updateChatSettings read the contribution before and after from the chat it
was passed, after the API call. After a resume SimpleXApp.updateChats lists
new Chat objects while an open ChatView keeps the old one, so the stats it
read could be stale and its settings never changed by updateContact/
updateGroup. And an item event processed during the call can already carry
the new settings (addChatItem -> updateChatInfo), so reading the settings
after the call gave before == after. The contribution before is now the
listed chat's stats with the listed chat's settings from before the call,
and after is the listed chat's, as the Kotlin updateChatSettings does.
The "keep conversation" re-add in deleteContactChat likewise carries over
the listed chat's stats, taken before removeChat, rather than the passed
chat's.
updateChatSettings read the chat's contribution and unread tag before the
change from the listed chat after apiSetSettings returned. An item event
processed during the call can already carry the new settings (addChatItem
-> updateChatInfo), so before equalled after: the count and the unread tags
kept the chat's old contribution. Before is now the listed chat's stats
with the listed chat's settings from before the call.
Opening a chat replaces its chatStats with the server's on Android and
desktop. When the chat was already listed and the server reports fewer
unread items than the list had (e.g. items expired or were read on
another path), the count now drops by the chat's contribution
difference, like every other stats writer.
A content-filtered initial load of a group returns zero stats when no
unread item matches the filter (otherwise the full counts), so a load
with a content filter doesn't move the count (statsFiltered). A search
never reaches this branch: the core rejects initial pagination with a
search.
It only moves down. A chat from outside the 5000-chat window can be
listed with empty stats before it is opened, while the seed already
counted its unread items; moving up on its first open would count them
twice. Chats the load adds come with the server's stats, which the seed
already counted, so the count stays as it is for them. Upward drift
corrects itself at the next reseed: resume on Android and iOS, a profile
switch, opening the profile picker, or changing the chat item TTL.
If a new item arrives between the load's query and its stats
replacement, the downward move can drop the count below the database
until the next reseed.
iOS keeps the listed chat's stats on load, so there is nothing to move there.
The count is seeded by getUsersInfo, which counts RcvNew items where ntfsEnabled
holds - every item for an unmuted chat, only mentions for a mentions-only one,
none for a muted one. The deltas that maintain it afterwards did not follow that
rule for the active profile: addChatItem incremented for every item regardless
of the chat's notification setting; on Android and desktop the mark-read helpers
subtracted the full unread count, while on iOS Mark read and Clear followed the
mentions-only setting but subtracted the full count for muted chats, and
per-item reads forwarded the raw delta; removeChat left a deleted chat's unread
behind; and changing the setting moved a chat between rules without moving the
count.
Chat.userUnreadCount names what a chat contributes, and it is not a new rule:
totalUnreadCountForAllUsers already computed exactly this inline for the app
badge, and now calls it. The sites that change a chat's stats, its settings or
its presence report the contribution before and after, and the count moves by
the difference - apart from the exceptions noted at the end.
For that to hold the stats it reads have to be maintained, so on Android and
desktop decreaseCounterInPrimaryContext now decrements unreadMentions alongside
unreadCount when the item was a mention. Without it a mentions-only chat's
contribution never moved on any of that function's three paths - a deleted item,
a moderated member item, or an item going from New to Read. iOS already passed
the mention delta on its deletion paths.
This is visible beyond the profile picker, which badges only other profiles: the
desktop tray dot sums the count across profiles including the active one, and on
iOS these same deltas drive the app icon badge. So on iOS, muting a chat with
unread now drops the badge by its contribution, deleting a chat drops it, and a
message in a muted chat no longer raises it - each of which now agrees with
totalUnreadCountForAllUsers, which the badge is also set from.
addChat is deliberately not the mirror of removeChat: adding a chat means it is
being loaded into view, and its items were already counted by the seed, so
counting them again on ChatItemsLoader's addChat would double them. The one
place that removes and re-adds a chat while keeping its items - deleting a
contact in "keep conversation" mode on iOS - now carries its stats across and
restores the contribution explicitly, since the core keeps both the contact row
and its items there and the seed still counts them.
Wherever the chat list is re-read wholesale the counts are re-read with it: both
resume paths, and setting a chat item TTL, which deletes the active profile's
items without per-item events and so leaves its count stale. They are assigned
before the chats, which matters on iOS because updateChats recomputes the app
badge from users there. Reading users is best effort on both
platforms - losing them must not cost us the chats already fetched.
