refactor: move CLI code from cmd/ to internal/cli

Move all non-bootstrapping CLI code to internal/cli package.
cmd/neoirc-cli/main.go now contains only minimal bootstrapping
that calls cli.Run(). The App struct, UI, command handlers, poll
loop, and api client are now in internal/cli/ and internal/cli/api/.

.gitignore

@@ -21,6 +21,7 @@ node_modules/
 *.key
 
 # Build artifacts
+web/dist/
 /neoircd
 /bin/
 *.exe

Dockerfile

@@ -1,3 +1,13 @@
+# Web build stage — compile SPA from source
+# node:22-alpine, 2026-03-09
+FROM node@sha256:8094c002d08262dba12645a3b4a15cd6cd627d30bc782f53229a2ec13ee22a00 AS web-builder
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/src/ src/
+COPY web/build.sh build.sh
+RUN sh build.sh
+
 # Lint stage — fast feedback on formatting and lint issues
 # golangci/golangci-lint:v2.1.6, 2026-03-02
 FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
@@ -5,6 +15,9 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
+# Create placeholder files so //go:embed dist/* in web/embed.go resolves
+# without depending on the web-builder stage (lint should fail fast)
+RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
 RUN make fmt-check
 RUN make lint
 
@@ -21,6 +34,7 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
+COPY --from=web-builder /web/dist/ web/dist/
 
 RUN make test
 

README.md

@@ -764,21 +764,98 @@ not pollute the message queue.
 
 **IRC reference:** RFC 1459 §4.6.2, §4.6.3
 
-#### MODE — Set/Query Modes (Planned)
+#### MODE — Query Modes
 
-Set channel or user modes.
+Query channel or user modes. Returns the current mode string and, for
+channels, the creation timestamp.
 
 **C2S:**
 ```json
-{"command": "MODE", "to": "#general", "params": ["+m"]}
-{"command": "MODE", "to": "#general", "params": ["+o", "alice"]}
+{"command": "MODE", "to": "#general"}
+{"command": "MODE", "to": "alice"}
 ```
 
-**Status:** Not yet implemented. See [Channel Modes](#channel-modes) for the
-planned mode set.
+**S2C (via message queue):**
+
+For channels, the server sends RPL_CHANNELMODEIS (324) and
+RPL_CREATIONTIME (329):
+```json
+{"command": "324", "to": "alice", "params": ["#general", "+n"]}
+{"command": "329", "to": "alice", "params": ["#general", "1709251200"]}
+```
+
+For users, the server sends RPL_UMODEIS (221):
+```json
+{"command": "221", "to": "alice", "body": ["+"]}
+```
+
+**Note:** Mode changes (setting/unsetting modes) are not yet implemented.
+Currently only query is supported.
 
 **IRC reference:** RFC 1459 §4.2.3
 
+#### NAMES — Channel Member List
+
+Request the member list for a channel. Returns RPL_NAMREPLY (353) and
+RPL_ENDOFNAMES (366).
+
+**C2S:**
+```json
+{"command": "NAMES", "to": "#general"}
+```
+
+**IRC reference:** RFC 1459 §4.2.5
+
+#### LIST — List Channels
+
+Request a list of all channels with member counts. Returns RPL_LIST (322)
+for each channel followed by RPL_LISTEND (323).
+
+**C2S:**
+```json
+{"command": "LIST"}
+```
+
+**IRC reference:** RFC 1459 §4.2.6
+
+#### WHOIS — User Information
+
+Query information about a user. Returns RPL_WHOISUSER (311),
+RPL_WHOISSERVER (312), RPL_WHOISCHANNELS (319), and RPL_ENDOFWHOIS (318).
+
+**C2S:**
+```json
+{"command": "WHOIS", "to": "alice"}
+```
+
+**IRC reference:** RFC 1459 §4.5.2
+
+#### WHO — Channel User List
+
+Query users in a channel. Returns RPL_WHOREPLY (352) for each user followed
+by RPL_ENDOFWHO (315).
+
+**C2S:**
+```json
+{"command": "WHO", "to": "#general"}
+```
+
+**IRC reference:** RFC 1459 §4.5.1
+
+#### LUSERS — Server Statistics
+
+Request server user/channel statistics. Returns RPL_LUSERCLIENT (251),
+RPL_LUSEROP (252), RPL_LUSERCHANNELS (254), and RPL_LUSERME (255).
+
+**C2S:**
+```json
+{"command": "LUSERS"}
+```
+
+LUSERS replies are also sent automatically during connection registration.
+
+**IRC reference:** RFC 1459 §4.3.2
+
 #### KICK — Kick User (Planned)
 
 Remove a user from a channel.
@@ -828,12 +905,27 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | Code | Name                 | When Sent | Example |
 |------|----------------------|-----------|---------|
 | `001` | RPL_WELCOME         | After session creation | `{"command":"001","to":"alice","body":["Welcome to the network, alice"]}` |
-| `002` | RPL_YOURHOST        | After session creation | `{"command":"002","to":"alice","body":["Your host is neoirc-server, running version 0.1"]}` |
+| `002` | RPL_YOURHOST        | After session creation | `{"command":"002","to":"alice","body":["Your host is neoirc, running version 0.1"]}` |
 | `003` | RPL_CREATED         | After session creation | `{"command":"003","to":"alice","body":["This server was created 2026-02-10"]}` |
-| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["neoirc-server","0.1","","imnst"]}` |
+| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["neoirc","0.1","","imnst"]}` |
+| `005` | RPL_ISUPPORT        | After session creation | `{"command":"005","to":"alice","params":["CHANTYPES=#","NICKLEN=32","NETWORK=neoirc"],"body":["are supported by this server"]}` |
+| `221` | RPL_UMODEIS         | In response to user MODE query | `{"command":"221","to":"alice","body":["+"]}` |
+| `251` | RPL_LUSERCLIENT     | On connect or LUSERS command | `{"command":"251","to":"alice","body":["There are 5 users and 0 invisible on 1 servers"]}` |
+| `252` | RPL_LUSEROP         | On connect or LUSERS command | `{"command":"252","to":"alice","params":["0"],"body":["operator(s) online"]}` |
+| `254` | RPL_LUSERCHANNELS   | On connect or LUSERS command | `{"command":"254","to":"alice","params":["3"],"body":["channels formed"]}` |
+| `255` | RPL_LUSERME         | On connect or LUSERS command | `{"command":"255","to":"alice","body":["I have 5 clients and 1 servers"]}` |
+| `311` | RPL_WHOISUSER       | In response to WHOIS | `{"command":"311","to":"alice","params":["bob","bob","neoirc","*"],"body":["bob"]}` |
+| `312` | RPL_WHOISSERVER     | In response to WHOIS | `{"command":"312","to":"alice","params":["bob","neoirc"],"body":["neoirc server"]}` |
+| `315` | RPL_ENDOFWHO        | End of WHO response | `{"command":"315","to":"alice","params":["#general"],"body":["End of /WHO list"]}` |
+| `318` | RPL_ENDOFWHOIS      | End of WHOIS response | `{"command":"318","to":"alice","params":["bob"],"body":["End of /WHOIS list"]}` |
+| `319` | RPL_WHOISCHANNELS   | In response to WHOIS | `{"command":"319","to":"alice","params":["bob"],"body":["#general #dev"]}` |
 | `322` | RPL_LIST            | In response to LIST | `{"command":"322","to":"alice","params":["#general","5"],"body":["General discussion"]}` |
 | `323` | RPL_LISTEND         | End of LIST response | `{"command":"323","to":"alice","body":["End of /LIST"]}` |
+| `324` | RPL_CHANNELMODEIS   | In response to channel MODE query | `{"command":"324","to":"alice","params":["#general","+n"]}` |
+| `329` | RPL_CREATIONTIME    | After channel MODE query | `{"command":"329","to":"alice","params":["#general","1709251200"]}` |
+| `331` | RPL_NOTOPIC         | Channel has no topic (on JOIN) | `{"command":"331","to":"alice","params":["#general"],"body":["No topic is set"]}` |
 | `332` | RPL_TOPIC           | On JOIN or TOPIC query | `{"command":"332","to":"alice","params":["#general"],"body":["Welcome!"]}` |
+| `352` | RPL_WHOREPLY        | In response to WHO | `{"command":"352","to":"alice","params":["#general","bob","neoirc","neoirc","bob","H"],"body":["0 bob"]}` |
 | `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["@op1 alice bob +voiced1"]}` |
 | `366` | RPL_ENDOFNAMES      | End of NAMES response | `{"command":"366","to":"alice","params":["#general"],"body":["End of /NAMES list"]}` |
 | `372` | RPL_MOTD            | MOTD line | `{"command":"372","to":"alice","body":["Welcome to the server"]}` |
@@ -841,14 +933,18 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | `376` | RPL_ENDOFMOTD       | End of MOTD | `{"command":"376","to":"alice","body":["End of /MOTD command"]}` |
 | `401` | ERR_NOSUCHNICK      | DM to nonexistent nick | `{"command":"401","to":"alice","params":["bob"],"body":["No such nick/channel"]}` |
 | `403` | ERR_NOSUCHCHANNEL   | Action on nonexistent channel | `{"command":"403","to":"alice","params":["#nope"],"body":["No such channel"]}` |
+| `421` | ERR_UNKNOWNCOMMAND  | Unrecognized command | `{"command":"421","to":"alice","params":["FOO"],"body":["Unknown command"]}` |
+| `432` | ERR_ERRONEUSNICKNAME | Invalid nick format | `{"command":"432","to":"alice","params":["bad nick!"],"body":["Erroneous nickname"]}` |
 | `433` | ERR_NICKNAMEINUSE   | NICK to taken nick | `{"command":"433","to":"*","params":["alice"],"body":["Nickname is already in use"]}` |
 | `442` | ERR_NOTONCHANNEL    | Action on unjoined channel | `{"command":"442","to":"alice","params":["#general"],"body":["You're not on that channel"]}` |
+| `461` | ERR_NEEDMOREPARAMS  | Missing required fields | `{"command":"461","to":"alice","params":["JOIN"],"body":["Not enough parameters"]}` |
 | `482` | ERR_CHANOPRIVSNEEDED | Non-op tries op action | `{"command":"482","to":"alice","params":["#general"],"body":["You're not channel operator"]}` |
 
-**Note:** Numeric replies are planned for full implementation. The current MVP
-returns standard HTTP error responses (4xx/5xx with JSON error bodies) instead
-of numeric replies for error conditions. Numeric replies in the message queue
-will be added post-MVP.
+**Note:** Numeric replies are now implemented. All IRC command responses
+(success and error) are delivered as numeric replies through the message queue.
+HTTP error codes are reserved for transport-level issues (auth failures,
+malformed requests, server errors). The `params` field in the message envelope
+carries IRC-style parameters (e.g., channel name, target nick).
 
 ### Channel Modes
 
@@ -891,7 +987,18 @@ the format:
 
 Create a new user session. This is the entry point for all clients.
 
-**Request:**
+If the server requires hashcash proof-of-work (see
+[Hashcash Proof-of-Work](#hashcash-proof-of-work)), the client must include a
+valid stamp in the `X-Hashcash` request header. The required difficulty is
+advertised via `GET /api/v1/server` in the `hashcash_bits` field.
+
+**Request Headers:**
+
+| Header       | Required | Description |
+|--------------|----------|-------------|
+| `X-Hashcash` | Conditional | Hashcash stamp (required when server has `hashcash_bits` > 0) |
+
+**Request Body:**
 ```json
 {"nick": "alice"}
 ```
@@ -920,12 +1027,15 @@ Create a new user session. This is the entry point for all clients.
 | Status | Error | When |
 |--------|-------|------|
 | 400    | `nick must be 1-32 characters` | Empty or too-long nick |
+| 402    | `hashcash proof-of-work required` | Missing `X-Hashcash` header when hashcash is enabled |
+| 402    | `invalid hashcash stamp: ...` | Stamp fails validation (wrong bits, expired, reused, etc.) |
 | 409    | `nick already taken` | Another active session holds this nick |
 
 **curl example:**
 ```bash
 TOKEN=$(curl -s -X POST http://localhost:8080/api/v1/session \
   -H 'Content-Type: application/json' \
+  -H 'X-Hashcash: 1:20:260310:neoirc::3a2f1' \
   -d '{"nick":"alice"}' | jq -r .token)
 echo $TOKEN
 ```
@@ -936,6 +1046,12 @@ Return the current user's session state.
 
 **Request:** No body. Requires auth.
 
+**Query Parameters:**
+
+| Parameter | Type   | Default | Description |
+|-----------|--------|---------|-------------|
+| `initChannelState` | string | (none) | When set to `1`, enqueues synthetic JOIN + TOPIC + NAMES messages for every channel the session belongs to into the calling client's queue. Used by the SPA on reconnect to restore channel tabs without re-sending JOIN commands. |
+
 **Response:** `200 OK`
 ```json
 {
@@ -968,6 +1084,12 @@ curl -s http://localhost:8080/api/v1/state \
   -H "Authorization: Bearer $TOKEN" | jq .
 ```
 
+**Reconnect with channel state initialization:**
+```bash
+curl -s "http://localhost:8080/api/v1/state?initChannelState=1" \
+  -H "Authorization: Bearer $TOKEN" | jq .
+```
+
 ### GET /api/v1/messages — Poll Messages (Long-Poll)
 
 Retrieve messages from the client's delivery queue. This is the primary
@@ -1054,27 +1176,78 @@ reference with all required and optional fields.
 
 | Command   | Required Fields     | Optional      | Response Status |
 |-----------|---------------------|---------------|-----------------|
-| `PRIVMSG` | `to`, `body`        | `meta`        | 201 Created     |
-| `NOTICE`  | `to`, `body`        | `meta`        | 201 Created     |
+| `PRIVMSG` | `to`, `body`        | `meta`        | 200 OK          |
+| `NOTICE`  | `to`, `body`        | `meta`        | 200 OK          |
 | `JOIN`    | `to`                |               | 200 OK          |
 | `PART`    | `to`                | `body`        | 200 OK          |
 | `NICK`    | `body`              |               | 200 OK          |
 | `TOPIC`   | `to`, `body`        |               | 200 OK          |
+| `MODE`    | `to`                |               | 200 OK          |
+| `NAMES`   | `to`                |               | 200 OK          |
+| `LIST`    |                     |               | 200 OK          |
+| `WHOIS`   | `to` or `body`      |               | 200 OK          |
+| `WHO`     | `to`                |               | 200 OK          |
+| `LUSERS`  |                     |               | 200 OK          |
 | `QUIT`    |                     | `body`        | 200 OK          |
 | `PING`    |                     |               | 200 OK          |
 
