TorChatChangelog.html

<!DOCTYPE html>
<html lang="en" itemscope itemtype="https://schema.org/WebPage">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">

    <title>OffCode Tor Chat: Changelog &amp; Update History</title>
    <meta name="description"
        content="OffCode Tor Chat changelog: FileSeal attachments, creator recovery, invite tokens, JoinRoom owner bypass, and Room Settings updates.">
    <meta name="author" content="OffCrypt">
    <meta name="last-modified" content="2026-08-13">
    <meta name="robots" content="noindex, follow">

    <meta http-equiv="X-Content-Type-Options" content="nosniff">
    <meta http-equiv="X-Frame-Options" content="DENY">
    <meta http-equiv="X-XSS-Protection" content="1; mode=block">
    <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin">
    <meta http-equiv="Permissions-Policy" content="camera=(), microphone=(), geolocation=()">

    <link rel="canonical" href="https://www.dev-offcode.com/TorChatChangelog.html">
    <link rel="alternate" hreflang="en" href="https://www.dev-offcode.com/TorChatChangelog.html">
    <link rel="alternate" hreflang="x-default" href="https://www.dev-offcode.com/TorChatChangelog.html">
    <link rel="icon" type="image/x-icon" href="/favicon.ico">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
    <link rel="manifest" href="/manifest.json">

    <link rel="preload" href="styles-automation.css?v=3.0.9" as="style">

    <meta name="theme-color" content="#c45c26">
    <meta name="msapplication-TileColor" content="#c45c26">

    <meta property="og:type" content="website">
    <meta property="og:locale" content="en_US">
    <meta property="og:url" content="https://www.dev-offcode.com/TorChatChangelog.html">
    <meta property="og:title" content="OffCode Tor Chat: Changelog">
    <meta property="og:description"
        content="Release notes for OffCode Tor Chat — FileSeal, recovery, invites, and Room Settings.">
    <meta property="og:image" content="https://www.dev-offcode.com/TorChat1.png">

    <meta name="twitter:card" content="summary_large_image">
    <meta name="twitter:url" content="https://www.dev-offcode.com/TorChatChangelog.html">
    <meta name="twitter:title" content="OffCode Tor Chat: Changelog">
    <meta name="twitter:description"
        content="Release notes for OffCode Tor Chat — FileSeal, recovery, invites, and Room Settings.">
    <meta name="twitter:image" content="https://www.dev-offcode.com/TorChat1.png">

    <script type="application/ld+json">
    {
        "@context": "https://schema.org",
        "@type": "SoftwareApplication",
        "name": "OffCode Tor Chat",
        "applicationCategory": "CommunicationApplication, SecurityApplication",
        "operatingSystem": "Windows (host); Tor Browser (clients)",
        "description": "Self-hosted Tor Hidden Service chat with browser WebCrypto AES-GCM, password E2EE rooms, and Server Manager.",
        "url": "https://www.dev-offcode.com/TorChatPage.html",
        "image": "https://www.dev-offcode.com/TorChat1.png",
        "releaseNotes": {
            "@type": "TechArticle",
            "headline": "OffCode Tor Chat changelog",
            "dateModified": "2026-08-13",
            "url": "https://www.dev-offcode.com/TorChatChangelog.html"
        }
    }
    </script>

    <link rel="stylesheet" href="styles-automation.css?v=3.0.9">
    <link rel="stylesheet" href="styles-at-extras.css?v=3.0.9">
</head>

<body class="at-page">
    <button class="mobile-menu-toggle" aria-label="Toggle Menu">
        <span class="hamburger"></span>
    </button>

    <header class="at-nav">
        <div class="at-nav__inner">
            <aside class="sidebar">
                <div class="sidebar-header">
                    <div class="sidebar-title">OffCode</div>
                </div>

                <nav class="sidebar-nav">
                    <ul class="sidebar-menu">
                        <li class="menu-item">
                            <a href="index.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--phone" aria-hidden="true"></span>
                                <span class="menu-text">Android App</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="OffCryptDesktop.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--monitor" aria-hidden="true"></span>
                                <span class="menu-text">Desktop App</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="ScreenLockBuilder.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--lock" aria-hidden="true"></span>
                                <span class="menu-text">Screen Lock Builder</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="ScreenLockBuilderPremium.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--star" aria-hidden="true"></span>
                                <span class="menu-text">Premium Builder</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="AutomationTool.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--cpu" aria-hidden="true"></span>
                                <span class="menu-text">Automation Tool</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="RemoteControl.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--cast" aria-hidden="true"></span>
                                <span class="menu-text">Web Remote Control</span>
                            </a>
                        </li>
                        <li class="menu-item active">
                            <a href="TorChatPage.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--layers" aria-hidden="true"></span>
                                <span class="menu-text">Tor Chat</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="https://ko-fi.com/emptyc0de" class="menu-link" target="_blank" rel="noopener noreferrer">
                                <span class="menu-icon at-icon at-icon--heart" aria-hidden="true"></span>
                                <span class="menu-text">Donate</span>
                            </a>
                        </li>
                        <li class="menu-item">
                            <a href="PrivacyPolicy.html" class="menu-link">
                                <span class="menu-icon at-icon at-icon--shield" aria-hidden="true"></span>
                                <span class="menu-text">Privacy Policy</span>
                            </a>
                        </li>
                    </ul>
                </nav>

