System Updates & Engineering Log

fix: trigger wrong password screen on invalid passphrase and hide changelog in stats modal

Fixed an issue where entering an incorrect secret passphrase silently skipped decryption errors and admitted clients into a blank room. Added active key verification fallback using historical queue ciphertext, triggered the dedicated DECRYPTION FAILED overlay, relocated the changelog link inside the System Stats modal, and enabled Enter key submission in join modals.

Launch interactive web update log and agent acceleration documentation system

• ▸Created public/update.html with interactive real-time commit search, category filtering, and semantic version grouping.
• ▸Added direct Changelog access buttons to desktop chat header and mobile tools dropdown.
• ▸Authored AGENTS.md master guide and specialized docs/agent/ architectural references to slash agent development cycles from 12m to <2m.

Fix chronological message ordering with server time sync, and add search & proper anchoring to emoji reaction panel

• ▸Enforced server-side monotonic timestamp clamping (now >= q[last].Timestamp + 1ms) to preserve strict arrival ordering.
• ▸Implemented client clock synchronization against serverTime in heartbeats and join handshakes to eliminate clock drift.
• ▸Introduced asynchronous FIFO promise decryption queue to prevent short messages racing ahead of long payloads.
• ▸Added search inputs to reaction and composer pickers with instant keyword and shortcode filtering.
• ▸Fixed reaction popover anchoring by resolving the target button element instead of the entire chat feed container.

Add delete channel confirmation, fix glow color to normal text, support effects on headers, and debounce color picker

• ▸Added confirmation modal before channel deletion with protected status for # Main Group and Direct Messages.
• ▸Updated glow text classes to inherit normal text color (#f8fafc / slate-200), keeping neon aura strictly in text-shadow.
• ▸Supported nested markdown formatting and glowing tags inside header syntax (# [glow=trvth]text[/glow]).
• ▸Debounced Windows color picker to only fire on confirmed change instead of every mouse movement.

Input auto-expansion, mobile Enter newline, compact stats UI, remove inspect/fingerprint/guide buttons

• ▸Implemented auto-expanding multi-line textarea with selection preservation.
• ▸Configured Enter key on mobile to insert a clean newline while requiring the Send button to dispatch.
• ▸Streamlined top navigation by removing redundant Inspect, Fingerprint, and Guide buttons.
• ▸Condensed hardware telemetry HUD into a compact, space-efficient overlay.

Instantaneous optimistic rendering and broadcast delivery for text messages

• ▸Rendered text messages immediately into the local feed before awaiting WebSocket wire transmission.
• ▸Decoupled client upload synchronization from the high-speed text messaging pipeline.

Paginated queue loading, upload cancellation, and memory leak resolution

• ▸Implemented initial fast chunk loading with on-demand scroll-back pagination (btn-load-older).
• ▸Added one-click Cancel Upload button to abort active chunked file transfers instantly.
• ▸Patched memory leaks in Blob URL management and bounded client message caches.

Reclaim RAM/buffers, display Linux OS storage in orange, debounce join/leave flapping, add markdown backslash escaping, allow typing during background uploads

• ▸Permitted unrestricted text composition in any channel while background chunked file uploads are in flight.
• ▸Added backslash escaping support for markdown symbols (\#, \*, \_).
• ▸Highlighted Linux OS storage telemetry in distinct orange amber alerts.
• ▸Debounced rapid join/leave socket flapping notices.

Prevent chat wipe on upload reconnect and enforce strict video player container sizing

• ▸Preserved existing chat DOM state when WebSocket reconnects during active upload streams.
• ▸Enforced aspect-ratio containment and max-height bounds on inline video player embeds.

Multi-file upload queue and chunked WebSocket streaming for large files

• ▸Built chunked binary WebSocket streaming protocol splitting multi-megabyte payloads into 64KB chunks.
• ▸Implemented concurrent multi-file queue with sequential streaming and individual progress bars.

Upload progress phases, optimistic file send, @mention autocomplete, lazy file downloads, video sizing

• ▸Split upload indicator into discrete phases: Reading -> Compressing -> Encrypting -> Streaming.
• ▸Added dynamic @username autocomplete popover with keyboard arrow navigation.
• ▸Implemented lazy on-demand downloads for large non-image attachments.

