* bots, nodejs: document chat, connection, member contact and network commands, typed commands in library
* bots, nodejs: restore apiConnect, wrap domain once, test all connect responses
* nodejs: JSDoc for new methods
* docs: plan for bot API commands and typed Node library methods
* tests: channel prepared with a domain has a verified SimpleX name
* docs: apply review fixes to the plan for bot API commands
* docs: apply second review pass to the plan for bot API commands
* docs: refer the bot API plan to the rewritten test commit
* docs: record decisions in the plan for bot API commands
* docs: plan tests of the generated Python command strings
* python: test the generated strings of the documented commands
* docs: plan the message information command for bots
* bots, nodejs: message information with the file servers for bots
* docs: plan the relay approval option of receiving files in Node
* nodejs: receive files without approving unknown relays
* docs: plan the user servers command for bots
* bots, nodejs: user servers and relays by operator for bots
* nodejs: document the message information method
* docs: plan the file upload progress event for bots
* bots: file upload progress event for bots
* bots: drop the file upload progress event
* docs: drop the upload progress event plan
* nodejs: document user servers and relay approval of received files
* core: keep channel profile from the owner's link when joining
* core: rename test of the channel profile on joining
* core: apply channel profile from link data when connecting
* WIP: Haskell impl of resizeImageToStrSize
* WIP: add FFI export wrapper
* WIP: switch ios resizeImageToStrSizeSync to backend
* WIP: fix resizeImageToStrSizeSync
* WIP: add JNI wrappers
* Add non-base64 resize and cWriteImage
* WIP: add chat_write_image
* fix resizeToStr
* fixes
* fix syntax, raise jpeg quality back
* add chatWriteImage
* Fix cfArgs in tests
* Use jpeg-turbo encoder
* add nix pins
* bump jpeg-turbo
* add CI deps
* add encoding funs to android lib
* bump jpeg-turbo for 20.04 fix
* jpeg-turbo fix for 8.10
* android fixes
* Bump jpeg-turbo
* set static flag for jpeg-turbo
* Fix nix for aarch64/android
* Fix android C api
* Fix resize in android
* Bump hs-libjpeg-turbo
* target correct override
* override android lib from android pkgs
* add macos build tweaks
* bump hs-jpeg-turbo for 8.10 fixes
* more build fixes
* make ios compile
* Always use pkgconfig for libjpeg-turbo
* WIP: debug libjpeg in ubuntu pkg-config CI
* Add pkg-config to dockerfiles
* Add libturbojpeg to dockerfiles
* Use -dev version of libturbojpeg in dockerfiles
* Install pkg-config in windows CI
* Disable flag for custom libturbojpeg linking options
Workarounds relocation error on x86_64-linux with gcc:
/usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/13/../../../x86_64-linux-gnu/libturbojpeg.a(turbojpeg.c.o): relocation R_X86_64_TPOFF32 against `errStr' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: failed to set dynamic section sizes: bad value
* WIP: debug libjpeg in windows pkg-config CI
* WIP: debug libjpeg package in windows CI
* core: image resize module and buffer FFI
* ci: link libjpeg-turbo statically on all platforms
* ui: resize images in the core
* core: rename image resize functions to chat_resize_image and chat_resize_image_uri
* ci: restore whitespace in build.yml
* ci: build libjpeg-turbo 3.1.4.1 from a submodule
* core: hs-jpeg-turbo from github.com/simplex-chat
* nodejs: resize images
* python: resize images
* core: hs-jpeg-turbo from gitlab.com, the GitHub import lacks LFS objects
* core: generate /img previews
* ci: link libjpeg-turbo on Windows without pkg-config
* ci: build libjpeg-turbo on Windows with the GHC toolchain
* docs: plan for image resizing in the core
* docs: update image resizing plan
* ios: prevent crash when wallpaper image cannot be resized
* android, desktop: raise an error when an image cannot be resized
* docs: update spec references for image resizing
* docker: build the CLI image from a clone without submodules
* docs: apply review fixes to image resizing plan
* docker: build the CLI from a git worktree with the submodule present
* docs: apply second review to image resizing plan
* docs: point image resizing plan at the rewritten commit
* core: choose image format by transparency in chat_resize_image
* nodejs: resize images to the app sizes
* python: resize images to the app sizes
* nodejs, python: describe the core modules as used for image resizing
* docs: add license notices of the image libraries
* ci: describe the avatar method without attributing it to the apps
* ci, ios, nix: remove the libjpeg-turbo build outside cabal
* python: name resize_image in the core module text
* nodejs, python: describe resizing to the app image sizes
* core: refuse images larger than the supported size
* core: resize to JPEG images with a side above 65500 pixels
* docs: record image resizing decisions for the bundled libjpeg-turbo
* core, docs: build libjpeg-turbo and stb from the fork submodules
* docs: record the fork pins in the image resizing plan
* core: resize images to at most 4320 pixels per side, refuse above 16384
