style: satisfy golangci-lint on the round-6 changes

nolintlint: gosec was not firing on the deferred Close.
nonamedreturns + varnamelen in collapseUserModeOps.

.dockerignore

@@ -1,80 +1,9 @@
-# .dockerignore does NOT use .gitignore semantics. Docker matches with
+.git
-# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+*.md
-# `/` and an unprefixed pattern is anchored at the context root. Every
+!README.md
-# depth-independent pattern therefore needs `**/`, or `config/.env` and
+neoircd
-# `certs/server.key` still ship while this file reads as solved. Only
+neoirc-cli
-# genuinely root-anchored entries go unprefixed. Never transplant these
+data.db
-# into .gitignore, where `**/` is wrong.
+data.db-wal
-#
+data.db-shm
-# Matching is case-sensitive, so secrets use character ranges rather
+.env
-# than an ALL-CAPS twin, which would still miss `Server.Key`.
-#
-# Extend with this repo's own host-built artifacts, written anchored:
-# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
-# deletes the package directory from the context.
-
-# .git is sent without its config. Without a VERSION build argument the
-# stage that compiles runs `git describe --tags --always` on .git, which
-# does not need .git/config; that file can hold a credential, such as a
-# password in a remote URL or the token the CI checkout step stores there.
-# Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules, or in
-# its own .git directory when it keeps one.
-# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
-# `deploy/config`, `config/lib`) loses its whole git directory, because
-# `**/.git/modules/**/config` also matches that segment's directory
-# under .git/modules/. Go's version stamping then fails the build;
-# nothing leaks. Name such a submodule without that segment:
-# `git submodule add --name`.
-**/.git/config
-**/.git/modules/**/config
-
-# Agent scratch: one full checkout of the repo per in-flight agent.
-# Anchored because it occurs once where agents run at the repo root.
-# KNOWN GAP: a repo running agents in subdirectories still ships
-# `services/api/.claude/` and must add its own anchored entry.
-.claude
-
-# Environment files. `*.env` covers bare `.env` and the `prod.env`
-# convention. Re-include a committed template with a negation if the
-# build needs one: `!docs/example.env`.
-**/*.[eE][nN][vV]
-**/.[eE][nN][vV].*
-**/.[eE][nN][vV][rR][cC]
-
-# Private keys and the bundles carrying them. Public certificates
-# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
-**/*.[pP][eE][mM]
-**/*.[kK][eE][yY]
-**/*.[pP]12
-**/*.[pP][fF][xX]
-**/[iI][dD]_[rR][sS][aA]
-**/[iI][dD]_[dD][sS][aA]
-**/[iI][dD]_[eE][cC][dD][sS][aA]
-**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
-**/[iI][dD]_[eE][dD]25519
-**/[iI][dD]_[eE][dD]25519_[sS][kK]
-
-# Dependencies: restored inside the image, never copied in.
-**/node_modules
-
-# OS metadata.
-**/.DS_Store
-**/Thumbs.db
-
-# Editor state: never a build input, and it churns COPY.
-**/*.swp
-**/*.swo
-**/*~
-**/*.bak
-**/.idea
-**/.vscode
-**/*.sublime-*
-
-# This repository's host-built artifacts: the binaries, and the database
-# a local run writes.
-/neoircd
-/neoirc-cli
-/data.db
-/data.db-wal
-/data.db-shm

.editorconfig

@@ -10,8 +10,3 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
-
-# This repository's own entries, after the shared content above.
-
-[*.go]
-indent_style = tab

.gitea/workflows/check.yml

@@ -6,4 +6,4 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .

.gitignore

@@ -11,48 +11,19 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
-# Agent scratch (worktrees of this repo, created and destroyed by
-# in-flight tooling). Unanchored: .gitignore patterns already match at
-# every depth, so no prefix is wanted here. This is not a .dockerignore
-# entry and must not be given a `**/` prefix on the way into one.
-.claude/
-
 # Node
 node_modules/
 
-# Secrets. Unanchored like every entry above, so each matches at every
+# Environment / secrets
-# depth. Matching is case-sensitive on Linux, so names use character
+.env
-# ranges rather than a lowercase form that misses `Server.Key`.
+.env.*
-
+*.pem
-# Environment files. `*.env` covers bare `.env` and the `prod.env`
+*.key
-# convention. Only the templates `example.env` and `sample.env` are
-# re-included below. A repository that commits any other template adds
-# its own negation after these lines, for example `!.env.example`.
-*.[eE][nN][vV]
-.[eE][nN][vV].*
-.[eE][nN][vV][rR][cC]
-!example.env
-!sample.env
-
-# Private keys and the bundles carrying them.
-*.[pP][eE][mM]
-*.[kK][eE][yY]
-*.[pP]12
-*.[pP][fF][xX]
-[iI][dD]_[rR][sS][aA]
-[iI][dD]_[dD][sS][aA]
-[iI][dD]_[eE][cC][dD][sS][aA]
-[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
-[iI][dD]_[eE][dD]25519
-[iI][dD]_[eE][dD]25519_[sS][kK]
-
-# This repository's own entries, after the shared content above.
 
 # Build artifacts
 web/dist/
-/bin/
 /neoircd
-/neoirc-cli
+/bin/
 *.exe
 *.dll
 *.so
@@ -61,6 +32,8 @@ web/dist/
 *.out
 vendor/
 
-# Local database and logs
+# Project
 data.db
-*.log
+debug.log
+/neoirc-cli
+web/node_modules/

.golangci.yml

@@ -1,30 +1,13 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
 
 linters:
   default: all
-  enable:
-    # Successor to the deprecated gomodguard. Named explicitly, rather than
-    # left to `default: all`, because it carries the module policy below.
-    - gomodguard_v2
   disable:
-    # Genuinely incompatible with project patterns
+    - wsl  # Deprecated in v2, replaced by wsl_v5
-    - exhaustruct      # Requires all struct fields
-    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
-    - godot            # Requires comments to end with periods
-    - wrapcheck        # Too verbose for internal packages
-    - varnamelen       # Short names like db, id are idiomatic Go
-    # Deprecated: the warning is attached to the old name, so it is
-    # silenced by disabling that name, not by enabling the successor.
-    - wsl              # Deprecated, replaced by wsl_v5
-    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -35,65 +18,19 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    gosec:
+      excludes:
+        - G704
     depguard:
-      # Test-support code must not be compiled into the shipped binary. A
-      # test-support package exists to hand a test privileges the program
-      # itself must never have, so a file that is not a test must not import
-      # one. Test files, and the files inside a package whose directory name
-      # ends in `test`, are where that code belongs, and are exempt.
-      #
-      # The deny list below is the one part of this file a repository is
-      # expected to extend, and the only part it may. depguard matches an
-      # import path against a list of prefixes, so it cannot be told "any path
-      # whose last segment ends in test"; a repository's own test-support
-      # packages have to be named here one at a time, by full import path,
-      # under a module path that differs from repository to repository. Add
-      # them; change nothing else.
       rules:
-        test-support:
+        all:
-          list-mode: lax
-          files:
-            - "$all"
-            - "!$test"
-            - "!**/*test/**"
           deny:
-            - pkg: net/http/httptest
+            - pkg: "io/ioutil"
-              desc: >-
+              desc: "Deprecated; use io and os packages."
-                Test-support code belongs in test files and in packages whose
+            - pkg: "math/rand$"
-                directory name ends in test, not in the shipped binary.
+              desc: "Use crypto/rand for security-sensitive code."
-    # Only decisions already recorded in the Go package defaults are
-    # listed here. Every entry matches the module path exactly.
-    gomodguard_v2:
-      blocked:
-        - module: github.com/rs/zerolog
-          recommendations:
-            - log/slog
-          reason: "Structured logging is stdlib log/slog."
-        # One entry per pre-fork module path, because the later releases
-        # are separate paths. A prefix match would be shorter but would
-        # also reach github.com/go-redis/redismock, the test double for
-        # the successor these entries recommend.
-        - module: github.com/go-redis/redis
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v7
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/go-redis/redis/v8
-          recommendations:
-            - github.com/redis/go-redis/v9
-          reason: "Pre-fork module; use the maintained go-redis v9."
-        - module: github.com/sergi/go-diff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "No unified diff output; use go-udiff."
-        - module: github.com/hexops/gotextdiff
-          recommendations:
-            - github.com/aymanbagabas/go-udiff
-          reason: "Unmaintained fork; use go-udiff."
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

.prettierignore

@@ -1,2 +0,0 @@
-node_modules/
-yarn.lock

.prettierrc

@@ -1,4 +0,0 @@
-{
-    "tabWidth": 4,
-    "proseWrap": "always"
-}

AGENTS.md

@@ -2,12 +2,10 @@
 
 ## Before Every Commit
 
-1. **Format**: `make fmt`
+1. **Format**: `gofmt -s -w .` and `goimports -w .`
-2. **Check**: `make check` — the tests and the linter, which run in Docker, and
+2. **Lint**: `golangci-lint run --config .golangci.yml ./...` — zero issues
-   the format check: all passing, zero issues
+3. **Test**: `go test -race ./...` — all passing
-
+4. **Build**: `go build ./cmd/neoircd` — compiles clean
-Never run `go test`, `golangci-lint` or `gofmt` directly; use the `make`
-targets.
 
 No commit lands on main with lint errors, test failures, or formatting issues.
 

CONVENTIONS.md

@@ -1,8 +1,6 @@
 # Go HTTP Server Conventions
 
-This document defines the architectural patterns, design decisions, and
+This document defines the architectural patterns, design decisions, and conventions for building Go HTTP servers. All new projects must follow these standards.
-conventions for building Go HTTP servers. All new projects must follow these
-standards.
 