-**Errors (all commands):**
+All IRC commands return HTTP 200 OK. IRC-level success and error responses
+are delivered as **numeric replies** through the message queue (see
+[Numeric Replies](#numeric-replies) below). HTTP error codes (4xx/5xx) are
+reserved for transport-level problems: malformed JSON (400), missing/invalid
+auth tokens (401), and server errors (500).
+
+**HTTP errors (transport-level only):**
 
 | Status | Error | When |
 |--------|-------|------|
-| 400    | `invalid request` | Malformed JSON |
-| 400    | `to field required` | Missing `to` for commands that need it |
-| 400    | `body required` | Missing `body` for commands that need it |
-| 400    | `unknown command: X` | Unrecognized command |
+| 400    | `invalid request` | Malformed JSON or empty command |
 | 401    | `unauthorized` | Missing or invalid auth token |
-| 404    | `channel not found` | Target channel doesn't exist |
-| 404    | `user not found` | DM target nick doesn't exist |
-| 409    | `nick already in use` | NICK target is taken |
+| 500    | `internal error` | Server-side failure |
+
+**IRC numeric error replies (delivered via message queue):**
+
+| Numeric | Name | When |
+|---------|------|------|
+| 401     | ERR_NOSUCHNICK | DM target nick doesn't exist |
+| 403     | ERR_NOSUCHCHANNEL | Target channel doesn't exist or invalid name |
+| 421     | ERR_UNKNOWNCOMMAND | Unrecognized command |
+| 432     | ERR_ERRONEUSNICKNAME | Invalid nickname format |
+| 433     | ERR_NICKNAMEINUSE | NICK target is taken |
+| 442     | ERR_NOTONCHANNEL | Not a member of the target channel |
+| 461     | ERR_NEEDMOREPARAMS | Missing required fields (to, body) |
+
+**IRC numeric success replies (delivered via message queue):**
+
+| Numeric | Name | When |
+|---------|------|------|
+| 001     | RPL_WELCOME | Sent on session creation/login |
+| 002     | RPL_YOURHOST | Sent on session creation/login |
+| 003     | RPL_CREATED | Sent on session creation/login |
+| 004     | RPL_MYINFO | Sent on session creation/login |
+| 005     | RPL_ISUPPORT | Sent on session creation/login |
+| 221     | RPL_UMODEIS | In response to user MODE query |
+| 251     | RPL_LUSERCLIENT | On connect or LUSERS command |
+| 252     | RPL_LUSEROP | On connect or LUSERS command |
+| 254     | RPL_LUSERCHANNELS | On connect or LUSERS command |
+| 255     | RPL_LUSERME | On connect or LUSERS command |
+| 311     | RPL_WHOISUSER | WHOIS user info |
+| 312     | RPL_WHOISSERVER | WHOIS server info |
+| 315     | RPL_ENDOFWHO | End of WHO list |
+| 318     | RPL_ENDOFWHOIS | End of WHOIS list |
+| 319     | RPL_WHOISCHANNELS | WHOIS channels list |
+| 322     | RPL_LIST | Channel in LIST response |
+| 323     | RPL_LISTEND | End of LIST |
+| 324     | RPL_CHANNELMODEIS | Channel mode query response |
+| 329     | RPL_CREATIONTIME | Channel creation timestamp |
+| 331     | RPL_NOTOPIC | Channel has no topic (on JOIN) |
+| 332     | RPL_TOPIC | Channel topic (on JOIN, TOPIC set) |
+| 352     | RPL_WHOREPLY | User in WHO response |
+| 353     | RPL_NAMREPLY | Channel member list (on JOIN, NAMES) |
+| 366     | RPL_ENDOFNAMES | End of NAMES list |
+| 375     | RPL_MOTDSTART | Start of MOTD |
+| 372     | RPL_MOTD | MOTD line |
+| 376     | RPL_ENDOFMOTD | End of MOTD |
 
 ### GET /api/v1/history — Message History
 
@@ -1215,16 +1388,20 @@ Return server metadata. No authentication required.
 ```json
 {
   "name": "My NeoIRC Server",
+  "version": "0.1.0",
   "motd": "Welcome! Be nice.",
-  "users": 42
+  "users": 42,
+  "hashcash_bits": 20
 }
 ```
 
 | Field           | Type    | Description |
-|---------|---------|-------------|
+|-----------------|---------|-------------|
 | `name`          | string  | Server display name |
+| `version`       | string  | Server version |
 | `motd`          | string  | Message of the day |
 | `users`         | integer | Number of currently active user sessions |
+| `hashcash_bits` | integer | Required proof-of-work difficulty (leading zero bits). Only present when > 0. See [Hashcash Proof-of-Work](#hashcash-proof-of-work). |
 
 ### GET /.well-known/healthcheck.json — Health Check
 
@@ -1463,6 +1640,10 @@ authenticity.
   termination.
 - **CORS**: The server allows all origins by default (`Access-Control-Allow-Origin: *`).
   Restrict this in production via reverse proxy configuration if needed.
+- **Content-Security-Policy**: The server sets a strict CSP header on all
+  responses, restricting resource loading to same-origin and disabling
+  dangerous features (object embeds, framing, base tag injection). The
+  embedded SPA works without `'unsafe-inline'` for scripts or styles.
 
 ---
 
@@ -1658,6 +1839,7 @@ directory is also loaded automatically via
 | `SENTRY_DSN`       | string  | `""`                                 | Sentry error tracking DSN (optional) |
 | `METRICS_USERNAME` | string  | `""`                                 | Basic auth username for `/metrics` endpoint. If empty, metrics endpoint is disabled. |
 | `METRICS_PASSWORD` | string  | `""`                                 | Basic auth password for `/metrics` endpoint |
+| `NEOIRC_HASHCASH_BITS` | int | `20`                               | Required hashcash proof-of-work difficulty (leading zero bits in SHA-256) for session creation. Set to `0` to disable. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |
 
 ### Example `.env` file
@@ -1669,6 +1851,7 @@ MOTD=Welcome! Be excellent to each other.
 DEBUG=false
 DBURL=file:///var/lib/neoirc/state.db?_journal_mode=WAL
 SESSION_IDLE_TIMEOUT=24h
+NEOIRC_HASHCASH_BITS=20
 ```
 
 ---
@@ -1691,26 +1874,16 @@ docker run -p 8080:8080 \
   neoirc
 ```
 
-The Dockerfile is a multi-stage build:
-1. **Build stage**: Compiles `neoircd` and `neoirc-cli` (CLI built to verify
+The Dockerfile is a four-stage build:
+1. **web-builder**: Installs Node dependencies and compiles the SPA (JSX →
+   bundled JS via esbuild) into `web/dist/`
+2. **lint**: Runs formatting checks and golangci-lint against the Go source
+   (uses empty placeholder files for `web/dist/` so it runs independently of
+   web-builder for fast feedback)
+3. **builder**: Runs tests and compiles static `neoircd` and `neoirc-cli`
+   binaries with the real SPA assets from web-builder (CLI built to verify
    compilation, not included in final image)
-2. **Final stage**: Alpine Linux + `neoircd` binary only
-
-```dockerfile
-FROM golang:1.24-alpine AS builder
-WORKDIR /src
-RUN apk add --no-cache make
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN go build -o /neoircd ./cmd/neoircd/
-RUN go build -o /neoirc-cli ./cmd/neoirc-cli/
-
-FROM alpine:latest
-COPY --from=builder /neoircd /usr/local/bin/neoircd
-EXPOSE 8080
-CMD ["neoircd"]
-```
+4. **final**: Minimal Alpine image with only the `neoircd` binary
 
 ### Binary
 
@@ -1951,62 +2124,102 @@ Clients should handle these message commands from the queue:
 
 ## Rate Limiting & Abuse Prevention
 
-Session creation (`POST /api/v1/session`) will require a
+### Hashcash Proof-of-Work
+
+Session creation (`POST /api/v1/session`) requires a
 [hashcash](https://en.wikipedia.org/wiki/Hashcash)-style proof-of-work token.
 This is the primary defense against resource exhaustion — no CAPTCHAs, no
 account registration, no IP-based rate limits that punish shared networks.
 
 ### How It Works
 
-1. Client requests a challenge: `GET /api/v1/challenge`
-   ```json
-   → {"nonce": "random-hex-string", "difficulty": 20, "expires": "2026-02-10T20:01:00Z"}
-   ```
-2. Server returns a nonce and a required difficulty (number of leading zero
-   bits in the SHA-256 hash)
-3. Client finds a counter value such that `SHA-256(nonce || ":" || counter)`
-   has the required number of leading zero bits:
-   ```
-   SHA-256("a1b2c3:0")     = 0xf3a1...  (0 leading zeros — no good)
-   SHA-256("a1b2c3:1")     = 0x8c72...  (0 leading zeros — no good)
-   ...
-   SHA-256("a1b2c3:94217") = 0x00003a... (20 leading zero bits — success!)
-   ```
-4. Client submits the proof with the session request:
-   ```json
-   POST /api/v1/session
-   {"nick": "alice", "proof": {"nonce": "a1b2c3", "counter": 94217}}
-   ```
-5. Server verifies:
-   - Nonce was issued by this server and hasn't expired
-   - Nonce hasn't been used before (prevent replay)
-   - `SHA-256(nonce || ":" || counter)` has the required leading zeros
-   - If valid, create the session normally
+1. Client fetches server info: `GET /api/v1/server` returns a `hashcash_bits`
+   field (e.g., `20`) indicating the required difficulty.
+2. Client computes a hashcash stamp: find a counter value such that the
+   SHA-256 hash of the stamp string has the required number of leading zero
+   bits.
+3. Client includes the stamp in the `X-Hashcash` request header when creating
+   a session: `POST /api/v1/session`.
+4. Server validates the stamp:
+   - Version is `1`
+   - Claimed bits ≥ required bits
+   - Resource matches the server name
+   - Date is within 48 hours (not expired, not too far in the future)
+   - SHA-256 hash has the required leading zero bits
+   - Stamp has not been used before (replay prevention)
 
-### Adaptive Difficulty
+### Stamp Format
 
-The required difficulty scales with server load. Under normal conditions, the
-cost is negligible (a few milliseconds of CPU). As concurrent sessions or
-session creation rate increases, difficulty rises — making bulk session creation
-exponentially more expensive for attackers while remaining cheap for legitimate
-single-user connections.
+Standard hashcash format:
 
-| Server Load        | Difficulty (bits) | Approx. Client CPU |
-|--------------------|-------------------|--------------------|
-| Normal (< 100/min) | 16                | ~1ms               |
-| Elevated           | 20                | ~15ms              |
-| High               | 24                | ~250ms             |
-| Under attack       | 28+               | ~4s+               |
+```
+1:bits:date:resource::counter
+```
 
-Each additional bit of difficulty doubles the expected work. An attacker
-creating 1000 sessions at difficulty 28 needs ~4000 CPU-seconds; a legitimate
-user creating one session needs ~4 seconds once and never again for the
-duration of their session.
+| Field      | Description |
+|------------|-------------|
+| `1`        | Version (always `1`) |
+| `bits`     | Claimed difficulty (must be ≥ server's `hashcash_bits`) |
+| `date`     | Date stamp in `YYMMDD` or `YYMMDDHHMMSS` format (UTC) |
+| `resource` | The server name (from `GET /api/v1/server`; defaults to `neoirc`) |
+| (empty)    | Extension field (unused) |
+| `counter`  | Hex counter value found by the client to satisfy the PoW |
+
+**Example stamp:** `1:20:260310:neoirc::3a2f1b`
+
+The SHA-256 hash of this entire string must have at least 20 leading zero bits.
+
+### Computing a Stamp
+
+```bash
+# Pseudocode
+bits = 20
+resource = "neoirc"
+date = "260310"         # YYMMDD in UTC
+counter = 0
+
+loop:
+    stamp = "1:{bits}:{date}:{resource}::{hex(counter)}"
+    hash = SHA-256(stamp)
+    if leading_zero_bits(hash) >= bits:
+        return stamp
+    counter++
+```
+
+At difficulty 20, this requires approximately 2^20 (~1M) hash attempts on
+average, taking roughly 0.5–2 seconds on modern hardware.
+
+### Client Integration
+
+Both the embedded web SPA and the CLI client automatically handle hashcash:
+
+1. Fetch `GET /api/v1/server` to read `hashcash_bits`
+2. If `hashcash_bits > 0`, compute a valid stamp
+3. Include the stamp in the `X-Hashcash` header on `POST /api/v1/session`
+
+The web SPA uses the Web Crypto API (`crypto.subtle.digest`) for SHA-256
+computation with batched parallelism. The CLI client uses Go's `crypto/sha256`.
+
+### Configuration
+
+Set `NEOIRC_HASHCASH_BITS` to control difficulty:
+
+| Value | Effect | Approx. Client CPU |
+|-------|--------|---------------------|
+| `0`   | Disabled (no proof-of-work required) | — |
+| `16`  | Light protection | ~1ms |
+| `20`  | Default — good balance | ~0.5–2s |
+| `24`  | Strong protection | ~10–30s |
+| `28`  | Very strong (may frustrate users) | ~2–10min |
+
+Each additional bit doubles the expected work. An attacker creating 1000
+sessions at difficulty 20 needs ~1000–2000 CPU-seconds; a legitimate user
+creating one session pays once and keeps their session.
 
 ### Why Hashcash and Not Rate Limits?
 
 - **No state to track**: No IP tables, no token buckets, no sliding windows.
-  The server only needs to verify a hash.
+  The server only needs to verify a single hash.
 - **Works through NATs and proxies**: Doesn't punish shared IPs (university
   campuses, corporate networks, Tor exits). Every client computes their own
   proof independently.
@@ -2014,36 +2227,9 @@ duration of their session.
   (one SHA-256 hash) regardless of difficulty. Only the client does more work.
 - **Fits the "no accounts" philosophy**: Proof-of-work is the cost of entry.
   No registration, no email, no phone number, no CAPTCHA. Just compute.
-- **Trivial for legitimate clients**: A single-user client pays ~1ms of CPU
-  once. A botnet trying to create thousands of sessions pays exponentially more.
 - **Language-agnostic**: SHA-256 is available in every programming language.
   The proof computation is trivially implementable in any client.
 
-### Challenge Endpoint (Planned)
-
-```
-GET /api/v1/challenge
-```
-
-**Response:** `200 OK`
-```json
-{
-  "nonce": "a1b2c3d4e5f6...",
-  "difficulty": 20,
-  "algorithm": "sha256",
-  "expires": "2026-02-10T20:01:00Z"
-}
-```
-
-| Field        | Type    | Description |
-|--------------|---------|-------------|
-| `nonce`      | string  | Server-generated random hex string (32+ chars) |
-| `difficulty` | integer | Required number of leading zero bits in the hash |
-| `algorithm`  | string  | Hash algorithm (always `sha256` for now) |
-| `expires`    | string  | ISO 8601 expiry time for this challenge |
-
-**Status:** Not yet implemented. Tracked for post-MVP.
-
 ---
 
 ## Roadmap
@@ -2072,15 +2258,23 @@ GET /api/v1/challenge
 
 ### Post-MVP (Planned)
 
-- [ ] **Hashcash proof-of-work** for session creation (abuse prevention)
+- [x] **Hashcash proof-of-work** for session creation (abuse prevention)
 - [ ] **Queue pruning** — delete old queue entries per `QUEUE_MAX_AGE`
 - [ ] **Message rotation** — enforce `MAX_HISTORY` per channel
 - [ ] **Channel modes** — enforce `+i`, `+m`, `+s`, `+t`, `+n`
 - [ ] **User channel modes** — `+o` (operator), `+v` (voice)
-- [ ] **MODE command** — set/query channel and user modes
+- [x] **MODE command** — query channel and user modes (set not yet implemented)
+- [x] **NAMES command** — query channel member list
+- [x] **LIST command** — list all channels with member counts
+- [x] **WHOIS command** — query user information and channel membership
+- [x] **WHO command** — query channel user list
+- [x] **LUSERS command** — query server statistics
+- [x] **Connection registration numerics** — 001-005 sent on session creation
+- [x] **LUSERS numerics** — 251/252/254/255 sent on connect and via /LUSERS
 - [ ] **KICK command** — remove users from channels
-- [ ] **Numeric replies** — send IRC numeric codes via the message queue
-  (001 welcome, 353 NAMES, 332 TOPIC, etc.)
+- [x] **Numeric replies** — send IRC numeric codes via the message queue
+  (001-005 welcome, 251-255 LUSERS, 311-319 WHOIS, 322-329 LIST/MODE,
+  331-332 TOPIC, 352-353 WHO/NAMES, 366, 372-376 MOTD, 401-461 errors)
 - [ ] **Max message size enforcement** — reject oversized messages
 - [ ] **NOTICE command** — distinct from PRIVMSG (no auto-reply flag)
 - [ ] **Multi-client sessions** — add client to existing session
@@ -2100,7 +2294,7 @@ GET /api/v1/challenge
 - [ ] **Push notifications** — optional webhook/push for mobile clients
   when messages arrive during disconnect
 - [ ] **Message search** — full-text search over channel history
-- [ ] **User info command** — WHOIS-equivalent for querying user metadata
+- [x] **User info command** — WHOIS for querying user info and channels
 - [ ] **Connection flood protection** — per-IP connection limits as a
   complement to hashcash
 - [ ] **Invite system** — `INVITE` command for `+i` channels
@@ -2117,15 +2311,18 @@ neoirc/
 ├── cmd/
 │   ├── neoircd/            # Server binary entry point
 │   │   └── main.go
-│   └── neoirc-cli/         # TUI client
-│       ├── main.go         # Command handling, poll loop
-│       ├── ui.go           # tview-based terminal UI
-│       └── api/
-│           ├── client.go   # HTTP API client library
-│           └── types.go    # Request/response types
+│   └── neoirc-cli/         # TUI client entry point
+│       └── main.go         # Minimal bootstrapping (calls internal/cli)
 ├── internal/
 │   ├── broker/             # In-memory pub/sub for long-poll notifications
 │   │   └── broker.go
+│   ├── cli/                # TUI client implementation
+│   │   ├── app.go          # App struct, command handling, poll loop
+│   │   ├── ui.go           # tview-based terminal UI
+│   │   └── api/
+│   │       ├── client.go   # HTTP API client library
+│   │       ├── types.go    # Request/response types
+│   │       └── hashcash.go # Hashcash proof-of-work minting
 │   ├── config/             # Viper-based configuration
 │   │   └── config.go
 │   ├── db/                 # Database access and migrations
@@ -2151,10 +2348,14 @@ neoirc/
 │       └── http.go         # HTTP timeouts
 ├── web/
 │   ├── embed.go            # go:embed directive for SPA
-│   └── dist/               # Built SPA (vanilla JS, no build step)
-│       ├── index.html
-│       ├── style.css
-│       └── app.js
+│   ├── build.sh            # SPA build script (esbuild, runs in Docker)
+│   ├── package.json        # Node dependencies (preact, esbuild)
+│   ├── package-lock.json
+│   ├── src/                # SPA source files (JSX + HTML + CSS)
+│   │   ├── app.jsx
+│   │   ├── index.html
+│   │   └── style.css
+│   └── dist/               # Generated at Docker build time (not committed)
 ├── schema/                 # JSON Schema definitions (planned)
 ├── go.mod
 ├── go.sum

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-02-22
+last_modified: 2026-03-09
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -98,6 +98,13 @@ style conventions are in separate documents:
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
   a new repo.
 
