* Mesh bridging: stitch nearby mesh islands over Nostr, courier drops, settings surface
Three features plus a UI consolidation, all opt-in behind a new Bridge toggle:
Channel bridge: while bridging, outgoing public mesh messages are also
signed (with a derived, unlinkable per-cell Nostr identity) as kind-20000
events tagged #r with the local geohash-6 cell and published to the cell's
deterministic geo relays; mesh-only peers deposit via new toBridge/fromBridge
carrier directions through a bridge gateway (bridge + gateway toggles).
Remote islands' events render into the mesh timeline marked with a network
glyph. Events carry the original mesh message ID so the store's insert-by-ID
absorbs radio/bridge duplicates in either order. Loop prevention mirrors
GatewayService (three BoundedIDSet caches + skip-if-seen-locally + budgets).
Nothing crosses a bridge unless its author signed it for the bridge; a
per-message "nearby only" composer toggle keeps a message radio-only.
Courier over the bridge: sealed courier envelopes park on default relays as
kind-1401 drops tagged #x with their day-rotating recipient tag (NIP-40
expiry), signed by per-drop throwaway keys. Recipients subscribe for their
own candidate tags; bridge gateways watch verified local peers' tags and
hand matching drops over as directed courier packets. DM delivery to known
peers stops requiring a physical courier encounter; the Noise-X seal never
opens in transit.
Presence: kind-20001 heartbeats on the rendezvous feed a "people across the
bridge" count in the header (approximate: local participants subtracted by
radio-copy attribution).
Settings/Info: AppInfoView is now a segmented Settings/Info sheet. Settings
hosts appearance, voice (fixes the duplicated Voice section), a Connectivity
section (bridge + gateway + Tor toggles, the latter two moved out of the
location sheet), and a confirmed panic-wipe button. New announce TLV 0x06
advertises the gateway's rendezvous cell; PeerCapabilities gains .bridge.
i18n: 23 new keys across all 29 locales; coverage tests green.
Tests: 50 new app tests + 3 BitFoundation tests; full suite 1445 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Settings polish: one toggle style, sticky Info-first tab, location access in Settings
- The live-voice toggle now uses the same settings card + IRC pill as the
connectivity toggles (settingToggle, renamed from connectivityToggle).
- Segmented control orders Info first; the selected pane persists across
opens (AppStorage), so first-ever open lands on Info and afterwards the
sheet reopens where it was left.
- "remove location access" moved from the channels sheet into the Settings
Connectivity section (same key, still deep-links to system settings).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Location UX + copy: state-aware access control, honest empty state, clearer bridge/gateway text
- Settings' location control now covers all three permission states: grant
(real prompt, only possible while never-asked), open-system-settings when
denied, remove-access when granted. The channels sheet keeps its own grant
path for people who start there.
- The channels list no longer spins forever without permission; it shows
"grant location access to find nearby channels" instead (new key, 29
locales).
- Bridge and gateway subtitles rewritten for clarity; the gateway subtitle
moved to a new key since it now carries bridge traffic, and the old
geohash-only key is deleted. The word "user" is banned from copy in every
locale ("this person is blocked").
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Field-test fixes: dedupe relay-connectivity triggers, throttle presence, log bridge decisions
First on-device run confirmed publishes accepted and the subscription
delivering, but exposed trigger spam: NostrRelayManager's isConnected
re-emits per relay recompute, so presence published 5x/second and the
courier-drop subscription rebuilt 6x in 300ms. removeDuplicates() on the
sinks + a 30s presence throttle (same-second heartbeats are byte-identical
events anyway). Also: injection/skip/downlink now log under 🌉 so field
verification is observable — the first test looked silent precisely because
dedup correctly suppressed same-island bridged copies.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix restart self-echo: recognize own rendezvous events by derived pubkey
Second field run proved bidirectional bridging live (~1-2s Mac<->iPhone via
Tor) but caught a bug: relay backfill after an app relaunch re-delivered the
device's own pre-restart events, and with the in-memory published-ID cache
wiped they rendered as bridged copies of your own messages. The rendezvous
identity is deterministically derived per cell, so self-recognition by
pubkey needs no cache and survives restarts; own events are also marked
never-downlink. Regression test simulates the fresh-launch state.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet: mesh, bridge, and groups in one list
The header's bridged count had no matching faces anywhere — the people
sheet only knew mesh peers. BridgeService now publishes named participants
(nickname from message tags, geohash-style #last4 disambiguation, presence
keeps a known name alive) and the mesh people sheet gains an
"across the bridge" section between mesh peers and groups. Display-only
rows in v1 (bridged identities have no DM route yet). Two new catalog keys
x29 locales; also normalizes one out-of-sort-order entry inherited from a
hand-edited key on main.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Header: one people icon, one count, one sheet
Fold the bridged-people count into the main person.2.fill count instead of
a second network-glyph counter; the merged people sheet (mesh / across the
bridge / groups) is the breakdown. VoiceOver still announces how many of
the total are across the bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet symmetry: #mesh section header, no active count
Every section now gets the same glyph+label header shape (shared
PeopleSectionHeader): #mesh over the peer list, across-the-bridge over
bridged people. The "N active" line is gone (mesh); location channels keep
their geohash subtitle. Dead subtitle/count helpers removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* One switch: the bridge toggle drives all internet sharing
Field feedback: two toggles (bridge + gateway) with an invisible dependency
was a trap — bridged messages silently never reached mesh-only neighbors
unless a second lever was found and flipped. Collapsed to a single switch
that does the right thing for your situation:
- Bridge ON + internet: your messages cross, you see the bridge, AND your
device serves its island — accepts toBridge deposits, carries remote
messages onto the radio, watches courier drops for verified local peers,
advertises the cell, and runs the geohash-channel gateway.
- Bridge ON, no internet: you ride whoever nearby is serving.
- Bridge OFF: nothing of yours crosses; radio reception of bridged traffic
stays passive and free.
With every online bridger serving, downlink gets a 0.2-1.5s jittered
holdoff + send-time suppression recheck so co-located gateways don't burn
duplicate airtime (two-gateway test included). The internet-gateway card is
gone from Settings (GatewayService now follows the bridge switch, with
launch-time migration); its orphaned catalog keys deleted and the bridge
subtitle broadened across all 29 locales. Also: MeshPeerList's empty state
("nobody around...") aligned to the section row rhythm.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Bridge pumps its own location; fix centered people sheet; stop drop-subscription churn
Field session 3 found the bridge silently cell-less: it read
availableChannels passively, which only flow while some other feature
(channels sheet, location notes, geo sampling) happens to pump location —
turn those off and the bridge never gets a rendezvous. BridgeService now
requests a one-shot fix whenever it's enabled without a cell (and
piggybacks one on the presence timer so moving devices migrate cells).
Also from the session: the people sheet's scroll content hugged its widest
child and got centered on iPhone when the list was empty — pinned to full
width, leading. And the courier-drop subscription rebuilt every ~60s on
verified announces despite an unchanged tag set — now resubscribes only
when the tags actually change.