* docs: record the image side limits in the image resizing plan
* core: pin the rebased hs-jpeg-turbo fork
* core: pin the hs-jpeg-turbo fork without package.yaml
* docs: plan scaled JPEG decoding and EXIF orientation of images
* docs: copy the JuicyPixels-stbir licence of the pinned fork
* core: pin the hs-jpeg-turbo fork with scaled JPEG decoding
* core: decode JPEG at the display size, up to 65500 pixels per side
* core: rotate JPEG images by their EXIF orientation
* docs: refer the image plan to the JPEG decoding code
* docs: record the approved image processing decisions
* core: limit JPEG decoding memory to 1024 MB outside iOS and Android
* docs: name JPEG decoding in the libjpeg-turbo notice
* docs: plan image resizing from files and the decisions of 26 Oct
* core: scale images in one Catmull-Rom pass with sharpening
* docs: plan image sizes at a fixed quality
* core: resize images at a fixed quality to fill the size limit
* core: resize images from a file path or a file descriptor
* ios, android, desktop: resize picked images from their files
* core: encode resized images with mozjpeg
* tests: check descriptor closing by the file it refers to
* core: raise JPEG quality only for a full-size image below 97% of the limit
* ci: name the mozjpeg submodule in the Windows cleanup comments
* docs: refer the image plan to the current code
* docs: refer the image plan to the code merged with master
* core: export every image resizing function from each library
* core: close the file descriptor when its handle cannot be created
* docs: count the C sources of mozjpeg with the arithmetic decoder
* core: use the reviewed hs-jpeg-turbo and JuicyPixels-stbir forks
* ci: build the armv7a Android core library on request
* core: round image heights half up in the size search
* ios: describe the file image resizing functions in SimpleX.h
* ci: pick, preview and send images in the Claude app tests
* core: decode PNG images with libspng and refuse other formats
* core: encode PNG with libspng, keeping the smaller filter choice
* ci: pick, preview and send images in the scripted app smoke tests
* flake: build the PNG decoder package in nix builds
* ios: remove the copy of a picked image after sending it
* core: refuse image files larger than the decode memory limit
* core: scale a JPEG image to its largest size once per resize
* core: bisect JPEG quality without a step function
* core: reduce the memory used to sharpen and to decode PNG images
* android, desktop: pass the image format to the core as an integer
* android, desktop: fuse the preview conditions of picked media
* android, desktop, ci: check that the core resized the smoke test images
* python: remove the docstrings of the explicit image resizing functions
* docs: add the second review fixes to the image plan
* ci: tap the iOS attachment button by its accessibility label
* core: keep the colour profiles of resized images
* docs: add the colour profiles to the image plan
* ci: wait up to 30 s for the new group screens in the iOS smoke test
* ci: pick the Android smoke test images from their own photo folders
* ci: tap the iOS photo picker by position, as its tree is not shown
* ci: pick the test card and the logo by their iOS picker positions
* core: update JuicyPixels-stbir with the stb_image_resize licence terms
* core: write a fixed Display P3 profile for Display P3 images only
* core: do not keep the input image in memory for its colour profile
* core: read the JPEG segments once for the orientation and the profile
* core: read an image file into one buffer of its size
* docs: add the third review fixes to the image plan
* core: resize images with Display P3 or no profile, not profile bytes
* ci: check the pixel sizes of the images sent in the iOS smoke test
* core: update hs-jpeg-turbo with PNG chunk limits and encoder fixes
* docs: list Compact ICC Profiles, libspng and miniz in the dependencies
* android, desktop: reword the picked media preview comment
* docs: refer the image plan to the code merged with master
* ci: render the iOS snapshots before the images case
* ci: dismiss the snapshot tests' camera alert before the iOS images case
* core: update hs-jpeg-turbo with tests and the JuicyPixels-spng synopsis
* core: pin hs-jpeg-turbo and JuicyPixels-stbir in simplex-chat repositories
* update ios core library
* core, ui: accept only JPEG and PNG image data
* core: update JuicyPixels-stbir
* docs: plan for the iOS copy of picked images
---------
Co-authored-by: IC Rainbow <aenor.realm@gmail.com>
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
Co-authored-by: Alexandre Esteves <alexfmpe@proton.me>
* core: test that history posted before channel signing reaches later joiners as signature missing, and channel moderator delete for all
Confirms the case the owner's new alert describes: a subscriber who joins after the owner turned on "Sign messages" sees the earlier posts as "signature missing" and later ones as signed, while earlier subscribers keep them unmarked. Also covers a non-owner channel moderator deleting a contributor's signed post for everyone.