+- **No build artifacts in version control.** Code-derived data (compiled
+  bundles, minified output, generated assets) must never be committed to the
+  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
+  should generate these at build time. Notable exception: Go protobuf generated
+  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
+  downloads code but does not execute code generation.
+
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 
 - Never force-push to `main`.
@@ -144,8 +151,14 @@ style conventions are in separate documents:
 - Use SemVer.
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
-  Post-1.0.0: add new migration files.
+  the binary.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
   settings.

cmd/neoirc-cli/main.go

@@ -1,804 +1,8 @@
 // Package main is the entry point for the neoirc-cli client.
 package main
 
-import (
-	"fmt"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	api "git.eeqj.de/sneak/neoirc/cmd/neoirc-cli/api"
-)
-
-const (
-	splitParts  = 2
-	pollTimeout = 15
-	pollRetry   = 2 * time.Second
-	timeFormat  = "15:04"
-)
-
-// App holds the application state.
-type App struct {
-	ui     *UI
-	client *api.Client
-
-	mu        sync.Mutex
-	nick      string
-	target    string
-	connected bool
-	lastQID   int64
-	stopPoll  chan struct{}
-}
+import "git.eeqj.de/sneak/neoirc/internal/cli"
 
 func main() {
-	app := &App{ //nolint:exhaustruct
-		ui:   NewUI(),
-		nick: "guest",
-	}
-
-	app.ui.OnInput(app.handleInput)
-	app.ui.SetStatus(app.nick, "", "disconnected")
-
-	app.ui.AddStatus(
-		"Welcome to neoirc-cli — an IRC-style client",
-	)
-	app.ui.AddStatus(
-		"Type [yellow]/connect <server-url>" +
-			"[white] to begin, " +
-			"or [yellow]/help[white] for commands",
-	)
-
-	err := app.ui.Run()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func (a *App) handleInput(text string) {
-	if strings.HasPrefix(text, "/") {
-		a.handleCommand(text)
-
-		return
-	}
-
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus(
-			"[red]Not connected. Use /connect <url>",
-		)
-
-		return
-	}
-
-	if target == "" {
-		a.ui.AddStatus(
-			"[red]No target. " +
-				"Use /join #channel or /query nick",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "PRIVMSG",
-		To:      target,
-		Body:    []string{text},
-	})
-	if err != nil {
-		a.ui.AddStatus(
-			"[red]Send error: " + err.Error(),
-		)
-
-		return
-	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
-}
-
-func (a *App) handleCommand(text string) {
-	parts := strings.SplitN(text, " ", splitParts)
-	cmd := strings.ToLower(parts[0])
-
-	args := ""
-	if len(parts) > 1 {
-		args = parts[1]
-	}
-
-	a.dispatchCommand(cmd, args)
-}
-
-func (a *App) dispatchCommand(cmd, args string) {
-	switch cmd {
-	case "/connect":
-		a.cmdConnect(args)
-	case "/nick":
-		a.cmdNick(args)
-	case "/join":
-		a.cmdJoin(args)
-	case "/part":
-		a.cmdPart(args)
-	case "/msg":
-		a.cmdMsg(args)
-	case "/query":
-		a.cmdQuery(args)
-	case "/topic":
-		a.cmdTopic(args)
-	case "/names":
-		a.cmdNames()
-	case "/list":
-		a.cmdList()
-	case "/window", "/w":
-		a.cmdWindow(args)
-	case "/quit":
-		a.cmdQuit()
-	case "/help":
-		a.cmdHelp()
-	default:
-		a.ui.AddStatus(
-			"[red]Unknown command: " + cmd,
-		)
-	}
-}
-
-func (a *App) cmdConnect(serverURL string) {
-	if serverURL == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /connect <server-url>",
-		)
-
-		return
-	}
-
-	serverURL = strings.TrimRight(serverURL, "/")
-
-	a.ui.AddStatus("Connecting to " + serverURL + "...")
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	client := api.NewClient(serverURL)
-
-	resp, err := client.CreateSession(nick)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Connection failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.client = client
-	a.nick = resp.Nick
-	a.connected = true
-	a.lastQID = 0
-	a.mu.Unlock()
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[green]Connected! Nick: %s, Session: %d",
-		resp.Nick, resp.ID,
-	))
-	a.ui.SetStatus(resp.Nick, "", "connected")
-
-	a.stopPoll = make(chan struct{})
-
-	go a.pollLoop()
-}
-
-func (a *App) cmdNick(nick string) {
-	if nick == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /nick <name>",
-		)
-
-		return
-	}
-
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.mu.Lock()
-		a.nick = nick
-		a.mu.Unlock()
-
-		a.ui.AddStatus(
-			"Nick set to " + nick +
-				" (will be used on connect)",
-		)
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "NICK",
-		Body:    []string{nick},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Nick change failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.nick = nick
-	target := a.target
-	a.mu.Unlock()
-
-	a.ui.SetStatus(nick, target, "connected")
-	a.ui.AddStatus("Nick changed to " + nick)
-}
-
-func (a *App) cmdJoin(channel string) {
-	if channel == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /join #channel",
-		)
-
-		return
-	}
-
-	if !strings.HasPrefix(channel, "#") {
-		channel = "#" + channel
-	}
-
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.JoinChannel(channel)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Join failed: %v", err,
-		))
-
-		return
-	}
-
-	a.mu.Lock()
-	a.target = channel
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchToBuffer(channel)
-	a.ui.AddLine(channel,
-		"[yellow]*** Joined "+channel,
-	)
-	a.ui.SetStatus(nick, channel, "connected")
-}
-
-func (a *App) cmdPart(channel string) {
-	a.mu.Lock()
-	if channel == "" {
-		channel = a.target
-	}
-
-	connected := a.connected
-	a.mu.Unlock()
-
-	if channel == "" ||
-		!strings.HasPrefix(channel, "#") {
-		a.ui.AddStatus("[red]No channel to part")
-
-		return
-	}
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.PartChannel(channel)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Part failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddLine(channel,
-		"[yellow]*** Left "+channel,
-	)
-
-	a.mu.Lock()
-	if a.target == channel {
-		a.target = ""
-	}
-
-	nick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchBuffer(0)
-	a.ui.SetStatus(nick, "", "connected")
-}
-
-func (a *App) cmdMsg(args string) {
-	parts := strings.SplitN(args, " ", splitParts)
-	if len(parts) < splitParts {
-		a.ui.AddStatus(
-			"[red]Usage: /msg <nick> <text>",
-		)
-
-		return
-	}
-
-	target, text := parts[0], parts[1]
-
-	a.mu.Lock()
-	connected := a.connected
-	nick := a.nick
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "PRIVMSG",
-		To:      target,
-		Body:    []string{text},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Send failed: %v", err,
-		))
-
-		return
-	}
-
-	timestamp := time.Now().Format(timeFormat)
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, nick, text,
-	))
-}
-
-func (a *App) cmdQuery(nick string) {
-	if nick == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /query <nick>",
-		)
-
-		return
-	}
-
-	a.mu.Lock()
-	a.target = nick
-	myNick := a.nick
-	a.mu.Unlock()
-
-	a.ui.SwitchToBuffer(nick)
-	a.ui.SetStatus(myNick, nick, "connected")
-}
-
-func (a *App) cmdTopic(args string) {
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	if !strings.HasPrefix(target, "#") {
-		a.ui.AddStatus("[red]Not in a channel")
-
-		return
-	}
-
-	if args == "" {
-		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-			Command: "TOPIC",
-			To:      target,
-		})
-		if err != nil {
-			a.ui.AddStatus(fmt.Sprintf(
-				"[red]Topic query failed: %v", err,
-			))
-		}
-
-		return
-	}
-
-	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
-		Command: "TOPIC",
-		To:      target,
-		Body:    []string{args},
-	})
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Topic set failed: %v", err,
-		))
-	}
-}
-
-func (a *App) cmdNames() {
-	a.mu.Lock()
-	target := a.target
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	if !strings.HasPrefix(target, "#") {
-		a.ui.AddStatus("[red]Not in a channel")
-
-		return
-	}
-
-	members, err := a.client.GetMembers(target)
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]Names failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[cyan]*** Members of %s: %s",
-		target, strings.Join(members, " "),
-	))
-}
-
-func (a *App) cmdList() {
-	a.mu.Lock()
-	connected := a.connected
-	a.mu.Unlock()
-
-	if !connected {
-		a.ui.AddStatus("[red]Not connected")
-
-		return
-	}
-
-	channels, err := a.client.ListChannels()
-	if err != nil {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[red]List failed: %v", err,
-		))
-
-		return
-	}
-
-	a.ui.AddStatus("[cyan]*** Channel list:")
-
-	for _, ch := range channels {
-		a.ui.AddStatus(fmt.Sprintf(
-			"  %s (%d members) %s",
-			ch.Name, ch.Members, ch.Topic,
-		))
-	}
-
-	a.ui.AddStatus("[cyan]*** End of channel list")
-}
-
-func (a *App) cmdWindow(args string) {
-	if args == "" {
-		a.ui.AddStatus(
-			"[red]Usage: /window <number>",
-		)
-
-		return
-	}
-
-	var bufIndex int
-
-	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
-
-	a.ui.SwitchBuffer(bufIndex)
-
-	a.mu.Lock()
-	nick := a.nick
-	a.mu.Unlock()
-
-	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
-		buf := a.ui.buffers[bufIndex]
-		if buf.Name != "(status)" {
-			a.mu.Lock()
-			a.target = buf.Name
-			a.mu.Unlock()
-
-			a.ui.SetStatus(
-				nick, buf.Name, "connected",
-			)
-		} else {
-			a.ui.SetStatus(nick, "", "connected")
-		}
-	}
-}
-
-func (a *App) cmdQuit() {
-	a.mu.Lock()
-
-	if a.connected && a.client != nil {
-		_ = a.client.SendMessage(
-			&api.Message{Command: "QUIT"}, //nolint:exhaustruct
-		)
-	}
-
-	if a.stopPoll != nil {
-		close(a.stopPoll)
-	}
-
-	a.mu.Unlock()
-	a.ui.Stop()
-}
-
-func (a *App) cmdHelp() {
-	help := []string{
-		"[cyan]*** neoirc-cli commands:",
-		"  /connect <url>  — Connect to server",
-		"  /nick <name>    — Change nickname",
-		"  /join #channel  — Join channel",
-		"  /part [#chan]    — Leave channel",
-		"  /msg <nick> <text> — Send DM",
-		"  /query <nick>   — Open DM window",
-		"  /topic [text]   — View/set topic",
-		"  /names          — List channel members",
-		"  /list           — List channels",
-		"  /window <n>     — Switch buffer",
-		"  /quit           — Disconnect and exit",
-		"  /help           — This help",
-		"  Plain text sends to current target.",
-	}
-
-	for _, line := range help {
-		a.ui.AddStatus(line)
-	}
-}
-
-// pollLoop long-polls for messages in the background.
-func (a *App) pollLoop() {
-	for {
-		select {
-		case <-a.stopPoll:
-			return
-		default:
-		}
-
-		a.mu.Lock()
-		client := a.client
-		lastQID := a.lastQID
-		a.mu.Unlock()
-
-		if client == nil {
-			return
-		}
-
-		result, err := client.PollMessages(
-			lastQID, pollTimeout,
-		)
-		if err != nil {
-			time.Sleep(pollRetry)
-
-			continue
-		}
-
-		if result.LastID > 0 {
-			a.mu.Lock()
-			a.lastQID = result.LastID
-			a.mu.Unlock()
-		}
-
-		for i := range result.Messages {
-			a.handleServerMessage(&result.Messages[i])
-		}
-	}
-}
-
-func (a *App) handleServerMessage(msg *api.Message) {
-	timestamp := a.formatTS(msg)
-
-	a.mu.Lock()
-	myNick := a.nick
-	a.mu.Unlock()
-
-	switch msg.Command {
-	case "PRIVMSG":
-		a.handlePrivmsgEvent(msg, timestamp, myNick)
-	case "JOIN":
-		a.handleJoinEvent(msg, timestamp)
-	case "PART":
-		a.handlePartEvent(msg, timestamp)
-	case "QUIT":
-		a.handleQuitEvent(msg, timestamp)
-	case "NICK":
-		a.handleNickEvent(msg, timestamp, myNick)
-	case "NOTICE":
-		a.handleNoticeEvent(msg, timestamp)
-	case "TOPIC":
-		a.handleTopicEvent(msg, timestamp)
-	default:
-		a.handleDefaultEvent(msg, timestamp)
-	}
-}
-
-func (a *App) formatTS(msg *api.Message) string {
-	if msg.TS != "" {
-		return msg.ParseTS().UTC().Format(timeFormat)
-	}
-
-	return time.Now().Format(timeFormat)
-}
-
-func (a *App) handlePrivmsgEvent(
-	msg *api.Message, timestamp, myNick string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	if msg.From == myNick {
-		return
-	}
-
-	target := msg.To
-	if !strings.HasPrefix(target, "#") {
-		target = msg.From
-	}
-
-	a.ui.AddLine(target, fmt.Sprintf(
-		"[gray]%s [green]<%s>[white] %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleJoinEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	a.ui.AddLine(msg.To, fmt.Sprintf(
-		"[gray]%s [yellow]*** %s has joined %s",
-		timestamp, msg.From, msg.To,
-	))
-}
-
-func (a *App) handlePartEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	lines := msg.BodyLines()
-	reason := strings.Join(lines, " ")
-
-	if reason != "" {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s (%s)",
-			timestamp, msg.From, msg.To, reason,
-		))
-	} else {
-		a.ui.AddLine(msg.To, fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has left %s",
-			timestamp, msg.From, msg.To,
-		))
-	}
-}
-
-func (a *App) handleQuitEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	reason := strings.Join(lines, " ")
-
-	if reason != "" {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has quit (%s)",
-			timestamp, msg.From, reason,
-		))
-	} else {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [yellow]*** %s has quit",
-			timestamp, msg.From,
-		))
-	}
-}
-
-func (a *App) handleNickEvent(
-	msg *api.Message, timestamp, myNick string,
-) {
-	lines := msg.BodyLines()
-
-	newNick := ""
-	if len(lines) > 0 {
-		newNick = lines[0]
-	}
-
-	if msg.From == myNick && newNick != "" {
-		a.mu.Lock()
-		a.nick = newNick
-
-		target := a.target
-		a.mu.Unlock()
-
-		a.ui.SetStatus(newNick, target, "connected")
-	}
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[gray]%s [yellow]*** %s is now known as %s",
-		timestamp, msg.From, newNick,
-	))
-}
-
-func (a *App) handleNoticeEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	a.ui.AddStatus(fmt.Sprintf(
-		"[gray]%s [magenta]--%s-- %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleTopicEvent(
-	msg *api.Message, timestamp string,
-) {
-	if msg.To == "" {
-		return
-	}
-
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	a.ui.AddLine(msg.To, fmt.Sprintf(
-		"[gray]%s [cyan]*** %s set topic: %s",
-		timestamp, msg.From, text,
-	))
-}
-
-func (a *App) handleDefaultEvent(
-	msg *api.Message, timestamp string,
-) {
-	lines := msg.BodyLines()
-	text := strings.Join(lines, " ")
-
-	if text != "" {
-		a.ui.AddStatus(fmt.Sprintf(
-			"[gray]%s [white][%s] %s",
-			timestamp, msg.Command, text,
-		))
-	}
+	cli.Run()
 }