(Also merges origin/main: keychain test isolation #1413.)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix launch race: bridge reacts to the permission callback, retries cell-less
Field session 4: the launch-time location request ran before the CoreLocation
authorization callback delivered, so refreshChannels() silently no-opped
(it requires .authorized) and nothing ever retried — the bridge stayed
cell-less all session. Three layers now close it:
- a $permissionState sink re-enters refreshRendezvous the moment
authorization resolves (the fast path),
- the maintenance timer arms even without a cell and retries the full
rendezvous refresh (the backstop; it previously required a cell, which
made it useless for exactly this failure),
- flipping the bridge switch while never-asked triggers the location
prompt — that's the user-initiated moment for it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet: one header style for every section; bridged people visible while own bridge is off
GroupChatList's header now uses the shared PeopleSectionHeader (glyph +
label, same size/padding as #mesh and across-the-bridge; keeps its key and
header trait). Bridge section and the header count are no longer gated on
this device's own toggle: bridged people arrive over passive radio from a
serving neighbor, and whoever is visible in the timeline belongs in the
sheet and the count.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet: equalize the first section's gap
MeshPeerList's first row kept a legacy 10pt top bump from when nothing sat
above it, and the outer VStack's 6pt inter-child spacing applied between
the #mesh header and the list but not inside the other sections. Both gone:
sections own their rhythm (header 12/4, rows 4), spacing 0 outside.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet: rows drop their leading glyphs — the section header carries the type
Mesh rows lose the per-state transport icon (connected/relayed/nostr/
offline), bridge rows the network glyph, group rows the person.3 icon.
Trailing state badges (star, lock, verified, unread, blocked, crown) stay,
and the row accessibility description still announces connection state, so
VoiceOver loses nothing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Remove dead code left behind by the Settings|Info consolidation
Periphery (--strict) flagged five leftovers on this branch:
- LocationChannelsModel.setGatewayEnabled: the standalone internet-gateway
toggle is gone (the bridge switch drives internet sharing), so nothing
calls it; the gatewayEnabled published property stays for the header dot.
- AppInfoView Strings.Location title/enable/openSettings: the old Location
section's header and permission buttons no longer exist. Their orphaned
Localizable.xcstrings entries go with them (the gateway-toggle keys were
already pruned).
- BridgePeopleList's appTheme environment value was never read.
The sixth CI finding (PrekeyBundleStore.StoredBundle.noiseKey assign-only)
is a Periphery flake: the property is read in loadFromDisk, the finding
didn't reproduce locally or on the next CI run of unchanged code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* People sheet: mesh rows get their transport glyph back
The mesh section is the one heterogeneous list — the leading icon encodes
HOW a peer is reachable (radio / relayed / nostr-only / offline), which the
header can't say. Bridge and group rows stay glyph-free.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix courier drop skipped by stale BLE reachability; periodic deposit sweep
Field test: a DM sent seconds after the recipient's radio vanished still
saw them as "reachable" (60s verified retention), so canDeliverPromptly
held, every deposit was skipped, and the message sat spooled with no retry
path. MessageRouter now sweeps its outbox every 2 minutes and publishes
bridge drops for messages whose recipient no transport can promptly reach;
the drop layer's message-ID dedup makes the sweep idempotent. Regression
test reproduces the exact field sequence.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Show "carried" when a message ships as a bridge drop
Field feedback: dropped DMs delivered but the sender saw nothing — the
drop path never fired onMessageCarried, and the recipient's delivery ack
has no radio route back until the peers next share a transport. depositDrop
now reports whether a fresh drop was sealed and the router marks the
message carried (📦) on both the send path and the sweep; the ack still
upgrades it to delivered whenever a route exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix locale word order: offline tag after name in DM header; localized "ago"
The private-chat header rendered the localized offline word in the
availability-glyph slot, before the name — "sin conexión bob". Offline now
shows the same dimmed person glyph the mesh list uses, with the word as a
small trailing tag after the name and lock, so it reads correctly in every
locale. Full sweep of views found one more composition bug: notice
timestamps glued English "ago" onto a localized duration; now the whole
phrase comes from RelativeDateTimeFormatter (same as the "fades" label).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* DM header offline state: icon only
The availability slot now reads uniformly as a glyph (radio / relayed /
globe / dimmed person), matching the mesh list; the text tag is gone.
VoiceOver still announces "offline" via the glyph's accessibility label.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Offline glyph: slashed antenna instead of dimmed person
Offline is now the visual negation of connected (same antenna glyph,
slashed) in both the DM header and mesh list rows; a generic person icon
didn't say "unreachable".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Live push-to-talk voice for DMs: stream while you talk, voice note as fallback
Holding the mic in a DM now streams AAC frames live over the Noise session
(walkie-talkie style, ~0.5s mouth-to-ear at one hop) while recording the same
audio as a normal voice note. On release the note ships through the existing
fileTransfer pipeline; receivers that heard the live stream absorb it silently
into the same bubble (matched by the burst ID embedded in the file name), so
reliability comes for free and nobody sees duplicates.
Protocol:
- NoisePayloadType.voiceFrame = 0x08 carrying VoiceBurstPacket
(burstID + seq + START/data/END/CANCELED, length-prefixed AAC frames)
- 210-byte burst-content budget keeps each Noise packet inside the 256-byte
padding bucket: one BLE frame, never the fragment scheduler
- fire-and-forget: frames are dropped (never queued) without an established
session; live is only offered when the peer is mesh-reachable
Receive:
- ChatLiveVoiceCoordinator assembles bursts (jitter-ordered, 0.5s gap skip,
3s idle end, flood/size caps), persists progressively as ADTS .aac so even
a partial burst is a replayable bubble
- live autoplay only when the conversation is on screen, app active, and the
new app-info "live voice messages" toggle is on (also gates live sending)
- one-playback-at-a-time via a shared ExclusivePlayback slot
Capture:
- PTTCaptureEngine taps AVAudioEngine, dual-encodes: live AAC frames + the
finalized .m4a (same 16kHz/mono/16kbps settings as VoiceRecorder)
- VoiceRecordingViewModel now drives a pluggable VoiceCaptureSession; the
composer HUD shows a pulsing LIVE treatment when streaming
Includes the push-to-talk design doc, 6 new localization keys across all 29
locales, and unit tests for framing, packetizer budget, ADTS output, codec
round-trip, and the assembly/absorb lifecycle. Public-mesh PTT (MessageType
0x29) lands separately on top of this.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* PTT follow-ups from review + field test: peer-ID normalization, toggle gates inbound, drop-path diagnostics
Codex review fixes (#1403):
- makeVoiceCaptureSession normalizes the selected peer with toShort() before
the reachability/session checks and binds the send target to that same
routing ID — a conversation selected under the stable 64-hex Noise key no
longer silently falls back to a classic note while the short-ID session is
established
- the live-voice toggle now gates inbound bursts too: off means
classic-notes-only in both directions (no live bubble, partial file, or
early notification; the finalized note still arrives), with a test
Field-test diagnostics (first device run: DM frames decrypted but no bubble
appeared, with no log evidence of which guard dropped them):
- coordinator logs undecodable frames (size + hex prefix) and blocked drops
- makeAssembly logs directory/file-handle failures instead of returning nil
silently
- PTTLiveVoiceSession logs capture start and finish (packet/frame/duration
counts); PTTCaptureEngine logs engine start success/failure with the input
format; BLEService.sendVoiceFrame logs no-session drops
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix iPhone live-capture failure: dead input unit (AURemoteIO -10851, 0 Hz)
Field testing showed the phone's live capture failing at mic enable with
AURemoteIO -10851 and an input format of 0 Hz / 2 ch — an input unit bound
to an earlier (playback-only or settling) audio session. The Mac, which has
no session lifecycle, captured fine, which is why public bursts from the Mac
worked while phone-side sends degraded from working (first hold) to sporadic
to dead across holds.