200MB file limit, optional image compression, per-chat RAM & disk telemetry

• ▸Increased maximum permissible attachment size from 10MB to 200MB.
• ▸Added user-controlled toggle for lossless vs high-efficiency WebP image compression.
• ▸Calculated per-channel byte consumption in server memory and NVMe disk.

Live Oracle Cloud hardware telemetry (host RAM, container RAM, NVMe disk)

• ▸Integrated Linux /proc/meminfo, /proc/stat, and cgroup memory controllers into /api/stats endpoint.
• ▸Provided real-time visibility into Host RAM, Docker Container RSS, and NVMe disk usage.

Ignore cloudflare tunnel token file in git tracking

• ▸Added cloudflare-tunnel-token.txt to .gitignore to prevent secret leakage.

Remove legacy system stats page and telemetry modal in preparation for native HUD

• ▸Cleaned up legacy Node.js stats modal templates in preparation for the native Go OCI telemetry HUD.

Secure context detection, HTTPS tunnel auto-redirection, and /api/tunnel endpoint

• ▸Detected whether window.crypto.subtle is available; redirected insecure HTTP visitors to secure HTTPS Cloudflare tunnel.
• ▸Added /api/tunnel endpoint for seamless client tunnel resolution.

Ignore private SSH keys in git repository

• ▸Added *.key and *.key.pub to .gitignore for operational security compliance.

Zero-cost production architecture (OCI Always Free, Docker, CDN caching, CI/CD)

• ▸Migrated QPSEC infrastructure to Oracle Cloud Infrastructure (OCI) Always Free VM.
• ▸Constructed production Docker Compose containerization with health checks and restart policies.
• ▸Authored automated deployment script deploy-oci.sh with rsync synchronization.
• ▸Enforced HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).

Harden XSS vectors, origin checks, session auth, and concurrency bottlenecks

• ▸Strict origin validation on WebSocket handshakes, HTML sanitization, and eliminated client mutex contention.

Safe websocket sends, dirty-room Upstash batching, Blob URL LRU eviction, and bounded message metadata

• ▸Prevented concurrent writes on WebSocket connections, debounced dirty-room persistence, and implemented Blob URL LRU cache.

Upgrade WebSocket connections on root and /ws, add auto-retry for cold starts

• ▸Supported dual WebSocket upgrade paths (/ and /ws) and added exponential backoff on client reconnections.

Switch Render deployment to native Go server with render.yaml and multi-stage Dockerfile

• ▸Crafted lightweight multi-stage Alpine Dockerfile compiling static Go binary.

Persist and synchronize message delivery receipts across server queues and database

• ▸Added two-way synchronized message delivery receipts across clients and server queues.

Scale dynamic room memory up to 128MB based on active instances and add database prune system notices

• ▸Dynamic per-room RAM allocation scaling up to 128MB under peak loads with automated prune notifications.

Fix test suite Step 3 deadlock and online support, reduce emojis, and add dynamic per-room memory scaling

• ▸Eliminated goroutine channel deadlocks in test-suite.go.

Add plain-English nontechnical explanations to Stats modal and high-precision RAM telemetry

• ▸Translated complex memory metrics into intuitive human-readable explanations.

Overhaul Stats Panel telemetry HUD and implement high-performance Go test suite

• ▸Implemented standalone test-suite.go benchmarking concurrent socket saturation.

Finalize Go toolchain integration and build standalone QPSEC Go server engine

• ▸Completed main.go implementation replacing Node.js runtime with compiled Go binary.

Optimize server with O(1) group socket routing, HTTP asset caching, pre-allocated frames, and add native Go server engine

• ▸O(1) room dispatch, pre-allocated frame buffers, and HTTP static asset caching headers.

Fix isVideo and isPdf reference error in setPendingAttachment

• ▸Fixed undefined variable references during attachment staging.

Add Module 7 to automated test suite: Massive Concurrent Image Storm (200 encrypted images blasted across 20 sockets)

• ▸Stress test hammering server queues with 200 concurrent encrypted binary payloads.

Refactor client into high-performance modular layers (crypto.js, media.js, storage.js) with live Compressing... visual indicators

• ▸Decomposed monolithic client code into dedicated crypto.js, media.js, and storage.js modules.

Add NASA AGC Multi-Media Binary Test Suite with bit-accurate PDF-1.7, MP4 container atoms, and JPEG EXIF verification

• ▸Created NASA AGC binary verification suite verifying byte-accurate decryption of complex document and media structures.