internal/cli/api/client.go

@@ -13,6 +13,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"git.eeqj.de/sneak/neoirc/internal/irc"
 )
 
 const (
@@ -41,13 +43,34 @@ func NewClient(baseURL string) *Client {
 }
 
 // CreateSession creates a new session on the server.
+// If the server requires hashcash proof-of-work, it
+// automatically fetches the difficulty and computes a
+// valid stamp.
 func (client *Client) CreateSession(
 	nick string,
 ) (*SessionResponse, error) {
-	data, err := client.do(
+	// Fetch server info to check for hashcash requirement.
+	info, err := client.GetServerInfo()
+
+	var headers map[string]string
+
+	if err == nil && info.HashcashBits > 0 {
+		resource := info.Name
+		if resource == "" {
+			resource = "neoirc"
+		}
+
+		stamp := MintHashcash(info.HashcashBits, resource)
+		headers = map[string]string{
+			"X-Hashcash": stamp,
+		}
+	}
+
+	data, err := client.doWithHeaders(
 		http.MethodPost,
 		"/api/v1/session",
 		&SessionRequest{Nick: nick},
+		headers,
 	)
 	if err != nil {
 		return nil, err
@@ -168,7 +191,7 @@ func (client *Client) PollMessages(
 func (client *Client) JoinChannel(channel string) error {
 	return client.SendMessage(
 		&Message{ //nolint:exhaustruct // only command+to needed
-			Command: "JOIN", To: channel,
+			Command: irc.CmdJoin, To: channel,
 		},
 	)
 }
@@ -177,7 +200,7 @@ func (client *Client) JoinChannel(channel string) error {
 func (client *Client) PartChannel(channel string) error {
 	return client.SendMessage(
 		&Message{ //nolint:exhaustruct // only command+to needed
-			Command: "PART", To: channel,
+			Command: irc.CmdPart, To: channel,
 		},
 	)
 }
@@ -259,6 +282,16 @@ func (client *Client) GetServerInfo() (
 func (client *Client) do(
 	method, path string,
 	body any,
+) ([]byte, error) {
+	return client.doWithHeaders(
+		method, path, body, nil,
+	)
+}
+
+func (client *Client) doWithHeaders(
+	method, path string,
+	body any,
+	extraHeaders map[string]string,
 ) ([]byte, error) {
 	var bodyReader io.Reader
 
@@ -291,6 +324,10 @@ func (client *Client) do(
 		)
 	}
 
+	for key, val := range extraHeaders {
+		request.Header.Set(key, val)
+	}
+
 	resp, err := client.HTTPClient.Do(request)
 	if err != nil {
 		return nil, fmt.Errorf("http: %w", err)

internal/cli/api/hashcash.go

@@ -0,0 +1,79 @@
+package neoircapi
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"math/big"
+	"time"
+)
+
+const (
+	// bitsPerByte is the number of bits in a byte.
+	bitsPerByte = 8
+	// fullByteMask is 0xFF, a mask for all bits in a byte.
+	fullByteMask = 0xFF
+	// counterSpace is the range for random counter seeds.
+	counterSpace = 1 << 48
+)
+
+// MintHashcash computes a hashcash stamp with the given
+// difficulty (leading zero bits) and resource string.
+func MintHashcash(bits int, resource string) string {
+	date := time.Now().UTC().Format("060102")
+	prefix := fmt.Sprintf(
+		"1:%d:%s:%s::", bits, date, resource,
+	)
+
+	for {
+		counter := randomCounter()
+		stamp := prefix + counter
+		hash := sha256.Sum256([]byte(stamp))
+
+		if hasLeadingZeroBits(hash[:], bits) {
+			return stamp
+		}
+	}
+}
+
+// hasLeadingZeroBits checks if hash has at least numBits
+// leading zero bits.
+func hasLeadingZeroBits(
+	hash []byte,
+	numBits int,
+) bool {
+	fullBytes := numBits / bitsPerByte
+	remainBits := numBits % bitsPerByte
+
+	for idx := range fullBytes {
+		if hash[idx] != 0 {
+			return false
+		}
+	}
+
+	if remainBits > 0 && fullBytes < len(hash) {
+		mask := byte(
+			fullByteMask << (bitsPerByte - remainBits),
+		)
+
+		if hash[fullBytes]&mask != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// randomCounter generates a random hex counter string.
+func randomCounter() string {
+	counterVal, err := rand.Int(
+		rand.Reader, big.NewInt(counterSpace),
+	)
+	if err != nil {
+		// Fallback to timestamp-based counter on error.
+		return fmt.Sprintf("%x", time.Now().UnixNano())
+	}
+
+	return hex.EncodeToString(counterVal.Bytes())
+}

internal/cli/api/types.go

@@ -66,6 +66,7 @@ type ServerInfo struct {
 	Name         string `json:"name"`
 	MOTD         string `json:"motd"`
 	Version      string `json:"version"`
+	HashcashBits int    `json:"hashcash_bits"` //nolint:tagliatelle
 }
 
 // MessagesResponse wraps polling results.

internal/cli/app.go

@@ -0,0 +1,912 @@
+// Package cli implements the neoirc-cli terminal client.
+package cli
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	api "git.eeqj.de/sneak/neoirc/internal/cli/api"
+	"git.eeqj.de/sneak/neoirc/internal/irc"
+)
+
+const (
+	splitParts  = 2
+	pollTimeout = 15
+	pollRetry   = 2 * time.Second
+	timeFormat  = "15:04"
+)
+
+// App holds the application state.
+type App struct {
+	ui     *UI
+	client *api.Client
+
+	mu        sync.Mutex
+	nick      string
+	target    string
+	connected bool
+	lastQID   int64
+	stopPoll  chan struct{}
+}
+
+// Run creates and runs the CLI application.
+func Run() {
+	app := &App{ //nolint:exhaustruct
+		ui:   NewUI(),
+		nick: "guest",
+	}
+
+	app.ui.OnInput(app.handleInput)
+	app.ui.SetStatus(app.nick, "", "disconnected")
+
+	app.ui.AddStatus(
+		"Welcome to neoirc-cli — an IRC-style client",
+	)
+	app.ui.AddStatus(
+		"Type [yellow]/connect <server-url>" +
+			"[white] to begin, " +
+			"or [yellow]/help[white] for commands",
+	)
+
+	err := app.ui.Run()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func (a *App) handleInput(text string) {
+	if strings.HasPrefix(text, "/") {
+		a.handleCommand(text)
+
+		return
+	}
+
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus(
+			"[red]Not connected. Use /connect <url>",
+		)
+
+		return
+	}
+
+	if target == "" {
+		a.ui.AddStatus(
+			"[red]No target. " +
+				"Use /join #channel or /query nick",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdPrivmsg,
+		To:      target,
+		Body:    []string{text},
+	})
+	if err != nil {
+		a.ui.AddStatus(
+			"[red]Send error: " + err.Error(),
+		)
+
+		return
+	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
+}
+
+func (a *App) handleCommand(text string) {
+	parts := strings.SplitN(text, " ", splitParts)
+	cmd := strings.ToLower(parts[0])
+
+	args := ""
+	if len(parts) > 1 {
+		args = parts[1]
+	}
+
+	a.dispatchCommand(cmd, args)
+}
+
+func (a *App) dispatchCommand(cmd, args string) {
+	switch cmd {
+	case "/connect":
+		a.cmdConnect(args)
+	case "/nick":
+		a.cmdNick(args)
+	case "/join":
+		a.cmdJoin(args)
+	case "/part":
+		a.cmdPart(args)
+	case "/msg":
+		a.cmdMsg(args)
+	case "/query":
+		a.cmdQuery(args)
+	case "/topic":
+		a.cmdTopic(args)
+	case "/window", "/w":
+		a.cmdWindow(args)
+	case "/quit":
+		a.cmdQuit()
+	case "/help":
+		a.cmdHelp()
+	default:
+		a.dispatchInfoCommand(cmd, args)
+	}
+}
+
+func (a *App) dispatchInfoCommand(cmd, args string) {
+	switch cmd {
+	case "/names":
+		a.cmdNames()
+	case "/list":
+		a.cmdList()
+	case "/motd":
+		a.cmdMotd()
+	case "/who":
+		a.cmdWho(args)
+	case "/whois":
+		a.cmdWhois(args)
+	default:
+		a.ui.AddStatus(
+			"[red]Unknown command: " + cmd,
+		)
+	}
+}
+
+func (a *App) cmdConnect(serverURL string) {
+	if serverURL == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /connect <server-url>",
+		)
+
+		return
+	}
+
+	serverURL = strings.TrimRight(serverURL, "/")
+
+	a.ui.AddStatus("Connecting to " + serverURL + "...")
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	client := api.NewClient(serverURL)
+
+	resp, err := client.CreateSession(nick)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Connection failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.client = client
+	a.nick = resp.Nick
+	a.connected = true
+	a.lastQID = 0
+	a.mu.Unlock()
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[green]Connected! Nick: %s, Session: %d",
+		resp.Nick, resp.ID,
+	))
+	a.ui.SetStatus(resp.Nick, "", "connected")
+
+	a.stopPoll = make(chan struct{})
+
+	go a.pollLoop()
+}
+
+func (a *App) cmdNick(nick string) {
+	if nick == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /nick <name>",
+		)
+
+		return
+	}
+
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.mu.Lock()
+		a.nick = nick
+		a.mu.Unlock()
+
+		a.ui.AddStatus(
+			"Nick set to " + nick +
+				" (will be used on connect)",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdNick,
+		Body:    []string{nick},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Nick change failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.nick = nick
+	target := a.target
+	a.mu.Unlock()
+
+	a.ui.SetStatus(nick, target, "connected")
+	a.ui.AddStatus("Nick changed to " + nick)
+}
+
+func (a *App) cmdJoin(channel string) {
+	if channel == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /join #channel",
+		)
+
+		return
+	}
+
+	if !strings.HasPrefix(channel, "#") {
+		channel = "#" + channel
+	}
+
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.JoinChannel(channel)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Join failed: %v", err,
+		))
+
+		return
+	}
+
+	a.mu.Lock()
+	a.target = channel
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchToBuffer(channel)
+	a.ui.AddLine(channel,
+		"[yellow]*** Joined "+channel,
+	)
+	a.ui.SetStatus(nick, channel, "connected")
+}
+
+func (a *App) cmdPart(channel string) {
+	a.mu.Lock()
+	if channel == "" {
+		channel = a.target
+	}
+
+	connected := a.connected
+	a.mu.Unlock()
+
+	if channel == "" ||
+		!strings.HasPrefix(channel, "#") {
+		a.ui.AddStatus("[red]No channel to part")
+
+		return
+	}
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.PartChannel(channel)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Part failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddLine(channel,
+		"[yellow]*** Left "+channel,
+	)
+
+	a.mu.Lock()
+	if a.target == channel {
+		a.target = ""
+	}
+
+	nick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchBuffer(0)
+	a.ui.SetStatus(nick, "", "connected")
+}
+
+func (a *App) cmdMsg(args string) {
+	parts := strings.SplitN(args, " ", splitParts)
+	if len(parts) < splitParts {
+		a.ui.AddStatus(
+			"[red]Usage: /msg <nick> <text>",
+		)
+
+		return
+	}
+
+	target, text := parts[0], parts[1]
+
+	a.mu.Lock()
+	connected := a.connected
+	nick := a.nick
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdPrivmsg,
+		To:      target,
+		Body:    []string{text},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Send failed: %v", err,
+		))
+
+		return
+	}
+
+	timestamp := time.Now().Format(timeFormat)
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, nick, text,
+	))
+}
+
+func (a *App) cmdQuery(nick string) {
+	if nick == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /query <nick>",
+		)
+
+		return
+	}
+
+	a.mu.Lock()
+	a.target = nick
+	myNick := a.nick
+	a.mu.Unlock()
+
+	a.ui.SwitchToBuffer(nick)
+	a.ui.SetStatus(myNick, nick, "connected")
+}
+
+func (a *App) cmdTopic(args string) {
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if !strings.HasPrefix(target, "#") {
+		a.ui.AddStatus("[red]Not in a channel")
+
+		return
+	}
+
+	if args == "" {
+		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdTopic,
+			To:      target,
+		})
+		if err != nil {
+			a.ui.AddStatus(fmt.Sprintf(
+				"[red]Topic query failed: %v", err,
+			))
+		}
+
+		return
+	}
+
+	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+		Command: irc.CmdTopic,
+		To:      target,
+		Body:    []string{args},
+	})
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Topic set failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdNames() {
+	a.mu.Lock()
+	target := a.target
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if !strings.HasPrefix(target, "#") {
+		a.ui.AddStatus("[red]Not in a channel")
+
+		return
+	}
+
+	members, err := a.client.GetMembers(target)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]Names failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[cyan]*** Members of %s: %s",
+		target, strings.Join(members, " "),
+	))
+}
+
+func (a *App) cmdList() {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	channels, err := a.client.ListChannels()
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]List failed: %v", err,
+		))
+
+		return
+	}
+
+	a.ui.AddStatus("[cyan]*** Channel list:")
+
+	for _, ch := range channels {
+		a.ui.AddStatus(fmt.Sprintf(
+			"  %s (%d members) %s",
+			ch.Name, ch.Members, ch.Topic,
+		))
+	}
+
+	a.ui.AddStatus("[cyan]*** End of channel list")
+}
+
+func (a *App) cmdMotd() {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]MOTD failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWho(args string) {
+	a.mu.Lock()
+	connected := a.connected
+	target := a.target
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	channel := args
+	if channel == "" {
+		channel = target
+	}
+
+	if channel == "" ||
+		!strings.HasPrefix(channel, "#") {
+		a.ui.AddStatus(
+			"[red]Usage: /who #channel",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdWho, To: channel,
+		},
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]WHO failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWhois(args string) {
+	a.mu.Lock()
+	connected := a.connected
+	a.mu.Unlock()
+
+	if !connected {
+		a.ui.AddStatus("[red]Not connected")
+
+		return
+	}
+
+	if args == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /whois <nick>",
+		)
+
+		return
+	}
+
+	err := a.client.SendMessage(
+		&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdWhois, To: args,
+		},
+	)
+	if err != nil {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[red]WHOIS failed: %v", err,
+		))
+	}
+}
+
+func (a *App) cmdWindow(args string) {
+	if args == "" {
+		a.ui.AddStatus(
+			"[red]Usage: /window <number>",
+		)
+
+		return
+	}
+
+	var bufIndex int
+
+	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
+
+	a.ui.SwitchBuffer(bufIndex)
+
+	a.mu.Lock()
+	nick := a.nick
+	a.mu.Unlock()
+
+	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
+		buf := a.ui.buffers[bufIndex]
+		if buf.Name != "(status)" {
+			a.mu.Lock()
+			a.target = buf.Name
+			a.mu.Unlock()
+
+			a.ui.SetStatus(
+				nick, buf.Name, "connected",
+			)
+		} else {
+			a.ui.SetStatus(nick, "", "connected")
+		}
+	}
+}
+
+func (a *App) cmdQuit() {
+	a.mu.Lock()
+
+	if a.connected && a.client != nil {
+		_ = a.client.SendMessage(
+			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
+		)
+	}
+
+	if a.stopPoll != nil {
+		close(a.stopPoll)
+	}
+
+	a.mu.Unlock()
+	a.ui.Stop()
+}
+
+func (a *App) cmdHelp() {
+	help := []string{
+		"[cyan]*** neoirc-cli commands:",
+		"  /connect <url>  — Connect to server",
+		"  /nick <name>    — Change nickname",
+		"  /join #channel  — Join channel",
+		"  /part [#chan]    — Leave channel",
+		"  /msg <nick> <text> — Send DM",
+		"  /query <nick>   — Open DM window",
+		"  /topic [text]   — View/set topic",
+		"  /names          — List channel members",
+		"  /list           — List channels",
+		"  /who [#channel] — List users in channel",
+		"  /whois <nick>   — Show user info",
+		"  /motd           — Show message of the day",
+		"  /window <n>     — Switch buffer",
+		"  /quit           — Disconnect and exit",
+		"  /help           — This help",
+		"  Plain text sends to current target.",
+	}
+
+	for _, line := range help {
+		a.ui.AddStatus(line)
+	}
+}
+
+// pollLoop long-polls for messages in the background.
+func (a *App) pollLoop() {
+	for {
+		select {
+		case <-a.stopPoll:
+			return
+		default:
+		}
+
+		a.mu.Lock()
+		client := a.client
+		lastQID := a.lastQID
+		a.mu.Unlock()
+
+		if client == nil {
+			return
+		}
+
+		result, err := client.PollMessages(
+			lastQID, pollTimeout,
+		)
+		if err != nil {
+			time.Sleep(pollRetry)
+
+			continue
+		}
+
+		if result.LastID > 0 {
+			a.mu.Lock()
+			a.lastQID = result.LastID
+			a.mu.Unlock()
+		}
+
+		for i := range result.Messages {
+			a.handleServerMessage(&result.Messages[i])
+		}
+	}
+}
+
+func (a *App) handleServerMessage(msg *api.Message) {
+	timestamp := a.formatTS(msg)
+
+	a.mu.Lock()
+	myNick := a.nick
+	a.mu.Unlock()
+
+	switch msg.Command {
+	case irc.CmdPrivmsg:
+		a.handlePrivmsgEvent(msg, timestamp, myNick)
+	case irc.CmdJoin:
+		a.handleJoinEvent(msg, timestamp)
+	case irc.CmdPart:
+		a.handlePartEvent(msg, timestamp)
+	case irc.CmdQuit:
+		a.handleQuitEvent(msg, timestamp)
+	case irc.CmdNick:
+		a.handleNickEvent(msg, timestamp, myNick)
+	case irc.CmdNotice:
+		a.handleNoticeEvent(msg, timestamp)
+	case irc.CmdTopic:
+		a.handleTopicEvent(msg, timestamp)
+	default:
+		a.handleDefaultEvent(msg, timestamp)
+	}
+}
+
+func (a *App) formatTS(msg *api.Message) string {
+	if msg.TS != "" {
+		return msg.ParseTS().UTC().Format(timeFormat)
+	}
+
+	return time.Now().Format(timeFormat)
+}
+
+func (a *App) handlePrivmsgEvent(
+	msg *api.Message, timestamp, myNick string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	if msg.From == myNick {
+		return
+	}
+
+	target := msg.To
+	if !strings.HasPrefix(target, "#") {
+		target = msg.From
+	}
+
+	a.ui.AddLine(target, fmt.Sprintf(
+		"[gray]%s [green]<%s>[white] %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleJoinEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	a.ui.AddLine(msg.To, fmt.Sprintf(
+		"[gray]%s [yellow]*** %s has joined %s",
+		timestamp, msg.From, msg.To,
+	))
+}
+
+func (a *App) handlePartEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	lines := msg.BodyLines()
+	reason := strings.Join(lines, " ")
+
+	if reason != "" {
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s (%s)",
+			timestamp, msg.From, msg.To, reason,
+		))
+	} else {
+		a.ui.AddLine(msg.To, fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has left %s",
+			timestamp, msg.From, msg.To,
+		))
+	}
+}
+
+func (a *App) handleQuitEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	reason := strings.Join(lines, " ")
+
+	if reason != "" {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has quit (%s)",
+			timestamp, msg.From, reason,
+		))
+	} else {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [yellow]*** %s has quit",
+			timestamp, msg.From,
+		))
+	}
+}
+
+func (a *App) handleNickEvent(
+	msg *api.Message, timestamp, myNick string,
+) {
+	lines := msg.BodyLines()
+
+	newNick := ""
+	if len(lines) > 0 {
+		newNick = lines[0]
+	}
+
+	if msg.From == myNick && newNick != "" {
+		a.mu.Lock()
+		a.nick = newNick
+
+		target := a.target
+		a.mu.Unlock()
+
+		a.ui.SetStatus(newNick, target, "connected")
+	}
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[gray]%s [yellow]*** %s is now known as %s",
+		timestamp, msg.From, newNick,
+	))
+}
+
+func (a *App) handleNoticeEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	a.ui.AddStatus(fmt.Sprintf(
+		"[gray]%s [magenta]--%s-- %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleTopicEvent(
+	msg *api.Message, timestamp string,
+) {
+	if msg.To == "" {
+		return
+	}
+
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	a.ui.AddLine(msg.To, fmt.Sprintf(
+		"[gray]%s [cyan]*** %s set topic: %s",
+		timestamp, msg.From, text,
+	))
+}
+
+func (a *App) handleDefaultEvent(
+	msg *api.Message, timestamp string,
+) {
+	lines := msg.BodyLines()
+	text := strings.Join(lines, " ")
+
+	if text != "" {
+		a.ui.AddStatus(fmt.Sprintf(
+			"[gray]%s [white][%s] %s",
+			timestamp, msg.Command, text,
+		))
+	}
+}

