- New rooms (public too) and direct messages are end-to-end encrypted by
default.
- Per-message trust: "Not verified" for sessions you haven't verified,
and what is wrong for unsigned sessions, mismatched keys or plain text
in an encrypted room (src/matrix/trust.ts).
- Verify a person's identity in a room you share (your DM first), and
QR-code verification both ways: show ours, scan theirs with the camera
(qrcode-generator, jsqr).
- Warnings when someone's identity changes, with acknowledge, verify
again or withdraw verification.
- Encrypted thumbnails for large images.
- A tab-only session encrypts its crypto store with a key kept in
sessionStorage; stores unused for two weeks are deleted.
- Reset encryption fixed: new secret storage first, so the new
cross-signing keys survive a stale /keys/query answer; status checks
no longer query our own keys mid-setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apps/web: a Matrix client for the browser on Vue 3, Tailwind and
matrix-js-sdk, built on @warp/ui. Like the admin panel it is an optional,
separate service: warp-web embeds the built app, serves /config.json and
proxies only /_matrix/client and /_matrix/media to the homeserver (or,
with -public-homeserver, lets the browser call it directly).
Sign-in and sign-up with registration tokens, room list, timeline with
back-pagination, text, images, video and files over authenticated media,
local echo with sent/read/failed states, receipts, typing, invites,
creating, joining and leaving rooms, room info, settings, phone layout.
End-to-end encryption through the Rust crypto: encrypted messages and
files, emoji verification, key backup setup and restore.
apps/ui: WRoomItem, WMessageBubble and WComposer from the brand package,
and the icons the client needs.
syncapi fixes found with the client:
- A room joined inside the sync window was sent as the join alone with
limited: false, so clients thought they had the whole room. It is now
read like an initial sync; a profile change is not mistaken for a join.
- A live typing notification was reported on every sync, so every long
poll returned at once while anybody typed. Typing now has a position
in the sync token and is reported when it changes, including the empty
list when the last person stops.
Also: Dockerfile, a `web` compose profile, Makefile targets, a CI job
with a proxy smoke test, docs. PLAN.md moves out of the repository.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
