new PresenceTracker();
        Assert.False(tracker.IsIrcOnly("nobody"));
    }
    [Fact]
    public void IsIrcOnly_NativeConnectionDisconnects_BecomesTrue()
    {
        var tracker = new PresenceTracker();
        var userId = Guid.NewGuid();
        tracker.UserConnected($"{HubConstants.IrcConnectionIdPrefix}conn1", userId, "alice");
        tracker.UserConnected("conn2", userId, "alice");
        tracker.UserDisconnected("conn2");
        Assert.True(tracker.IsIrcOnly("alice"));
    }
 }
@@ -0,0 +1,168 @@
 using System.Security.Cryptography;
 using EchoHub.Client.Services;
 using EchoHub.Core.Security;
 using Xunit;
 namespace EchoHub.Tests;
 /// <summary>
 /// At-rest encryption of the cached room keys (RoomKeyProtector) and the store-level
 /// decisions built on it (RoomKeyStore): fresh envelopes overwrite stale cached keys,
 /// legacy plain-base64 entries are recognized for the one-way migration.
 /// </summary>
 public class RoomKeyProtectorTests : IDisposable
 {
    private readonly string _dir = Directory.CreateTempSubdirectory("echohub-keyprotector-").FullName;
    public void Dispose()
    {
        try { Directory.Delete(_dir, recursive: true); } catch { /* best-effort cleanup */ }
    }
    [Fact]
    public void KeyFile_Protect_RoundTrips()
    {
        var protector = new RoomKeyProtector(_dir, useDpapi: false);
        var key = RoomCrypto.GenerateRoomKey();
        var stored = protector.Protect(key);
        Assert.StartsWith(RoomKeyProtector.KeyFilePrefix, stored);
        Assert.True(protector.TryUnprotect(stored, out var recovered, out var wasLegacy));
        Assert.Equal(key, recovered);
        Assert.False(wasLegacy);
    }
    [Fact]
    public void Dpapi_Protect_RoundTrips()
    {
        if (!OperatingSystem.IsWindows()) return; // DPAPI is Windows-only
        var protector = new RoomKeyProtector(_dir, useDpapi: true);
        var key = RoomCrypto.GenerateRoomKey();
        var stored = protector.Protect(key);
        Assert.StartsWith(RoomKeyProtector.DpapiPrefix, stored);
        Assert.True(protector.TryUnprotect(stored, out var recovered, out var wasLegacy));
        Assert.Equal(key, recovered);
        Assert.False(wasLegacy);
    }
    [Fact]
    public void Protect_DoesNotStoreThePlainKey()
    {
        var protector = new RoomKeyProtector(_dir, useDpapi: false);
        var key = RoomCrypto.GenerateRoomKey();
        var stored = protector.Protect(key);
        Assert.DoesNotContain(Convert.ToBase64String(key), stored);
    }
    [Fact]
    public void Legacy_PlainBase64_IsAccepted_AndFlaggedForMigration()
    {
        var protector = new RoomKeyProtector(_dir, useDpapi: false);
        var key = RoomCrypto.GenerateRoomKey();
        Assert.True(protector.TryUnprotect(Convert.ToBase64String(key), out var recovered, out var wasLegacy));
        Assert.Equal(key, recovered);
        Assert.True(wasLegacy);
        // The migration re-protects it; the upgraded value round-trips and is no longer legacy
        var upgraded = protector.Protect(recovered);
        Assert.True(protector.TryUnprotect(upgraded, out var recoveredAgain, out var stillLegacy));
        Assert.Equal(key, recoveredAgain);
        Assert.False(stillLegacy);
    }
    [Fact]
    public void Malformed_Values_AreRejected()
    {
        var protector = new RoomKeyProtector(_dir, useDpapi: false);
        Assert.False(protector.TryUnprotect("not base64 at all!!", out _, out _));
        Assert.False(protector.TryUnprotect(RoomKeyProtector.KeyFilePrefix + "not base64!!", out _, out _));
        // Valid base64 but not a 32-byte room key → not a usable legacy entry
        Assert.False(protector.TryUnprotect(Convert.ToBase64String([1, 2, 3]), out _, out _));
    }
    [Fact]
    public void KeyFile_Lost_MakesStoredValuesUnreadable_NotThrow()
    {
        var protector = new RoomKeyProtector(_dir, useDpapi: false);
        var stored = protector.Protect(RoomCrypto.GenerateRoomKey());
        File.Delete(Path.Combine(_dir, "roomkeys.key"));
        // A fresh protector regenerates a different master key — the value must fail
        // cleanly (entry dropped, passphrase prompt recovers it), not throw
        var fresh = new RoomKeyProtector(_dir, useDpapi: false);
        Assert.False(fresh.TryUnprotect(stored, out _, out _));
    }
 }
 public class RoomKeyStoreEnvelopeTests
 {
    // Note: without LoadForServer the store never touches the config file on disk —
    // these tests exercise the in-memory decision logic only.
