Drop couriered mail from blocked senders at envelope open

The UI-layer block check (isPeerBlocked in the transport event coordinator) resolves a fingerprint from the live session or peer list, but a couriered message arrives precisely when its sender is absent — no session, no registry entry — so the check failed open and a blocked identity's mail was delivered anyway. Gate in openCourierEnvelope, where the sealed sender's full static key is in hand. End-to-end test ferries a full deposit→carry→handover round and verifies the envelope from a blocked sender never reaches the delegate (confirmed failing without the gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Merge branch 'main' into feat/courier
2026-07-06 14:34:46 +02:00 · 2026-07-06 14:27:17 +02:00 · 2026-07-01 23:52:52 +02:00 · 2026-07-01 23:02:13 +02:00 · 2026-07-01 22:54:03 +02:00 · 2026-07-01 22:48:10 +02:00
501 changed files with 17424 additions and 150944 deletions
--- a/.github/workflows/fetch_georelays.yml
+++ b/.github/workflows/fetch_georelays.yml
--- a/.github/workflows/periphery.yml
+++ b/.github/workflows/periphery.yml
--- a/.github/workflows/source-manifest.yml
+++ b/.github/workflows/source-manifest.yml
--- a/.github/workflows/swift-tests.yml
+++ b/.github/workflows/swift-tests.yml
--- a/.gitignore
+++ b/.gitignore
--- a/.periphery.baseline.json
+++ b/.periphery.baseline.json
--- a/.periphery.yml
+++ b/.periphery.yml
--- a/.swiftlint.yml
+++ b/.swiftlint.yml
--- a/Configs/Local.xcconfig.example
+++ b/Configs/Local.xcconfig.example
--- a/Configs/Release.xcconfig
+++ b/Configs/Release.xcconfig
--- a/149
+++ b/149
--- a/PRIVACY_POLICY.md
+++ b/PRIVACY_POLICY.md
--- a/Package.swift
+++ b/Package.swift
--- a/README.md
+++ b/README.md
--- a/SECURITY.md
+++ b/SECURITY.md
--- a/WHITEPAPER.md
+++ b/WHITEPAPER.md
--- a/bitchat.xcodeproj/project.pbxproj
+++ b/bitchat.xcodeproj/project.pbxproj
--- a/bitchat/App/AppArchitecture.swift
+++ b/bitchat/App/AppArchitecture.swift
--- a/bitchat/App/AppChromeModel.swift
+++ b/bitchat/App/AppChromeModel.swift
--- a/bitchat/App/AppRuntime.swift
+++ b/bitchat/App/AppRuntime.swift
--- a/bitchat/App/ConversationStore.swift
+++ b/bitchat/App/ConversationStore.swift
--- a/bitchat/App/ConversationUIModel.swift
+++ b/bitchat/App/ConversationUIModel.swift
--- a/bitchat/App/LocationChannelsModel.swift
+++ b/bitchat/App/LocationChannelsModel.swift
--- a/bitchat/App/LocationPresenceStore.swift
+++ b/bitchat/App/LocationPresenceStore.swift
--- a/bitchat/App/NearbyNotesCounter.swift
+++ b/bitchat/App/NearbyNotesCounter.swift
--- a/bitchat/App/PeerIdentityStore.swift
+++ b/bitchat/App/PeerIdentityStore.swift
--- a/bitchat/App/PeerListModel.swift
+++ b/bitchat/App/PeerListModel.swift
--- a/bitchat/App/PrivacyScreen.swift
+++ b/bitchat/App/PrivacyScreen.swift
--- a/bitchat/App/PrivateConversationModels.swift
+++ b/bitchat/App/PrivateConversationModels.swift
--- a/bitchat/App/SharedContentImportModel.swift
+++ b/bitchat/App/SharedContentImportModel.swift
--- a/bitchat/App/VerificationModel.swift
+++ b/bitchat/App/VerificationModel.swift
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_128x128.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_128x128.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_128x128@2x.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_128x128@2x.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_16x16.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_16x16.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_16x16@2x.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_16x16@2x.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_256x256.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_256x256.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_256x256@2x.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_256x256@2x.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_32x32.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_32x32.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_32x32@2x.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_32x32@2x.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_512x512.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_512x512.png
--- a/bitchat/Assets.xcassets/AppIcon.appiconset/icon_512x512@2x.png
+++ b/bitchat/Assets.xcassets/AppIcon.appiconset/icon_512x512@2x.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/Contents.json
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/Contents.json