 ## Table of Contents
 
@@ -87,8 +85,7 @@ project-root/
 ### Key Principles
 
 -   **`cmd/{appname}/`**: Only the entry point. Minimal logic, just bootstrapping.
-- **`internal/`**: All application packages. Not importable by external
+-   **`internal/`**: All application packages. Not importable by external projects.
-  projects.
 -   **One package per concern**: config, database, handlers, middleware, etc.
 -   **Flat handler files**: One file per handler or logical group of handlers.
 
@@ -191,8 +188,7 @@ Providers are resolved automatically by fx, but conceptually follow this order:
 2. `logger.New` - Logger (depends on Globals)
 3. `config.New` - Configuration (depends on Globals, Logger)
 4. `database.New` - Database (depends on Logger, Config)
-5. `healthcheck.New` - Health check (depends on Globals, Config, Logger,
+5. `healthcheck.New` - Health check (depends on Globals, Config, Logger, Database)
-   Database)
 6. `middleware.New` - Middleware (depends on Logger, Globals, Config)
 7. `handlers.New` - Handlers (depends on Logger, Globals, Database, Healthcheck)
 8. `server.New` - Server (depends on all above)
@@ -456,11 +452,11 @@ func New(lc fx.Lifecycle, params HandlersParams) (*Handlers, error) {
 ### Closure-Based Handler Pattern
 
 For JSON route handlers, both the request and the response structures are
-defined in the scope of the method that returns the HandlerFunc. They can be
+defined in the scope of the method that returns the HandlerFunc.  They can
-called simply `Request` and `Response` or slightly more descriptive names.
+be called simply `Request` and `Response` or slightly more descriptive
+names.
 
-All handlers return `http.HandlerFunc` using the closure pattern. This allows
+All handlers return `http.HandlerFunc` using the closure pattern. This allows initialization logic to run once when the handler is created:
-initialization logic to run once when the handler is created:
 
 ```go
 // internal/handlers/index.go
@@ -522,8 +518,7 @@ func (s *Handlers) decodeJSON(w http.ResponseWriter, r *http.Request, v interfac
 ### Handler Naming Convention
 
 -   `HandleIndex()` - Main page
-- `HandleLoginGET()` / `HandleLoginPOST()` - Form handlers with HTTP method
+-   `HandleLoginGET()` / `HandleLoginPOST()` - Form handlers with HTTP method suffix
-  suffix
 -   `HandleNow()` - API endpoints
 -   `HandleHealthCheck()` - System endpoints
 
@@ -746,8 +741,7 @@ func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
 
 1. **Environment variables** (highest priority via `AutomaticEnv()`)
 2. **`.env` file** (loaded via `godotenv/autoload` import)
-3. **Config files**: `/etc/{appname}/{appname}.yaml`,
+3. **Config files**: `/etc/{appname}/{appname}.yaml`, `~/.config/{appname}/{appname}.yaml`
-   `~/.config/{appname}/{appname}.yaml`
 4. **Defaults** (lowest priority)
 
 ### Environment Loading

Dockerfile

@@ -1,82 +1,49 @@
 # Web build stage — compile SPA from source
 # node:22-alpine, 2026-03-09
 FROM node@sha256:8094c002d08262dba12645a3b4a15cd6cd627d30bc782f53229a2ec13ee22a00 AS web-builder
-# yarn 1.22.22, 2026-10-06
-# The version script/bootstrap pins, checked against the sha512 of its
-# npm package. corepack enable replaces the yarn the image ships with
-# corepack's own, which runs the version activated here.
-RUN corepack enable \
-    && corepack prepare yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e --activate
 WORKDIR /web
-COPY web/package.json web/yarn.lock ./
+COPY web/package.json web/package-lock.json ./
-RUN yarn install --frozen-lockfile
+RUN npm ci
 COPY web/src/ src/
 COPY web/build.sh build.sh
 RUN sh build.sh
 
-# Lint phase, built alone by script/lint. The linter is invoked directly
+# Lint stage — fast feedback on formatting and lint issues
-# rather than through `make lint`, which is itself a docker build and
+# golangci/golangci-lint:v2.1.6, 2026-03-02
-# would recurse into a daemon that does not exist in a build step.
+FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
-# golangci/golangci-lint:v2.14.0, 2026-10-06
-FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-# Placeholder files so //go:embed dist/* in web/embed.go resolves
+# Create placeholder files so //go:embed dist/* in web/embed.go resolves
-# without waiting for the web-builder stage. The test phase does the same.
+# without depending on the web-builder stage (lint should fail fast)
 RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
-RUN golangci-lint run --config .golangci.yml ./...
+RUN make fmt-check
+RUN make lint
 
-# Test phase, built alone by script/test. -race needs cgo and so a C
+# Build stage
-# compiler, which the Debian Go image ships and the alpine one does not.
-# golang:1.24.13-bookworm, 2026-10-06
-FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
-# -p 4 because test runs on a shared build host cap their parallelism.
-RUN go test -p 4 -timeout 90s -race -cover ./... || \
-    { echo "--- Rerunning with -v for details ---"; \
-      go test -p 4 -timeout 90s -race -v ./...; exit 1; }
-
-# Build stage. Nothing is wanted from either phase above; the copies
-# are what make BuildKit build them first, so this stage cannot run
-# unless lint and test passed.
 # golang:1.24-alpine, 2026-02-26
 FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
-COPY --from=lint /src/go.sum /dev/null
-COPY --from=test /src/go.sum /dev/null
-RUN apk add --no-cache git
-# A tar-stream context keeps the sender's file owners, which git refuses.
-RUN git config --system --add safe.directory /src
 WORKDIR /src
+RUN apk add --no-cache git build-base make
+
+# Force BuildKit to run the lint stage before proceeding
+COPY --from=lint /src/go.sum /dev/null
+
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
 COPY --from=web-builder /web/dist/ web/dist/
 
+RUN make test
+
 # Build static binaries (no cgo needed at runtime — modernc.org/sqlite is pure Go)
-#
+ARG VERSION=dev
-# neoircd is stamped with the VERSION build arg when one is given, otherwise
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
-# with `git describe --tags --always` on the .git in the build context. With
-# .git present, a version that is still empty, dev or unknown fails the build:
-# git is missing or could not read the checkout.
-ARG VERSION
-RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
-    if [ -e .git ]; then \
-        case "$VERSION" in ""|dev|unknown) \
-            echo "version is '$VERSION' although .git is present" >&2; \
-            exit 1 ;; \
-        esac; \
-    fi; \
-    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoirc-cli/
 
-# Runtime stage, and the last one: a plain `docker build .` builds this
+# Runtime stage
-# stage's chain and nothing else.
 # alpine:3.21, 2026-02-26
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 RUN apk add --no-cache ca-certificates \

Makefile

@@ -1,25 +1,16 @@
-.PHONY: all bootstrap setup build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
+.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
 
 BINARY := neoircd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
-LDFLAGS := -X main.Version=$(VERSION)
+BUILDARCH := $(shell go env GOARCH)
-
+LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
-# The standard targets are thin shims; the implementations live in
-# script/ per the scripts-to-rule-them-all pattern (see the Entrypoints
-# section of README.md).
 
 all: check build
 
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
-
 # ensure-web-dist creates placeholder files so //go:embed dist/* in
 # web/embed.go resolves without a full Node.js build.  The real SPA is
 # built by the web-builder Docker stage; these placeholders let
-# "make build" work outside Docker.
+# "make test" and "make build" work outside Docker.
 ensure-web-dist:
 	@if [ ! -d web/dist ]; then \
 		mkdir -p web/dist && \
@@ -30,20 +21,25 @@ ensure-web-dist:
 build: ensure-web-dist
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd
 
-test:
+lint: ensure-web-dist
-	@script/test
+	golangci-lint run --config .golangci.yml ./...
-
-lint:
-	@script/lint
 
 fmt:
-	@script/fmt
+	gofmt -s -w .
+	goimports -w .
 
 fmt-check:
-	@script/fmt-check
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 
-check:
+test: ensure-web-dist
-	@script/check
+	go test -timeout 30s -race -cover ./... || go test -timeout 30s -race -v ./...
+
+# check runs all validation without making changes
+# Used by CI and Docker build — fails if anything is wrong
+check: test lint fmt-check
+	@echo "==> Building..."
+	go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/neoircd
+	@echo "==> All checks passed!"
 
 run: build
 	./bin/$(BINARY)
@@ -55,7 +51,10 @@ clean:
 	rm -rf bin/ neoircd
 
 docker:
-	@script/docker
+	docker build -t neoirc .
 
 hooks:
-	@script/install-precommit
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-04
+last_modified: 2026-03-09
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,57 +34,10 @@ style conventions are in separate documents:
   every file before committing. There are zero exceptions to this rule.
 
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  `make hooks` (installs pre-commit hook). A model Makefile is at
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
-  with the version; the Gitea workflow calls it. **`script/cibuild` runs
-  `script/bootstrap` first**, because the workflow checks out the repo and runs
-  nothing else, while `script/fmt-check` runs the formatter on the host: on a
-  pristine checkout with nothing installed the run dies there, after the
-  containerised gates have passed. **The bootstrap alone is not enough**:
-  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
-  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
-  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
-  source nvm for the pinned node version before invoking it, exactly as
-  `script/bootstrap`'s own install step does. A runner carrying nothing but
-  docker and git then gets through `script/check`. Four further scripts are our
-  own extensions to the standard: `script/check` runs `script/test`,
-  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
-  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
-  installs the git pre-commit hook (the `make hooks` target shims to it); and
-  `script/projectname` (literally that filename) simply outputs the project's