    private static RoomKeyStore NewStore() =>
        new(new RoomKeyProtector(Path.Combine(Path.GetTempPath(), "echohub-unused"), useDpapi: false));
    [Fact]
    public void TryStoreFromEnvelope_FreshEnvelope_OverwritesStaleCachedKey()
    {
        var store = NewStore();
        var stale = RoomCrypto.GenerateRoomKey();
        store.StoreKey("vault", stale);
        // Channel deleted and recreated under the same name → new room key, new envelope
        var fresh = RoomCrypto.GenerateRoomKey();
        var kek = RandomNumberGenerator.GetBytes(32);
        var wrapped = RoomCrypto.WrapRoomKey(fresh, kek);
        Assert.True(store.TryStoreFromEnvelope("vault", wrapped, kek));
        Assert.True(store.TryGetKey("vault", out var current));
        Assert.Equal(fresh, current);
    }
    [Fact]
    public void TryStoreFromEnvelope_WrongKek_KeepsCachedKey()
    {
        var store = NewStore();
        var cached = RoomCrypto.GenerateRoomKey();
        store.StoreKey("vault", cached);
        var wrapped = RoomCrypto.WrapRoomKey(RoomCrypto.GenerateRoomKey(), RandomNumberGenerator.GetBytes(32));
        Assert.False(store.TryStoreFromEnvelope("vault", wrapped, RandomNumberGenerator.GetBytes(32)));
        Assert.True(store.TryGetKey("vault", out var current));
        Assert.Equal(cached, current);
    }
    [Fact]
    public void MarkChannelEncrypted_TracksAndUntracks()
    {
        var store = NewStore();
        Assert.False(store.IsChannelEncrypted("vault"));
        store.MarkChannelEncrypted("vault", true);
        Assert.True(store.IsChannelEncrypted("vault"));
        Assert.True(store.IsChannelEncrypted("VAULT")); // channel names are case-insensitive
        store.MarkChannelEncrypted("vault", false);
        Assert.False(store.IsChannelEncrypted("vault"));
    }
    [Fact]
    public void StoreKey_MarksChannelEncrypted()
    {
        var store = NewStore();
        store.StoreKey("vault", RoomCrypto.GenerateRoomKey());
        Assert.True(store.IsChannelEncrypted("vault"));
    }
 }
@@ -0,0 +1,231 @@
 using EchoHub.Core.Models;
 using EchoHub.Server.Config;
 using EchoHub.Server.Services;
 using Xunit;
 namespace EchoHub.Tests;
 public class SpamGuardTests
 {
    private static readonly DateTimeOffset T0 = new(2026, 1, 1, 12, 0, 0, TimeSpan.Zero);
    private static readonly Guid Alice = Guid.NewGuid();
    private static SpamGuard CreateGuard(Action<SpamOptions>? configure = null)
    {
        var options = new SpamOptions();
        configure?.Invoke(options);
        return new SpamGuard(options);
    }
    // ── Message flood ─────────────────────────────────────────────────
    [Fact]
    public void Flood_UnderLimit_Allowed()
    {
        var guard = CreateGuard();
        for (var i = 0; i < 8; i++)
        {
            var verdict = guard.CheckMessage(Alice, ServerRole.Member, $"msg {i}", T0.AddMilliseconds(i * 100));
            Assert.Equal(SpamVerdictKind.Allowed, verdict.Kind);
        }
    }
    [Fact]
    public void Flood_OverLimit_Rejected()
    {
        var guard = CreateGuard();
        for (var i = 0; i < 8; i++)
            guard.CheckMessage(Alice, ServerRole.Member, $"msg {i}", T0.AddMilliseconds(i * 100));
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "msg 9", T0.AddSeconds(1));
        Assert.Equal(SpamVerdictKind.Rejected, verdict.Kind);
        Assert.Contains("too fast", verdict.Reason);
    }
    [Fact]
    public void Flood_RecoversAfterWindow()
    {