internal/cli/ui.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"fmt"

internal/config/config.go

@@ -13,6 +13,14 @@ import (
 	_ "github.com/joho/godotenv/autoload" // loads .env file
 )
 
+const defaultMOTD = ` _ __   ___  ___  (_)_ __ ___
+| '_ \ / _ \/ _ \ | | '__/ __|
+| | | |  __/ (_) || | | | (__
+|_| |_|\___|\___/ |_|_|  \___|
+
+Welcome to NeoIRC — IRC semantics over HTTP.
+Type /help for available commands.`
+
 // Params defines the dependencies for creating a Config.
 type Params struct {
 	fx.In
@@ -36,6 +44,7 @@ type Config struct {
 	ServerName         string
 	FederationKey      string
 	SessionIdleTimeout string
+	HashcashBits       int
 	params             *Params
 	log                *slog.Logger
 }
@@ -62,10 +71,11 @@ func New(
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("MAX_HISTORY", "10000")
 	viper.SetDefault("MAX_MESSAGE_SIZE", "4096")
-	viper.SetDefault("MOTD", "")
+	viper.SetDefault("MOTD", defaultMOTD)
 	viper.SetDefault("SERVER_NAME", "")
 	viper.SetDefault("FEDERATION_KEY", "")
 	viper.SetDefault("SESSION_IDLE_TIMEOUT", "24h")
+	viper.SetDefault("NEOIRC_HASHCASH_BITS", "20")
 
 	err := viper.ReadInConfig()
 	if err != nil {
@@ -90,6 +100,7 @@ func New(
 		ServerName:         viper.GetString("SERVER_NAME"),
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
+		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
 		log:                log,
 		params:             &params,
 	}

internal/db/queries.go

@@ -7,8 +7,10 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"strconv"
 	"time"
 
+	"git.eeqj.de/sneak/neoirc/internal/irc"
 	"github.com/google/uuid"
 )
 
@@ -33,14 +35,25 @@ func generateToken() (string, error) {
 type IRCMessage struct {
 	ID      string          `json:"id"`
 	Command string          `json:"command"`
+	Code    int             `json:"code,omitempty"`
 	From    string          `json:"from,omitempty"`
 	To      string          `json:"to,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
 	Body    json.RawMessage `json:"body,omitempty"`
 	TS      string          `json:"ts"`
 	Meta    json.RawMessage `json:"meta,omitempty"`
 	DBID    int64           `json:"-"`
 }
 
+// isNumericCode returns true if s is exactly a 3-digit
+// IRC numeric reply code.
+func isNumericCode(s string) bool {
+	return len(s) == 3 &&
+		s[0] >= '0' && s[0] <= '9' &&
+		s[1] >= '0' && s[1] <= '9' &&
+		s[2] >= '0' && s[2] <= '9'
+}
+
 // ChannelInfo is a lightweight channel representation.
 type ChannelInfo struct {
 	ID    int64  `json:"id"`
@@ -491,12 +504,17 @@ func (database *Database) GetSessionChannelIDs(
 func (database *Database) InsertMessage(
 	ctx context.Context,
 	command, from, target string,
+	params json.RawMessage,
 	body json.RawMessage,
 	meta json.RawMessage,
 ) (int64, string, error) {
 	msgUUID := uuid.New().String()
 	now := time.Now().UTC()
 
+	if params == nil {
+		params = json.RawMessage("[]")
+	}
+
 	if body == nil {
 		body = json.RawMessage("[]")
 	}
@@ -508,10 +526,10 @@ func (database *Database) InsertMessage(
 	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO messages
 		 (uuid, command, msg_from, msg_to,
-		  body, meta, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		  params, body, meta, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
 		msgUUID, command, from, target,
-		string(body), string(meta), now)
+		string(params), string(body), string(meta), now)
 	if err != nil {
 		return 0, "", fmt.Errorf(
 			"insert message: %w", err,
@@ -578,7 +596,7 @@ func (database *Database) PollMessages(
 	rows, err := database.conn.QueryContext(ctx,
 		`SELECT cq.id, m.uuid, m.command,
 		   m.msg_from, m.msg_to,
-		   m.body, m.meta, m.created_at
+		   m.params, m.body, m.meta, m.created_at
 		 FROM client_queues cq
 		 INNER JOIN messages m
 		   ON m.id = cq.message_id
@@ -642,7 +660,7 @@ func (database *Database) queryHistory(
 	if beforeID > 0 {
 		rows, err := database.conn.QueryContext(ctx,
 			`SELECT id, uuid, command, msg_from,
-			   msg_to, body, meta, created_at
+			   msg_to, params, body, meta, created_at
 			 FROM messages
 			 WHERE msg_to = ? AND id < ?
 			   AND command = 'PRIVMSG'
@@ -659,7 +677,7 @@ func (database *Database) queryHistory(
 
 	rows, err := database.conn.QueryContext(ctx,
 		`SELECT id, uuid, command, msg_from,
-		   msg_to, body, meta, created_at
+		   msg_to, params, body, meta, created_at
 		 FROM messages
 		 WHERE msg_to = ?
 		   AND command = 'PRIVMSG'
@@ -686,14 +704,14 @@ func scanMessages(
 		var (
 			msg                IRCMessage
 			qID                int64
-			body, meta string
+			params, body, meta string
 			createdAt          time.Time
 		)
 
 		err := rows.Scan(
 			&qID, &msg.ID, &msg.Command,
 			&msg.From, &msg.To,
-			&body, &meta, &createdAt,
+			&params, &body, &meta, &createdAt,
 		)
 		if err != nil {
 			return nil, fallbackQID, fmt.Errorf(
@@ -701,12 +719,25 @@ func scanMessages(
 			)
 		}
 
+		if params != "" && params != "[]" {
+			msg.Params = json.RawMessage(params)
+		}
+
 		msg.Body = json.RawMessage(body)
 		msg.Meta = json.RawMessage(meta)
 		msg.TS = createdAt.Format(time.RFC3339Nano)
 		msg.DBID = qID
 		lastQID = qID
 
+		if isNumericCode(msg.Command) {
+			code, _ := strconv.Atoi(msg.Command)
+			msg.Code = code
+
+			if name := irc.Name(code); name != "" {
+				msg.Command = name
+			}
+		}
+
 		msgs = append(msgs, msg)
 	}
 
@@ -943,3 +974,125 @@ func (database *Database) GetSessionChannels(
 
 	return scanChannels(rows)
 }
+
+// GetChannelCount returns the total number of channels.
+func (database *Database) GetChannelCount(
+	ctx context.Context,
+) (int64, error) {
+	var count int64
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT COUNT(*) FROM channels",
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf(
+			"get channel count: %w", err,
+		)
+	}
+
+	return count, nil
+}
+
+// ChannelInfoFull contains extended channel information.
+type ChannelInfoFull struct {
+	ID          int64  `json:"id"`
+	Name        string `json:"name"`
+	Topic       string `json:"topic"`
+	MemberCount int64  `json:"memberCount"`
+}
+
+// ListAllChannelsWithCounts returns every channel
+// with its member count.
+func (database *Database) ListAllChannelsWithCounts(
+	ctx context.Context,
+) ([]ChannelInfoFull, error) {
+	rows, err := database.conn.QueryContext(ctx,
+		`SELECT c.id, c.name, c.topic,
+		   COUNT(cm.session_id) AS member_count
+		 FROM channels c
+		 LEFT JOIN channel_members cm
+		   ON cm.channel_id = c.id
+		 GROUP BY c.id
+		 ORDER BY c.name`)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"list channels with counts: %w", err,
+		)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var out []ChannelInfoFull
+
+	for rows.Next() {
+		var chanInfo ChannelInfoFull
+
+		err = rows.Scan(
+			&chanInfo.ID, &chanInfo.Name,
+			&chanInfo.Topic, &chanInfo.MemberCount,
+		)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"scan channel full: %w", err,
+			)
+		}
+
+		out = append(out, chanInfo)
+	}
+
+	err = rows.Err()
+	if err != nil {
+		return nil, fmt.Errorf("rows error: %w", err)
+	}
+
+	if out == nil {
+		out = []ChannelInfoFull{}
+	}
+
+	return out, nil
+}
+
+// GetChannelCreatedAt returns the creation time of a
+// channel.
+func (database *Database) GetChannelCreatedAt(
+	ctx context.Context,
+	channelID int64,
+) (time.Time, error) {
+	var createdAt time.Time
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT created_at FROM channels WHERE id = ?",
+		channelID,
+	).Scan(&createdAt)
+	if err != nil {
+		return time.Time{}, fmt.Errorf(
+			"get channel created_at: %w", err,
+		)
+	}
+
+	return createdAt, nil
+}
+
+// GetSessionCreatedAt returns the creation time of a
+// session.
+func (database *Database) GetSessionCreatedAt(
+	ctx context.Context,
+	sessionID int64,
+) (time.Time, error) {
+	var createdAt time.Time
+
+	err := database.conn.QueryRowContext(
+		ctx,
+		"SELECT created_at FROM sessions WHERE id = ?",
+		sessionID,
+	).Scan(&createdAt)
+	if err != nil {
+		return time.Time{}, fmt.Errorf(
+			"get session created_at: %w", err,
+		)
+	}
+
+	return createdAt, nil
+}

internal/db/queries_test.go

@@ -383,7 +383,7 @@ func TestInsertMessage(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, msgUUID, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -417,7 +417,7 @@ func TestPollMessages(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -475,7 +475,7 @@ func TestGetHistory(t *testing.T) {
 	for range msgCount {
 		_, _, err := database.InsertMessage(
 			ctx, "PRIVMSG", "user", "#hist",
-			json.RawMessage(`["msg"]`), nil,
+			nil, json.RawMessage(`["msg"]`), nil,
 		)
 		if err != nil {
 			t.Fatal(err)
@@ -627,7 +627,7 @@ func TestEnqueueToClient(t *testing.T) {
 	body := json.RawMessage(`["test"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#ch", body, nil,
+		ctx, "PRIVMSG", "sender", "#ch", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)

internal/db/schema/001_initial.sql

@@ -50,6 +50,7 @@ CREATE TABLE IF NOT EXISTS messages (
     command TEXT NOT NULL DEFAULT 'PRIVMSG',
     msg_from TEXT NOT NULL DEFAULT '',
     msg_to TEXT NOT NULL DEFAULT '',
+    params TEXT NOT NULL DEFAULT '[]',
     body TEXT NOT NULL DEFAULT '[]',
     meta TEXT NOT NULL DEFAULT '{}',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP

internal/globals/globals.go

@@ -2,6 +2,8 @@
 package globals
 
 import (
+	"time"
+
 	"go.uber.org/fx"
 )
 