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_128x128.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_128x128.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_128x128@2x.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_128x128@2x.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_16x16.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_16x16.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_16x16@2x.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_16x16@2x.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_256x256.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_256x256.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_256x256@2x.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_256x256@2x.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_32x32.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_32x32.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_32x32@2x.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_32x32@2x.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_512x512.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_512x512.png
--- a/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_512x512@2x.png
+++ b/bitchat/Assets.xcassets/AppIconDebug.appiconset/mac_512x512@2x.png
--- a/bitchat/BitchatApp.swift
+++ b/bitchat/BitchatApp.swift
--- a/bitchat/Features/media/ImageUtils.swift
+++ b/bitchat/Features/media/ImageUtils.swift
--- a/bitchat/Features/voice/AudioSessionCoordinator.swift
+++ b/bitchat/Features/voice/AudioSessionCoordinator.swift
--- a/bitchat/Features/voice/PTTAudioCodec.swift
+++ b/bitchat/Features/voice/PTTAudioCodec.swift
--- a/bitchat/Features/voice/PTTAudioFormat.swift
+++ b/bitchat/Features/voice/PTTAudioFormat.swift
--- a/bitchat/Features/voice/PTTBurstPlayer.swift
+++ b/bitchat/Features/voice/PTTBurstPlayer.swift
--- a/bitchat/Features/voice/PTTCaptureEngine.swift
+++ b/bitchat/Features/voice/PTTCaptureEngine.swift
--- a/bitchat/Features/voice/PTTSettings.swift
+++ b/bitchat/Features/voice/PTTSettings.swift
--- a/bitchat/Features/voice/VoiceCaptureSession.swift
+++ b/bitchat/Features/voice/VoiceCaptureSession.swift
--- a/bitchat/Features/voice/VoiceNotePlaybackController.swift
+++ b/bitchat/Features/voice/VoiceNotePlaybackController.swift
--- a/bitchat/Features/voice/VoiceRecorder.swift
+++ b/bitchat/Features/voice/VoiceRecorder.swift
--- a/bitchat/Features/voice/Waveform.swift
+++ b/bitchat/Features/voice/Waveform.swift
--- a/bitchat/Identity/IdentityModels.swift
+++ b/bitchat/Identity/IdentityModels.swift
--- a/bitchat/Identity/SecureIdentityStateManager.swift
+++ b/bitchat/Identity/SecureIdentityStateManager.swift
--- a/bitchat/Info.plist
+++ b/bitchat/Info.plist
--- a/bitchat/Localizable.xcstrings
+++ b/bitchat/Localizable.xcstrings
--- a/bitchat/Models/BitchatMessage+Media.swift
+++ b/bitchat/Models/BitchatMessage+Media.swift
--- a/bitchat/Models/BitchatPeer.swift
+++ b/bitchat/Models/BitchatPeer.swift
--- a/bitchat/Models/CommandInfo.swift
+++ b/bitchat/Models/CommandInfo.swift
--- a/bitchat/Models/NoisePayload.swift
+++ b/bitchat/Models/NoisePayload.swift
--- a/bitchat/Models/RequestSyncPacket.swift
+++ b/bitchat/Models/RequestSyncPacket.swift
--- a/bitchat/Noise/NoiseProtocol.swift
+++ b/bitchat/Noise/NoiseProtocol.swift
--- a/bitchat/Noise/NoiseSecurityConstants.swift
+++ b/bitchat/Noise/NoiseSecurityConstants.swift
--- a/bitchat/Noise/NoiseSecurityError.swift
+++ b/bitchat/Noise/NoiseSecurityError.swift
--- a/bitchat/Noise/NoiseSecurityValidator.swift
+++ b/bitchat/Noise/NoiseSecurityValidator.swift
--- a/bitchat/Noise/NoiseSession.swift
+++ b/bitchat/Noise/NoiseSession.swift
--- a/bitchat/Noise/NoiseSessionError.swift
+++ b/bitchat/Noise/NoiseSessionError.swift
--- a/bitchat/Noise/NoiseSessionManager.swift
+++ b/bitchat/Noise/NoiseSessionManager.swift
--- a/bitchat/Noise/SecureNoiseSession.swift
+++ b/bitchat/Noise/SecureNoiseSession.swift
--- a/bitchat/Nostr/GeoRelayDirectory.swift
+++ b/bitchat/Nostr/GeoRelayDirectory.swift
--- a/bitchat/Nostr/NostrIdentity.swift
+++ b/bitchat/Nostr/NostrIdentity.swift
--- a/bitchat/Nostr/NostrIdentityBridge.swift
+++ b/bitchat/Nostr/NostrIdentityBridge.swift
--- a/bitchat/Nostr/NostrPoW.swift
+++ b/bitchat/Nostr/NostrPoW.swift
--- a/bitchat/Nostr/NostrProtocol.swift
+++ b/bitchat/Nostr/NostrProtocol.swift
--- a/bitchat/Nostr/NostrRelayManager.swift
+++ b/bitchat/Nostr/NostrRelayManager.swift
--- a/bitchat/Nostr/NostrRelaySettings.swift
+++ b/bitchat/Nostr/NostrRelaySettings.swift
--- a/bitchat/Nostr/NostrRelayURL.swift
+++ b/bitchat/Nostr/NostrRelayURL.swift
--- a/bitchat/PrivacyInfo.xcprivacy
+++ b/bitchat/PrivacyInfo.xcprivacy
--- a/bitchat/Protocols/BitchatFilePacket.swift
+++ b/bitchat/Protocols/BitchatFilePacket.swift
--- a/bitchat/Protocols/BitchatProtocol.swift
+++ b/bitchat/Protocols/BitchatProtocol.swift
--- a/bitchat/Protocols/BoardPackets.swift
+++ b/bitchat/Protocols/BoardPackets.swift
--- a/bitchat/Protocols/Geohash.swift
+++ b/bitchat/Protocols/Geohash.swift
--- a/bitchat/Protocols/MeshMessageIdentity.swift
+++ b/bitchat/Protocols/MeshMessageIdentity.swift
