# v0.2.8

## Bug Fixes

- Fix memory leak — `HttpResponseMessage` objects never disposed in `ApiClient`, leaking TCP connections and content buffers on every API call (especially on failed connection attempts)
- Fix 401 retry leak — `AuthenticatedGetAsync`/`AuthenticatedRequestAsync` leaked the original response when retrying after token refresh
- Fix connection failure cleanup — `ConnectionManager.ConnectAsync` now properly disposes `ApiClient` and `EchoHubConnection` on any failure path (previously only cleaned up on saved-token auth failures)
- Fix IRC gateway sending UTF-8 BOM on first message, breaking CAP negotiation and SASL auth for all clients
- Handle `AUTHENTICATE *` (SASL abort) instead of crashing on invalid base64
- Fix userlist not refreshing when creating a new channel — now fetches online users after channel creation
- Fix unmute timer not working — add `MuteExpirationService` background job that proactively unmutes users when their timed mute expires (previously only checked on message send)
- Fix missing space between mod/admin role icon and username in the userlist
- Fix invisible users still visible in the userlist — `GetOnlineUsersAsync` now filters invisible users; server skips `UserJoined` broadcast for invisible users
- Fix invisible→online transition — user reappears in cached userlist when switching from invisible back to a visible status
- Fix thread safety — `_channelUsers` presence cache now protected by `Lock` to prevent races between SignalR events and background fetches
- Fix `@mention` regex matching email addresses and `#channel` regex matching hex colors / issue numbers — both now use lookbehind and letter-requirement guards
- Fix `ParseThemeColor` accepting non-hex characters — now validates `[0-9a-fA-F]` digits
- Fix ghost channel when trying to join a channel that doesn't exist

## New Features

- Add Docker support for EchoHub.Server — `docker compose up -d` for easy self-hosting with persistent volume for database, uploads, and logs
- IRC account creation — connecting with a new username auto-registers the account (PASS and SASL PLAIN)
- Auto-updater rollback — pre-update backup created automatically before each update; restore via File > Rollback menu or `--rollback` CLI flag
- Update failure recovery — if an update fails mid-extraction, offers to restore from the backup immediately
- Defensive Unix permission check — verify execute permission on startup after auto-update (defense-in-depth)
- Clickable usernames — press Enter on a username in the userlist or message sender to view their profile
- Clickable @mentions — press Enter on a message containing `@username` to open that user's profile
- Clickable #channels — press Enter on a message containing `#channel` to join/switch to that channel; `#channel` references are now highlighted in chat
- Embed theme colors — embed vertical border line now uses the source site's `theme-color` meta tag when available
- Stateful userlist — user presence is cached per channel and updated incrementally via SignalR events instead of re-fetching the full list on every join/leave/status change

## Security

- Restrict file auto-open — only safe file types (video, PDF, text) are opened with the system default app; all other files are downloaded to temp without executing (prevents script execution via `.bat`, `.exe`, etc.)

## Refactoring

- Extract `IUserService`/`UserService` — consolidate user registration, authentication, and profile management into a dedicated service, eliminating duplicated logic between `AuthController` and `ChatService`
- IRC gateway now checks ban status during authentication (previously skipped)
- EchoHubSpace directory updates — server now only sends user count when it actually changes instead of every 30 seconds
- `ChatHub.JoinChannel` now returns `JoinChannelResult` instead of `List<MessageDto>` to allow for better error handling

## Distribution

- Add Chocolatey package — `choco install echohub` for Windows users, auto-published from CI on each release
- Add Linux/macOS install script — `curl -sSfL .../install.sh | sh` with automatic OS/arch detection

## Documentation

- Add Flows section — Mermaid sequence diagrams documenting all major request/event flows (auth, connection, messaging, channels, moderation, file upload, link embeds, server directory) with inline code references

## CI

- Add Docker workflow — builds and pushes multi-arch (`amd64`/`arm64`) server image to GHCR on release
- Add `linux-arm64` builds to release pipeline — server and client binaries for ARM Linux (Raspberry Pi, cloud ARM instances)
- Automate Chocolatey package publishing in release workflow (checksum calculation, pack, push)