Enforce authoritative server-side limits, remove client-side alert blocking, and add WebSocket ghost socket heartbeat pruning

• ▸Authoritative server payload caps and automatic ghost socket reaper on missed heartbeats.

Add adaptive WebP/JPEG autocompression and instant size preview for image uploads

• ▸Client-side HTML5 canvas autocompression preserving image resolution while shrinking bytes by 80%+.

Optimize media performance with 1080p proportional downscaling, Blob URL streaming, IndexedDB media storage, and server ciphertext limits

• ▸1080p canvas downscaling, streaming blob object URLs, and client IndexedDB caching.

Optimize server performance with O(1) queue byte tracking, zero-copy broadcasts, non-blocking async disk writes, and comprehensive test suite

• ▸O(1) memory tracking per room, zero-copy broadcast frames, and async atomic disk flush.

Implement zero memory spike storage architecture with 8MB safe room queues

• ▸Capped per-channel queues at 8MB with rolling FIFO eviction to prevent memory spikes.

Implement granular per-queue Upstash storage to bypass 10MB limit

• ▸Segmented room storage keys in Upstash Redis to prevent exceeding single-key limits.

Fix message and video ordering with strict chronological DOM insertion

• ▸Enforced binary search timestamp comparison when inserting elements into chat feed.

Fix attachment re-sending with concurrency lock and immediate preview clear

• ▸Added concurrency mutex preventing duplicate sends when tapping send multiple times.

Eliminate all duplicate JSON string cloning and cap WebSocket payload frames

• ▸Eliminated redundant JSON serialization cycles during message forwarding.

Add mobile wakeup inactivity resync and fix attachment queue recovery

• ▸Triggered automatic state resynchronization when mobile browsers awaken from sleep.

Add System Stats RAM and Database Usage Monitor Modal

• ▸First iteration of the live system telemetry modal tracking process heap and database records.

Fix Node heap memory limit with debounced saving and heap size flag

• ▸Configured Node --max-old-space-size and debounced periodic disk writes.

Add persistent join/leave broadcast toggle button

• ▸Allowed users to silence their join and leave presence notices for OpSec stealth.

Broadcast and persist system status messages for all users

• ▸Stored authoritative system notices in encrypted room history.

Broadcast user status notices and presence updates

• ▸Real-time status updates broadcast across connected peers.

Fix granular single message delete and 24h 200MB retention

• ▸Server-side message deletion with targeted queue filtering.

Fix message full width layout and tap to show compact toolbar

• ▸Full width message bubble layout on small viewports with tap-to-reveal toolbars.

Upgrade offline media storage to IndexedDB

• ▸Migrated client-side image and video caching from localStorage to IndexedDB.

Fix chronological message ordering mobile action toolbar and Upstash SDK

• ▸Sorted queue entries by timestamp and integrated official Upstash Redis client.

Fix syntax error in server.js

• ▸Resolved syntax bug in Node.js server persistence routine.

Add Upstash Redis cloud persistence support

• ▸Integrated serverless Redis queue backup via Upstash REST API.

Fix instance restoration across server restarts and add Upstash cloud sync

• ▸Restored instance state upon reboot from local disk and cloud storage.

Add single message delete from server queue and clients

• ▸Added capability for senders to permanently purge individual messages across all clients.

Add Message Info and Delivery Audit Inspector

• ▸Inspect ciphertext size, recipient delivery receipts, and cryptographic fingerprints.

Fix glow dropdown popover clipping on Firefox Windows 11

• ▸Adjusted z-index and fixed container overflow clipping on Windows Firefox.

Add multi-colored glows CIA TRVTH GOLD HEX rainbow text and strikethrough

• ▸Added custom text styling tags: [glow=cia], [glow=trvth], [glow=gold], [glow=#hex], [rainbow], and ~~strike~~.

Add multi-channel message broadcasting heartbeat and instant reconnect sync

• ▸Heartbeat ping/pong intervals and instant queue synchronization upon reconnection.

Fix instance preservation across server restarts and redeploys

• ▸Serialized active instance configurations to persistent disk storage.

Make metadata stripping mandatory on all images and display exact GPS coordinates

• ▸Sanitized all EXIF/TIFF/GPS metadata before client-side encryption. Warned users if GPS coordinates were detected.

Add GPS location detection and OpSec awareness in metadata inspection

• ▸Client-side binary inspection of JPEG EXIF headers for latitude/longitude metadata.