        var guard = CreateGuard();
        for (var i = 0; i < 9; i++)
            guard.CheckMessage(Alice, ServerRole.Member, $"msg {i}", T0.AddMilliseconds(i * 100));
        // The whole window has passed with no attempts — allowed again
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "later", T0.AddSeconds(10));
        Assert.Equal(SpamVerdictKind.Allowed, verdict.Kind);
    }
    [Fact]
    public void Flood_IsPerUser()
    {
        var guard = CreateGuard();
        var bob = Guid.NewGuid();
        for (var i = 0; i < 9; i++)
            guard.CheckMessage(Alice, ServerRole.Member, $"msg {i}", T0.AddMilliseconds(i * 100));
        var verdict = guard.CheckMessage(bob, ServerRole.Member, "hello", T0.AddSeconds(1));
        Assert.Equal(SpamVerdictKind.Allowed, verdict.Kind);
    }
    // ── Duplicates ────────────────────────────────────────────────────
    [Fact]
    public void Duplicates_UpToLimit_Allowed_ThenRejected()
    {
        // Slow enough that the flood window never trips (one message per 10 s)
        var guard = CreateGuard();
        for (var i = 0; i < 3; i++)
        {
            var v = guard.CheckMessage(Alice, ServerRole.Member, "same thing", T0.AddSeconds(i * 10));
            Assert.Equal(SpamVerdictKind.Allowed, v.Kind);
        }
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "same thing", T0.AddSeconds(30));
        Assert.Equal(SpamVerdictKind.Rejected, verdict.Kind);
        Assert.Contains("Duplicate", verdict.Reason);
    }
    [Fact]
    public void Duplicates_CaseAndWhitespaceInsensitive()
    {
        var guard = CreateGuard(o => o.MaxDuplicateMessages = 1);
        guard.CheckMessage(Alice, ServerRole.Member, "Hello World", T0);
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "  hello world  ", T0.AddSeconds(10));
        Assert.Equal(SpamVerdictKind.Rejected, verdict.Kind);
    }
    [Fact]
    public void Duplicates_ResetByDifferentMessage()
    {
        var guard = CreateGuard(o => o.MaxDuplicateMessages = 1);
        guard.CheckMessage(Alice, ServerRole.Member, "same", T0);
        guard.CheckMessage(Alice, ServerRole.Member, "different", T0.AddSeconds(10));
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "same", T0.AddSeconds(20));
        Assert.Equal(SpamVerdictKind.Allowed, verdict.Kind);
    }
    // ── Escalation → auto-mute ────────────────────────────────────────
    [Fact]
    public void Escalation_EnoughViolations_ReturnsAutoMute()
    {
        var guard = CreateGuard(o => o.ViolationThreshold = 3);
        SpamVerdict verdict = default;
        // Keep hammering inside the flood window: 8 allowed, then rejections accumulate
        for (var i = 0; i < 8 + 3; i++)
            verdict = guard.CheckMessage(Alice, ServerRole.Member, $"m{i}", T0.AddMilliseconds(i * 50));
        Assert.Equal(SpamVerdictKind.AutoMute, verdict.Kind);
        Assert.Equal(TimeSpan.FromMinutes(5), verdict.MuteDuration);
    }
    [Fact]
    public void Escalation_ClearsViolations_NextRejectionIsPlain()
    {
        var guard = CreateGuard(o => o.ViolationThreshold = 3);
        for (var i = 0; i < 8 + 3; i++)
            guard.CheckMessage(Alice, ServerRole.Member, $"m{i}", T0.AddMilliseconds(i * 50));
        // Still inside the flood window — rejected, but the counter restarted
        var verdict = guard.CheckMessage(Alice, ServerRole.Member, "again", T0.AddSeconds(2));
        Assert.Equal(SpamVerdictKind.Rejected, verdict.Kind);
    }
    [Fact]