Run: 001-channel-signing-moderators, slice 1
* ios: keep "Chat with admins" off when saving group preferences
toGroupPreferences left out the support preference, so the saved profile had none and core filled in its default, on: every channel preference save from iOS silently turned on chats with admins, which have no end-to-end encryption in channels. Android and desktop already pass it.
Run: 001-channel-signing-moderators, slice 2
* ui: let channel owners turn on "Sign messages", warning that earlier messages will show signature missing
The channel preference was hidden while signing was recipient-only. Owners now see the switch; turning it on asks for confirmation, because subscribers who join later receive the earlier posts unsigned through history and see them as "signature missing". The "Signature missing" explanation now says the message may predate signing or have been forwarded by a relay without its signature, instead of only implying tampering.
Run: 001-channel-signing-moderators, slice 3
* ui: channel owners can make subscribers moderators, and moderators see the subscriber list
Core already lets a channel owner make a subscriber a moderator; the role picker offered only subscriber and contributor. It now offers moderator too (not admin, by decision). Moderators see the full member list the owner sees, so they can reach the subscribers they may block (subscribers can't post, so there was no other way to reach them), and member info is headed Moderator or Contributor instead of Subscriber for those roles.
Run: 001-channel-signing-moderators, slice 4
* ci: long-press and right-click for app tests, safer ui arguments, desktop Kotlin 4 GB, desktop session limits from claude-scope
Message menus open only on long-press (iOS) or right-click (desktop), so Claude sessions couldn't reach Moderate, Info or Delete. Ported from f/directory-search unchanged, with its hardening: the guards refuse unquoted glob, brace and tilde expansion, and desktop ui checks numbers and sends one key per call so a key argument can't run an xdotool command. The desktop app job's Kotlin compiler gets 4 GB, as f/directory-search needed after merging master. Desktop sessions take max-turns and max-budget-usd from claude-scope like iOS (60 and 3 when unset, as before), and the Claude job may run 120 minutes.
Run: 001-channel-signing-moderators, slice 5
* ci: Claude test plans for channel message signing and channel moderators
This branch's iOS device test plan and desktop prompt replace master's smoke tests: the owner creates a channel on the preset relays, turns on Sign messages through its alert, and two more profiles in the same app join by the copied link; the owner makes one a moderator, who then sees the subscriber list, moderates a contributor's message and blocks the contributor. Signatures are checked as text in message Info. One layout, no test backend.
Run: 001-channel-signing-moderators, slice 6
* fixup! ui: let channel owners turn on "Sign messages", warning that earlier messages will show signature missing
* update plans
* fixup! ui: let channel owners turn on "Sign messages", warning that earlier messages will show signature missing
* fixup! ci: Claude test plans for channel message signing and channel moderators
* fixup! ui: let channel owners turn on "Sign messages", warning that earlier messages will show signature missing
* fixup! ci: Claude test plans for channel message signing and channel moderators
* fixup! ui: let channel owners turn on "Sign messages", warning that earlier messages will show signature missing
* fixup! ci: Claude test plans for channel message signing and channel moderators
---------
Co-authored-by: spacedandy-agents-simplex <342056592+spacedandy-agents-simplex@users.noreply.github.com>
* plan: UI improvements to improve LLM usage via SimpleX
* core, ui: types for chat layout
* core, ui: settings for alternative terminal-like chat layout for managing LLMs or other service bots
* plan: message priority
* fixes
* query plan
* update plans
* remove silent messages plan
* rename migrations
* implement layout
* amend
* fix
* fix
* fix
* improve
* time on the right, sender name in blue
* no avatar in direct chats
* better previews
* update, fixes
* update
* time gap
* changes
* ui: terminal layout line heights, gaps and time placement
* ui: simplify terminal meta layout, correct its docs and tests
* ui: right-to-left emoji edge in terminal rows, time placement tests
* android, desktop: raise Kotlin compiler memory to 4 GB
* ui: terminal captions as follow-up text, classic event separators
* ui: terminal media edge and overlay time, plan decisions
* ui: simplify terminal row separation, correct doc line references
* ui: keep the media time inside terminal rows, restore caption conditions
* ui: terminal heading capitals at large font scales, idle live message time
* ui: rename the classic voice-with-text flag, correct the meta copy docs
* ui: smaller terminal layout diff, sender gap and meta names
* ui: terminal row as tall as the media time
* docs: remove the chat layout section from the bots readme
* docs: shorten the terminal layout section of the chat view