@@ -17,14 +19,16 @@ var (
 type Globals struct {
 	Appname   string
 	Version   string
+	StartTime time.Time
 }
 
 // New creates a new Globals instance from the global state.
 func New(_ fx.Lifecycle) (*Globals, error) {
-	n := &Globals{
+	result := &Globals{
 		Appname:   Appname,
 		Version:   Version,
+		StartTime: time.Now(),
 	}
 
-	return n, nil
+	return result, nil
 }

internal/handlers/api_test.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -84,6 +85,7 @@ func newTestServer(
 
 				cfg.DBURL = dbURL
 				cfg.Port = 0
+				cfg.HashcashBits = 0
 
 				return cfg, nil
 			},
@@ -117,6 +119,7 @@ func newTestGlobals() *globals.Globals {
 	return &globals.Globals{
 		Appname:   "neoirc-test",
 		Version:   "test",
+		StartTime: time.Now(),
 	}
 }
 
@@ -462,6 +465,22 @@ func findMessage(
 	return false
 }
 
+func findNumeric(
+	msgs []map[string]any,
+	numeric string,
+) bool {
+	want, _ := strconv.Atoi(numeric)
+
+	for _, msg := range msgs {
+		code, ok := msg["code"].(float64)
+		if ok && int(code) == want {
+			return true
+		}
+	}
+
+	return false
+}
+
 // --- Tests ---
 
 func TestCreateSessionValid(t *testing.T) {
@@ -473,6 +492,47 @@ func TestCreateSessionValid(t *testing.T) {
 	}
 }
 
+func TestWelcomeNumeric(t *testing.T) {
+	tserver := newTestServer(t)
+	token := tserver.createSession("welcomer")
+
+	msgs, _ := tserver.pollMessages(token, 0)
+
+	if !findNumeric(msgs, "001") {
+		t.Fatalf(
+			"expected RPL_WELCOME (001), got %v",
+			msgs,
+		)
+	}
+}
+
+func TestJoinNumerics(t *testing.T) {
+	tserver := newTestServer(t)
+	token := tserver.createSession("jnumtest")
+
+	_, lastID := tserver.pollMessages(token, 0)
+
+	tserver.sendCommand(token, map[string]any{
+		commandKey: joinCmd, toKey: "#numtest",
+	})
+
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "353") {
+		t.Fatalf(
+			"expected RPL_NAMREPLY (353), got %v",
+			msgs,
+		)
+	}
+
+	if !findNumeric(msgs, "366") {
+		t.Fatalf(
+			"expected RPL_ENDOFNAMES (366), got %v",
+			msgs,
+		)
+	}
+}
+
 func TestCreateSessionDuplicate(t *testing.T) {
 	tserver := newTestServer(t)
 	tserver.createSession("alice")
@@ -668,17 +728,22 @@ func TestJoinMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("joiner3")
 
-	status, result := tserver.sendCommand(
+	// Drain initial MOTD/welcome numerics.
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: joinCmd},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "461" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -735,17 +800,21 @@ func TestMessageMissingBody(t *testing.T) {
 		commandKey: joinCmd, toKey: "#test",
 	})
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd, toKey: "#test",
 	})
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "412" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 412, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -754,7 +823,9 @@ func TestMessageMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("noto")
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd,
 		bodyKey:    []string{"hello"},
 	})
@@ -762,10 +833,12 @@ func TestMessageMissingTo(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "411" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 411, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -780,8 +853,10 @@ func TestNonMemberCannotSend(t *testing.T) {
 		commandKey: joinCmd, toKey: "#private",
 	})
 
+	_, lastID := tserver.pollMessages(aliceToken, 0)
+
 	// Alice tries to send without joining.
-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		aliceToken,
 		map[string]any{
 			commandKey: privmsgCmd,
@@ -793,10 +868,12 @@ func TestNonMemberCannotSend(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "442" {
+	msgs, _ := tserver.pollMessages(aliceToken, lastID)
+
+	if !findNumeric(msgs, "442") {
 		t.Fatalf(
-			"expected IRC 442, got %v",
-			result[commandKey],
+			"expected ERR_NOTONCHANNEL (442), got %v",
+			msgs,
 		)
 	}
 }
@@ -846,7 +923,9 @@ func TestDMToNonexistentUser(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("dmsender")
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd,
 		toKey:      "nobody",
 		bodyKey:    []string{"hello?"},
@@ -855,10 +934,12 @@ func TestDMToNonexistentUser(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "401" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "401") {
 		t.Fatalf(
-			"expected IRC 401, got %v",
-			result[commandKey],
+			"expected ERR_NOSUCHNICK (401), got %v",
+			msgs,
 		)
 	}
 }
@@ -906,7 +987,9 @@ func TestNickCollision(t *testing.T) {
 
 	tserver.createSession("taken_nick")
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "NICK",
 		bodyKey:    []string{"taken_nick"},
 	})
@@ -914,10 +997,12 @@ func TestNickCollision(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "433" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "433") {
 		t.Fatalf(
-			"expected IRC 433, got %v",
-			result[commandKey],
+			"expected ERR_NICKNAMEINUSE (433), got %v",
+			msgs,
 		)
 	}
 }
@@ -926,7 +1011,9 @@ func TestNickInvalid(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("nickval")
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "NICK",
 		bodyKey:    []string{"bad nick!"},
 	})
@@ -934,10 +1021,12 @@ func TestNickInvalid(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "432" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "432") {
 		t.Fatalf(
-			"expected IRC 432, got %v",
-			result[commandKey],
+			"expected ERR_ERRONEUSNICKNAME (432), got %v",
+			msgs,
 		)
 	}
 }
@@ -946,17 +1035,21 @@ func TestNickEmptyBody(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("nicknobody")
 
-	status, result := tserver.sendCommand(
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: "NICK"},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "431" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 431, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -994,7 +1087,9 @@ func TestTopicMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("topicnoto")
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "TOPIC",
 		bodyKey:    []string{"topic"},
 	})
@@ -1002,10 +1097,12 @@ func TestTopicMissingTo(t *testing.T) {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "461" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -1018,17 +1115,21 @@ func TestTopicMissingBody(t *testing.T) {
 		commandKey: joinCmd, toKey: "#topictest",
 	})
 
-	status, result := tserver.sendCommand(token, map[string]any{
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "TOPIC", toKey: "#topictest",
 	})
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "461" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "461") {
 		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
+			"expected ERR_NEEDMOREPARAMS (461), got %v",
+			msgs,
 		)
 	}
 }
@@ -1097,17 +1198,21 @@ func TestUnknownCommand(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("cmdtest")
 
-	status, result := tserver.sendCommand(
+	_, lastID := tserver.pollMessages(token, 0)
+
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: "BOGUS"},
 	)
 	if status != http.StatusOK {
 		t.Fatalf("expected 200, got %d", status)
 	}
 
-	if result[commandKey] != "421" {
+	msgs, _ := tserver.pollMessages(token, lastID)
+
+	if !findNumeric(msgs, "421") {
 		t.Fatalf(
-			"expected IRC 421, got %v",
-			result[commandKey],
+			"expected ERR_UNKNOWNCOMMAND (421), got %v",
+			msgs,
 		)
 	}
 }
@@ -1116,18 +1221,11 @@ func TestEmptyCommand(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("emptycmd")
 
-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: ""},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "421" {
-		t.Fatalf(
-			"expected IRC 421, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }
 
@@ -1362,12 +1460,18 @@ func TestLongPollTimeout(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("lp_timeout")
 
+	// Drain initial welcome/MOTD numerics.
+	_, lastID := tserver.pollMessages(token, 0)
+
 	start := time.Now()
 
 	resp, err := doRequestAuth(
 		t,
 		http.MethodGet,
-		tserver.url(apiMessages+"?timeout=1"),
+		tserver.url(fmt.Sprintf(
+			"%s?timeout=1&after=%d",
+			apiMessages, lastID,
+		)),
 		token,
 		nil,
 	)

internal/handlers/auth.go

@@ -80,7 +80,7 @@ func (hdlr *Handlers) handleRegister(
 		return
 	}
 
-	hdlr.deliverMOTD(request, clientID, sessionID)
+	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
 
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
@@ -162,7 +162,7 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 
-	sessionID, _, token, err :=
+	sessionID, clientID, token, err :=
 		hdlr.params.Database.LoginUser(
 			request.Context(),
 			payload.Nick,
@@ -178,6 +178,16 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 
+	hdlr.deliverMOTD(
+		request, clientID, sessionID, payload.Nick,
+	)
+
+	// Initialize channel state so the new client knows
+	// which channels the session already belongs to.
+	hdlr.initChannelState(
+		request, clientID, sessionID, payload.Nick,
+	)
+
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
 		"nick":  payload.Nick,

internal/handlers/handlers.go

@@ -13,6 +13,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/config"
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
+	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"go.uber.org/fx"
@@ -39,6 +40,7 @@ type Handlers struct {
 	log           *slog.Logger
 	hc            *healthcheck.Healthcheck
 	broker        *broker.Broker
+	hashcashVal   *hashcash.Validator
 	cancelCleanup context.CancelFunc
 }
 
@@ -47,11 +49,17 @@ func New(
 	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Handlers, error) {
+	resource := params.Config.ServerName
+	if resource == "" {
+		resource = "neoirc"
+	}
+
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
 		params:      &params,
 		log:         params.Logger.Get(),
 		hc:          params.Healthcheck,
 		broker:      broker.New(),
+		hashcashVal: hashcash.NewValidator(resource),
 	}
 
 	lifecycle.Append(fx.Hook{

internal/hashcash/hashcash.go

@@ -0,0 +1,277 @@
+// Package hashcash implements SHA-256-based hashcash
+// proof-of-work validation for abuse prevention.
+//
+// Stamp format: 1:bits:YYMMDD:resource::counter.
+//
+// The SHA-256 hash of the entire stamp string must have
+// at least `bits` leading zero bits.
+package hashcash
+
+import (
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	// stampVersion is the only supported hashcash version.
+	stampVersion = "1"
+	// stampFields is the number of fields in a stamp.
+	stampFields = 6
+	// maxStampAge is how old a stamp can be before
+	// rejection.
+	maxStampAge = 48 * time.Hour
+	// maxFutureSkew allows stamps slightly in the future.
+	maxFutureSkew = 1 * time.Hour
+	// pruneInterval controls how often expired stamps are
+	// removed from the spent set.
+	pruneInterval = 10 * time.Minute
+	// dateFormatShort is the YYMMDD date layout.
+	dateFormatShort = "060102"
+	// dateFormatLong is the YYMMDDHHMMSS date layout.
+	dateFormatLong = "060102150405"
+	// dateShortLen is the length of YYMMDD.
+	dateShortLen = 6
+	// dateLongLen is the length of YYMMDDHHMMSS.
+	dateLongLen = 12
+	// bitsPerByte is the number of bits in a byte.
+	bitsPerByte = 8
+	// fullByteMask is 0xFF, a mask for all bits in a byte.
+	fullByteMask = 0xFF
+)
+
+var (
+	errInvalidFields    = errors.New("invalid stamp field count")
+	errBadVersion       = errors.New("unsupported stamp version")
+	errInsufficientBits = errors.New("insufficient difficulty")
+	errWrongResource    = errors.New("wrong resource")
+	errStampExpired     = errors.New("stamp expired")
+	errStampFuture      = errors.New("stamp date in future")
+	errProofFailed      = errors.New("proof-of-work failed")
+	errStampReused      = errors.New("stamp already used")
+	errBadDateFormat    = errors.New("unrecognized date format")
+)
+
+// Validator checks hashcash stamps for validity and
+// prevents replay attacks via an in-memory spent set.
+type Validator struct {
+	resource string
+	mu       sync.Mutex
+	spent    map[string]time.Time
+}
+
+// NewValidator creates a Validator for the given resource.
+func NewValidator(resource string) *Validator {
+	validator := &Validator{
+		resource: resource,
+		mu:       sync.Mutex{},
+		spent:    make(map[string]time.Time),
+	}
+
+	go validator.pruneLoop()
+
+	return validator
+}
+
+// Validate checks a hashcash stamp. It returns nil if the
+// stamp is valid and has not been seen before.
+func (v *Validator) Validate(
+	stamp string,
+	requiredBits int,
+) error {
+	if requiredBits <= 0 {
+		return nil
+	}
+
+	parts := strings.Split(stamp, ":")
+	if len(parts) != stampFields {
+		return fmt.Errorf(
+			"%w: expected %d, got %d",
+			errInvalidFields, stampFields, len(parts),
+		)
+	}
+
+	version := parts[0]
+	bitsStr := parts[1]
+	dateStr := parts[2]
+	resource := parts[3]
+
+	if err := v.validateHeader(
+		version, bitsStr, resource, requiredBits,
+	); err != nil {
+		return err
+	}
+
+	stampTime, err := parseStampDate(dateStr)
+	if err != nil {
+		return err
+	}
+
+	if err := validateTime(stampTime); err != nil {
+		return err
+	}
+
+	if err := validateProof(
+		stamp, requiredBits,
+	); err != nil {
+		return err
+	}
+
+	return v.checkAndRecordStamp(stamp, stampTime)
+}
+
+func (v *Validator) validateHeader(
+	version, bitsStr, resource string,
+	requiredBits int,
+) error {
+	if version != stampVersion {
+		return fmt.Errorf(
+			"%w: %s", errBadVersion, version,
+		)
+	}
+
+	claimedBits, err := strconv.Atoi(bitsStr)
+	if err != nil || claimedBits < requiredBits {
+		return fmt.Errorf(
+			"%w: need %d bits",
+			errInsufficientBits, requiredBits,
+		)
+	}
+
+	if resource != v.resource {
+		return fmt.Errorf(
+			"%w: got %q, want %q",
+			errWrongResource, resource, v.resource,
+		)
+	}
+
+	return nil
+}
+
+func validateTime(stampTime time.Time) error {
+	now := time.Now()
+
+	if now.Sub(stampTime) > maxStampAge {
+		return errStampExpired
+	}
+
+	if stampTime.Sub(now) > maxFutureSkew {
+		return errStampFuture
+	}
+
+	return nil
+}
+
+func validateProof(stamp string, requiredBits int) error {
+	hash := sha256.Sum256([]byte(stamp))
+	if !hasLeadingZeroBits(hash[:], requiredBits) {
+		return fmt.Errorf(
+			"%w: need %d leading zero bits",
+			errProofFailed, requiredBits,
+		)
+	}
+
+	return nil
+}
+
+func (v *Validator) checkAndRecordStamp(
+	stamp string,
+	stampTime time.Time,
+) error {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	if _, ok := v.spent[stamp]; ok {
+		return errStampReused
+	}
+
+	v.spent[stamp] = stampTime
+
+	return nil
+}
+
+// hasLeadingZeroBits checks if the hash has at least n
+// leading zero bits.
+func hasLeadingZeroBits(hash []byte, numBits int) bool {
+	fullBytes := numBits / bitsPerByte
+	remainBits := numBits % bitsPerByte
+
+	for idx := range fullBytes {
+		if hash[idx] != 0 {
+			return false
+		}
+	}
+
+	if remainBits > 0 && fullBytes < len(hash) {
+		mask := byte(
+			fullByteMask << (bitsPerByte - remainBits),
+		)
+
+		if hash[fullBytes]&mask != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// parseStampDate parses a hashcash date stamp.
+// Supports YYMMDD and YYMMDDHHMMSS formats.
+func parseStampDate(dateStr string) (time.Time, error) {
+	switch len(dateStr) {
+	case dateShortLen:
+		parsed, err := time.Parse(
+			dateFormatShort, dateStr,
+		)
+		if err != nil {
+			return time.Time{}, fmt.Errorf(
+				"parse date: %w", err,
+			)
+		}
+
+		return parsed, nil
+	case dateLongLen:
+		parsed, err := time.Parse(
+			dateFormatLong, dateStr,
+		)
+		if err != nil {
+			return time.Time{}, fmt.Errorf(
+				"parse date: %w", err,
+			)
+		}
+
+		return parsed, nil
+	default:
+		return time.Time{}, fmt.Errorf(
+			"%w: %q", errBadDateFormat, dateStr,
+		)
+	}
+}
+
+// pruneLoop periodically removes expired stamps from the
+// spent set.
+func (v *Validator) pruneLoop() {
+	ticker := time.NewTicker(pruneInterval)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		v.prune()
+	}
+}
+
+func (v *Validator) prune() {
+	cutoff := time.Now().Add(-maxStampAge)
+
+	v.mu.Lock()
+	defer v.mu.Unlock()
+
+	for stamp, stampTime := range v.spent {
+		if stampTime.Before(cutoff) {
+			delete(v.spent, stamp)
+		}
+	}
+}