    public void Escalation_AutoMuteDisabled_StaysRejected()
    {
        var guard = CreateGuard(o => { o.ViolationThreshold = 3; o.AutoMuteMinutes = 0; });
        SpamVerdict verdict = default;
        for (var i = 0; i < 8 + 10; i++)
            verdict = guard.CheckMessage(Alice, ServerRole.Member, $"m{i}", T0.AddMilliseconds(i * 50));
        Assert.Equal(SpamVerdictKind.Rejected, verdict.Kind);
    }
    // ── Exemptions / master switch ────────────────────────────────────
    [Theory]
    [InlineData(ServerRole.Mod)]
    [InlineData(ServerRole.Admin)]
    [InlineData(ServerRole.Owner)]
    public void ModAndAbove_AlwaysAllowed(ServerRole role)
    {
        var guard = CreateGuard();
        for (var i = 0; i < 50; i++)
        {
            var verdict = guard.CheckMessage(Alice, role, "same spam", T0.AddMilliseconds(i * 10));
            Assert.Equal(SpamVerdictKind.Allowed, verdict.Kind);
        }
    }
    [Fact]
    public void Disabled_EverythingAllowed()
    {
        var guard = CreateGuard(o => o.Enabled = false);
        for (var i = 0; i < 50; i++)
            Assert.Equal(SpamVerdictKind.Allowed,
                guard.CheckMessage(Alice, ServerRole.Member, "same", T0.AddMilliseconds(i * 10)).Kind);
        Assert.Equal(SpamVerdictKind.Allowed, guard.CheckJoin(Alice, ServerRole.Member, T0).Kind);
        Assert.Equal(SpamVerdictKind.Allowed, guard.CheckChannelCreate(Alice, ServerRole.Member, T0).Kind);
        Assert.False(guard.Enabled);
    }
    // ── Join throttle ─────────────────────────────────────────────────
    [Fact]
    public void Joins_OverLimit_Rejected_ThenRecovers()
    {
        var guard = CreateGuard(o => { o.MaxJoinsPerWindow = 5; o.JoinWindowSeconds = 30; });
        for (var i = 0; i < 5; i++)
            Assert.Equal(SpamVerdictKind.Allowed, guard.CheckJoin(Alice, ServerRole.Member, T0.AddSeconds(i)).Kind);
        Assert.Equal(SpamVerdictKind.Rejected, guard.CheckJoin(Alice, ServerRole.Member, T0.AddSeconds(6)).Kind);
        Assert.Equal(SpamVerdictKind.Allowed, guard.CheckJoin(Alice, ServerRole.Member, T0.AddSeconds(60)).Kind);
    }
    // ── Channel-create throttle ───────────────────────────────────────
    [Fact]
    public void ChannelCreates_OverLimit_Rejected_ThenRecovers()
    {
        var guard = CreateGuard();
        for (var i = 0; i < 3; i++)
            Assert.Equal(SpamVerdictKind.Allowed, guard.CheckChannelCreate(Alice, ServerRole.Member, T0.AddSeconds(i)).Kind);
        Assert.Equal(SpamVerdictKind.Rejected, guard.CheckChannelCreate(Alice, ServerRole.Member, T0.AddSeconds(10)).Kind);
        Assert.Equal(SpamVerdictKind.Allowed, guard.CheckChannelCreate(Alice, ServerRole.Member, T0.AddMinutes(15)).Kind);
    }
    [Fact]
    public void JoinAndCreateRejections_NeverAutoMute()
    {
        var guard = CreateGuard(o => { o.MaxJoinsPerWindow = 1; o.ViolationThreshold = 2; });
        for (var i = 0; i < 20; i++)
        {
            var verdict = guard.CheckJoin(Alice, ServerRole.Member, T0.AddSeconds(i));
            Assert.NotEqual(SpamVerdictKind.AutoMute, verdict.Kind);
        }
    }
 }
@@ -0,0 +1,242 @@
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using EchoHub.Server.Data;
 using EchoHub.Server.Services;
 using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Xunit;
 namespace EchoHub.Tests;
 /// <summary>
 /// Registration gate tests: open/invite/closed modes, invite-code consumption,