-  name. Scripts that need the name call `script/projectname` — e.g.
-  `script/docker` assembles its image tag from it — so those scripts stay
-  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
-  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
-  the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the single
@@ -100,198 +53,15 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  `lint` phase and a `test` phase, with the final stage depending on both so the
+  as a build step so the build fails if the branch is not green. For non-server
-  image cannot be built unless they pass. For non-server repos the final stage
+  repos, the Dockerfile should bring up a development environment and run
-  brings up a development environment; for server repos it is the runtime image.
+  `make check`. For server repos, `make check` should run as an early build
-  The gate phases and the build stage start from their pinned base images and
+  stage before the final image is assembled.
-  install what those images lack either inline, as the canonical Go `Dockerfile`
-  below does for `git`, or by running `script/bootstrap`, as the `prompts`
-  repo's own `Dockerfile` does for its yarn packages. The development
-  environment stage installs development prerequisites by running
-  `script/bootstrap` rather than duplicating its installs inline. A stage that
-  runs `script/bootstrap` COPYs `script/` and the dependency manifests
-  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
-
-- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
-  no separate lint file. `script/lint` and `script/test` each build one phase
-  and nothing else:
-
-    ```sh
-    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
-    docker build --no-cache --target test -t "$(script/projectname)-test" .
-    ```
-
-    **A stage that is not the last one in the file is built only when the final
-    stage's chain depends on it, or when `--target` names it.** That is why the
-    two gates are always invoked by name here, and why the final stage carries a
-    `COPY --from=` of a harmless file from each of them: without that edge a
-    plain `docker build .` builds the last stage alone and exits 0 having linted
-    and tested nothing.
-
-    **Every `docker build` in `script/` is tagged**, here and in
-    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
-    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image.
-
-    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
-    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
-    themselves a `docker build` and would recurse into a daemon that does not
-    exist in a build step. Formatting is the exception and stays on the host:
-    `script/fmt` writes the working tree, and `script/fmt-check` is its
-    read-only twin.
-
-    **No lint verdict may come from a host invocation of the linter.** On a
-    shared host golangci-lint reads a result cache keyed on file content rather
-    than location, so a second checkout of the same content is served the first
-    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
-    exit non-zero with `parallel golangci-lint is running` — a status a caller
-    cannot tell from real findings. Both have produced wrong verdicts in this
-    org, in both directions. A container has its own cache, its own `TMPDIR` and
-    a digest-pinned binary, so neither is reachable.
-
-- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
-  a `COPY` layer only when the copied content changes, so on an unchanged tree
-  the check `RUN` is served from cache, nothing executes, and the build still
-  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
-  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
-  four, and there is no fifth — `script/check` runs the two gate phases and
-  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
-  not evidence that anything ran: a sub-second build reporting success is a
-  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
-  and friends destroy a build cache shared with every other build on the host.
-  When a check is added or changed, prove it works by planting a defect it must
-  catch and watching the run fail on it, then revert the defect. A green run
-  alone shows neither that the check ran nor that it covers what it should.
-
-- **The gate phases are separate stages, and the build stage depends on both.**
-  The lint phase is based on the `golangci/golangci-lint` image (pinned by
-  hash), so lint failures surface in seconds rather than after a full compile,
-  and the test phase is based on the Debian Go image. The canonical Go repo
-  `Dockerfile`:
-
-    ```dockerfile
-    # Lint phase
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN golangci-lint run --config .golangci.yml ./...
-
-    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
-    # image ships and the alpine one does not.
-    # golang:1.x, YYYY-MM-DD
-    FROM golang@sha256:... AS test
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN go test -timeout 90s -race -cover ./... || \
-        { echo "--- Rerunning with -v for details ---"; \
-          go test -timeout 90s -race -v ./...; exit 1; }
-
-    # Build stage. Nothing is wanted from either phase above; the copies
-    # are what make BuildKit build them first, so this stage cannot run
-    # unless lint and test passed.
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    COPY --from=lint /src/go.sum /dev/null
-    COPY --from=test /src/go.sum /dev/null
-    RUN apk add --no-cache git
-    # A tar-stream context keeps the sender's file owners, which git refuses.
-    RUN git config --system --add safe.directory /src
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-
-    # The VERSION build arg when one is given, otherwise
-    # `git describe --tags --always` on the .git in the build context. With
-    # .git present, a version that is still empty, dev or unknown fails the
-    # build: git is missing or could not read the checkout.
-    ARG VERSION
-    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
-        if [ -e .git ]; then \
-            case "$VERSION" in ""|dev|unknown) \
-                echo "version is '$VERSION' although .git is present" >&2; \
-                exit 1 ;; \
-            esac; \
-        fi; \
-        CGO_ENABLED=0 go build -trimpath \
-            -ldflags="-s -w -X main.Version=${VERSION}" \
-            -o /app ./cmd/app/
-
-    # Runtime stage, and the last one
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint phase uses the `golangci/golangci-lint` image directly (it has
-      both Go and the linter), so nothing needs installing.
-    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
-      purpose is the ordering edge. BuildKit runs stages in parallel by default,
-      and a stage nothing depends on is not built at all, so without these two
-      lines a red gate would not fail the build.
-    - Keep the runtime stage last, and if you add a stage after it, give it the
-      same two copies. A plain `docker build .` builds the last stage's chain
-      and nothing else.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint phase must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-    - If the project requires CGO or system libraries for linting, install them
-      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
-      has no `apk`, so install with `apt-get` under the Debian package name
-      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
-      lists in the same `RUN`, so the layer does not keep them:
-
-        ```dockerfile
-        RUN apt-get update \
-            && apt-get install -y --no-install-recommends libvips-dev \
-            && rm -rf /var/lib/apt/lists/*
-        ```
-
-    - `.dockerignore` lets `.git` into the build context. It keeps out every git
-      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
-      repository's own, each submodule's under `.git/modules/`, and that of a
-      submodule keeping its own `.git` directory. `git describe` does not need
-      them, and each can hold a credential: a password in a remote URL, or the
-      token the CI checkout step stores there. A submodule whose name has a
-      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
-      git directory to `**/.git/modules/**/config`, and Go's version stamping
-      then fails the build: give it a name without that segment
-      (`git submodule add --name`). The stage that compiles has `git` (the
-      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
-      takes the version from the `VERSION` build argument when one is given,
-      otherwise from `git describe --tags --always`. That gives the tag on a
-      tagged commit; on a later commit, the tag, the number of commits since it
-      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
-      tag is reachable. The stage that compiles also marks its working directory
-      safe for git (`git config --system --add safe.directory /src`): a context
-      sent as a tar stream keeps the sender's file owners, and git refuses a
-      checkout owned by another user, so the version would come out empty.
-      `ARG VERSION` has no default, and the build fails if the context carries
-      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
-      `docker build .` with no build arguments must succeed; a Dockerfile that
-      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  That script bootstraps, runs the gate phases, and then builds the image, so a
+  a successful build implies all checks pass.
-  successful run means every check passed; a bare `docker build .` does not
-  carry the same guarantee, because its gate phases may come from the cache. The
-  image build is uncached and so runs the gate phases a second time. That is the
-  price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  checked by review: to try a change to it, add the feature branch to that list
-  and push, then remove the branch from the list again before merging. Keep any
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -299,11 +69,9 @@ style conventions are in separate documents:
   Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
   HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
 
-- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+- Pre-commit hook: `make check` if local testing is possible, otherwise
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  target to install the pre-commit hook.
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
 
 - All repos with software must have tests that run via the platform-standard
   test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -311,66 +79,8 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 60 seconds. That is the hard cap, and a
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  Makefile.
-  20 and 60 seconds is still green, but the overage must be filed as an
-  improvement bug against that repo. Add a 90-second timeout to the test
-  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
-  hard cap so that it catches a genuinely hung test rather than a merely slow
-  one.
-
-- **The test command should use the conditional verbose rerun pattern.** Run
-  tests without `-v` (verbose) first. If tests fail, automatically rerun with
-  `-v` to show full output. This keeps CI logs and `docker build` output clean
-  on success (just package/suite summaries) while providing full diagnostic
-  detail on failure (every test case, every assertion). The command lives in the
-  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
-  Makefile form below is the same pattern for any repo-local invocation:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -count=1 -timeout 90s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
-    ```
-
-    `-count=1` is required on both invocations: it defeats Go's test _result_
-    cache, so neither run can report a stored pass in place of running the
-    tests. It leaves the build cache alone, so it costs the runtime of the suite
-    and no recompilation.
-
-    That cache is Go's own, separate from Docker's layer cache. Go stores a
-    passing result in its cache directory (`GOCACHE`), and when the same tests
-    run again on unchanged code it prints that result, marked `(cached)`,
-    without running them. That matters on a developer's machine, where this
-    target runs and the directory lasts from one run to the next. The `test`
-    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
-    result for this repo's tests and nothing before its `go test` step runs a
-    test, so there is nothing to replay. `--no-cache` (above) is what makes that
-    step run on an unchanged tree.
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
 
 - Docker builds must complete in under 5 minutes.
 
@@ -383,84 +93,10 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  Fetch the standard `.gitignore` from
-  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  setting up a new repo. These patterns are written to `.gitignore`'s own
+  a new repo.
-  semantics, in which an unanchored pattern already matches at every depth; they
-  are not a `.dockerignore` and must not be transplanted into one unmodified.
-
-- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
-  across unmodified leaves secrets in the build context.** Docker matches with
-  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
-  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
-  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
-  therefore excludes only the copies at the repository root, while `config/.env`
-  and `certs/server.key` still reach the context and can land in an image layer
-  — which is more dangerous than a short file with no secret patterns at all,
-  because it reads as solved and stops anyone looking. Give every
-  depth-independent pattern the `**/` prefix and leave only genuinely
-  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
-  binary, written `/myapp` and never `**/myapp`, which would also match
-  `cmd/myapp/` and delete the package directory from the context. Matching is
-  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
-  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
-  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
-  also catches something the build needs, re-include it with a negation
-  (`!docs/example.env`); deleting the pattern reopens the exposure for every
-  other file it covers. Fetch the standard `.dockerignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
-  it with the repo's own artifacts.
-
-- **In-repo agent scratch belongs in both files, written to each file's own
-  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
-  additional checkout of the repo — so under `COPY . .` the build context
-  inflates by a multiple of the repo and another session's unreviewed work can
-  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
-  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
-  prefix, because the prefixed form would also delete any nested directory of
-  that name from the build. Anchoring carries a known gap that the canonical
-  `.dockerignore` states in its own comment, since consuming repos receive the
-  file and not the tracker: the directory is created in the agent's working
-  directory, so a repo running agents in subdirectories still ships
-  `services/api/.claude/` and must add its own anchored entry there.
-
-- **A plain `docker build .` of a clone stamps the version that
-  `git describe --tags --always` gives**, derived from the `.git` in the build
-  context as the canonical `Dockerfile` above shows. Without its failure check,
-  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
-  and the build would still exit 0. `script/docker` and `script/cibuild` pass
-  the version they compute on the host; it takes precedence. They do this
-  byte-identically across repos:
-
-    ```sh
-    # Own line: a failing command substitution inside an argument does not
-    # trip `set -e`, so the inline form degrades to an empty constant.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$(script/projectname)" .
-    ```
-
-    `--always` makes an untagged repo yield an abbreviated commit hash rather
-    than failing, and the `[ -n "$version" ]` line is the single place the
-    fallback is applied — a live check that fires on a build from an export with
-    no `.git` and on a repository with no commits yet. Do not fold it into the
-    substitution as `|| echo unknown`, which makes the guard unreachable. The
-    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
-    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
-    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
-    the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
-
-- **Verify `.dockerignore` by enumerating the image, not by reading the
-  patterns.** Plant files at the root _and_ at least two directories deep, build
-  a probe image that does `COPY . .`, and list what actually landed
-  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
-  size is not a substitute: a nested secret is a few bytes, and BuildKit
-  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -476,56 +112,9 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  _NEVER_ be modified by an agent: fetch it from
+  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
-  byte-identical, so that no repo can quietly loosen its own linting. Linter
-  configuration changes are made to the canonical copy in the `prompts` repo and
-  reach consuming repos by re-vendoring; an agent may open a PR against
-  canonical, which only the user merges. One list is exempt from byte-identity,
-  because it cannot be written once for every repo: the `deny` list of the
-  `test-support` depguard rule, where a repo names its own test-support packages
-  by full import path. A repo adds entries there and changes nothing else, and a
-  re-vendor carries its entries forward. The canonical golangci-lint version is
-  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
-  image
-  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
-  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
-  directive must not name a newer Go minor version than the one golangci-lint
-  was built with, or golangci-lint refuses to lint it: this release lints
-  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
-  installs golangci-lint on the host. A repo sets the lint phase digest to the
-  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
-  the two prompted the change: the canonical copy can name linters that an older
-  golangci-lint rejects, and a newer golangci-lint can add linters that
-  `default: all` switches on until the canonical copy disables them.
-
-- **`script/bootstrap` installs a pinned tool by comparing versions, never by
-  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
-  `PATH` only, so on an already-provisioned machine the pin is inert and a
-  version bump is a silent no-op — while the Dockerfile, installing into a clean
-  image, gets the pinned version, so a local `make check` and `make docker` can
-  disagree about what the tool even is. The canonical form:
-    - compares the installed version against the pin over the **whole** version
-      token; a parser that stops at the first `-` reports `2.12.2` for a host
-      running `2.12.2-rc1` and skips the install;
-    - treats absent, non-zero, empty or unrecognised `--version` output as a
-      mismatch, so the failure direction is a redundant install and never a
-      skipped one;
-    - after installing, re-resolves the binary the way callers do — `hash -r`,
-      then through `PATH`, not through the directory the installer wrote to —
-      and fails naming the resolved path, since an install that a shadowing
-      binary hides succeeds while changing nothing any caller sees;
-    - is actually called, and prints the version on both success paths: a
-      function defined and never invoked has the same exit status and the same
-      empty output as one that worked.
-
-    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
-
-    A Go tool a repo needs on the host is installed with `go install` pinned to
-    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
-    a `go.mod` tool dependency or through a `tools.go` file, either of which
-    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -539,76 +128,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
   `PORT`.
 
-- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
 - `README.md` is the primary documentation. Required sections:
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
