git.iko.soy/skrepka
on master help sign in
history ofbca43fb..master
compare
82eae7cFix profile photo clearing on absent field, remove dead code in padded_len, fix CI comment typoLancelot 850d68dsecurity audit fixes: 35 findings across core, shell, server, specLancelot ee54351Security audit 13th pass: fix 23 findings across crypto, server, clientLancelot 3258116Security: add AAD to AEAD (v0x02), fix livelock, bound dedup, cap gossip amplificationiko 11c24d8Security audit fixes: Q16 cursor poisoning, Q17 ack ordering, Q18 persistent seen_ids, Q25 malformed JSON, Q35 revokeOthers challenges, Q37 sig inside atomic, Q38 audit log, Q49 low-order X25519 check, spec gaps Q39-Q44, §10 risk table updatesLancelot da51700Security audit Q1-Q9: zstd window cap, poll event/body caps, cursor clamp, verify_strict, TEST-NET-2, cursor watchdog, cached X25519 keys, base64 photo validationLancelot e57c03cEleventh-pass audit: add flush generation to prevent send-loop forkLancelot 660cb44Tenth-pass audit: AddContact clears stale error on retryLancelot 492430cNinth-pass audit: SetBlocked clears stale error on unblockiko e894a24Eighth-pass audit: fix silent send/profile errors, draft loss on failed sendiko c24f528Seventh-pass audit: zeroize encrypt inner on AEAD failure, fix stale commentsiko 4e03722Sixth-pass audit: send-side body/profile/nickname length checks, zeroize Decrypted plaintext, send watchdogiko f34323cFifth-pass audit: fix send_text contact-cap ordering, spec version-byte omissions, zstd level, DeleteContact UI, comment mismatchiko 92e93f0Fourth-pass audit: zeroize decrypt intermediates, fix dead poll loop, clamp ts lower bound, enforce MAX_CONTACTS in send_text, profile-before-text ordering, ack_ids post-filter count check, fix §4 Blocking speciko b8d30b6Third-pass audit: fix cursor-loss, block-check, zeroization, spec driftiko 3154319Second-pass audit: fix regressions from first passiko f04d81bAudit: implement all 18 findings from protocol/codebase reviewiko c28cf14Swift: disable HTTP redirect following; server/protocol: document timing side-channel and key rotation future extensioniko aaf961acrypto: use is_multiple_of in the padding-bucket assertioniko 9efb186core: bound the outbox, batch its sends, and add DeleteContactiko 540f20cphonemic: use HashMap lookup for @p syllable decode (O(1) vs O(256))iko b0ffcd8Add length padding to encrypted blobsiko c89ed87server.knot: fix orphaned forwards bug + 10 simplificationsiko e4eeb27server.knot: fix 4 bugs + 22 simplifications from auditiko 8d304b5server.knot: remove duplicate pruneExpired block commentiko 9118bb4server.knot: saturate decimalValueGo accumulator to prevent i64 overflow paniciko 4acbb40PROTOCOL-REVIEW: add #9 federation retry loop starvationiko 254f6a0server.knot: document Knot compiler hang on beforeChar consolidationiko 5477c47Comprehensive bug fix pass: crypto, state machine, FFI, server, Apple shelliko 9558212Fix server.knot type mismatches: keep PubkeyHex on route-boundary typesiko df3fc05Simplify server.knot: remove workarounds for fixed Knot compiler issuesiko 744d270Fix boltffi.toml: use [cargo.command_args] section instead of inline tableiko 1b7855cFix iOS CI: add facet_typegen feature to boltffi.toml cargo.command_argsiko 199ec3ePin Knot compiler to 2026.6.26.1947 (last working release)iko c0c3f64Fix main: use type variable a (like backgroundPrune) to match listenOn's IO typeiko d93928fFix main: bind listenOn, use let with explicit {} type as final pure valueiko 191f599Fix main: concrete effect row, listenOn as final IO expression (matching backgroundPrune pattern)iko 8b28231Fix main: explicit effect row, _ <- listenOn, {} as final pure valueiko 5a73090Fix main: IO {| r} {} annotation, listenOn as final bare expressioniko 997b9d0Fix main: bind listenOn with _ <- too, yield {} as final IO valueiko 0ac92a3Fix main: all statements as _ <- binds except final listenOniko 73e8ac0Fix main: first statement as IO bind to force IO do-block inferenceiko 4b6f751Fix main: bind listenOn with _ <- and yield {} for IO do-blockiko 918e789Fix main: add yield {} after listenOn for IO do-block typeiko 533de35Fix last server.knot compilation errors: refined-type comparisons, main typeiko 92c8058Fix remaining server.knot compilation errorsiko 4bfde3dFix server.knot compilation errors for stricter Knot compileriko 362399cFix round-2 audit findings: blocked acks, ts clamping, key validation, docsiko affb421Fix all 16 audit findings: outbox stall, deploy auth, panics, security, docsiko 1fc068eMake CLAUDE.md a symlink to AGENTS.mdiko