internal/irc/commands.go

@@ -0,0 +1,21 @@
+package irc
+
+// IRC command names (RFC 1459 / RFC 2812).
+const (
+	CmdJoin    = "JOIN"
+	CmdList    = "LIST"
+	CmdLusers  = "LUSERS"
+	CmdMode    = "MODE"
+	CmdMotd    = "MOTD"
+	CmdNames   = "NAMES"
+	CmdNick    = "NICK"
+	CmdNotice  = "NOTICE"
+	CmdPart    = "PART"
+	CmdPing    = "PING"
+	CmdPong    = "PONG"
+	CmdPrivmsg = "PRIVMSG"
+	CmdQuit    = "QUIT"
+	CmdTopic   = "TOPIC"
+	CmdWho     = "WHO"
+	CmdWhois   = "WHOIS"
+)

internal/irc/numerics.go

@@ -0,0 +1,150 @@
+// Package irc provides constants and utilities for the
+// IRC protocol, including numeric reply codes from
+// RFC 1459 and RFC 2812, and standard command names.
+package irc
+
+// Connection registration replies (001-005).
+const (
+	RplWelcome  = 1
+	RplYourHost = 2
+	RplCreated  = 3
+	RplMyInfo   = 4
+	RplIsupport = 5
+)
+
+// Command responses (200-399).
+const (
+	RplUmodeIs       = 221
+	RplLuserClient   = 251
+	RplLuserOp       = 252
+	RplLuserUnknown  = 253
+	RplLuserChannels = 254
+	RplLuserMe       = 255
+	RplAway          = 301
+	RplUserHost      = 302
+	RplIson          = 303
+	RplUnaway        = 305
+	RplNowAway       = 306
+	RplWhoisUser     = 311
+	RplWhoisServer   = 312
+	RplWhoisOperator = 313
+	RplEndOfWho      = 315
+	RplWhoisIdle     = 317
+	RplEndOfWhois    = 318
+	RplWhoisChannels = 319
+	RplList          = 322
+	RplListEnd       = 323
+	RplChannelModeIs = 324
+	RplCreationTime  = 329
+	RplNoTopic       = 331
+	RplTopic         = 332
+	RplTopicWhoTime  = 333
+	RplInviting      = 341
+	RplWhoReply      = 352
+	RplNamReply      = 353
+	RplEndOfNames    = 366
+	RplBanList       = 367
+	RplEndOfBanList  = 368
+	RplMotd          = 372
+	RplMotdStart     = 375
+	RplEndOfMotd     = 376
+)
+
+// Error replies (400-599).
+const (
+	ErrNoSuchNick        = 401
+	ErrNoSuchServer      = 402
+	ErrNoSuchChannel     = 403
+	ErrCannotSendToChan  = 404
+	ErrTooManyChannels   = 405
+	ErrNoRecipient       = 411
+	ErrNoTextToSend      = 412
+	ErrUnknownCommand    = 421
+	ErrNoNicknameGiven   = 431
+	ErrErroneusNickname  = 432
+	ErrNicknameInUse     = 433
+	ErrUserNotInChannel  = 441
+	ErrNotOnChannel      = 442
+	ErrNotRegistered     = 451
+	ErrNeedMoreParams    = 461
+	ErrAlreadyRegistered = 462
+	ErrChannelIsFull     = 471
+	ErrInviteOnlyChan    = 473
+	ErrBannedFromChan    = 474
+	ErrBadChannelKey     = 475
+	ErrChanOpPrivsNeeded = 482
+)
+
+// names maps numeric codes to their standard IRC names.
+//
+//nolint:gochecknoglobals
+var names = map[int]string{
+	RplWelcome:       "RPL_WELCOME",
+	RplYourHost:      "RPL_YOURHOST",
+	RplCreated:       "RPL_CREATED",
+	RplMyInfo:        "RPL_MYINFO",
+	RplIsupport:      "RPL_ISUPPORT",
+	RplUmodeIs:       "RPL_UMODEIS",
+	RplLuserClient:   "RPL_LUSERCLIENT",
+	RplLuserOp:       "RPL_LUSEROP",
+	RplLuserUnknown:  "RPL_LUSERUNKNOWN",
+	RplLuserChannels: "RPL_LUSERCHANNELS",
+	RplLuserMe:       "RPL_LUSERME",
+	RplAway:          "RPL_AWAY",
+	RplUserHost:      "RPL_USERHOST",
+	RplIson:          "RPL_ISON",
+	RplUnaway:        "RPL_UNAWAY",
+	RplNowAway:       "RPL_NOWAWAY",
+	RplWhoisUser:     "RPL_WHOISUSER",
+	RplWhoisServer:   "RPL_WHOISSERVER",
+	RplWhoisOperator: "RPL_WHOISOPERATOR",
+	RplEndOfWho:      "RPL_ENDOFWHO",
+	RplWhoisIdle:     "RPL_WHOISIDLE",
+	RplEndOfWhois:    "RPL_ENDOFWHOIS",
+	RplWhoisChannels: "RPL_WHOISCHANNELS",
+	RplList:          "RPL_LIST",
+	RplListEnd:       "RPL_LISTEND", //nolint:misspell
+	RplChannelModeIs: "RPL_CHANNELMODEIS",
+	RplCreationTime:  "RPL_CREATIONTIME",
+	RplNoTopic:       "RPL_NOTOPIC",
+	RplTopic:         "RPL_TOPIC",
+	RplTopicWhoTime:  "RPL_TOPICWHOTIME",
+	RplInviting:      "RPL_INVITING",
+	RplWhoReply:      "RPL_WHOREPLY",
+	RplNamReply:      "RPL_NAMREPLY",
+	RplEndOfNames:    "RPL_ENDOFNAMES",
+	RplBanList:       "RPL_BANLIST",
+	RplEndOfBanList:  "RPL_ENDOFBANLIST",
+	RplMotd:          "RPL_MOTD",
+	RplMotdStart:     "RPL_MOTDSTART",
+	RplEndOfMotd:     "RPL_ENDOFMOTD",
+
+	ErrNoSuchNick:        "ERR_NOSUCHNICK",
+	ErrNoSuchServer:      "ERR_NOSUCHSERVER",
+	ErrNoSuchChannel:     "ERR_NOSUCHCHANNEL",
+	ErrCannotSendToChan:  "ERR_CANNOTSENDTOCHAN",
+	ErrTooManyChannels:   "ERR_TOOMANYCHANNELS",
+	ErrNoRecipient:       "ERR_NORECIPIENT",
+	ErrNoTextToSend:      "ERR_NOTEXTTOSEND",
+	ErrUnknownCommand:    "ERR_UNKNOWNCOMMAND",
+	ErrNoNicknameGiven:   "ERR_NONICKNAMEGIVEN",
+	ErrErroneusNickname:  "ERR_ERRONEUSNICKNAME",
+	ErrNicknameInUse:     "ERR_NICKNAMEINUSE",
+	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
+	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
+	ErrNotRegistered:     "ERR_NOTREGISTERED",
+	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
+	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
+	ErrChannelIsFull:     "ERR_CHANNELISFULL",
+	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
+	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
+	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
+	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
+}
+
+// Name returns the standard IRC name for a numeric code
+// (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
+// empty string if the code is unknown.
+func Name(code int) string {
+	return names[code]
+}

internal/middleware/middleware.go

@@ -180,3 +180,36 @@ func (mware *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 		},
 	)
 }
+
+// cspPolicy is the Content-Security-Policy header value applied to all
+// responses.  The embedded SPA loads scripts and styles from same-origin
+// files only (no inline scripts or inline style attributes), so a strict
+// policy works without 'unsafe-inline'.
+const cspPolicy = "default-src 'self'; " +
+	"script-src 'self'; " +
+	"style-src 'self'; " +
+	"connect-src 'self'; " +
+	"img-src 'self'; " +
+	"font-src 'self'; " +
+	"object-src 'none'; " +
+	"frame-ancestors 'none'; " +
+	"base-uri 'self'; " +
+	"form-action 'self'"
+
+// CSP returns middleware that sets the Content-Security-Policy header on
+// every response for defense-in-depth against XSS.
+func (mware *Middleware) CSP() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(
+			func(
+				writer http.ResponseWriter,
+				request *http.Request,
+			) {
+				writer.Header().Set(
+					"Content-Security-Policy",
+					cspPolicy,
+				)
+				next.ServeHTTP(writer, request)
+			})
+	}
+}

internal/server/routes.go

@@ -29,6 +29,7 @@ func (srv *Server) SetupRoutes() {
 	}
 
 	srv.router.Use(srv.mw.CORS())
+	srv.router.Use(srv.mw.CSP())
 	srv.router.Use(middleware.Timeout(routeTimeout))
 
 	if srv.sentryEnabled {

web/dist/index.html

@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>NeoIRC</title>
-  <link rel="stylesheet" href="/style.css">
-</head>
-<body>
-  <div id="root"></div>
-  <script type="module" src="/app.js"></script>
-</body>
-</html>

web/dist/style.css

@@ -1,466 +0,0 @@
-* {
-  margin: 0;
-  padding: 0;
-  box-sizing: border-box;
-}
-
-:root {
-  --bg: #0a0e14;
-  --bg-panel: #0d1117;
-  --bg-input: #0d1117;
-  --bg-tab: #161b22;
-  --bg-tab-active: #0d1117;
-  --bg-topic: #0d1117;
-  --text: #c9d1d9;
-  --text-dim: #6e7681;
-  --text-bright: #e6edf3;
-  --accent: #58a6ff;
-  --accent-dim: #1f6feb;
-  --border: #21262d;
-  --system: #7d8590;
-  --action: #d2a8ff;
-  --warn: #d29922;
-  --error: #f85149;
-  --unread: #f0883e;
-  --nick-brackets: #6e7681;
-  --timestamp: #484f58;
-  --input-bg: #161b22;
-  --prompt: #3fb950;
-  --tab-indicator: #58a6ff;
-  --user-list-bg: #0d1117;
-  --user-list-header: #484f58;
-}
-
-html,
-body,
-#root {
-  height: 100%;
-  font-family: "JetBrains Mono", "Cascadia Code", "Fira Code", "SF Mono",
-    "Consolas", "Liberation Mono", "Courier New", monospace;
-  font-size: 13px;
-  background: var(--bg);
-  color: var(--text);
-  overflow: hidden;
-}
-
-/* ============================================
-   Login Screen
-   ============================================ */
-
-.login-screen {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  height: 100%;
-  background: var(--bg);
-}
-
-.login-box {
-  text-align: center;
-  max-width: 360px;
-  width: 100%;
-  padding: 32px;
-}
-
-.login-box h1 {
-  color: var(--accent);
-  font-size: 1.8em;
-  margin-bottom: 16px;
-  font-weight: 400;
-}
-
-.login-box .motd {
-  color: var(--text-dim);
-  font-size: 12px;
-  margin-bottom: 20px;
-  text-align: left;
-  white-space: pre-wrap;
-  font-family: inherit;
-  border-left: 2px solid var(--border);
-  padding-left: 12px;
-}
-
-.login-box form {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  align-items: stretch;
-}
-
-.login-box label {
-  color: var(--text-dim);
-  text-align: left;
-  font-size: 12px;
-}
-
-.login-box input {
-  padding: 8px 12px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--input-bg);
-  border: 1px solid var(--border);
-  color: var(--text-bright);
-  border-radius: 3px;
-  outline: none;
-}
-
-.login-box input:focus {
-  border-color: var(--accent-dim);
-}
-
-.login-box button {
-  padding: 8px 16px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--accent-dim);
-  border: none;
-  color: var(--text-bright);
-  border-radius: 3px;
-  cursor: pointer;
-  margin-top: 4px;
-}
-
-.login-box button:hover {
-  background: var(--accent);
-}
-
-.login-box .error {
-  color: var(--error);
-  font-size: 12px;
-  margin-top: 8px;
-}
-
-/* ============================================
-   IRC App Layout
-   ============================================ */
-
-.irc-app {
-  display: flex;
-  flex-direction: column;
-  height: 100%;
-  overflow: hidden;
-}
-
-/* ============================================
-   Tab Bar
-   ============================================ */
-
-.tab-bar {
-  display: flex;
-  background: var(--bg-tab);
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 32px;
-  align-items: stretch;
-}
-
-.tabs {
-  display: flex;
-  overflow-x: auto;
-  flex: 1;
-  scrollbar-width: none;
-}
-
-.tabs::-webkit-scrollbar {
-  display: none;
-}
-
-.tab {
-  display: flex;
-  align-items: center;
-  padding: 0 12px;
-  cursor: pointer;
-  color: var(--text-dim);
-  white-space: nowrap;
-  user-select: none;
-  border-right: 1px solid var(--border);
-  font-size: 12px;
-  gap: 4px;
-  position: relative;
-}
-
-.tab:hover {
-  color: var(--text);
-  background: rgba(255, 255, 255, 0.03);
-}
-
-.tab.active {
-  color: var(--text-bright);
-  background: var(--bg-tab-active);
-  border-bottom: 2px solid var(--tab-indicator);
-  margin-bottom: -1px;
-}
-
-.tab.has-unread .tab-label {
-  color: var(--unread);
-  font-weight: bold;
-}
-
-.tab .unread-count {
-  color: var(--unread);
-  font-size: 11px;
-  font-weight: bold;
-}
-
-.tab-close {
-  color: var(--text-dim);
-  font-size: 14px;
-  line-height: 1;
-  margin-left: 2px;
-}
-
-.tab-close:hover {
-  color: var(--error);
-}
-
-.status-area {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  padding: 0 12px;
-  flex-shrink: 0;
-  font-size: 12px;
-}
-
-.status-nick {
-  color: var(--accent);
-  font-weight: bold;
-}
-
-.status-warn {
-  color: var(--warn);
-  animation: blink 1.5s ease-in-out infinite;
-}
-
-@keyframes blink {
-  0%,
-  100% {
-    opacity: 1;
-  }
-  50% {
-    opacity: 0.4;
-  }
-}
-
-/* ============================================
-   Topic Bar
-   ============================================ */
-
-.topic-bar {
-  padding: 4px 12px;
-  background: var(--bg-topic);
-  border-bottom: 1px solid var(--border);
-  font-size: 12px;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  flex-shrink: 0;
-  line-height: 1.5;
-}
-
-.topic-label {
-  color: var(--text-dim);
-}
-
-.topic-text {
-  color: var(--text);
-}
-
-/* ============================================
-   Main Content Area
-   ============================================ */
-
-.main-area {
-  display: flex;
-  flex: 1;
-  overflow: hidden;
-  min-height: 0;
-}
-
-/* ============================================
-   Messages Panel
-   ============================================ */
-
-.messages-panel {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-  min-width: 0;
-}
-
-.messages-scroll {
-  flex: 1;
-  overflow-y: auto;
-  padding: 4px 8px;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.messages-scroll::-webkit-scrollbar {
-  width: 8px;
-}
-
-.messages-scroll::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.messages-scroll::-webkit-scrollbar-thumb {
-  background: var(--border);
-  border-radius: 4px;
-}
-
-/* ============================================
-   Message Lines
-   ============================================ */
-
-.message {
-  padding: 1px 0;
-  line-height: 1.4;
-  white-space: pre-wrap;
-  word-wrap: break-word;
-  font-size: 13px;
-}
-
-.message .timestamp {
-  color: var(--timestamp);
-  font-size: 12px;
-}
-
-.message .nick {
-  font-weight: bold;
-}
-
-.message .content {
-  color: var(--text);
-}
-
-/* System messages (joins, parts, quits, etc.) */
-.system-message {
-  color: var(--system);
-}
-
-.system-message .system-text {
-  color: var(--system);
-}
-
-/* /me action messages */
-.action-message .action-text {
-  color: var(--action);
-}
-
-/* ============================================
-   User List (Right Panel)
-   ============================================ */
-
-.user-list {
-  width: 160px;
-  background: var(--user-list-bg);
-  border-left: 1px solid var(--border);
-  display: flex;
-  flex-direction: column;
-  flex-shrink: 0;
-  overflow: hidden;
-}
-
-.user-list-header {
-  padding: 6px 10px;
-  color: var(--user-list-header);
-  font-size: 11px;
-  text-transform: uppercase;
-  letter-spacing: 0.5px;
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-}
-
-.user-list-entries {
-  overflow-y: auto;
-  padding: 4px 0;
-  flex: 1;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.nick-entry {
-  padding: 2px 10px;
-  font-size: 12px;
-  cursor: pointer;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  line-height: 1.5;
-}
-
-.nick-entry:hover {
-  background: rgba(255, 255, 255, 0.04);
-}
-
-.nick-prefix {
-  color: var(--text-dim);
-  display: inline-block;
-  width: 1ch;
-  text-align: right;
-  margin-right: 1px;
-}
-
-.nick-name {
-  font-weight: normal;
-}
-
-/* ============================================
-   Input Line (Bottom)
-   ============================================ */
-
-.input-line {
-  display: flex;
-  align-items: center;
-  background: var(--input-bg);
-  border-top: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 36px;
-  padding: 0 8px;
-  gap: 6px;
-}
-
-.input-prompt {
-  color: var(--prompt);
-  font-size: 13px;
-  flex-shrink: 0;
-  white-space: nowrap;
-}
-
-.input-line input {
-  flex: 1;
-  padding: 4px 0;
-  font-family: inherit;
-  font-size: 13px;
-  background: transparent;
-  border: none;
-  color: var(--text-bright);
-  outline: none;
-  caret-color: var(--accent);
-}
-
-.input-line input::placeholder {
-  color: var(--text-dim);
-  font-style: italic;
-}
-
-/* ============================================
-   Responsive
-   ============================================ */
-
-@media (max-width: 600px) {
-  .user-list {
-    display: none;
-  }
-
-  .tab {
-    padding: 0 8px;
-    font-size: 11px;
-  }
-
-  .input-prompt {
-    font-size: 12px;
-  }
-}