Three layers of defense:
- PTTCaptureEngine recreates its AVAudioEngine on every start(), after the
session is configured, so the input unit binds to the session that is
active now; a dead input (0 Hz or 0 channels) is now a distinct, logged
error instead of a silent setup failure
- PTTLiveVoiceSession retries the capture start once after a 150 ms
route-settle pause
- VoiceRecordingViewModel falls back to the classic VoiceRecorder within the
same hold if the live engine still cannot start — a route glitch now costs
the live stream, never the voice note
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Unified notices: merge board pins and location notes into one sheet
One pin icon in the header now opens a single Notices sheet with a
geo/mesh scope toggle, replacing the separate board, location-notes,
and mesh-only note buttons:
- geo tab: current geohash's notices — mesh-synced board posts merged
and deduped with Nostr kind-1 location notes, with per-item mesh/net
source badges. Scope follows the selected location channel, or the
device's building geohash when chatting on mesh.
- mesh tab: mesh-local board only (fully offline).
- One composer: geo posts go to the board and bridge to Nostr (existing
bridge), so mesh and internet see the same notice.
- Merged delete: tombstoning an own board post now also retracts the
bridged Nostr copy via NIP-09 (new createDeleteEvent, bridged event
ids tracked in BoardManager); own Nostr-only notes are deletable too.
- LocationNotesManager accepts any channel-precision geohash (1-12
chars), not just building-level.
BoardView and LocationNotesView are superseded by NoticesView.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Notices round 2: honest composer, friendlier copy, new-pin chat alerts
- Urgent + expiry controls now appear on the mesh tab only: the bridged
Nostr copy of a geo post carries neither, so relay-side readers would
never see them. Geo posts default to non-urgent with 7-day expiry, and
the bridged note now gets a NIP-40 expiration tag so honoring relays
drop it in step with the board copy.
- Geo tab explainer reuses the original location-notes description
(keeps its 29 existing translations); mesh tab gets a new plain-
language description.
- New-pin chat alerts, fully local (no wire traffic): BoardStore fires
postArrivals for posts newly accepted from the wire; BoardAlertsModel
filters own posts, dedups by postID, and for urgent pins created
within the last 30 minutes emits one system line into the matching
timeline (geo pin -> that geohash's chat, mesh pin -> mesh chat),
collapsing simultaneous arrivals into a count line.
- Routine pins light up the header: the pin icon tints orange whenever
the current scope has notices at all, and fills (pin.fill) while
unseen new pins are waiting; opening the sheet clears them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* i18n: translate the unified-notices strings into all 28 non-English locales
Adds the 13 new notices keys (sheet title, geo/mesh tabs, mesh
description, source badges, urgent alert lines, button tooltip and
accessibility strings) to the string catalog with translations for
every locale the app ships. The geo tab already reuses the fully
translated location_notes.description; this covers the rest. Insertion
preserves the catalog's case-insensitive key order, so the diff is
purely additive.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Address Codex review: panic-wipe reset, scoped badge clear, geohash-aware dedupe
- BoardStore.wipe() now emits didWipe; BoardAlertsModel subscribes and
resets, so a panic wipe drops pending urgent lines (which could
otherwise re-append pre-wipe content into chat after the collapse
flush), unseen badge scopes, and handled-post history.
- Opening the notices sheet clears unseen badges only for the scopes it
actually shows (mesh + current geo scope); pins for other geohash
channels keep their badge until visited.
- LocationNotesManager.Note now retains the matched g tag, and the
bridged-copy dedupe requires the note's geohash to equal the board
post's — a same-text note from a neighboring cell is no longer
swallowed as a duplicate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add mesh diagnostics: /ping, /trace, and topology map
- New protocol types ping=0x26 / pong=0x27 (9-byte payload: 8-byte nonce
+ origin TTL) with per-peer inbound rate limiting (5 per 10s)
- /ping @name reports RTT and hop count, 10s timeout
- /trace @name prints the estimated path from gossiped directNeighbors
- Topology map sheet (circular Canvas layout) reachable from App Info
- Ping/pong ride the deterministic directed-relay path like DMs
- Tests: payload round-trip, hop-count math, command output, edge
normalization, layout
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Fix CI media-wipe race, per-link ping rate limiting, and /ping output routing
Three fixes for PR #1377 review:
1. CI flake (sendImage_privateChatProcessesAndTransfersImage): the
panicClearAllData / clearCurrentPublicTimeline detached utility-priority
tasks delete the real ~/Library/Application Support/files tree, which the
test process shares. The wipe fires at a nondeterministic time and raced
the sendImage test's JPEG in files/images/outgoing (write then re-read),
so prepareImagePacket threw and the test timed out. Both wipes are now
skipped under tests (existing TestEnvironment.isRunningTests pattern);
this also stops test runs from deleting the developer's real media.
2. Codex P1: ping packets are unsigned, so keying the pong rate limiter on
packet.senderID let one connected peer rotate forged sender IDs to bypass
the 5-per-10s budget. The limiter now keys on the ingress link (the
directly connected peer that delivered the packet); the pong still goes
to the claimed sender. Regression test proves rotating senders over one
link exhaust one budget (fails 10 vs 5 pongs on the old code).
3. Codex P2: /ping output arrived up to 10s later and was routed from
selectedPrivateChatPeer at callback time, misrouting the result after a
chat switch. The origin conversation is now captured when the command is
issued (CommandOutputDestination) and deferred output is routed there:
a DM result lands in the origin chat's history even if deselected, and a
mesh-timeline result pins to #mesh instead of the active channel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* App Info: move NETWORK section under HOW TO USE and uppercase NETWORK/SYMBOLS headers
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Conform DiagnosticsMockContext to sendPublicMessage
CommandContextProvider gained sendPublicMessage (Cashu /pay, #1376) after
this branch forked, so the diagnostics test mock no longer conformed once
main was merged in. Add the no-op stub.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Centralize UI theme colors into semantic ThemePalette tokens
Introduce AppTheme/ThemePalette (Utils/Theme.swift) with an environment
key and @ThemedPalette property wrapper, persisted via @AppStorage.
Views now resolve background/primary/secondary/accentBlue/alertRed/
divider tokens from the environment instead of computing colors inline,
removing the backgroundColor/textColor/secondaryTextColor prop-drilling
through the header, composer, and people-sheet hierarchy.
Matrix theme output is pixel-identical; this is groundwork for a
user-selectable theme switcher.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add liquid glass theme with in-app appearance switcher
Add a .liquidGlass AppTheme alongside the matrix terminal theme,
selectable from a one-line APPEARANCE row in the app info sheet
(persisted via @AppStorage, applies live).
Liquid glass renders system fonts and colors over a subtle gradient
backdrop, with the header and composer floating as Liquid Glass panels
(real .glassEffect() on iOS/macOS 26, compiler-gated with an
ultraThinMaterial fallback for older SDKs). The message list scrolls
underneath the chrome via safe-area insets, and all sheets share the
same backdrop and surface language. The matrix theme is unchanged.