       git-frontend webhooks and deploys applications via Docker in realtime."
     - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
     - **Rationale**: Why does this exist?
     - **Design**: How is the program structured?
     - **TODO**: Update meticulously, even between commits. When planning, put
@@ -639,14 +164,12 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  and language-specific config). Everything else goes in a subdirectory.
+  language-specific config). Everything else goes in a subdirectory. Canonical
-  Canonical subdirectory names:
+  subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+    - `cmd/` — Go command entrypoints
-      body is a single call into `internal/` or `pkg/`, no project logic in
-      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -665,15 +188,8 @@ style conventions are in separate documents:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
     - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
-
-- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
-  is never committed under a file or directory named after one agent tool, such
-  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

internal/broker/broker.go

@@ -47,16 +47,6 @@ func (b *Broker) Notify(userID int64) {
 	}
 }
 
-// ListenerCount returns how many channels from Wait are still
-// registered for the user: those that neither Notify nor Remove
-// has taken out.
-func (b *Broker) ListenerCount(userID int64) int {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-
-	return len(b.listeners[userID])
-}
-
 // Remove removes a specific wait channel (for cleanup on timeout).
 func (b *Broker) Remove(
 	userID int64,

internal/broker/broker_test.go

@@ -59,39 +59,6 @@ func TestRemove(t *testing.T) {
 	}
 }
 
-func TestListenerCount(t *testing.T) {
-	t.Parallel()
-
-	brk := broker.New()
-
-	wantCount := func(step string, userID int64, want int) {
-		t.Helper()
-
-		got := brk.ListenerCount(userID)
-		if got != want {
-			t.Errorf("%s: user %d: got %d, want %d",
-				step, userID, got, want)
-		}
-	}
-
-	wantCount("before Wait", 1, 0)
-
-	waitCh := brk.Wait(1)
-	brk.Wait(1)
-	brk.Wait(2)
-
-	wantCount("after two Waits", 1, 2)
-
-	brk.Remove(1, waitCh)
-
-	wantCount("after Remove", 1, 1)
-
-	brk.Notify(1)
-
-	wantCount("after Notify", 1, 0)
-	wantCount("after Notify", 2, 1)
-}
-
 func TestMultipleWaiters(t *testing.T) {
 	t.Parallel()
 

internal/cli/api/client.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
@@ -42,34 +41,11 @@ func NewClient(baseURL string) *Client {
 		BaseURL: baseURL,
 		HTTPClient: &http.Client{ //nolint:exhaustruct // defaults fine
 			Timeout: httpTimeout,
-			Jar:     loopbackJar{CookieJar: jar},
+			Jar:     jar,
 		},
 	}
 }
 
-// loopbackJar also sends the server's auth cookie, which is
-// always Secure, over plain HTTP to a server on localhost, as
-// curl does. Go 1.24's cookie jar sends a Secure cookie only
-// over HTTPS.
-type loopbackJar struct {
-	http.CookieJar
-}
-
-// Cookies returns the cookies to send to target, treating a
-// plain-HTTP target on localhost as HTTPS.
-func (jar loopbackJar) Cookies(target *url.URL) []*http.Cookie {
-	host := target.Hostname()
-	loopback := host == "localhost" || net.ParseIP(host).IsLoopback()
-
-	if target.Scheme == "http" && loopback {
-		secure := *target
-		secure.Scheme = "https"
-		target = &secure
-	}
-
-	return jar.CookieJar.Cookies(target)
-}
-
 // CreateSession creates a new session on the server.
 // If the server requires hashcash proof-of-work, it
 // automatically fetches the difficulty and computes a
@@ -250,7 +226,7 @@ func (client *Client) ListChannels() (
 // GetMembers returns members of a channel.
 func (client *Client) GetMembers(
 	channel string,
-) ([]Member, error) {
+) ([]string, error) {
 	name := strings.TrimPrefix(channel, "#")
 
 	data, err := client.do(
@@ -263,7 +239,7 @@ func (client *Client) GetMembers(
 		return nil, err
 	}
 
-	var members []Member
+	var members []string
 
 	err = json.Unmarshal(data, &members)
 	if err != nil {

internal/cli/api/client_test.go

@@ -1,490 +0,0 @@
-package neoircapi_test
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"reflect"
-	"slices"
-	"strconv"
-	"strings"
-	"testing"
-
-	api "sneak.berlin/go/neoirc/internal/cli/api"
-	"sneak.berlin/go/neoirc/internal/hashcash"
-)
-
-const (
-	cookieValue = "opaque-value"
-	testNick    = "alice"
-	testChannel = "#general"
-)
-
-// newSessionServer starts a plain-HTTP server that, like
-// neoircd, sets a Secure auth cookie when a session is
-// created and answers GET /api/v1/state only when that
-// cookie comes back.
-func newSessionServer(t *testing.T) *httptest.Server {
-	t.Helper()
-
-	mux := http.NewServeMux()
-
-	// Without hashcash the server sends no hashcash_bits.
-	mux.HandleFunc("GET /api/v1/server", func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		_, _ = io.WriteString(writer, `{
-			"name": "My NeoIRC Server",
-			"version": "0.1.0",
-			"motd": "Welcome! Be nice.",
-			"users": 42
-		}`)
-	})
-
-	mux.HandleFunc("POST /api/v1/session", func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		http.SetCookie(writer, &http.Cookie{
-			Name:     "neoirc_auth",
-			Value:    cookieValue,
-			Path:     "/",
-			HttpOnly: true,
-			Secure:   true,
-			SameSite: http.SameSiteStrictMode,
-		})
-		writer.WriteHeader(http.StatusCreated)
-
-		_, _ = io.WriteString(writer, `{"id":1,"nick":"alice"}`)
-	})
-
-	mux.HandleFunc("GET /api/v1/state", func(
-		writer http.ResponseWriter, request *http.Request,
-	) {
-		cookie, err := request.Cookie("neoirc_auth")
-		if err != nil || cookie.Value != cookieValue {
-			writer.WriteHeader(http.StatusUnauthorized)
-
-			return
-		}
-
-		_, _ = io.WriteString(writer, `{
-			"id": 1,
-			"nick": "alice",
-			"channels": [
-				{"id": 1, "name": "#general", "topic": "Welcome!"},
-				{"id": 2, "name": "#dev", "topic": ""}
-			]
-		}`)
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	return server
-}
-
-// newClientForPath starts a server that answers GET path with
-// body, and returns a client for it.
-func newClientForPath(t *testing.T, path, body string) *api.Client {
-	t.Helper()
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET "+path, func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		_, _ = io.WriteString(writer, body)
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	return api.NewClient(server.URL)
-}
-
-func TestGetStateDecodesFields(t *testing.T) {
-	t.Parallel()
-
-	client := api.NewClient(newSessionServer(t).URL)
-
-	_, err := client.CreateSession(testNick)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	state, err := client.GetState()
-	if err != nil {
-		t.Fatalf("state: %v", err)
-	}
-
-	want := api.StateResponse{
-		ID:   1,
-		Nick: testNick,
-		Channels: []api.Channel{
-			{Name: testChannel, Topic: "Welcome!"},
-			{Name: "#dev", Topic: ""},
-		},
-	}
-	if !reflect.DeepEqual(*state, want) {
-		t.Fatalf("state: got %+v, want %+v", *state, want)
-	}
-}
-
-func TestGetServerInfoDecodesFields(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/server", `{
-		"name": "My NeoIRC Server",
-		"version": "0.1.0",
-		"motd": "Welcome! Be nice.",
-		"users": 42,
-		"hashcash_bits": 20
-	}`)
-
-	info, err := client.GetServerInfo()
-	if err != nil {
-		t.Fatalf("server info: %v", err)
-	}
-
-	want := api.ServerInfo{
-		Name:         "My NeoIRC Server",
-		MOTD:         "Welcome! Be nice.",
-		Version:      "0.1.0",
-		HashcashBits: 20,
-	}
-	if *info != want {
-		t.Fatalf("server info: got %+v, want %+v", *info, want)
-	}
-}
-
-// TestCreateSessionSendsNickAndStamp serves a server that, like
-// neoircd with hashcash on, advertises hashcash_bits and creates
-// the session only for a pow_token the server's validator in
-// internal/hashcash accepts.
-func TestCreateSessionSendsNickAndStamp(t *testing.T) {
-	t.Parallel()
-
-	const (
-		serverName = "My NeoIRC Server"
-		stampBits  = 8
-		sessionID  = 7
-	)
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET /api/v1/server", func(
-		writer http.ResponseWriter, _ *http.Request,
-	) {
-		_, _ = fmt.Fprintf(writer, `{
-			"name": %q,
-			"version": "0.1.0",
-			"motd": "Welcome! Be nice.",
-			"users": 42,
-			"hashcash_bits": %d
-		}`, serverName, stampBits)
-	})
-
-	validator := hashcash.NewValidator(serverName)
-
-	mux.HandleFunc("POST /api/v1/session", func(
-		writer http.ResponseWriter, request *http.Request,
-	) {
-		// Decoded with the field names handleCreateSession uses.
-		var payload struct {
-			Nick     string `json:"nick"`
-			Hashcash string `json:"pow_token"` //nolint:tagliatelle
-		}
-
-		err := json.NewDecoder(request.Body).Decode(&payload)
-		if err != nil {
-			writer.WriteHeader(http.StatusBadRequest)
-
-			return
-		}
-
-		err = validator.Claim(payload.Hashcash, stampBits)
-		if err != nil {
-			writer.WriteHeader(http.StatusPaymentRequired)
-
-			return
-		}
-
-		writer.WriteHeader(http.StatusCreated)
-
-		_ = json.NewEncoder(writer).Encode(map[string]any{
-			"id":   sessionID,
-			"nick": payload.Nick,
-		})
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	session, err := api.NewClient(server.URL).CreateSession(testNick)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	want := api.SessionResponse{ID: sessionID, Nick: testNick}
-	if *session != want {
-		t.Fatalf("session: got %+v, want %+v", *session, want)
-	}
-}
-
-func TestListChannelsDecodesNamesAndTopics(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/channels", `[
-		{"id": 1, "name": "#general", "topic": "Welcome!"},
-		{"id": 2, "name": "#dev", "topic": "Development discussion"}
-	]`)
-
-	channels, err := client.ListChannels()
-	if err != nil {
-		t.Fatalf("list channels: %v", err)
-	}
-
-	want := []api.Channel{
-		{Name: testChannel, Topic: "Welcome!"},
-		{Name: "#dev", Topic: "Development discussion"},
-	}
-	if !slices.Equal(channels, want) {
-		t.Fatalf("channels: got %+v, want %+v", channels, want)
-	}
-}
-
-func TestGetMembersDecodesMemberObjects(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/channels/general/members", `[
-		{
-			"id": 1, "nick": "alice", "username": "alice",
-			"hostname": "host.example.com",
-			"isOperator": true, "isVoiced": false,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		},
-		{
-			"id": 2, "nick": "bob", "username": "bob",
-			"hostname": "host.example.com",
-			"isOperator": false, "isVoiced": true,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		},