* core: address settings API as on master, /auto_accept reads the stored layout
* ui: smaller terminal headings
* ui: classic sender rows and avatar rule as on master
* ui: classic reply quote text colour as on master
* ios: keep the chat layout setting with other UI settings
* ui: go-to button at the end of terminal rows, no gutter in direct chats
* ui: forwarded arrow on the header line of terminal rows, above the time
* ui: forwarded arrow centred above the time line of terminal rows
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
* tests: fix group tests
* fix test
* fix
* fix delivery worker fix
* watch ci
* debug
* fix delivery worker not forwarding to moderators during host acceptance
* add script, update simplexmq
* debug lines
* more debug
* rerun
* debug
* fix, debug
* simplexmq
* simplexmq
* fix
* debug: log member-not-found call sites, restore hang diagnostics, use simplexmq fork
* tests: do not prompt for migration confirmation in strict tables test
* ci: run tests with one capability; simplexmq: end inactive sessions without closing under readers
* ci: run tests on all capabilities
* remote: close the HTTP2 client before its TLS connection
* cabal: use warp that kills timed out connection threads without closing their sockets
* remove diagnostics: member-not-found log, thread dump, CI watchdog; update simplexmq
* badge-service: prevent interleaving of concurrent log lines
* tests: wait for badge group broadcasts before closing members
* tests: log contact connected events received twice
* tests: log member connected events received twice
* core: use simplexmq that logs connections emitting CON twice
* core: keep the team contact above notes in a new user's chat list
* ci: skip macOS and Windows builds while hunting a Linux-only flake
* core: use simplexmq that logs the history of connections emitting CON twice
* tests: remove the logging of connected events received twice
* ci: run macOS and Windows builds again
* core: use simplexmq that runs one thread per agent worker
* core: use the merged simplex-chat/wai warp and the updated simplexmq
* core: use the merged simplexmq
* core: update simplexmq
* core, badge service: comment single writes of terminal segments and log lines
* rfc: invite member of one group to another group
* update
* update
* implement
* version
* update
* do not show error if contact was removed when joining group
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* core: group fixes/improvements
* Large messages dropped by relays and hosts (the same 15602 limit was applied, without accounting for forwarding header)
* Members below v18 did not receive forwarded messages or history in p2p groups.
* Join confirmations near the size limit could fail.
* SMP servers are limited to 2 host names each.
* simplify
* remove legacy forwarding and history support
* only restrict p2p groups
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* core, ui: remove database backups after key changes
* ui: delete database backups on chat start without delaying encryption marker reset
Keeping encryptionStartedAt set until chat start made DatabaseErrorView show
"The attempt to change database passphrase was not completed" with a Restore
button after every successful passphrase change when the passphrase is not
stored. Restore the marker handling from master and delete backups
unconditionally after chat starts.
* another flag
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
Co-authored-by: Narasimha-sc <166327228+Narasimha-sc@users.noreply.github.com>
* core: cancel the chat callback on interrupt
* badges: add multi-use codes
* badges: add the managed group
* badges: document multi-use codes and the group
* core: sign test badges with whole-second expiry
* badges: rework tracker and reply texts
* core: support message signing in p2p groups
* improve
* add member key
* distribute keys and sign
* refactor
* better query
* map
* sign in relay groups too
* clean up
* list
* fix test
* update bot types
* some refactor
* remove unnecessary condition
* simplify
* refactor
* simplify
* move
* clean up
* diff
* diff
* limit attempts for key sending
* optimize
* fix test
* split
* fuse
* null
* only mark as "key sent" when forwarder supports binary encoding
* fix bot apis
* fix some tests
* add key distribution steps, and fix some tests
* fix test
* increase timeout
* fix tests
* fix more tests
* simplify
* disable test output
* mark keys sent with invitations
* fix test
* fix test, query plans
* unify signing of connection info packets
* revert change to createNewGroup
* create key at group/member creation
* rename, remove liftIO
* clean up
* fix type
* remove ad hoc key sending
* update bot api
* diff
* reduce diff
* failing test
* fix sending messages in groups with members before version 18
* remove test delays
* update query plans
* update test
* add tests
* fix tests
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* core, ui: auto-accept group invitations per user profile
Add a per-profile toggle for auto-accepting group invitations, and regroup it
with the existing contact-requests setting under a single Auto-accept section
in Privacy & Security, relabelled "Contact requests in groups".