Details:
- Theme is threaded through ChatMessageFormatter so message
AttributedStrings switch font design per theme; the per-message
format cache gains a variant key so themes never serve each other's
cached strings
- New palette tokens: accent (interactive tint) and locationAccent
(geohash green), replacing scattered hardcoded greens/blues in the
voice note, waveform, verification, and people-sheet views
- Header controls get full-height tap targets and the people count
becomes a real Button (previously a tap gesture on the cluster)
- CommandSuggestionsView renders nothing when empty instead of a
zero-height view that pushed the composer input off-center
- New appearance strings localized for all 29 catalog languages
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Extract message list into dedicated MessageListView
* Fix broken smoke test
Mounts two distinct fixtures to cover separate render branches: a truncatable message (>2000 chars, no payment tokens) and a payment message (lightning + cashu, private, partial delivery). Expectations guard that each fixture actually reaches its intended branch.
---------
Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com>
* Extract `ImagePreviewView` + add `#Preview`
* Extract image pickers + dedupe and bg processing of images
* Include a dummy photo in the preview assets vs live url
* Fix development assets + url percent encoding
* Fix iOS vs macOS build issue
* Fix SPM-related issues
* Extract voice-related code to a dedicated VM
* Minor optimization of permission request + fix ui bug
When isPreparing is being set to true before permission is granted, the UI is shown for a fraction of a second and it’s even worse if the permission is being asked constantly if the user drags the finger even when the alert is shown
* Remove dead code
* Remove unnecessary delegate conformance
* `actor VoiceRecorder` + other minor improvements
* Centralized opening system settings + open for mic access
* Better voice-recording state handling with Enum
* Remove manual timer management
* Simplify formatting + avoid jumping UI w/ countdown
* Add `requestingPermission` state to avoid repetitive calls
* Improve guarding of the states after awaits
* Fix potential “actor reentrancy across awaits” issue
* Remove short-circuiting on .idle + guard before error
* Fix playbackLabel’s formatting for duration vs remainder
---------
Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com>
Fixes crash on macOS when presenting sheets due to missing @EnvironmentObject.
Added .environmentObject(viewModel) to 8 sheet/fullScreenCover presentations.
Fixed presentations:
- AppInfoView sheet
- FingerprintView sheet
- ImagePickerView fullScreenCover (iOS, both contexts)
- MacImagePickerView sheet (macOS, both contexts)
- ImagePreviewView sheet
- LocationChannelsSheet sheet
Tested on macOS 26.1 (Apple Silicon M4).
All sheet presentations now open without crash.
Platform: macOS only
Impact: Resolves EnvironmentObject.error() crashes
- ContentView: Wrap Timer callbacks in Task { @MainActor in } to
properly access main actor-isolated properties (updateAutocomplete,
messages)
- BitchatApp: Capture nickname before entering background queue to
avoid accessing main actor-isolated property from Sendable closure
* Add localizable strings in show commands view n refactor code to remove duplicate string declarations.
* Modify struct to enum in separate file to Models/CommandsInfo.
* Add corrections code in refactory and enum.
* Correct code in command enum and ContentView.
* Dedicated CommandSuggestionsView to extract code
* Simplify CommandInfo + minor optimization
* Fix preview
---------
Co-authored-by: islam <2553451+qalandarov@users.noreply.github.com>
Implements mutually-exclusive image picker presentations to fix the error
"Currently, only presenting a single sheet is supported" when tapping
camera in a DM.
Solution:
- ContentView: Only presents image picker when NOT in a sheet
(when showSidebar=false and no private chat active)
- peopleSheetView: Only presents image picker when IN a sheet
(when showSidebar=true or private chat active)
This ensures only ONE presentation is active at any time, preventing
conflicts. Uses fullScreenCover on iOS to allow presentation over sheets.
Addresses feedback from @qalandarov in PR #834 with minimal approach.
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* Add BLE file transfer support and media UX
* Gracefully disable mac attachment pickers in sandbox
* Tighten spacing above media message bubbles
* Reduce vertical padding between chat rows
* Restore iOS file importer for attachments
* Copy imported files before sending to preserve access
* Allow file transfers from connected but unverified peers
* Raise BLE notification buffer cap for large file transfers
* Revert "Raise BLE notification buffer cap for large file transfers"
This reverts commit b624523af843475db84e4a846db8dcbe824ae408.
* Add guard to drop oversized BLE notification assemblies
* Let BLE assembler accept large frames up to hard cap
* Add detailed logging for BLE fragment assembly
* Log incomplete BLE frames for debugging
* Stop dropping partial BLE frames while assembling notifications
* Fix compressed BLE file transfers
* Enable mac attachment importers
* Allow mac microphone access
* Permit mac media library access
* Describe microphone usage
* Harden attachment transfer bookkeeping
* Display recording milliseconds
* Restore mac photo picker access
* Use Photos picker on mac
* Allow long-press reblur on images
* Reblur images via swipe
* Lowercase image preview buttons
* Keep processed images for outgoing messages
* Use save panel for mac image export
* Fix image attachment detection
* Allow user-selected write access
* Align mac image JPEG encoding
* Revert unsupported JPEG option
* Strip metadata in mac image encoding
* Normalize mac JPEG color space
* Target image byte size across platforms
* Fix CFMutableData handling
* Preserve packet version when signing
* Use unique transfer identifiers
* Stub file transfer methods in mock
* Stub file transfer methods in mock
* Hide absolute paths in media messages
* Resolve image/voice path handling
* Fix cleanupLocalFile lookup
* Restore BLE broadcasts when notify buffer is saturated
* Guard peer map reads on BLE message path
* Drop attachment ceilings to 1 MiB and bump release version
* Reset BLE assembler on stalled fragment trains
* Fix binary protocol test fixtures
* Fix critical issues from PR #681 review
Critical fixes:
- BinaryProtocol: Return nil for unknown versions (prevents buffer underflows)
- Add BinaryProtocol.Offsets struct to centralize magic numbers
- Replace magic offset calculations with named constants
Security/Privacy:
- FileAttachmentView: Use url.lastPathComponent instead of url.path
(prevents exposing full system paths)
Documentation:
- Fix compression algorithm documentation (zlib, not LZ4)
All tests passing.
* Fix UI freeze when receiving voice notes
Problem: AVAudioPlayer initialization in VoiceNotePlaybackController.init()
was running synchronously on main thread during view creation, blocking
UI for 50-200ms per voice note.
Solution:
- Remove eager preparePlayer() call from init
- Load duration asynchronously on background queue
- Player is only prepared when playback is actually requested via ensurePlayerReady()
This prevents UI freezes when voice notes appear in the chat.
* Fix memory leaks and post-playback freeze
Fixes:
1. Post-playback freeze: audioPlayerDidFinishPlaying now dispatches to main
thread before updating @Published properties (Swift concurrency violation)
2. Unbounded waveform cache: Implement LRU eviction with 20-entry limit
- Track last access time for each cached waveform
- Evict oldest entry when cache is full
- Prevents unlimited memory growth as voice notes accumulate
3. Audio buffer memory leaks: Wrap computeWaveform in autoreleasepool
- AVAudioPCMBuffer allocations are autoreleased
- Pool ensures buffers are freed promptly
4. Image processing memory: Add autoreleasepool around compression loops
- Each jpegData() call creates temporary objects
- Inner pool per iteration prevents memory spikes during quality search
Memory should now remain stable during extended use.