-		{
-			"id": 3, "nick": "Carol", "username": "carol",
-			"hostname": "host.example.com",
-			"isOperator": false, "isVoiced": false,
-			"lastSeen": "2026-02-10T20:00:00Z"
-		}
-	]`)
-
-	members, err := client.GetMembers(testChannel)
-	if err != nil {
-		t.Fatalf("get members: %v", err)
-	}
-
-	want := []api.Member{
-		{Nick: testNick, IsOperator: true, IsVoiced: false},
-		{Nick: "bob", IsOperator: false, IsVoiced: true},
-		{Nick: "Carol", IsOperator: false, IsVoiced: false},
-	}
-	if !slices.Equal(members, want) {
-		t.Fatalf("members: got %+v, want %+v", members, want)
-	}
-}
-
-// TestPollMessagesAdvancesCursor serves the queue as the server
-// does: entries after the cursor, and last_id as the new cursor.
-func TestPollMessagesAdvancesCursor(t *testing.T) {
-	t.Parallel()
-
-	const lastQueueID = 42
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("GET /api/v1/messages", func(
-		writer http.ResponseWriter, request *http.Request,
-	) {
-		after := request.URL.Query().Get("after")
-		if after == strconv.Itoa(lastQueueID) {
-			_, _ = io.WriteString(
-				writer, `{"messages": [], "last_id": 42}`,
-			)
-
-			return
-		}
-
-		_, _ = io.WriteString(writer, `{
-			"messages": [{
-				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-				"command": "PRIVMSG",
-				"from": "alice",
-				"to": "#general",
-				"body": ["hello world"],
-				"ts": "2026-02-10T20:00:01.234567891Z",
-				"meta": {}
-			}],
-			"last_id": 42
-		}`)
-	})
-
-	server := httptest.NewServer(mux)
-	t.Cleanup(server.Close)
-
-	client := api.NewClient(server.URL)
-
-	first, err := client.PollMessages(0, 0)
-	if err != nil {
-		t.Fatalf("first poll: %v", err)
-	}
-
-	if first.LastID != lastQueueID || len(first.Messages) != 1 {
-		t.Fatalf(
-			"first poll: got last ID %d and %d messages, "+
-				"want %d and 1",
-			first.LastID, len(first.Messages), lastQueueID,
-		)
-	}
-
-	second, err := client.PollMessages(first.LastID, 0)
-	if err != nil {
-		t.Fatalf("second poll: %v", err)
-	}
-
-	if len(second.Messages) != 0 {
-		t.Fatalf(
-			"second poll: got %d messages again, want none",
-			len(second.Messages),
-		)
-	}
-}
-
-// TestPollMessagesDecodesMessageFields serves a relayed PRIVMSG
-// with the sender's meta and a numeric, as the server queues
-// them.
-func TestPollMessagesDecodesMessageFields(t *testing.T) {
-	t.Parallel()
-
-	client := newClientForPath(t, "/api/v1/messages", `{
-		"messages": [
-			{
-				"id": "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-				"command": "PRIVMSG",
-				"from": "alice",
-				"to": "#general",
-				"body": ["signed message"],
-				"ts": "2026-02-10T20:00:01.234567891Z",
-				"meta": {"sig": "base64...", "alg": "ed25519"}
-			},
-			{
-				"id": "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
-				"command": "RPL_LUSEROP",
-				"code": 252,
-				"from": "neoirc",
-				"to": "alice",
-				"params": ["0"],
-				"body": ["operator(s) online"],
-				"ts": "2026-02-10T20:00:02Z",
-				"meta": {}
-			}
-		],
-		"last_id": 42
-	}`)
-
-	result, err := client.PollMessages(0, 0)
-	if err != nil {
-		t.Fatalf("poll: %v", err)
-	}
-
-	want := []api.Message{
-		{
-			ID:      "b7c8210f-849c-4b90-9ee8-d99c8889358e",
-			Command: "PRIVMSG",
-			From:    testNick,
-			To:      testChannel,
-			Body:    []any{"signed message"},
-			TS:      "2026-02-10T20:00:01.234567891Z",
-			Meta:    map[string]any{"sig": "base64...", "alg": "ed25519"},
-		},
-		{
-			ID:      "7f5a04f8-eab4-4d2e-be55-f5cfcfaf43c5",
-			Command: "RPL_LUSEROP",
-			From:    "neoirc",
-			To:      testNick,
-			Params:  []string{"0"},
-			Body:    []any{"operator(s) online"},
-			TS:      "2026-02-10T20:00:02Z",
-			Meta:    map[string]any{},
-		},
-	}
-	if !reflect.DeepEqual(result.Messages, want) {
-		t.Fatalf("messages: got %+v, want %+v", result.Messages, want)
-	}
-}
-
-func TestClientKeepsSessionOverPlainHTTPOnLocalhost(t *testing.T) {
-	t.Parallel()
-
-	server := newSessionServer(t)
-
-	serverURL, err := url.Parse(server.URL)
-	if err != nil {
-		t.Fatalf("parse server URL: %v", err)
-	}
-
-	for _, host := range []string{"127.0.0.1", "localhost"} {
-		t.Run(host, func(t *testing.T) {
-			t.Parallel()
-
-			client := api.NewClient(
-				"http://" + net.JoinHostPort(host, serverURL.Port()),
-			)
-
-			_, err := client.CreateSession(testNick)
-			if err != nil {
-				t.Fatalf("create session: %v", err)
-			}
-
-			_, err = client.GetState()
-			if err != nil {
-				t.Fatalf("state after creating the session: %v", err)
-			}
-		})
-	}
-}
-
-func TestClientWithholdsCookieOverPlainHTTPFromOtherHosts(t *testing.T) {
-	t.Parallel()
-
-	server := newSessionServer(t)
-
-	// neoirc.example is not loopback. Every connection the client
-	// opens to it goes to the test server instead.
-	client := api.NewClient("http://neoirc.example")
-	client.HTTPClient.Transport = &http.Transport{
-		DialContext: func(
-			ctx context.Context, network, _ string,
-		) (net.Conn, error) {
-			var dialer net.Dialer
-
-			return dialer.DialContext(
-				ctx, network, server.Listener.Addr().String(),
-			)
-		},
-	}
-
-	_, err := client.CreateSession(testNick)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	// The server answers 401 when the auth cookie does not arrive.
-	_, err = client.GetState()
-	if err == nil || !strings.Contains(err.Error(), "401") {
-		t.Fatalf("state: got %v, want 401: cookie sent over plain HTTP", err)
-	}
-}

internal/cli/api/types.go

@@ -18,7 +18,7 @@ type SessionResponse struct {
 type StateResponse struct {
 	ID       int64    `json:"id"`
 	Nick     string   `json:"nick"`
-	Channels []Channel `json:"channels"`
+	Channels []string `json:"channels"`
 }
 
 // Message represents a neoirc message envelope.
@@ -53,19 +53,12 @@ func (m *Message) BodyLines() []string {
 	}
 }
 
-// Channel is a channel as GET /api/v1/channels and
+// Channel represents a channel in the list response.
-// GET /api/v1/state describe it.
 type Channel struct {
 	Name      string `json:"name"`
 	Topic     string `json:"topic"`
-}
+	Members   int    `json:"members"`
-
+	CreatedAt string `json:"createdAt"`
-// Member is one entry of the response from
-// GET /api/v1/channels/{name}/members.
-type Member struct {
-	Nick       string `json:"nick"`
-	IsOperator bool   `json:"isOperator"`
-	IsVoiced   bool   `json:"isVoiced"`
 }
 
 // ServerInfo is the response from GET /api/v1/server.
@@ -79,7 +72,7 @@ type ServerInfo struct {
 // MessagesResponse wraps polling results.
 type MessagesResponse struct {
 	Messages []Message `json:"messages"`
-	LastID   int64     `json:"last_id"` //nolint:tagliatelle
+	LastID   int64     `json:"lastId"`
 }
 
 // PollResult wraps the poll response including the cursor.

internal/cli/app.go

@@ -434,9 +434,16 @@ func (a *App) cmdTopic(args string) {
 		return
 	}
 
-	// The HTTP API has no topic query: a TOPIC needs text.
 	if args == "" {
-		a.ui.AddStatus("[red]Usage: /topic <text>")
+		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
+			Command: irc.CmdTopic,
+			To:      target,
+		})
+		if err != nil {
+			a.ui.AddStatus(fmt.Sprintf(
+				"[red]Topic query failed: %v", err,
+			))
+		}
 
 		return
 	}
@@ -480,32 +487,12 @@ func (a *App) cmdNames() {
 		return
 	}
 
-	nicks := make([]string, 0, len(members))
-
-	for _, member := range members {
-		nicks = append(nicks, memberPrefix(member)+member.Nick)
-	}
-
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[cyan]*** Members of %s: %s",
-		target, strings.Join(nicks, " "),
+		target, strings.Join(members, " "),
 	))
 }
 
-// memberPrefix returns "@" for an operator, "+" for a voiced
-// member, and "" for anyone else.
-func memberPrefix(member api.Member) string {
-	if member.IsOperator {
-		return "@"
-	}
-
-	if member.IsVoiced {
-		return "+"
-	}
-
-	return ""
-}
-
 func (a *App) cmdList() {
 	a.mu.Lock()
 	connected := a.connected
@@ -530,7 +517,8 @@ func (a *App) cmdList() {
 
 	for _, ch := range channels {
 		a.ui.AddStatus(fmt.Sprintf(
-			"  %s %s", ch.Name, ch.Topic,
+			"  %s (%d members) %s",
+			ch.Name, ch.Members, ch.Topic,
 		))
 	}
 
@@ -688,7 +676,7 @@ func (a *App) cmdHelp() {
 		"  /part [#chan]    — Leave channel",
 		"  /msg <nick> <text> — Send DM",
 		"  /query <nick>   — Open DM window",
-		"  /topic <text>   — Set topic",
+		"  /topic [text]   — View/set topic",
 		"  /names          — List channel members",
 		"  /list           — List channels",
 		"  /who [#channel] — List users in channel",
@@ -757,7 +745,7 @@ func (a *App) handleServerMessage(msg *api.Message) {
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
-		a.handlePartEvent(msg, timestamp, myNick)
+		a.handlePartEvent(msg, timestamp)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
@@ -813,14 +801,10 @@ func (a *App) handleJoinEvent(
 	))
 }
 
-// handlePartEvent shows another user's part. The server
-// also sends the user's own part back to it, which cmdPart
-// has already shown; showing it again would add a second
-// line and mark the channel just left as unread.
 func (a *App) handlePartEvent(
-	msg *api.Message, timestamp, myNick string,
+	msg *api.Message, timestamp string,
 ) {
-	if msg.To == "" || msg.From == myNick {
+	if msg.To == "" {
 		return
 	}
 

internal/cli/app_internal_test.go

@@ -1,116 +0,0 @@
-package cli
-
-import (
-	"testing"
-
-	"github.com/gdamore/tcell/v2"
-	api "sneak.berlin/go/neoirc/internal/cli/api"
-	"sneak.berlin/go/neoirc/pkg/irc"
-)
-
-func TestMemberPrefix(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		member api.Member
-		want   string
-	}{
-		{
-			name:   "operator",
-			member: api.Member{Nick: "alice", IsOperator: true},
-			want:   "@",
-		},
-		{
-			name:   "voiced member",
-			member: api.Member{Nick: "bob", IsVoiced: true},
-			want:   "+",
-		},
-		{
-			name: "voiced operator",
-			member: api.Member{
-				Nick: "Carol", IsOperator: true, IsVoiced: true,
-			},
-			want: "@",
-		},
-		{
-			name:   "plain member",
-			member: api.Member{Nick: "dave"},
-			want:   "",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := memberPrefix(test.member)
-			if got != test.want {
-				t.Fatalf("got %q, want %q", got, test.want)
-			}
-		})
-	}
-}
-
-// TestPartEvent checks that a PART event adds a line to the
-// channel's buffer and marks it unread, except for the
-// user's own part, which cmdPart has already shown.
-func TestPartEvent(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		from       string
-		wantLines  int