The join is fully async. processGroupInvitation already had an async accept
path, used when the invitation matches a group link the user opened:
prepareAgentJoin + createMemberConnectionAsync + joinAgentConnectionAsync,
with the outcome reported later against the CFJoinConn command id. Auto-accept
takes that same path instead of going through APIJoinGroup, so it works while
the app is closed and never blocks message processing.
An auto-accepted invitation still records a CIRcvGroupInvitation item in the
chat with the inviting contact, so there is a record of who added the user to
which group.
Two details worth noting for review:
hostContact is reported to clients only for group links. Clients respond to it
by replacing the transient host connection view with the group and removing
that chat - correct for a group link, where the contact is a placeholder, but
wrong for a plain invitation, where it is a real contact.
A resent invitation returns the existing group, because createGroupInvitation
is idempotent on inv_queue_info. The join therefore only runs while the
membership is still GSMemInvited, so a resend cannot open a second connection.
* booldef
* order
* refactor
* update translation key
* query plans
* ios: export translations
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
Co-authored-by: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
Messages of blocked members are hidden, but they still marked chat item
as user mention, showing mention badge and counting group as unread in
"mentions only" notification mode:
- createNonLive passed mentions unfiltered, allowing members blocked by
admin to mention user - it is the default path, as it is only used
when full delete is not allowed;
- userReply was set for replies to user messages from blocked members.
* core: remove SimpleX Status preset contact
Preset contact cards are only created at user record creation
(createPresetContactCards), so this affects new profiles only;
existing profiles keep their stored SimpleX Status contact.
Removing the card shifts contact ids allocated after /create user
down by one, hence the test id updates.
* plans: justify SimpleX Status preset contact removal
* core: don't mark member support chat items read when reading group without scope
Reading a group without a scope marked support-scope items read without
decrementing the per-member support_chat_items_* counters, so members stayed
unread in the support list even after their chat was fully read. Restrict the
no-scope group read and its timed-items query to main-scope items.
* plans: support chat unread on no-scope group read
* core: update query plans for group scope read
The main-scope read and timed-items queries now filter on group_scope_tag
and group_scope_group_member_id, so they seek via idx_chat_items_group_scope_stats_all
(5-column) instead of idx_chat_items_groups_user_mention (3-column).
* plans: document query-plan and benchmark performance results
* tests: fix unreliable support item id capture in no-scope group read test
lastItemId returns the latest item by item_ts, which right after createGroup2
can be the group "connected" event rather than the just-sent support message.
The per-item read then targeted the wrong (already-read, main-scope) item and
never decremented the support counters, so the test failed regardless of the
fix (consistently in CI, flakily locally depending on item ordering).
Capture the support item id directly from the member-support scope instead,
keeping the change contained to this test. Verified: the test passes with the
fix and fails when the fix is reverted.
* tests: fix name-shadowing build error in no-scope group read test
The local pattern binding `itemId` shadowed the `itemId` helper imported
from ChatTests.Utils, which -Wname-shadowing (Werror) rejects. Rename the
local binding to `iId`.
* core, ui: plan per-server roles for self-hosted servers
* core: add per-server roles field to UserServer
* core: add nullable role columns to protocol_servers
* core: persist per-server roles
* core: validate server coverage using per-server roles
* test: cover per-server roles resolution and coverage
* multiplatform: per-server role toggles for self-hosted servers
* ios: per-server role toggles for self-hosted servers
* core: per-server role overrides with per-role defaults
* test: cover three-state per-server role resolution
* fix: derive Eq for ServerRolesOverride
* multiplatform: three-state role dropdowns on saved servers
* ios: three-state role pickers on saved servers
* test: per-server roles independent across two servers
* test: enable names role in name-resolution tests
* style: trim comments in per-server roles code
* chore: rename server_roles migration to 20260716 (last)
* core: per-server roles override operator roles, inherit when unset
* multiplatform: per-server role default inherits from operator
* ios: per-server role default inherits from operator
* refactor(servers): tidy per-server roles per review
- dedup no-operator default into ServerRoles.noOperatorDefault (Kotlin/Swift)
- iOS: move roles-section control flow to the call site via a named gate,
and parse the server address once instead of up to three times
- Kotlin: collapse redundant derivedState; revert defaultOn->default rename
for cross-platform parity
- drop unused Hashable conformance on Swift ServerRoles
- add agentServerCfgs test for names inheritance from an operator
- remove no-op enableNamesRole calls from dormant DirectoryTests
- fix ChatClient import ordering
* chore(migration): date server_roles migration 20260720
* only show roles when server is enabled, move section above QR code
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
Evgeny @ SimpleX Chat