* Eliminate disk I/O from SwiftUI view rendering path
Critical performance fix for UI freezes when receiving media:
Problem: mediaAttachment(for:) was called during every SwiftUI render,
performing synchronous disk I/O on main thread:
- FileManager.fileExists() called 2-6x per message (checking subdirs)
- applicationFilesDirectory() creating directories on every call
- With multiple media messages, this meant 20-100+ disk ops per render
Solution:
1. Remove fileExists checks - construct URLs directly
- Files are validated during playback/display (fail gracefully if missing)
- Sender determines subdirectory (outgoing vs incoming)
2. Cache applicationFilesDirectory() result
- Static cache prevents repeated FileManager.url() calls
- Directory created only once
3. Remove redundant playback.replaceURL() in VoiceNoteView.onAppear
- Controller already initialized with correct URL
This eliminates ALL disk I/O from the view rendering hot path.
* Cache Nostr identity derivation to prevent crypto during view rendering
Critical performance fix:
Problem: formatMessageHeader() called deriveIdentity(forGeohash:) during
every SwiftUI render for every media message. Each call performed:
- Keychain I/O (getOrCreateDeviceSeed)
- HMAC-SHA256 computation
- Up to 10 secp256k1 key validations (elliptic curve crypto)
With multiple media messages, this resulted in 100s of milliseconds of
blocking crypto on main thread per render cycle.
Solution: Add thread-safe cache for derived identities
- Check cache before expensive crypto operations
- NSLock protects concurrent access
- Identity is deterministic per geohash, so caching is safe
This eliminates crypto from the hot rendering path.
* Cache geohash identity in ChatViewModel to prevent crypto during rendering
Additional optimization for location channels (voice notes are mesh-only,
but this helps with text message rendering in geohash channels):
- Add cachedGeohashIdentity to avoid deriveIdentity calls during rendering
- Check cache before falling back to crypto derivation
- Reduces main thread crypto work in location channels
* Make voice note loading completely lazy with deferred initialization
Aggressive performance optimization to prevent UI freezes:
Problem: Even with async loading, creating 10+ VoiceNotePlaybackController
instances simultaneously (when scrolling past multiple voice notes) spawned
20+ concurrent background tasks, potentially starving main thread.
Solution - Ultra-lazy loading:
1. VoiceNotePlaybackController.init() now does ZERO work
- No duration loading
- No player creation
- Instant initialization
2. Duration loaded on-demand via public loadDuration() method
- Called from VoiceNoteView.onAppear after 150ms delay
- Reduced priority: .utility instead of .userInitiated
- Guard prevents duplicate loading
3. Waveform loading also deferred 150ms
- Gives UI time to settle after message appears
- Prevents task storms when multiple voice notes appear
This spreads the work over time instead of all at once.
* Ensure /clear and panic triple-tap delete media files
Fix: /clear command and panicClearAllData() now properly delete media files
1. /clear (triple-tap on chat):
- Deletes outgoing media (voice notes, images, files)
- Conservative: only our sent media, preserves received media
- Runs in background to avoid UI freeze
2. panicClearAllData() (triple-tap on bitchat/ header):
- Deletes ALL media files (incoming + outgoing)
- Removes entire files directory and recreates structure
- Ensures complete data wipe for emergency scenarios
Both operations run async on .utility queue to prevent blocking UI.
* Fix infinite render loop and apply all security fixes
CRITICAL BUG FIX - Infinite Render Loop:
Root Cause: Duplicate view identity in ContentView.swift:368
ForEach(messageItems) { item in // Already uses item.id via Identifiable
messageRow(...)
.id(item.id) // ❌ REDUNDANT modifier caused identity re-evaluation loop
}
When @Published properties updated, SwiftUI re-evaluated .id() → appeared as
'new' identity → triggered re-render → infinite loop. Caused UI freezes,
keyboard failures, and 100% CPU usage.
Fix: Remove redundant .id() modifier - ForEach already has stable identity.
PERFORMANCE FIXES:
1. Waveform Cache Deadlock (Waveform.swift)
- Removed nested queue.async(barrier) on cache hits
- Was causing task saturation and potential deadlocks
2. Async Send Pattern (ContentView.swift)
- Clear input immediately, defer actual send to next runloop
- Prevents blocking current event handler
3. Proper Swift Concurrency (VoiceNoteView.swift)
- Switch from .onAppear + DispatchQueue to .task
- Cleaner async/await pattern for loading
4. Remove Redundant objectWillChange (ChatViewModel.swift)
- @Published already triggers updates automatically
- Explicit send() was causing double update cycles
SECURITY FIXES (C1-C5, H1-H2):
C1. Path Traversal Protection (BLEService.swift)
- Unicode normalization, null byte removal
- Replace ALL path separators, reject dotfiles
- Validate paths don't escape directory
C2. Integer Overflow (BitchatFilePacket.swift)
- Use UInt64 for TLV parsing, safe Int conversion
C3. MIME Validation (BLEService.swift)
- Whitelist: JPEG, PNG, GIF, WebP, M4A, MP3, WAV, OGG, PDF
- Magic byte validation for all types
- Lenient on M4A (platform variations)
C4. Compression Bomb (BinaryProtocol.swift)
- Ratio validation <= 50,000:1
- Defense-in-depth with 1MB size cap
C5. TOCTOU Race (ChatViewModel.swift)
- Direct removeItem without fileExists check
H1. File Size Validation (ChatViewModel, ImageUtils)
- Check attributes BEFORE Data(contentsOf:)
- Prevents memory exhaustion
H2. Metadata Stripping (ImageUtils.swift)
- Remove ALL metadata keys from JPEG encoding
- Only compression quality set
- Protects GPS/EXIF/device info privacy
RESULT:
✅ No render loops
✅ Works with Xcode debugger
✅ Voice notes display properly
✅ All security vulnerabilities fixed
✅ 164 tests passing
Production ready.
* Complete all translations to 100% and fix auto-extraction
- Mark non-localizable strings with Text(verbatim:) to prevent extraction
- Update UI strings to lowercase per style guide (open, save, close, recording)
- Add complete translations for all 29 languages (194/194 strings at 100%)
- Remove empty/duplicate entries (@, bitchat/, Open, Recording %@)
- Add proper localization comments for all user-facing strings
* macOS: Focus message input on launch instead of nickname field
* Remove debug print statements from sendMessage
* Optimize voice note codec to 16 kHz / 20 kbps for smaller file sizes
- Reduce sample rate from 44.1 kHz to 16 kHz (telephony standard)
- Lower bitrate from 32 kbps to 20 kbps
- Results in ~37% file size reduction (~150 KB/min vs 240 KB/min)
- Increases max voice note length from 4.4 to 7 minutes over 1 MiB BLE limit
- Maintains excellent voice quality using native AAC-LC codec
* Fix critical security issues in fragment reassembly and file cleanup
Fragment Reassembly Race Condition (CRITICAL):
- Wrap all incomingFragments/fragmentMetadata access in collectionsQueue.sync
- Prevents concurrent modification crashes from multi-threaded access
- Minimizes lock contention by doing heavy work (reassembly/decode) outside locks
- Add upper bound check: reject fragments with total > 10,000 (DoS prevention)
- Add cumulative size validation before storing fragments (memory DoS prevention)
File Cleanup Path Traversal (CRITICAL):
- Use NSString.lastPathComponent to extract filename safely
- Prevents directory traversal attacks via malicious filenames
- Add path prefix validation before file deletion
- Now checks both incoming and outgoing directories (fixes disk leak)
Additional Protections:
- Fragment assemblies now limited by both count (128) and cumulative bytes (1MB)
- Explicit checks for "." and ".." filenames in cleanup
- Defense-in-depth: multiple validation layers
* Fix post-rebase compilation errors
- Remove duplicate NostrIdentityBridge and Bech32 from NostrIdentity.swift (now in separate files)
- Add caching to NostrIdentityBridge.deriveIdentity() for performance
- Remove duplicate NotificationStreamAssembler from BLEService.swift
- Remove duplicate function declarations in BLEService.swift
- Remove duplicate DeliveryStatusView and PaymentChipView from ContentView.swift
- Fix PeerID type conversions throughout (use .id for String, PeerID(str:) for wrapping)
- Update ContentView body to use main's simple VStack structure
- Fix NostrIdentityBridge instance method calls
- Remove privateChatView (replaced with sheet-based UI in main)
Build and tests passing (137/139 tests pass).