--- a/bitchat/Protocols/NostrCarrierPacket.swift
+++ b/bitchat/Protocols/NostrCarrierPacket.swift
--- a/bitchat/Protocols/Packets.swift
+++ b/bitchat/Protocols/Packets.swift
--- a/bitchat/Protocols/PeerCapabilities+Local.swift
+++ b/bitchat/Protocols/PeerCapabilities+Local.swift
--- a/bitchat/Protocols/VoiceBurstPacket.swift
+++ b/bitchat/Protocols/VoiceBurstPacket.swift
--- a/bitchat/Protocols/VouchAttestation.swift
+++ b/bitchat/Protocols/VouchAttestation.swift
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
jack	02828731b9	Drop couriered mail from blocked senders at envelope open The UI-layer block check (isPeerBlocked in the transport event coordinator) resolves a fingerprint from the live session or peer list, but a couriered message arrives precisely when its sender is absent — no session, no registry entry — so the check failed open and a blocked identity's mail was delivered anyway. Gate in openCourierEnvelope, where the sealed sender's full static key is in hand. End-to-end test ferries a full deposit→carry→handover round and verifies the envelope from a blocked sender never reaches the delegate (confirmed failing without the gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:34:46 +02:00
jack	f5b2150f11	Merge branch 'main' into feat/courier Resolve DeliveryStatusView conflict: adopt main's bitchatDescription extension (tooltip + VoiceOver via body modifiers) and fold the .carried case into it, dropping the branch's Strings enum. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:27:17 +02:00
jack	b28fb26504	Merge branch 'main' into feat/courier	2026-07-01 23:52:52 +02:00
jack	ba0861a446	Merge branch 'main' into feat/courier	2026-07-01 23:02:13 +02:00
jack	424c47be82	Use Xcode-bundled Swift in CI instead of a standalone toolchain The unpinned setup-swift action installs Swift 6.1, which refuses the SDK on runner images that have rolled to Xcode 26.5 ("this SDK is not supported by the compiler"). Jobs passed or failed depending on which image they landed on. The Xcode-bundled toolchain always matches the image's SDK, and matches local development. Cache keys now include the toolchain version so artifacts from one compiler are never restored into builds with another. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-01 22:54:03 +02:00
jack	20c1c0f687	Gate courier handover on direct announces and isolate store test Envelopes are removed from the courier store optimistically, so releasing them on a relayed (multi-hop) announce risks losing carried mail to a speculative flood that never reaches the recipient. Handover now also requires the announce to have arrived directly (full TTL), i.e. an actual encounter with a live link; regression test builds a relayed copy of a genuinely signed announce (TTL is excluded from announce signatures). Also make CourierStore's on-disk location injectable so the persistence test round-trips through a temp directory instead of wiping the real Application Support store, and reattach BLEAnnounceHandler's doc comment to the class it describes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-01 22:48:10 +02:00
jack	ebdcdf83dd	Authenticate courier deposits by ingress peer	2026-06-19 17:39:00 +02:00
jack	2c04f65c83	Fix courier handoff verification and directed sends	2026-06-17 10:04:16 +02:00
jack	293380e671	Merge branch 'main' into feat/courier	2026-06-17 10:03:07 +02:00
jack	5aaa209020	Friend-courier store-and-forward: mutual favorites carry sealed messages to offline peers When a private message has no reachable transport, the router now seals it to the recipient's Noise static key (new one-way Noise X pattern) and hands the envelope to up to three connected mutual favorites. Couriers store the opaque ciphertext under strict quotas (20 total, 5 per depositor, 16 KiB, 24 h) and hand it over when the recipient's announce matches a rotating HMAC recipient tag; the recipient opens it and the message flows through the normal private-message pipeline, so dedup and delivery acks just work. - CourierEnvelope TLV + courierEnvelope (0x04) message type in BitFoundation - Noise X one-way pattern reusing the existing handshake machinery, domain-separated by a courier prologue; sender identity authenticated via the ss DH (no forward secrecy - documented tradeoff) - CourierStore with eviction, file persistence, and panic-wipe integration - Rotating recipient tags (HMAC over epoch day) so carried envelopes don't correlate for observers who don't already know the recipient's key - New "carried" delivery status with figure.walk glyph; header indicator while carrying mail for others - Three-node end-to-end test ferrying packets through real BLEService instances, plus codec/crypto/store/router suites (986 tests green) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 11:13:16 +02:00