 /// first-user bootstrap, and the reserved tombstone username. Runs against a real
 /// SQLite in-memory database because the gate includes a guarded UPDATE.
 /// </summary>
 public sealed class UserServiceRegistrationTests : IDisposable
 {
    private readonly SqliteConnection _connection;
    private readonly ServiceProvider _provider;
    public UserServiceRegistrationTests()
    {
        _connection = new SqliteConnection("DataSource=:memory:");
        _connection.Open();
        var services = new ServiceCollection();
        services.AddDbContext<EchoHubDbContext>(o => o.UseSqlite(_connection));
        _provider = services.BuildServiceProvider();
        using var scope = _provider.CreateScope();
        scope.ServiceProvider.GetRequiredService<EchoHubDbContext>().Database.EnsureCreated();
    }
    public void Dispose()
    {
        _provider.Dispose();
        _connection.Dispose();
    }
    private UserService CreateService(string? registrationMode = null)
    {
        var settings = new Dictionary<string, string?>();
        if (registrationMode is not null)
            settings["Server:Registration"] = registrationMode;
        var config = new ConfigurationBuilder().AddInMemoryCollection(settings).Build();
        return new UserService(_provider.GetRequiredService<IServiceScopeFactory>(), config);
    }
    private EchoHubDbContext Db()
    {
        // Root-scope context is fine here: the connection is shared, EnsureCreated ran
        return _provider.GetRequiredService<IServiceScopeFactory>()
            .CreateScope().ServiceProvider.GetRequiredService<EchoHubDbContext>();
    }
    private async Task<InviteCode> SeedInviteAsync(int maxUses = 1, DateTimeOffset? expiresAt = null, int useCount = 0)
    {
        using var scope = _provider.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
        var invite = new InviteCode
        {
            Id = Guid.NewGuid(),
            Code = "TEST-CODE",
            CreatedByUserId = Guid.NewGuid(),
            CreatedByUsername = "admin",
            ExpiresAt = expiresAt,
            MaxUses = maxUses,
            UseCount = useCount,
        };
        db.InviteCodes.Add(invite);
        await db.SaveChangesAsync();
        return invite;
    }
    private async Task SeedOwnerAsync()
    {
        // First registration is always allowed and becomes Owner
        var service = CreateService("open");
        var result = await service.RegisterUserAsync("owner", "password123");
        Assert.True(result.IsSuccess);
    }
    // ── Open mode ─────────────────────────────────────────────────────
    [Fact]
    public async Task OpenMode_RegistersWithoutCode()
    {
        await SeedOwnerAsync();
        var service = CreateService("open");
        var result = await service.RegisterUserAsync("alice", "password123");
        Assert.True(result.IsSuccess);
        Assert.Equal(ServerRole.Member, result.User!.Role);
    }
    [Fact]
    public async Task DefaultMode_IsOpen()
    {
        await SeedOwnerAsync();
        var service = CreateService(registrationMode: null);
        var result = await service.RegisterUserAsync("alice", "password123");
        Assert.True(result.IsSuccess);
    }
    // ── Closed mode ───────────────────────────────────────────────────
    [Fact]
    public async Task ClosedMode_RefusesRegistration()
    {
        await SeedOwnerAsync();
        var service = CreateService("closed");
        var result = await service.RegisterUserAsync("alice", "password123");