web/src/app.jsx

@@ -8,6 +8,56 @@ const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
 
+// Hashcash proof-of-work helpers using Web Crypto API.
+
+function checkLeadingZeros(hashBytes, bits) {
+  let count = 0;
+  for (let i = 0; i < hashBytes.length; i++) {
+    if (hashBytes[i] === 0) {
+      count += 8;
+      continue;
+    }
+    let b = hashBytes[i];
+    while ((b & 0x80) === 0) {
+      count++;
+      b <<= 1;
+    }
+    break;
+  }
+  return count >= bits;
+}
+
+async function mintHashcash(bits, resource) {
+  const encoder = new TextEncoder();
+  const now = new Date();
+  const date =
+    String(now.getUTCFullYear()).slice(2) +
+    String(now.getUTCMonth() + 1).padStart(2, "0") +
+    String(now.getUTCDate()).padStart(2, "0");
+  const prefix = `1:${bits}:${date}:${resource}::`;
+  let nonce = Math.floor(Math.random() * 0x100000);
+  const batchSize = 1024;
+
+  for (;;) {
+    const stamps = [];
+    const hashPromises = [];
+    for (let i = 0; i < batchSize; i++) {
+      const stamp = prefix + (nonce + i).toString(16);
+      stamps.push(stamp);
+      hashPromises.push(
+        crypto.subtle.digest("SHA-256", encoder.encode(stamp)),
+      );
+    }
+    const hashes = await Promise.all(hashPromises);
+    for (let i = 0; i < hashes.length; i++) {
+      if (checkLeadingZeros(new Uint8Array(hashes[i]), bits)) {
+        return stamps[i];
+      }
+    }
+    nonce += batchSize;
+  }
+}
+
 function api(path, opts = {}) {
   const token = localStorage.getItem("neoirc_token");
   const headers = {
@@ -60,18 +110,22 @@ function LoginScreen({ onLogin }) {
   const [motd, setMotd] = useState("");
   const [serverName, setServerName] = useState("NeoIRC");
   const inputRef = useRef();
+  const hashcashBitsRef = useRef(0);
+  const hashcashResourceRef = useRef("neoirc");
 
   useEffect(() => {
     api("/server")
       .then((s) => {
         if (s.name) setServerName(s.name);
         if (s.motd) setMotd(s.motd);
+        hashcashBitsRef.current = s.hashcash_bits || 0;
+        if (s.name) hashcashResourceRef.current = s.name;
       })
       .catch(() => {});
     const saved = localStorage.getItem("neoirc_token");
     if (saved) {
-      api("/state")
-        .then((u) => onLogin(u.nick))
+      api("/state?initChannelState=1")
+        .then((u) => onLogin(u.nick, true))
         .catch(() => localStorage.removeItem("neoirc_token"));
     }
     inputRef.current?.focus();
@@ -81,9 +135,20 @@ function LoginScreen({ onLogin }) {
     e.preventDefault();
     setError("");
     try {
+      const extraHeaders = {};
+      if (hashcashBitsRef.current > 0) {
+        setError("Computing proof-of-work...");
+        const stamp = await mintHashcash(
+          hashcashBitsRef.current,
+          hashcashResourceRef.current,
+        );
+        extraHeaders["X-Hashcash"] = stamp;
+        setError("");
+      }
       const res = await api("/session", {
         method: "POST",
         body: JSON.stringify({ nick: nick.trim() }),
+        headers: extraHeaders,
       });
       localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);
@@ -333,7 +398,24 @@ function App() {
         case "JOIN": {
           const text = `${msg.from} has joined ${msg.to}`;
           if (msg.to) addMessage(msg.to, { ...base, text, system: true });
-          if (msg.to && msg.to.startsWith("#")) refreshMembers(msg.to);
+          if (msg.to && msg.to.startsWith("#")) {
+            // Create a tab when the current user joins a channel
+            // (including JOINs from initChannelState on reconnect).
+            if (msg.from === nickRef.current) {
+              setTabs((prev) => {
+                if (
+                  prev.find(
+                    (t) => t.type === "channel" && t.name === msg.to,
+                  )
+                )
+                  return prev;
+
+                return [...prev, { type: "channel", name: msg.to }];
+              });
+            }
+
+            refreshMembers(msg.to);
+          }
 
           break;
         }
@@ -419,6 +501,100 @@ function App() {
 
           break;
         }
+        case "322": {
+          // RPL_LIST — channel, member count, topic.
+          if (Array.isArray(msg.params) && msg.params.length >= 2) {
+            const chName = msg.params[0];
+            const count = msg.params[1];
+            const chTopic = body || "";
+            addMessage("Server", {
+              ...base,
+              text: `${chName} (${count} users): ${chTopic.trim()}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case "323":
+          addMessage("Server", {
+            ...base,
+            text: body || "End of channel list",
+            system: true,
+          });
+
+          break;
+        case "352": {
+          // RPL_WHOREPLY — channel, user, host, server, nick, flags.
+          if (Array.isArray(msg.params) && msg.params.length >= 5) {
+            const whoCh = msg.params[0];
+            const whoNick = msg.params[4];
+            const whoFlags = msg.params.length > 5 ? msg.params[5] : "";
+            addMessage("Server", {
+              ...base,
+              text: `${whoCh} ${whoNick} ${whoFlags}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case "315":
+          addMessage("Server", {
+            ...base,
+            text: body || "End of /WHO list",
+            system: true,
+          });
+
+          break;
+        case "311": {
+          // RPL_WHOISUSER — nick, user, host, *, realname.
+          if (Array.isArray(msg.params) && msg.params.length >= 1) {
+            const wiNick = msg.params[0];
+            addMessage("Server", {
+              ...base,
+              text: `${wiNick} (${body})`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case "312": {
+          // RPL_WHOISSERVER — nick, server, server info.
+          if (Array.isArray(msg.params) && msg.params.length >= 2) {
+            const wiNick = msg.params[0];
+            const wiServer = msg.params[1];
+            addMessage("Server", {
+              ...base,
+              text: `${wiNick} on ${wiServer}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case "319": {
+          // RPL_WHOISCHANNELS — nick, channels.
+          if (Array.isArray(msg.params) && msg.params.length >= 1) {
+            const wiNick = msg.params[0];
+            addMessage("Server", {
+              ...base,
+              text: `${wiNick} is on: ${body}`,
+              system: true,
+            });
+          }
+
+          break;
+        }
+        case "318":
+          addMessage("Server", {
+            ...base,
+            text: body || "End of /WHOIS list",
+            system: true,
+          });
+
+          break;
         case "375":
         case "372":
         case "376":
@@ -497,6 +673,31 @@ function App() {
     inputRef.current?.focus();
   }, [activeTab]);
 
+  // Global keyboard handler — capture '/' to prevent
+  // Firefox quick search and redirect focus to the input.
+  useEffect(() => {
+    const handleGlobalKeyDown = (e) => {
+      if (
+        e.key === "/" &&
+        document.activeElement !== inputRef.current &&
+        !e.ctrlKey &&
+        !e.altKey &&
+        !e.metaKey
+      ) {
+        e.preventDefault();
+        inputRef.current?.focus();
+      }
+    };
+
+    document.addEventListener("keydown", handleGlobalKeyDown);
+
+    // Also focus input on initial mount.
+    inputRef.current?.focus();
+
+    return () =>
+      document.removeEventListener("keydown", handleGlobalKeyDown);
+  }, []);
+
   // Fetch topic for active channel.
   useEffect(() => {
     if (!loggedIn) return;
@@ -512,10 +713,31 @@ function App() {
   }, [loggedIn, activeTab, tabs]);
 
   const onLogin = useCallback(
-    async (userNick) => {
+    async (userNick, isResumed) => {
       setNick(userNick);
       setLoggedIn(true);
       addSystemMessage("Server", `Connected as ${userNick}`);
+
+      if (isResumed) {
+        // Request MOTD on resumed sessions (new sessions
+        // get it automatically from the server during
+        // creation).  Channel state is initialized by the
+        // server via the message queue
+        // (?initChannelState=1), so we do not need to
+        // re-JOIN channels here.
+        try {
+          await api("/messages", {
+            method: "POST",
+            body: JSON.stringify({ command: "MOTD" }),
+          });
+        } catch (e) {
+          // MOTD is non-critical.
+        }
+
+        return;
+      }
+
+      // Fresh session — join any previously saved channels.
       const saved = JSON.parse(
         localStorage.getItem("neoirc_channels") || "[]",
       );
@@ -791,16 +1013,125 @@ function App() {
 
         break;
       }
+      case "/motd": {
+        try {
+          await api("/messages", {
+            method: "POST",
+            body: JSON.stringify({ command: "MOTD" }),
+          });
+        } catch (err) {
+          addSystemMessage(
+            "Server",
+            `Failed to request MOTD: ${err.data?.error || "error"}`,
+          );
+        }
+
+        break;
+      }
+      case "/query": {
+        if (parts[1]) {
+          const target = parts[1];
+          openDM(target);
+          const msgText = parts.slice(2).join(" ");
+          if (msgText) {
+            try {
+              await api("/messages", {
+                method: "POST",
+                body: JSON.stringify({
+                  command: "PRIVMSG",
+                  to: target,
+                  body: [msgText],
+                }),
+              });
+            } catch (err) {
+              addSystemMessage(
+                "Server",
+                `Message failed: ${err.data?.error || "error"}`,
+              );
+            }
+          }
+        } else {
+          addSystemMessage("Server", "Usage: /query <nick> [message]");
+        }
+
+        break;
+      }
+      case "/list": {
+        try {
+          await api("/messages", {
+            method: "POST",
+            body: JSON.stringify({ command: "LIST" }),
+          });
+        } catch (err) {
+          addSystemMessage(
+            "Server",
+            `Failed to list channels: ${err.data?.error || "error"}`,
+          );
+        }
+
+        break;
+      }
+      case "/who": {
+        const whoTarget = parts[1] || (tab.type === "channel" ? tab.name : "");
+        if (whoTarget) {
+          try {
+            await api("/messages", {
+              method: "POST",
+              body: JSON.stringify({ command: "WHO", to: whoTarget }),
+            });
+          } catch (err) {
+            addSystemMessage(
+              "Server",
+              `WHO failed: ${err.data?.error || "error"}`,
+            );
+          }
+        } else {
+          addSystemMessage("Server", "Usage: /who #channel");
+        }
+
+        break;
+      }
+      case "/whois": {
+        if (parts[1]) {
+          try {
+            await api("/messages", {
+              method: "POST",
+              body: JSON.stringify({ command: "WHOIS", to: parts[1] }),
+            });
+          } catch (err) {
+            addSystemMessage(
+              "Server",
+              `WHOIS failed: ${err.data?.error || "error"}`,
+            );
+          }
+        } else {
+          addSystemMessage("Server", "Usage: /whois <nick>");
+        }
+
+        break;
+      }
+      case "/clear": {
+        const clearTarget = tab.name;
+        setMessages((prev) => ({ ...prev, [clearTarget]: [] }));
+
+        break;
+      }
       case "/help": {
         const helpLines = [
           "Available commands:",
           "  /join #channel        — Join a channel",
           "  /part [reason]        — Part the current channel",
           "  /msg nick message     — Send a private message",
+          "  /query nick [message] — Open a DM tab (optionally send a message)",
           "  /me action            — Send an action",
           "  /nick newnick         — Change your nickname",
           "  /topic [text]         — View or set channel topic",
           "  /mode +/-flags        — Set channel modes",
+          "  /motd                 — Display the message of the day",
+          "  /list                 — List all channels",
+          "  /who [#channel]       — List users in a channel",
+          "  /whois nick           — Show info about a user",
+          "  /clear                — Clear messages in the current tab",
           "  /quit [reason]        — Disconnect from server",
           "  /help                 — Show this help",
         ];

web/src/style.css

@@ -70,14 +70,14 @@ body,
 }
 
 .login-box .motd {
-  color: var(--text-dim);
-  font-size: 12px;
+  color: var(--accent);
+  font-size: 11px;
   margin-bottom: 20px;
   text-align: left;
-  white-space: pre-wrap;
+  white-space: pre;
   font-family: inherit;
-  border-left: 2px solid var(--border);
-  padding-left: 12px;
+  line-height: 1.2;
+  overflow-x: auto;
 }
 
 .login-box form {