* Fix remaining compilation issues after rebase
- Fix PhotosUI import order (must be after platform imports)
- Fix Data.WritingOptions.atomic reference
- Add identity derivation caching to NostrIdentityBridge
- Fix all remaining PeerID type conversions in ChatViewModel
- Fix ContentView body structure to use main's VStack layout
- Fix PaymentChipView API usage (now uses PaymentType enum)
Build and tests now passing.
* Add proper availability checks for PhotosPickerItem
PhotosPickerItem requires iOS 16+ / macOS 13+ but canImport(PhotosUI)
succeeds on older macOS versions. Add compiler version check to ensure
PhotosPicker code only compiles when actually available.
This fixes CI build failures on older macOS environments.
* Limit PhotosPicker to iOS only to fix CI
PhotosPickerItem has SDK availability issues on macOS in CI.
Change PhotosPicker from canImport(PhotosUI) to os(iOS) only.
macOS users can still import images via file importer (.fileImporter).
This is actually cleaner as macOS file picker is more familiar to users.
Fixes CI build failures.
* Convert new tests to Swift Testing
* Fix compilation issue
* Add the missing `fileTransfer` case
* Explicitly list all Enum cases to get compile-time errors
* Revive lost `NotificationStreamAssembler` changes
* Allow file fragments to account for protocol overhead
* Simplify PR: Focus on audio+image, fix EXIF stripping, remove file transfers
- Fix critical EXIF privacy issue in iOS image processing
- Both iOS and macOS now use CGImageDestination for metadata stripping
- Shared encodeJPEG function ensures no GPS, camera, or metadata leaks
- Remove file transfer functionality to simplify PR scope
- Deleted FileAttachmentView
- Removed sendFileAttachment from ChatViewModel
- Removed file picker UI from ContentView
- Simplified attachment dialog to image only (iOS) or voice only
- Keep focused media features:
- Voice recording and playback
- Image sending with progressive reveal
- Binary protocol for media transfer
* Improve camera UX: Direct camera access with camera icon
- Change paperclip icon to camera icon for clearer affordance
- Open camera directly on tap (no confirmation dialog)
- Add CameraPickerView wrapper for UIImagePickerController
- Remove PhotosPicker in favor of direct camera access
- Images still processed through ImageUtils with EXIF stripping
- Accessibility: Added 'Take photo' label
* Full-screen camera with photo library option
- Change to fullScreenCover for immersive camera experience
- Add action sheet with 'Take Photo' and 'Choose from Library' options
- Renamed ImagePickerView to support both camera and library sources
- Both options open full-screen for better UX
- Updated accessibility label to 'Add photo' (more accurate)
* Fix camera white bars with overFullScreen presentation
- Changed modalPresentationStyle from .fullScreen to .overFullScreen
- This should eliminate white bars at top/bottom on notched devices
- Explicitly set showsCameraControls and cameraOverlayView for camera mode
* Gesture-based photo access: Tap for library, long-press for camera
UX improvements:
- Tap camera icon → Photo library (common use case)
- Long press camera icon (0.3s) → Direct camera (quick photos)
- Removed action sheet entirely for cleaner flow
- Power users can long-press for instant camera access
This is more discoverable and eliminates an extra step in the UI.
* Simplify camera presentation to reduce frame errors
- Changed back to standard .fullScreen presentation
- Removed overFullScreen which was causing frame dimension errors
- Let iOS handle safe areas automatically (white bars are intentional)
- Reduces gesture gate timeout warnings
Note: White bars on notched devices are iOS default behavior for
UIImagePickerController. This respects safe areas for status bar
and home indicator. True edge-to-edge would require custom AVFoundation
camera implementation.
* Force dark mode on camera/picker for black safe area bars
- Set overrideUserInterfaceStyle = .dark on UIImagePickerController
- Changes white bars to black (much better looking)
- Camera controls and photo library also appear in dark mode
- Consistent dark appearance regardless of system settings
* Optimize sheet presentation for camera UI
- Force .large detent for maximum height
- Hide drag indicator for cleaner look
- Use ignoresSafeArea to give camera full space
- Should show complete flash button and controls
* Fix P1: Add DoS protections to PeerID fragment handler
Critical security fix addressing Codex review feedback:
The PeerID overload of handleFragment (which is actually called by
CoreBluetooth) was missing key safety checks that existed in the
String overload:
1. Added total <= 10000 check to prevent unbounded fragment counts
2. Added cumulative size check against FileTransferLimits before
storing each fragment
3. Prevents memory exhaustion DoS attacks via malicious fragment streams
This ensures the actually-used code path has proper bounds checking.
* Fix decompression size limit to support max-sized file transfers
Root cause: BinaryProtocol.decode() was rejecting decompressed payloads
larger than maxPayloadBytes (1 MB), but TLV-encoded file transfers are
slightly larger due to metadata overhead.
Fixes:
- Changed decompression limit from maxPayloadBytes to maxFramedFileBytes
- This accounts for TLV overhead (~50 bytes) + binary protocol headers
- Now allows ~1.12 MB decompressed payloads (1 MB + overhead budget)
The failing test was:
- Creating 1 MB file content
- TLV encoding adds ~50 bytes (1,048,627 total)
- Compression reduces to ~1,084 bytes (highly repetitive data)
- During decode, decompression was rejecting the 1,048,627 byte output
- Now correctly allows it since 1,048,627 < 1,179,760 (maxFramedFileBytes)
All 154 tests now pass including 'Max-sized file transfer survives reassembly'
* Fix critical thread-safety crash in PeerID fragment handler
CRITICAL: The PeerID version of _handleFragment was accessing
incomingFragments dictionary without collectionsQueue synchronization,
causing crashes when multiple BLE threads processed fragments concurrently.
Crash stack trace pointed to line 3431 (dictionary subscript) with:
'doesNotRecognizeSelector' - classic concurrent mutation crash.
Fix:
- Wrapped ALL incomingFragments/fragmentMetadata access in
collectionsQueue.sync(flags: .barrier)
- Matches the thread-safe pattern used in String version
- Separate cleanup into its own barrier block after reassembly
- Prevents concurrent dictionary mutations from multiple BLE threads
This is the same pattern as the String version (line 1128) which didn't crash.