-		wantUnread int
-	}{
-		{name: "own part", from: "erin", wantLines: 0, wantUnread: 0},
-		{name: "other member", from: "bob", wantLines: 1, wantUnread: 1},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			app := &App{ui: NewUI(), nick: "erin"}
-			runUI(t, app.ui)
-
-			app.handleServerMessage(&api.Message{
-				Command: irc.CmdPart, From: test.from, To: "#chan",
-			})
-
-			var lines, unread int
-
-			app.ui.app.QueueUpdate(func() {
-				buf := app.ui.getOrCreateBuffer("#chan")
-				lines = len(buf.Lines)
-				unread = buf.Unread
-			})
-
-			if lines != test.wantLines || unread != test.wantUnread {
-				t.Fatalf("got %d lines and %d unread, want %d and %d",
-					lines, unread, test.wantLines, test.wantUnread)
-			}
-		})
-	}
-}
-
-// runUI runs ui on a simulated screen until the test ends.
-func runUI(t *testing.T, ui *UI) {
-	t.Helper()
-
-	ui.app.SetScreen(tcell.NewSimulationScreen(""))
-
-	done := make(chan error)
-
-	go func() { done <- ui.Run() }()
-
-	t.Cleanup(func() {
-		ui.Stop()
-
-		err := <-done
-		if err != nil {
-			t.Errorf("run ui: %v", err)
-		}
-	})
-}

internal/config/config.go

@@ -4,7 +4,6 @@ package config
 import (
 	"errors"
 	"log/slog"
-	"os"
 
 	"github.com/spf13/viper"
 	"go.uber.org/fx"
@@ -22,12 +21,6 @@ const defaultMOTD = ` _ __   ___  ___  (_)_ __ ___
 Welcome to NeoIRC — IRC semantics over HTTP.
 Type /help for available commands.`
 
-// DefaultDBURL is the database URL used when DBURL is not set. Its
-// _pragma parameters, which the SQLite driver runs on every connection
-// it opens, set WAL mode and a 5000 ms busy timeout.
-const DefaultDBURL = "file:///var/lib/neoirc/state.db" +
-	"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)"
-
 // Params defines the dependencies for creating a Config.
 type Params struct {
 	fx.In
@@ -78,7 +71,7 @@ func New(
 	viper.SetDefault("DEBUG", "false")
 	viper.SetDefault("MAINTENANCE_MODE", "false")
 	viper.SetDefault("PORT", "8080")
-	viper.SetDefault("DBURL", DefaultDBURL)
+	viper.SetDefault("DBURL", "file:///var/lib/neoirc/state.db?_journal_mode=WAL")
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
@@ -130,13 +123,6 @@ func New(
 		params:             &params,
 	}
 
-	// Viper counts an empty environment variable as unset, but an
-	// empty IRC_LISTEN_ADDR must turn the IRC listener off.
-	ircListenAddr, set := os.LookupEnv("IRC_LISTEN_ADDR")
-	if set {
-		cfg.IRCListenAddr = ircListenAddr
-	}
-
 	if cfg.Debug {
 		params.Logger.EnableDebugLogging()
 		cfg.log = params.Logger.Get()

internal/config/config_test.go

@@ -1,61 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/logger"
-)
-
-func newConfig(t *testing.T) *config.Config {
-	t.Helper()
-
-	globs := &globals.Globals{
-		Appname:   "neoirc-test",
-		Version:   "test",
-		StartTime: time.Now(),
-	}
-
-	log, err := logger.New(nil, logger.Params{Globals: globs})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	cfg, err := config.New(
-		nil, config.Params{Globals: globs, Logger: log},
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return cfg
-}
-
-func TestIRCListenAddrUnsetKeepsDefault(t *testing.T) {
-	// t.Setenv puts back whatever value was there after the test.
-	t.Setenv("IRC_LISTEN_ADDR", "")
-
-	err := os.Unsetenv("IRC_LISTEN_ADDR")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	const want = ":6667"
-
-	cfg := newConfig(t)
-	if cfg.IRCListenAddr != want {
-		t.Errorf("IRCListenAddr = %q, want %q", cfg.IRCListenAddr, want)
-	}
-}
-
-func TestIRCListenAddrEmptyTurnsListenerOff(t *testing.T) {
-	t.Setenv("IRC_LISTEN_ADDR", "")
-
-	cfg := newConfig(t)
-	if cfg.IRCListenAddr != "" {
-		t.Errorf("IRCListenAddr = %q, want empty", cfg.IRCListenAddr)
-	}
-}

internal/db/db.go

@@ -87,7 +87,7 @@ func (database *Database) GetDB() *sql.DB {
 func (database *Database) connect(ctx context.Context) error {
 	dbURL := database.params.Config.DBURL
 	if dbURL == "" {
-		dbURL = config.DefaultDBURL
+		dbURL = "file:///var/lib/neoirc/state.db?_journal_mode=WAL&_busy_timeout=5000"
 	}
 
 	database.log.Info(
@@ -116,6 +116,13 @@ func (database *Database) connect(ctx context.Context) error {
 		return fmt.Errorf("enable foreign keys: %w", err)
 	}
 
+	_, err = database.conn.ExecContext(
+		ctx, "PRAGMA busy_timeout = 5000",
+	)
+	if err != nil {
+		return fmt.Errorf("set busy timeout: %w", err)
+	}
+
 	return database.runMigrations(ctx)
 }
 

internal/db/db_test.go

@@ -1,75 +0,0 @@
-package db_test
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/logger"
-)
-
-const wantBusyTimeoutMS = 5000
-
-// TestDefaultDBURLSetsWALAndBusyTimeout opens a file database
-// with the default URL's parameters the way the server does,
-// and checks the journal mode and busy timeout it ends up with.
-func TestDefaultDBURLSetsWALAndBusyTimeout(t *testing.T) {
-	t.Parallel()
-
-	_, params, _ := strings.Cut(config.DefaultDBURL, "?")
-	dbURL := "file://" + filepath.Join(t.TempDir(), "state.db") +
-		"?" + params
-
-	lifecycle := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lifecycle, logger.Params{
-		Globals: &globals.Globals{},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	database, err := db.New(lifecycle, db.Params{
-		Logger: log,
-		Config: &config.Config{DBURL: dbURL},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	lifecycle.RequireStart()
-	t.Cleanup(lifecycle.RequireStop)
-
-	var journalMode string
-
-	err = database.GetDB().QueryRowContext(
-		t.Context(), "PRAGMA journal_mode",
-	).Scan(&journalMode)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if journalMode != "wal" {
-		t.Errorf("journal_mode = %q, want %q", journalMode, "wal")
-	}
-
-	var busyTimeout int
-
-	err = database.GetDB().QueryRowContext(
-		t.Context(), "PRAGMA busy_timeout",
-	).Scan(&busyTimeout)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if busyTimeout != wantBusyTimeoutMS {
-		t.Errorf(
-			"busy_timeout = %d, want %d",
-			busyTimeout, wantBusyTimeoutMS,
-		)
-	}
-}

internal/db/errors.go

@@ -1,3 +1,4 @@
+// Package db provides database access and migration management.
 package db
 
 import (
@@ -17,14 +18,3 @@ func IsUniqueConstraintError(err error) bool {
 
 	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
 }
-
-// IsForeignKeyConstraintError reports whether err is a
-// SQLite foreign-key constraint violation.
-func IsForeignKeyConstraintError(err error) bool {
-	var sqliteErr *sqlite.Error
-	if !errors.As(err, &sqliteErr) {
-		return false
-	}
-
-	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_FOREIGNKEY
-}

internal/db/export_test.go

@@ -59,8 +59,10 @@ func (database *Database) Close() error {
 	return nil
 }
 
-// ExecForTest runs a raw statement, such as a trigger that
+// ExecForTest runs a raw statement against the test
-// makes a write fail.
+// database.  Tests use it to install SQLite triggers that
+// force a specific write to fail, so that the atomicity of
+// multi-statement helpers can be exercised.
 func (database *Database) ExecForTest(
 	ctx context.Context,
 	query string,

internal/db/queries_test.go

@@ -2,7 +2,6 @@ package db_test
 
 import (
 	"encoding/json"
-	"slices"
 	"testing"
 
 	"sneak.berlin/go/neoirc/internal/db"
@@ -412,7 +411,7 @@ func TestJoinAndPart(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sid)
+	err = database.PartChannel(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -423,10 +422,7 @@ func TestJoinAndPart(t *testing.T) {
 	}
 }
 
-// TestPartChannelAndDeleteIfEmpty checks that a part keeps
+func TestDeleteChannelIfEmpty(t *testing.T) {
-// a channel another session is still on and deletes the
-// channel when its last member parts.
-func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
@@ -439,13 +435,9 @@ func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	nicks := []string{"temp1", "temp2"}
+	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
-	sids := make([]int64, 0, len(nicks))
+	if err != nil {
-
+		t.Fatal(err)
-	for _, nick := range nicks {
-		sid, _, _, createErr := database.CreateSession(ctx, nick, "", "", "")
-		if createErr != nil {
-			t.Fatal(createErr)
 	}
 
 	err = database.JoinChannel(ctx, chID, sid)
@@ -453,20 +445,12 @@ func TestPartChannelAndDeleteIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-		sids = append(sids, sid)
+	err = database.PartChannel(ctx, chID, sid)
-	}
-
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[0])
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_, err = database.GetChannelByName(ctx, "#empty")
+	err = database.DeleteChannelIfEmpty(ctx, chID)
-	if err != nil {
-		t.Fatalf("channel deleted while a member is on it: %v", err)
-	}
-
-	err = database.PartChannelAndDeleteIfEmpty(ctx, chID, sids[1])
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -635,7 +619,7 @@ func TestInsertMessage(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, msgUUID, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -669,13 +653,13 @@ func TestPollMessages(t *testing.T) {
 	body := json.RawMessage(`["hello"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "poller", "#test", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "poller", "#test", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.EnqueueToSession(ctx, sid, dbID, 0)
+	err = database.EnqueueToSession(ctx, sid, dbID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -722,16 +706,11 @@ func TestGetHistory(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	chID, err := database.GetOrCreateChannel(ctx, "#hist")
-	if err != nil {
-		t.Fatal(err)
-	}
-
 	const msgCount = 10
 
 	for range msgCount {
-		_, _, err = database.InsertMessage(
+		_, _, err := database.InsertMessage(
-			ctx, "PRIVMSG", "user", "#hist", 0, chID,
+			ctx, "PRIVMSG", "user", "#hist",
 			nil, json.RawMessage(`["msg"]`), nil,
 		)
 		if err != nil {
@@ -742,7 +721,7 @@ func TestGetHistory(t *testing.T) {
 	const histLimit = 5
 
 	msgs, err := database.GetHistory(
-		ctx, 0, chID, "", histLimit,
+		ctx, "#hist", 0, histLimit,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -758,209 +737,44 @@ func TestGetHistory(t *testing.T) {
 	}
 }
 
-// TestGetHistoryReusedNames checks that history follows the
+func TestDeleteSession(t *testing.T) {
-// session and the channel row, not the nick or the channel
-// name: a session that takes a released nick, and a channel
-// created again under a deleted one's name, start with none.
-func TestGetHistoryReusedNames(t *testing.T) {
 	t.Parallel()
 