                <div class="sidebar-footer">
                    <p class="footer-text">Social media</p>
                    <div class="sidebar-social-divider"></div>
                    <div class="sidebar-social">
                        <a href="https://x.com/OffCryptAndroid" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on X">
                            <span class="sidebar-social-icon at-icon at-icon--x" aria-hidden="true"></span>
                            <span class="sidebar-social-label">X</span>
                        </a>
                        <a href="https://www.instagram.com/off.crypt86/" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on Instagram">
                            <span class="sidebar-social-icon at-icon at-icon--camera" aria-hidden="true"></span>
                            <span class="sidebar-social-label">Instagram</span>
                        </a>
                        <a href="https://www.tiktok.com/@offcrypt0" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on TikTok">
                            <span class="sidebar-social-icon at-icon at-icon--music" aria-hidden="true"></span>
                            <span class="sidebar-social-label">TikTok</span>
                        </a>
                        <a href="https://www.youtube.com/@OffCrypt" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on YouTube">
                            <span class="sidebar-social-icon at-icon at-icon--play" aria-hidden="true"></span>
                            <span class="sidebar-social-label">YouTube</span>
                        </a>
                        <a href="https://bsky.app/profile/off-crypt86.bsky.social" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on Bluesky">
                            <span class="sidebar-social-icon at-icon at-icon--butterfly" aria-hidden="true"></span>
                            <span class="sidebar-social-label">Bluesky</span>
                        </a>
                        <a href="https://www.linkedin.com/in/off-crypt-b94175382/" target="_blank" rel="noopener noreferrer"
                            aria-label="Follow OffCrypt on LinkedIn">
                            <span class="sidebar-social-icon at-icon at-icon--briefcase" aria-hidden="true"></span>
                            <span class="sidebar-social-label">LinkedIn</span>
                        </a>
                    </div>
                </div>
            </aside>
        </div>
    </header>

    <div class="main-wrapper">
        <main class="at-main">
            <nav aria-label="Breadcrumb"
                style="position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden;">
                <ol style="list-style: none; padding: 0; margin: 0; display: flex; gap: 0.5rem; font-size: 0.9rem;">
                    <li><a href="https://www.dev-offcode.com/">Home</a></li>
                    <li>›</li>
                    <li><a href="https://www.dev-offcode.com/TorChatPage.html">OffCode Tor Chat</a></li>
                    <li>›</li>
                    <li>Changelog</li>
                </ol>
            </nav>

            <div class="changelog-hero">
                <div class="changelog-container">
                    <div class="changelog-header">
                        <h1 class="changelog-title">Changelog</h1>
                        <p class="changelog-subtitle">OffCode Tor Chat — updates, fixes, and new features</p>
                    </div>
                </div>
            </div>

            <div class="changelog-content">
                <div class="changelog-container">
                    <div class="changelog-intro">
                        <p>Release notes for <strong>OffCode Tor Chat</strong>: self-hosted Tor Hidden Service chat,
                            browser WebCrypto AES-GCM, SignalR relay, SQLCipher, and Server Manager.</p>
                        <p><strong>Latest:</strong> VER 0.1 (2026-08-12): Max members and announcement / read-only Room Settings.</p>
                    </div>