* Remove Localizable.xcstrings formatting noise
The Localizable.xcstrings file had massive formatting-only changes
(spacing: 'key' vs 'key :') that added 50K+ lines to the PR diff.
This was just Xcode reformatting with no actual string changes.
Reverted to main's version to keep PR focused on actual code changes.
* Add macOS photo picker support
- Added MacImagePickerView with NSOpenPanel for macOS
- macOS shows photo.circle.fill icon (no camera hardware)
- Opens native file picker for images (.png, .jpeg, .heic)
- Images processed through ImageUtils with EXIF stripping
- Simple sheet with Select/Cancel buttons
Cross-platform photo sharing now works:
- iOS: Tap for library, long-press for camera
- macOS: Tap for file picker
* Add Localizable strings for camera and voice features
Xcode auto-generated localization strings for new UI elements:
- Camera/photo picker labels
- Voice recording UI strings
- Media attachment descriptions
These are legitimate new strings needed for the audio+image feature,
not just formatting changes.
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: islam <2553451+qalandarov@users.noreply.github.com>
Simplifies geonotes architecture by eliminating all background subscriptions:
- Delete LocationNotesCounter.swift (104 lines) and related tests (58 lines)
- Remove background subscription system entirely
- Icon is now constant darker orange (indicates availability, not state)
- Subscription ONLY happens when user explicitly opens the sheet
- Total: ~220 lines of code removed
Privacy Benefits:
- Zero network traffic until user action
- No location leaking to relays via background polling
- User must explicitly opt-in to discover notes
The icon (note.text in orange) simply indicates the feature is available
when location permission is granted. Notes are only fetched when the
sheet is opened, prioritizing privacy over convenience.
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* Allow closing people sheet from X and swipe
* Swipe right to return from DM to people list
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Restructured ContentView layout to prevent sidebar from covering input box
and removed gesture conflicts that caused jitter during slow drags.
Changes:
- Moved sidebar overlay to only cover messages area, not input box
- Input box now always accessible below sidebar (not covered by overlay)
- Removed blocking drag gesture from mainChatView
- Changed sidebar gesture from simultaneousGesture to gesture for priority
- Removed animation-disabling transactions that amplified touch noise
- Removed 2pt threshold checks that caused visible jumps
Result: Send button taps immediately, sidebar slides smoothly without jitter.
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* Location notes: fix performance and UI issues
Performance fixes:
- Add Set-based duplicate detection (O(1) vs O(n) lookup)
- Eliminates lag when receiving 200+ notes during EOSE
Correctness fixes:
- Fix optimistic echo timestamp to match signed event timestamp
- Add echo IDs to noteIDs set for consistency
UI improvements:
- Remove duplicate "loading recent notes" text in header
- Simplify toolbar icon color logic for immediate green indication
- Icon now reliably turns green when notes exist in geohash
Tests: All 3 LocationNotes tests passing
* Location notes: add remaining robustness fixes
Additional improvements:
- Align counter/manager limits to 200 (prevents showing count higher than displayable)
- Set loading state before clearing notes to eliminate UI flicker on geohash change
- Add geohash validation for building-level precision (8 valid base32 chars)
- Add defensive 500-note memory cap with automatic trimming
- Clear stale notesGeohash state on sheet dismiss
Tests:
- Fix test geohashes to use valid base32 characters
- All 3 LocationNotes tests passing
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* enabled drag gesture to close the sidebar view
* removed extraneous onChanged block
* Fix sidebar swipe gestures to work with ScrollView
Improvements:
- Use simultaneousGesture() instead of gesture() to work alongside ScrollView
- Add horizontal-only detection (width > height * 1.5) to prevent interfering with vertical scrolling
- Add visual feedback during drag with sidebarDragOffset updates
- Add 20pt right edge zone for easier swipe-to-open activation (iOS-native behavior)
- Lower threshold for edge swipe (-50pt instead of -100pt)
Both swipe-to-open and swipe-to-close now work reliably:
- Swipe left from anywhere (or from right edge) to open sidebar
- Swipe right on sidebar to close it
- Vertical scrolling unaffected
* Fix sidebar drag offset direction
Changed offset calculation from:
showSidebar ? -dragOffset : width - dragOffset
To:
showSidebar ? dragOffset : width + dragOffset
This fixes the issue where dragging right to close the sidebar would
make it fly to the left side of the screen before closing.
Now the sidebar correctly follows the finger during drag:
- When closing: moves right (toward off-screen)
- When opening: moves left (toward on-screen)
* Optimize sidebar drag performance for smooth 60fps
Performance improvements:
- Remove .animation() modifier that was conflicting with drag updates
- Use Transaction with disablesAnimations during drag for instant updates
- Throttle state updates to only fire when offset changes >2pt
- Always render sidebar (avoid conditional view creation overhead)
- Only animate on gesture end, not during drag
This eliminates the lag/jank during swipe by ensuring:
1. No animation conflicts during manual drag
2. Direct offset updates follow finger immediately
3. Stable view hierarchy (no conditional rendering)
4. Reduced state update frequency
The sidebar now feels buttery smooth at 60fps.
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* Rearrange `Transport`’s properties and functions
* `NostrTransport`: group Transport-related code together
* `BLEService`: group Transport-related code together
* Extract `NotificationStreamAssembler` into a file
* Move private functions to a dedicated extension
* PeerID 14/n: `Transport` and its dependents
* Automated update of relay data - Sun Sep 21 06:26:33 UTC 2025
* chore(l10n): add empty string catalogs
* chore(l10n): populate string catalogs from legacy resources
* test(l10n): add catalog guardrail suite
* chore(l10n): remove legacy localization files
* fix: Add localization resources to Package.swift targets
- Add .process("Localization") to bitchat target resources
- Add .process("Localization") to bitchatTests target resources
- Resolves Bundle.module resource loading for localization files
- Enables proper localization testing in Swift Package Manager builds
* feat: Add Korean localization and convert to UTF-8 format
Korean Language Support:
- Add complete Korean (ko) localization with 191 strings from PR #686
- Include all app strings: UI, features, system messages, alerts
- Include all share extension strings: status messages, errors
- Verified 100% translation coverage for Korean locale
UTF-8 Format Conversion:
- Convert 23,047 Unicode escape sequences to readable UTF-8 characters
- Transform \u sequences (e.g. \u0625\u063a\u0644\u0627\u0642) to native text (إغلاق)
- Improve maintainability across all 15 supported locales
- Preserve all existing translations while enhancing readability
Locales supported: en, ar, de, es, fr, he, id, it, ja, ko, ne, pt-BR, ru, uk, zh-Hans
* test: Enhance dynamic localization test framework
Dynamic Test Framework:
- Replace hardcoded locale tests with data-driven approach
- Add testLocalizationExpectedValues() for dynamic locale validation
- Add testConfiguredLocalesCompleteness() for coverage verification
- Tests now read configuration from PrimaryLocalizationKeys.json
Expanded Test Coverage:
- Increase from 14 to 33 key validations (135% increase)
- Add critical UI strings: common actions, app info, security, sharing
- Cover 364 total string validations across 15 locales
- Include Korean validation with native Korean expected values
Test Categories Added:
- Common UI: cancel, close, copy actions
- App Info: encryption, offline features, app name
- Bluetooth: permission and settings alerts
- Security: verification badges and actions
- Share Extension: all status and error messages
- Content Actions: accessibility and user actions
Maintains 100% test success rate across all supported locales.