Add live uploading and encrypting progress bar above chat input

• ▸Real-time visual progress bar tracking client-side encryption and socket transmission.

Add rich media and file uploads with metadata inspection and EXIF stripping

• ▸Supported end-to-end encrypted images, audio, video, and documents with EXIF scrubbers.

Increase PBKDF2 iterations to 600K

• ▸Strengthened key derivation resistance against GPU/ASIC brute-force attacks by increasing iterations to 600,000.

Robust passphrase check step1 instance name step2 verify blob before join

• ▸Implemented zero-knowledge verification challenge before granting room entry.

Silently skip corrupted messages without error overlay

• ▸Gracefully ignored un-decryptable or corrupted frames without halting client rendering.

Text instance input zero knowledge opsec and decryption fail kick

• ▸Zero-knowledge client validation with automatic disconnect on unauthorized keys.

Instance browser persistent instances create new silent decrypt fail

• ▸Persistent instance list stored in client local storage with silent fallback.

Fix bg message processing and discord square count badges

• ▸Corrected background tab message counter and channel pill badges.

Persist custom group channels and renamed chat names across reloads

• ▸Stored custom group channels and user renames locally and synchronized to server state.

Fix left edge indicator bar clipping in sidebar

• ▸Fixed CSS overflow clipping on active channel indicator bars.

Add discord left edge indicator pill and square avatar badges

• ▸Visual Discord-style white indicator pill on active channels and colored avatar squares.

Mobile top right burger menu and enhanced ping detection

• ▸Added hamburger slide-out menu on mobile viewports and multi-word @mention pings.

Add discord style unread and ping badges to channels

• ▸Red ping badges for direct mentions and subtle gray badges for unread messages.

Add customizable TTL expiry timer with presets and persistence

• ▸Configurable message auto-burn timers (1h, 6h, 12h, 24h, 7d) with automatic background pruning.

Add encrypted server queue disk persistence

• ▸Wrote encrypted message queues to local server disk to survive daemon restarts.

Fix mobile chat screen viewport and footer pinning

• ▸Fixed virtual keyboard pushing chat input offscreen on iOS and Android viewports.

Fix mobile viewport height pc toolbar and multiword pings

• ▸Dynamic 100dvh viewport calculation and support for multi-word nickname pings.

Mobile formatting tools menu inline reactions and click to mention

• ▸Added mobile slide-up formatting tools sheet and click-on-avatar to insert @mention.

Remove default password values from login

• ▸Removed placeholder credentials from login inputs to enforce intentional authentication.

Fix mobile layout and multiword pings

• ▸Resolved horizontal scrolling overflow on small mobile screens.

Fix compact message spacing

• ▸Tightened message padding to optimize readability and vertical information density.

Fix autocomplete position and reactions picker

• ▸Anchored autocomplete menu above the cursor caret.

Add offline persistence and char redact

• ▸Persisted messages in client storage across reloads; added blackout redaction formatting.

Add autocomplete and reactions

• ▸Added inline emoji reactions and @mention username autocompletion.

Discord grouping and emoji db

• ▸Grouped consecutive messages from same sender within 5 minutes into single card; integrated emoji dictionary.

Fix emoji picker close

• ▸Closed emoji popover when clicking outside or pressing Escape.

Fix group rename and color sync

• ▸Synchronized custom channel title updates across active tabs.

Add emoji support

• ▸Added full unicode emoji selector and shortcode replacement (:smile:, :fire:).

Remove admin role and fix refresh

• ▸Eliminated centralized admin role to maintain decentralized peer parity.

Add member picker and handbook

• ▸Added channel active member list sidebar and security handbook modal.

Update alias locking and modals

• ▸Enforced unique per-instance pseudonym locking to prevent impersonation.

Add multi server alias locking

• ▸Multi-server nickname claiming mechanism.

Update inspector and layout

• ▸Enhanced message layout and visual inspector widgets.

Fix message send reload

• ▸Prevented form submit default action from reloading page during transmission.

Initial Qpsec Release

• ▸Initial commit of the QPSEC zero-knowledge secure communication architecture.
• ▸Client-side AES-256-GCM symmetric encryption using Web Crypto API with PBKDF2 key derivation.
• ▸WebSocket real-time relay architecture routing ciphertext blind to plaintext contents.
• ▸Ephemeral in-memory room queues and responsive cyber-dark interface.