        Assert.False(result.IsSuccess);
        Assert.Equal(UserError.ValidationFailed, result.Error);
        Assert.Contains("closed", result.ErrorMessage, StringComparison.OrdinalIgnoreCase);
    }
    [Fact]
    public async Task ClosedMode_FirstUserBootstrap_StillAllowed()
    {
        var service = CreateService("closed");
        var result = await service.RegisterUserAsync("owner", "password123");
        Assert.True(result.IsSuccess);
        Assert.Equal(ServerRole.Owner, result.User!.Role);
    }
    // ── Invite mode ───────────────────────────────────────────────────
    [Fact]
    public async Task InviteMode_NoCode_Refused()
    {
        await SeedOwnerAsync();
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("alice", "password123");
        Assert.False(result.IsSuccess);
        Assert.Contains("invite", result.ErrorMessage, StringComparison.OrdinalIgnoreCase);
    }
    [Fact]
    public async Task InviteMode_ValidCode_RegistersAndConsumesUse()
    {
        await SeedOwnerAsync();
        await SeedInviteAsync(maxUses: 2);
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("alice", "password123", inviteCode: "test-code");
        Assert.True(result.IsSuccess);
        using var db = Db();
        Assert.Equal(1, (await db.InviteCodes.SingleAsync()).UseCount);
    }
    [Fact]
    public async Task InviteMode_ExhaustedCode_Refused()
    {
        await SeedOwnerAsync();
        await SeedInviteAsync(maxUses: 1, useCount: 1);
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("alice", "password123", inviteCode: "TEST-CODE");
        Assert.False(result.IsSuccess);
        Assert.Contains("Invalid invite", result.ErrorMessage);
    }
    [Fact]
    public async Task InviteMode_ExpiredCode_Refused()
    {
        await SeedOwnerAsync();
        await SeedInviteAsync(expiresAt: DateTimeOffset.UtcNow.AddHours(-1));
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("alice", "password123", inviteCode: "TEST-CODE");
        Assert.False(result.IsSuccess);
        Assert.Contains("expired", result.ErrorMessage, StringComparison.OrdinalIgnoreCase);
    }
    [Fact]
    public async Task InviteMode_WrongCode_Refused()
    {
        await SeedOwnerAsync();
        await SeedInviteAsync();
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("alice", "password123", inviteCode: "WRONG-ONE");
        Assert.False(result.IsSuccess);
    }
    [Fact]
    public async Task InviteMode_UsernameTaken_DoesNotConsumeCode()
    {
        await SeedOwnerAsync();
        await SeedInviteAsync(maxUses: 1);
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("owner", "password123", inviteCode: "TEST-CODE");
        Assert.False(result.IsSuccess);
        Assert.Equal(UserError.AlreadyExists, result.Error);
        using var db = Db();
        Assert.Equal(0, (await db.InviteCodes.SingleAsync()).UseCount);
    }
    [Fact]
    public async Task InviteMode_FirstUserBootstrap_NeedsNoCode()
    {
        var service = CreateService("invite");
        var result = await service.RegisterUserAsync("owner", "password123");
        Assert.True(result.IsSuccess);
        Assert.Equal(ServerRole.Owner, result.User!.Role);
    }
    // ── Reserved username ─────────────────────────────────────────────
    [Fact]
    public async Task ReservedTombstoneUsername_Refused()
    {
        await SeedOwnerAsync();
        var service = CreateService("open");
        var result = await service.RegisterUserAsync("deleted-user", "password123");