* fix: Convert plural strings to correct xcstrings format
Three plural strings (content.accessibility.people_count,
location_channels.row_title, location_notes.header) were using
incorrect format causing runtime String(format:) errors.
Migrated from stringUnit.variations structure to proper
substitutions.variations format across all 14 languages.
* refactor(l10n): migrate to native String(localized:) APIs
Remove L10n.string wrapper in favor of Swift's native localization APIs.
Migrate 100+ localization call sites to use String(localized:) and String(localized:defaultValue:) with string interpolation.
- Update catalog to use interpolation syntax (\(var)) instead of format specifiers (%@)
- Migrate simple strings to String(localized:)
- Migrate strings with arguments to String(localized:defaultValue:) with interpolation
- Keep format strings for plural substitutions (String(format:locale:))
- Remove bitchat/Utils/Localization.swift
Net result: -407 insertions, +130 deletions across 15 files
* fix(l10n): correct interpolation to use format strings
Interpolation in String(localized:defaultValue:) doesn't work as expected -
the interpolation happens at the call site before localization lookup.
Convert dynamic strings to use String(format:String(localized:),args) pattern:
- Update catalog entries from \(var) syntax to %@ placeholders
- Wrap String(localized:) calls with String(format:locale:) for dynamic values
- Affects 17 strings across 6 files
This fixes UI showing literal "\(geohash)" text instead of actual values.
* chore(l10n): remove invalid catalog entries
Remove auto-extracted literal strings (@, #, ✔︎, @%@, bitchat/) that were
generated without proper localization structure. These caused test
decoding failures.
* fix(l10n): remove unused auto-extracted format string
Remove '%@/%@' key that was auto-extracted by Xcode but never used.
This key only existed in English causing locale parity test failures
across all 13 other languages.
Fixes locale parity tests - all 8 localization tests now pass with
only expected failures (incomplete translations in some locales).
* fix(l10n): copy format string to all locales for 100% completion
Add %@/%@ format string to all 14 non-English locales. Format strings
are locale-independent so using the same value everywhere is correct.
This brings all locales to 100% completion (189/189 strings) to prevent
Xcode from reporting incomplete translations when building.
* fix(l10n): prevent auto-extraction of UI literals
Use Text(verbatim:) for non-localizable UI elements:
- App branding ("bitchat/")
- Symbols (@, #, ✔︎)
- Dynamic usernames (@username)
- Count ratios (reached/total)
This prevents Xcode from auto-extracting these literals into the
String Catalog when building through Xcode GUI, which was causing
locales to show 96% completion instead of 100%.
* chore(l10n): remove auto-extracted UI literal entries
Delete 5 auto-extracted keys from catalog that are now using Text(verbatim:):
- @, #, ✔︎, %@, %@/%@
These were showing as stale/incomplete in Xcode causing 97% completion.
All locales now at 100% (188/188 strings).
* fix(l10n): prevent AttributedString from extracting @ symbol
Use string interpolation "\\(at)" instead of literal "@" in
AttributedString to prevent Xcode from auto-extracting it to the
String Catalog during build.
This was the last string causing locales to show 99% instead of 100%.
* fix(l10n): add %@ as non-translatable key in all locales
Mark %@ as non-translatable and add to all 15 locales with same value.
This prevents Xcode from showing incomplete translations when it
auto-extracts this format specifier during GUI builds.
All locales remain at 100% (189/189 strings).
* refactor: move Localizable.xcstrings to bitchat root
Move bitchat/Localization/Localizable.xcstrings to bitchat/ (after LaunchScreen)
and remove empty Localization directory.
* fix(test): update catalog path in localization tests
Update test paths from bitchat/Localization/Localizable.xcstrings to
bitchat/Localizable.xcstrings after moving the file.
---------
Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
* UI: replace textual 'close' with X icon\n\n- AppInfoView (iOS): use xmark icon in nav bar to match Location Notes style.\n- LocationChannelsSheet: use xmark icon for close on iOS/macOS toolbars; add accessibility label.
* Location Notes: prefix usernames with @ and lighten #geohash\n\n- Show @ before usernames in notes list.\n- Split header into '@' and '#geohash' and color the geohash with secondary green for consistency.
* Header spacing: add breathing room between channel badge, notes button, and people count\n\n- Add trailing padding after #mesh/#geohash badge.\n- Add leading padding before notes button and people counter to improve readability.
* Header: nudge #mesh/#geohash badge right with leading padding
* Location Notes + Header polish\n\n- Header: add space in '@ #geohash' and use darker green for geohash.\n- Notes list: render '@name#abcd' with darker green for #abcd to match chat.\n- Header: move geochat bookmark icon after #geohash badge with consistent spacing.
* Location Notes: @name regular green, #abcd darker; nudge #hash\n\n- Render '@' and base name in regular green, suffix '#abcd' in darker green.\n- Add extra left padding before '#geohash' in notes header.\n- Increase leading padding for channel badge to push #mesh/#geohash further right.
* Fix notes icon color: subscribe/count at block-level geohash\n\n- Use block (precision 7) geohash for notes: when opening sheet, on channel changes, and when subscribing the counter.\n- Aligns with LocationNotesManager which publishes at street-level geohash, allowing the counter to detect notes and turn icon blue.
* Header spacing: move #mesh/#geohash closer to notes/bookmark\n\n- Reduce trailing padding on channel badge and leading padding on notes/bookmark to cluster them together.\n- Keeps larger gap before people count for readability.
* Notes: standardize on building-level (8 chars) for publish/read\n\n- Use .building geohash when opening notes, reacting to channel updates, and subscribing the counter.\n- Update comments to reflect building-level scope.
* Location Channels sheet: use black sheet background like other sheets\n\n- Add backgroundColor and apply to container and list.\n- Hide list default background with scrollContentBackground(.hidden).
* Notes icon: use green when notes exist (matches app green)
* Location Channels: boxed 'bookmarked' section; keep 'remove location access' outside box\n\n- Wrap bookmarked list in a rounded, subtle grey box within the list.\n- Ensure the 'remove location access' button is not inside the box and clears list row background.
* Notes counter UX: avoid grey flicker when closing sheet\n\n- Preserve last count during resubscribe to prevent brief 0 state.\n- Keep existing subscription when building geohash temporarily unavailable; only cancel if none or permission revoked.
* Notes counter: unsubscribe without clearing count on resubscribe\n\n- Avoid calling cancel() in subscribe; just unsubscribe old sub to prevent wiping count to 0.\n- Prevents green→grey flicker after closing sheet or location updates.
* Notes icon: use sheet count until counter finishes initial load; don’t zero on sheet close\n\n- Compute hasNotes using max(count, sheetCount) while initialLoadComplete is false.\n- Remove sheetNotesCount reset on sheet disappear to avoid transient grey.
* Location Notes header: remove extra gap before #geohash (drop leading padding)
* Notes sheet: color #abcd suffix as darker green via opacity (match chat)
* Notes sheet: show timestamp in brackets; drop #abcd from @name
* chore: commit remaining local changes
* Header: move notes + bookmark to left of #mesh/#geohash
* Header spacing: tighten gap between #mesh/#geohash and peer count
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