This does not make the count exact. getUsersInfo has no group_scope_tag filter
where the query behind chatStats.unreadCount does, so the seed counts
support-scope items that no client-side rule can, and the count steps up by the
outstanding support unread on each reseed. replaceChat also installs a whole
chatStats without moving the count: on Android and desktop from a snapshot taken
before the API call, in ChatListNavLinkView's markChatRead and markChatUnread
and ChatView's markUnreadChatAsRead, and on iOS from the server in the
receivedContactRequest handler in SimpleXAPI. Settings changes that arrive in
events through updateChatInfo do not move it either.
* desktop: fix crash in SimpleX address screen when there is no profile
* desktop: close SimpleX address screen when there is no profile
* desktop: rerun address screen self-close when its modal is reused or the stack changes
* desktop: close SimpleX address screen only when it is the top modal
* plans: correct address no-profile crash triggers and fix description
* plans: correct address no-profile crash fix description and verification
* plans: tighten address no-profile crash wording
* plans: add self-destruct trigger to address no-profile crash
* plans: qualify self-destruct trigger on desktop
* plans: drop desktop-only title from address no-profile crash
* plans: no connected mobile, not no mobile
* spec, product: document isLastModal and address screen without profile
* plans, spec, product: plan sections, address row spec, GAP-08 and GAP-09
* spec, product, plans: fix GAP-08/09 wording, table placement, ModalManager line
* spec, product: GAP-08/09 accuracy, gap count, clickable ModalManager location
* product, plans: GAP-09 at the level the code supports; qualify picker auto-open
* spec, product, plans: fix GAP-09 locations, stale line links, wording
* spec, product, plans: update plain-text line numbers; GAP-09 read wording
* plans: name the picker auto-open condition
* spec, plans: wording; security note
* plans: self-destruct did not crash on Android master; not a trigger
* plans: self-destruct path possible but unconfirmed; Android recovers silently
* spec, product, plans: drop GAP-09 and unrelated line refreshes
* plan: Android self-destruct path confirmed in logcat
* desktop: close Chat preferences screen when there is no profile, as the address screen does
* badge-service: accept a list of Apple roots
* badge-service: document root_certificates
---------
Co-authored-by: spaced4ndy <8711996+spaced4ndy@users.noreply.github.com>
* ci: drop dlltool from nodejs libs release
* nodejs: download libsimplex into the user cache
* nodejs: load libsimplex at runtime per backend
* support bot: select db backend with --db
* python: match backend switch error text
* nodejs: download prebuilt add-on at runtime
* ci: build nodejs add-on for libs release
* calculator bot: load libs and add-on in image
* support bot: document add-on override
* nodejs: keep worker test output free of colors
* nodejs: verify sha-256 of downloaded assets
* python: pin core libs release with sha-256
* ci: add packages release script
* ci: release nodejs add-on and open release PR
* ci: publish packages after release PR
* nodejs: keep npm from building the add-on
* calculator bot: build the add-on in the image
* ci: merge package release workflows
* ci: open release PR when publishing fails
* ci: build the add-on with node-addon-api only
* ci: skip publishing in a called packages workflow
* ci: update package release actions to Node 24
* nodejs: fix receive test timeout
* ci: test packages on pull requests
* nodejs: reuse the database in the close stress test
* ci: keep failed package tests from hanging
* ci: skip preset server tests
* ci: plan package builds from the changes
* ci: test packages with a given libsimplex
* ci: test packages with libsimplex of core changes
* ui: show unicode characters in address as unicode markers
* defence in depth for links in messages (they are non-clickable from parser)
---------
Current code does not have this problem, as markdown parser rejects such links, and they are not clickable - it is needed for new markdown file viewer - this way unicode links in markdown show with unicode sequences instead of look-alike letters.
* rfc: invite member of one group to another group
* update
* update
* implement
* version
* update
* do not show error if contact was removed when joining group
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* ios: delete temp data from storage view
The temp folder is the XFTP agent work directory and holds scratch
files for received-file encryption and roster transfers, so deleting it
under a running chat breaks those writes mid-flight. The button is only
enabled while chat is stopped, the same precondition core deleteStorage
relies on, and the row says how to stop chat.
* ios: show delete temp data alert over settings sheet
AlertManager presents from ContentView, which is behind the settings
sheet, so the confirmation never appeared. The alert now also warns
that interrupted transfers never complete and that videos in unsent
drafts, which live in the temp folder, are lost, and the caption names
the screen where chat is stopped.
* ios: say unsent draft videos are sent without the file
A draft video whose converted file was deleted from the temp folder is
still sent, as a preview with no file, so "lost" understated it.