        Assert.False(result.IsSuccess);
        Assert.Contains("reserved", result.ErrorMessage, StringComparison.OrdinalIgnoreCase);
    }
 }
Author	SHA1	Message	Date
HueByte	df1bd0119c	feat: Update configuration files for storage path and spam protection settings	2026-07-17 19:54:30 +02:00
HueByte	71d82b45fb	fix: Remove invisible character from using directive	2026-07-17 19:49:38 +02:00
HueByte	53d0d326cb	feat: Implement spam protection with configurable limits and auto-mute escalation	2026-07-17 19:47:57 +02:00
HueByte	3281064720	feat: Add invite codes and message replies functionality - Introduced a new migration to add InviteCodes table and ReplyToMessageId column in Messages. - Updated ChatHub to support replying to messages. - Enhanced ChatService to handle message replies and validate reply targets. - Modified UserService to implement invite-only registration mode with invite code consumption. - Added configuration options for registration modes in appsettings. - Created unit tests for new features including invite code registration and message reply formatting.	2026-07-17 19:47:57 +02:00
Hue	bb987dda82	Merge pull request #60 from HueByte/dev_irc_fixes_adjustments Dev irc fixes adjustments	2026-07-17 18:01:00 +02:00
HueByte	e71575d920	feat: update changelog for v0.2.15 release with new features and bug fixes	2026-07-17 17:11:06 +02:00
HueByte	96736d69df	feat: enhance message broadcasting to exclude sender's connection and improve IRC compliance	2026-07-17 17:05:03 +02:00
HueByte	953e081123	feat: add image handling actions and improve IRC message formatting	2026-07-17 16:52:15 +02:00
Stone_Red	b9d099dd73	chore: bump version and add changelog	2026-07-17 16:36:10 +02:00
Stone_Red	a9519a52cc	feat: add support for broadcasting and handling channel deletions across clients	2026-07-17 16:35:59 +02:00
Hue	4d25458717	Merge pull request #58 from HueByte/dev Dev	2026-07-16 20:33:43 +02:00
Hue	584ce45979	Merge branch 'master' into dev	2026-07-16 20:26:16 +02:00
HueByte	53927b130c	Add markdown linting tools and scripts - Create package.json to manage markdownlint-cli2 as a dev dependency. - Add PowerShell script for linting Markdown files with options for fixing issues. - Update shell script to prefer locally installed markdownlint-cli2 or fallback to npx.	2026-07-16 20:22:57 +02:00
HueByte	ca3c1ec2b5	feat: add documentation for TUI, messages & attachments, and IRC gateway; update index and TOC	2026-07-16 20:02:18 +02:00
Hue	35a4eec749	Merge pull request #57 from HueByte/dev_copy_paste_qol Dev copy paste qol	2026-07-16 19:44:32 +02:00
HueByte	78f18a36ba	docs: update changelog for v0.2.14 to include clipboard image and multi-file paste features	2026-07-16 19:41:15 +02:00
HueByte	2157884e61	refactor: replace Key constants with KeyCode for improved clarity and performance	2026-07-16 19:40:18 +02:00
HueByte	4f2cffa372	feat: add clipboard image handling for pasting and staging attachments	2026-07-16 19:40:18 +02:00
Hue	31a0bb8c9f	Merge pull request #56 from HueByte/dev_fixes_features_and_nightmares feat: enhance IRC support with display name handling, private channel…	2026-07-16 19:32:15 +02:00
HueByte	e439c8ae72	feat: implement end-to-end encryption for room keys with secure storage and migration support	2026-07-16 18:47:28 +02:00
HueByte	b6c01dab15	feat: enhance IRC support with display name handling, private channel tracking, and connection identification	2026-07-16 18:22:34 +02:00