                        <div class="changelog-entry">
                            <div class="changelog-version">
                                <span class="version-tag">VER: 0.1</span>
                                <span class="version-date">12/08/2026</span>
                            </div>
                            <div class="changelog-changes">
                                <h3>Changes</h3>
                                <ul>
                                    <li><strong>FileSeal:</strong> Client wraps a random DEK with the room/hybrid <code>CryptoKey</code> (AES-GCM + AAD), encrypts the file in 256&nbsp;KiB plaintext chunks, and uploads opaque ciphertext via <code>PUT /api/attachments/{id}/chunks/{n}</code> with HMAC <code>X-Transfer-Token</code>.</li>
                                    <li><strong>Manifest v2:</strong> Compact envelope (wrap + salts + <code>downloadToken</code>) still goes through E2EE <code>SendEncrypted</code>; legacy v1 Base64 envelopes remain readable.</li>
                                    <li><strong>Limits:</strong> Max 32&nbsp;MiB per file; hub Begin/Complete/Cancel; SQLCipher <code>attachment_transfers</code> + disk under the data dir; TTL/orphan cleanup with messages.</li>
                                    <li><strong>Policy:</strong> <code>attachments_disabled</code> still blocks Begin; text-only PayloadB64 gate unchanged for disabled rooms.</li>
                                    <li><strong>Generate new code:</strong> Profile button + hub <code>RebindCreatorSecret(old, new)</code> rebinds all <code>room_creators</code> rows to the new SHA-256 hash and revokes the old code immediately. Restore alone does not invalidate server bindings.</li>
                                    <li><strong>Hash model docs:</strong> Creator/manage/invite tokens use SHA-256 of high-entropy secrets; join proof uses PBKDF2. Weak-restore warning in Profile UI.</li>
                                    <li><strong>Invite tokens:</strong> Stored as SHA-256 only; plaintext returned once on create/rotate; client caches last link; startup migrates legacy plaintext rows.</li>
                                    <li><strong>JoinRoom owner-proof:</strong> Server verifies <code>manageToken</code> / <code>creatorSecret</code> only when joins are closed or a hidden room lacks a valid invite; client sends recovery only when this browser likely owns the room (manage token, owned-room cache from create/My rooms/restore, or My rooms page). Owner bypass logs + caller <code>SystemNotice</code>.</li>
                                    <li><strong>GetMyRooms IncludePublic:</strong> Separate rate limit (5 / min) vs hidden-only My rooms (20 / min).</li>
                                    <li><strong>Recovery docs:</strong> Profile + README treat recovery as a capability token (Settings, listing, closed rejoin).</li>
                                    <li><strong>Attachments disabled:</strong> Text-only PayloadB64 gate tightened to ~16&nbsp;KiB (blind size gate; not content-type).</li>
                                    <li><strong>Restore recovery code:</strong> After saving the code, client calls <code>GetMyRooms(includePublic: true)</code> and shows a toast listing Hidden (My rooms) vs Public (Public rooms) room ids (or “none” / empty-server message).</li>
                                    <li><strong>API:</strong> <code>GetMyRoomsRequest.IncludePublic</code>; <code>ListRoomsForCreator(secret, hiddenOnly)</code>.</li>
                                    <li><strong>Owner bypass on JoinRoom:</strong> When <code>joins_closed</code> (and for hidden rooms, disabled invite), the creator can still join by sending <code>manageToken</code> and/or Profile <code>creatorSecret</code>. Other members stay blocked. Password <code>joinProof</code> still required for locked rooms.</li>
                                    <li><strong>Client:</strong> <code>joinRoom</code> / reconnect attach ownership proof from localStorage recovery + per-room manage token.</li>
                                    <li><strong>API:</strong> <code>IRoomInviteService.IsOwner</code>; optional fields on <code>JoinRoomRequest</code>.</li>
                                    <li><strong>Disable attachments:</strong> Creator Room Settings toggle (<code>attachments_disabled</code> in SQLCipher). Members get <code>AttachmentsPolicy</code> on join / toggle; Attach button gated in <code>room-attachments.js</code>. Server enforces a text-only PayloadB64 size cap when disabled (blind relay cannot inspect ciphertext kind).</li>
                                    <li><strong>Hub / registry:</strong> <code>SetAttachmentsDisabled</code>, <code>InviteStatusResponse.AttachmentsDisabled</code>, registry getters/setters, DB migration.</li>
                                    <li><strong>Room Settings UI:</strong> Wider two-column layout (Membership | Attachments; Slow mode compact row; Invite / Lock / Delete full width); denser hints and spacing.</li>
                                    <li><strong>Max members:</strong> Creator Room Settings toggle (<code>max_members</code> in SQLCipher, 0 = off, else 2–50). Enforced in <code>RoomPresenceService.Join</code>; public <code>"Room is full."</code>, hidden generic <code>"Cannot join room."</code>. Existing members stay if the cap is lowered.</li>
                                    <li><strong>Announcement / read-only:</strong> Creator Room Settings toggle (<code>read_only</code>). Only the creator may <code>SendEncrypted</code> / <code>BeginAttachmentUpload</code>; owner tokens are extra hub args (not persisted). Members get a disabled composer (<code>room-readonly.js</code>).</li>
                                </ul>
                            </div>
                        </div>
                    </div>

                    <div class="purchase-instructions-box" style="margin-top: 2rem;">
                        <h3 class="instructions-title">Back to OffCode Tor Chat</h3>
                        <p class="instructions-intro">Return to the product page or download flow.</p>
                        <div
                            style="display: flex; flex-wrap: wrap; gap: 1rem; justify-content: center; margin-top: 1.5rem;">
                            <a href="TorChatPage.html" class="button secondary-download">Tor Chat</a>
                            <a href="TorChatDisclaimer.html" class="button secondary-download">Download</a>
                        </div>
                    </div>
                </div>
            </div>
        </main>
    </div>

    <script src="script.js" defer></script>
    <link rel="stylesheet" href="cookie-consent.css">
    <script src="cookie-consent.js" defer></script>
</body>

</html>