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
* android: recognise passphrase fields as passwords for password managers
Passphrase fields used a hand-rolled VisualTransformation lambda, so Compose never
marked them as password fields: the autofill structure carried no hints and no
password inputType, and password managers could not identify them. The raw
passphrase was also exposed through the CopyText/ACTION_COPY accessibility action.
PassphraseField now declares an autofill content type and uses
PasswordVisualTransformation, which sets the password semantics Compose derives
that flag from.
Fields that create a passphrase declare NewPassword. Where no field would carry
plain password (first-time setup, hidden profile password) they declare both, as
managers do not recognise a form whose every field is newPassword. On the change
form the current-passphrase field supplies password, so the new fields declare
only newPassword - adding password there leaves the manager unable to tell which
field holds the new value and suppresses the save prompt.
* android: do not offer to save hidden profile passwords
Hidden profile password fields no longer declare an autofill content type.
Compose commits the autofill session, which shows the password manager's
save prompt, only after the last field with a content type leaves the
screen, so these fields never trigger it. A saved entry would reveal that
the hidden profile exists.
Rewrite the plan to match the code.
* android, desktop: storage breakdown in developer options
Port of the iOS Storage screen (#5529): lists each top-level entry of the app's data, config and temp folders with its recursive size, so it is possible to see what takes space.
* android, desktop: simplify storage view
Use DefaultProgressView, drop the bold total and redundant absoluteFile, and do not follow top-level symlinks (matches iOS; avoids counting the Android lib link).
* android, desktop: storage view: do not crash on names the JVM cannot convert to Path
Under a non-UTF-8 locale on Linux, File.toPath() throws InvalidPathException for a non-ASCII top-level name (e.g. a received file decrypted into tmpDir); log it and show 0 bytes. Also correct plan wording.
* android, desktop: storage view: fold path conversion into treeSize, use produceState
Also correct plan wording (du per-directory overhead, unlistable roots, Windows junctions).
* android, desktop: storage view: open as card screen like other settings screens
* android, desktop: storage view: list top-level entries as Path to keep their exact names
File.listFiles + toPath loses names that are not valid in the JVM file-name encoding (non-ASCII under a C locale, invalid UTF-8), so those entries showed 0 bytes. Files.newDirectoryStream keeps the raw bytes.
* android, desktop: storage view: normalize root paths before dropping nested roots
A root spelled with .. (e.g. XDG_DATA_HOME=/x/data/../tmp) compared as nested in another root and its size was shown nowhere.
* android, desktop: document storage view in spec and product docs
* android, desktop: storage view: single catch when listing a root
* android, desktop: do not log file paths in storage view
The walk's IOException messages contain the full path, which in tmpDir can be a received file's original name.
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
The core allocates every chat_* response with malloc and passes ownership to
the caller, as iOS does in API.swift. Both JNI bindings copied the bytes into a
Java string and dropped the pointer, so every command, event and file read
leaked its whole response into the C allocator - invisible to both the JVM and
the Haskell heap profiler.
Desktop frees in decode_to_utf8_string, the funnel every entry point already
goes through. Android has no such funnel because NewStringUTF is called inline,
so decode_and_free is added and the call sites routed through it. chatReadFile
frees directly on both.
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
* tests: close the walk stream in withTempDir
* desktop: receive app links from args and macOS
* desktop: forward an app link to the running app
* desktop: initialize the desktop platform lazily
* tests: share the temp directory helper
* desktop: register simplexchat scheme in packages
* desktop: register simplexchat scheme at runtime
* ui: end the badge page with a link on desktop
* desktop: raise the window over other apps
* docs: describe desktop deep links in the spec
* docs: plan desktop deep links
* docs: report on desktop deep links
* desktop: open simplex connection links
* docs: describe simplex links on desktop
* desktop: keep a link from opening twice
* desktop: retry taking a signal held open
* desktop: keep the user's AppImage link handler
* desktop: register Windows links through Capabilities
* desktop: add %u to the deb entry only once
* docs: describe the review fixes
* ui: open the badge link screen on the left
* ui: import moko accessors in the badge screens
---------
Co-authored-by: spaced4ndy <8711996+spaced4ndy@users.noreply.github.com>
* core: group fixes/improvements
* Large messages dropped by relays and hosts (the same 15602 limit was applied, without accounting for forwarding header)
* Members below v18 did not receive forwarded messages or history in p2p groups.
* Join confirmations near the size limit could fail.
* SMP servers are limited to 2 host names each.
* simplify
* remove legacy forwarding and history support
* only restrict p2p groups
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
Narasimha-sc