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	historyLen := func(toSessionID, toChannelID int64) int {
+	sid, _, _, err := database.CreateSession(
-		t.Helper()
+		ctx, "deleteme", "", "", "",
-
-		msgs, err := database.GetHistory(
-			ctx, toSessionID, toChannelID, "", 0,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-		return len(msgs)
+	chID, err := database.GetOrCreateChannel(
-	}
+		ctx, "#delchan",
-
-	oldSID, _, _, err := database.CreateSession(
-		ctx, "reused", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	oldChID, err := database.GetOrCreateChannel(ctx, "#reused")
+	err = database.JoinChannel(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = database.JoinChannel(ctx, oldChID, oldSID)
+	err = database.DeleteSession(ctx, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	body := json.RawMessage(`["hi"]`)
-
-	_, _, err = database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "reused", oldSID, 0,
-		nil, body, nil,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, _, err = database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#reused", 0, oldChID,
-		nil, body, nil,
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if historyLen(oldSID, 0) != 1 || historyLen(0, oldChID) != 1 {
-		t.Fatal("expected one DM and one channel message")
-	}
-
-	// The session is the channel's only member, so quitting
-	// deletes the channel too.
-	_, err = database.QuitSession(ctx, oldSID, "reused", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	newSID, _, _, err := database.CreateSession(
-		ctx, "reused", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	newChID, err := database.GetOrCreateChannel(ctx, "#reused")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if historyLen(newSID, 0) != 0 || historyLen(0, newChID) != 0 {
-		t.Fatal("expected no history for the names' new holders")
-	}
-}
-
-// TestQuitSession checks that QuitSession deletes the
-// session, keeps a channel another session is still on,
-// deletes a channel it leaves with no members, and queues
-// one QUIT to the other session; and that a second call for
-// the same session changes nothing.
-func TestQuitSession(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sid, sharedID, _ := createSessionWithChannels(
-		t, database, "deleteme", "#shared", "#alone",
-	)
-
-	peerSID, peerClientID, _, err := database.CreateSession(
-		ctx, "peer", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = database.JoinChannel(ctx, sharedID, peerSID)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	body := json.RawMessage(`["bye"]`)
-
-	peerIDs, err := database.QuitSession(ctx, sid, "deleteme", body)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !slices.Equal(peerIDs, []int64{peerSID}) {
-		t.Fatalf("got peers %v, want [%d]", peerIDs, peerSID)
-	}
-
 	_, err = database.GetSessionByNick(ctx, "deleteme")
 	if err == nil {
 		t.Fatal("session should be deleted")
 	}
 
-	ids, _ := database.GetChannelMemberIDs(ctx, sharedID)
+	ids, _ := database.GetChannelMemberIDs(ctx, chID)
-	if !slices.Equal(ids, []int64{peerSID}) {
+	if len(ids) != 0 {
-		t.Fatalf("#shared members: got %v, want [%d]", ids, peerSID)
+		t.Fatal("expected no members after deletion")
-	}
-
-	_, err = database.GetChannelByName(ctx, "#alone")
-	if err == nil {
-		t.Fatal("expected the emptied channel to be deleted")
-	}
-
-	checkOneQuitQueued(t, database, peerClientID, "deleteme")
-
-	peerIDs, err = database.QuitSession(ctx, sid, "deleteme", body)
-	if err != nil || len(peerIDs) != 0 {
-		t.Fatalf("second quit: got %v, %v; want none", peerIDs, err)
-	}
-
-	checkOneQuitQueued(t, database, peerClientID, "deleteme")
-}
-
-// checkOneQuitQueued fails the test unless the queue of the
-// client clientID holds one message, a QUIT from nick.
-func checkOneQuitQueued(
-	t *testing.T,
-	database *db.Database,
-	clientID int64,
-	nick string,
-) {
-	t.Helper()
-
-	msgs, _, err := database.PollMessages(t.Context(), clientID, 0, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(msgs) != 1 || msgs[0].Command != "QUIT" || msgs[0].From != nick {
-		t.Fatalf("queue: got %v, want one QUIT from %s", msgs, nick)
-	}
-}
-
-// TestLogoutClientFailureKeepsClient checks that when the
-// session of a logout's last client cannot be deleted,
-// LogoutClient fails and the client stays logged in.
-func TestLogoutClientFailureKeepsClient(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sid, clientID, token, err := database.CreateSession(
-		ctx, "stuck", "", "", "",
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.GetDB().ExecContext(ctx,
-		`CREATE TRIGGER keep_sessions
-		 BEFORE DELETE ON sessions
-		 BEGIN
-		   SELECT RAISE(ABORT, 'sessions are kept');
-		 END`)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = database.LogoutClient(ctx, sid, clientID, "stuck", nil)
-	if err == nil {
-		t.Fatal("logout succeeded although the session was kept")
-	}
-
-	_, _, nick, err := database.GetSessionByToken(ctx, token)
-	if err != nil || nick != "stuck" {
-		t.Fatalf("client gone after a failed logout: %q, %v", nick, err)
 	}
 }
 
@@ -1049,7 +863,7 @@ func TestEnqueueToClient(t *testing.T) {
 	body := json.RawMessage(`["test"]`)
 
 	dbID, _, err := database.InsertMessage(
-		ctx, "PRIVMSG", "sender", "#ch", 0, 0, nil, body, nil,
+		ctx, "PRIVMSG", "sender", "#ch", nil, body, nil,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -1173,12 +987,11 @@ func TestGetOperCount(t *testing.T) {
 	sid2, _, _, err := database.CreateSession(
 		ctx, "user2", "", "", "",
 	)
+	_ = sid2
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	_ = sid2
-
 	// Initially zero opers.
 	count, err := database.GetOperCount(ctx)
 	if err != nil {
@@ -1210,25 +1023,23 @@ func TestGetOperCount(t *testing.T) {
 func TestWildcardMatch(t *testing.T) {
 	t.Parallel()
 
-	const hostmask = "nick!user@host"
-
 	tests := []struct {
 		pattern string
 		input   string
 		match   bool
 	}{
-		{"*!*@*", hostmask, true},
+		{"*!*@*", "nick!user@host", true},
 		{"*!*@*.example.com", "nick!user@foo.example.com", true},
 		{"*!*@*.example.com", "nick!user@other.net", false},
 		{"badnick!*@*", "badnick!user@host", true},
 		{"badnick!*@*", "goodnick!user@host", false},
-		{hostmask, hostmask, true},
+		{"nick!user@host", "nick!user@host", true},
-		{hostmask, "nick!user@other", false},
+		{"nick!user@host", "nick!user@other", false},
 		{"*", "anything", true},
-		{"?ick!*@*", hostmask, true},
+		{"?ick!*@*", "nick!user@host", true},
 		{"?ick!*@*", "nn!user@host", false},
 		// Case-insensitive.
-		{"Nick!*@*", hostmask, true},
+		{"Nick!*@*", "nick!user@host", true},
 	}
 
 	for _, tc := range tests {
@@ -1439,6 +1250,17 @@ func TestChannelInviteCRUD(t *testing.T) {
 	if !has {
 		t.Fatal("should have invite")
 	}
+
+	// Clear invite.
+	err = database.ClearChannelInvite(ctx, chID, sid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	has, _ = database.HasChannelInvite(ctx, chID, sid)
+	if has {
+		t.Fatal("invite should be cleared")
+	}
 }
 
 func TestChannelSecret(t *testing.T) {
@@ -1667,9 +1489,13 @@ func TestChannelUserLimit(t *testing.T) {
 	}
 }
 
-// TestSetSessionUserModesIsAtomic makes the is_oper write
+// TestSetSessionUserModesIsAtomic proves that a multi-mode
-// fail after the is_wallops write has run, and checks that
+// change is all-or-nothing.  A trigger makes the is_oper
-// the wallops change was rolled back.
+// UPDATE fail after the is_wallops UPDATE has already run,
+// which is exactly the "+w-o" partial-failure the previous
+// implementation exhibited: it issued the two UPDATEs
+// independently, so +w persisted while the caller reported
+// total failure.
 func TestSetSessionUserModesIsAtomic(t *testing.T) {
 	t.Parallel()
 
@@ -1711,12 +1537,16 @@ func TestSetSessionUserModesIsAtomic(t *testing.T) {
 	}
 
 	if gotWallops {
-		t.Error("wallops was stored although the change failed")
+		t.Error(
+			"wallops persisted despite the transaction " +
+				"failing; the apply stage is not atomic",
+		)
 	}
 }
 
-// TestSetSessionUserModesAppliesBoth checks that both flags
+// TestSetSessionUserModesAppliesBoth is the success-path
-// are written, and that a nil flag is left as it is.
+// counterpart: when nothing fails, both flags are written,
+// and a nil pointer leaves that flag untouched.
 func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 	t.Parallel()
 
@@ -1730,18 +1560,18 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = database.SetSessionOper(ctx, sessionID, true)
+	if err := database.SetSessionOper(
-	if err != nil {
+		ctx, sessionID, true,
+	); err != nil {
 		t.Fatal(err)
 	}
 
 	wallops := true
 	oper := false
 
-	err = database.SetSessionUserModes(
+	if err := database.SetSessionUserModes(
 		ctx, sessionID, &wallops, &oper,
-	)
+	); err != nil {
-	if err != nil {
 		t.Fatal(err)
 	}
 
@@ -1764,10 +1594,10 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 		)
 	}
 
-	err = database.SetSessionUserModes(
+	// A nil pointer must leave the stored value alone.
+	if err := database.SetSessionUserModes(
 		ctx, sessionID, nil, nil,
-	)
+	); err != nil {
-	if err != nil {
 		t.Fatal(err)
 	}
 
@@ -1779,6 +1609,6 @@ func TestSetSessionUserModesAppliesBoth(t *testing.T) {
 	}
 
 	if !gotWallops {
-		t.Error("a nil wallops flag cleared wallops")
+		t.Error("nil pointers must not clear wallops")
 	}
 }

internal/db/schema/001_initial.sql

@@ -85,25 +85,19 @@ CREATE TABLE IF NOT EXISTS channel_members (
     UNIQUE(channel_id, session_id)
 );
 
--- Messages: IRC envelope format. to_session_id is the session a DM
+-- Messages: IRC envelope format
--- or INVITE was sent to, to_channel_id the channel a channel message
--- was sent to. History is selected by these ids because nicks and
--- channel names are reused once released, and ids are not.
 CREATE TABLE IF NOT EXISTS messages (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     uuid TEXT NOT NULL UNIQUE,
     command TEXT NOT NULL DEFAULT 'PRIVMSG',
     msg_from TEXT NOT NULL DEFAULT '',
     msg_to TEXT NOT NULL DEFAULT '',
-    to_session_id INTEGER REFERENCES sessions(id) ON DELETE SET NULL,
-    to_channel_id INTEGER REFERENCES channels(id) ON DELETE SET NULL,
     params TEXT NOT NULL DEFAULT '[]',
     body TEXT NOT NULL DEFAULT '[]',
     meta TEXT NOT NULL DEFAULT '{}',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
-CREATE INDEX IF NOT EXISTS idx_messages_to_session ON messages(to_session_id, id);
+CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
-CREATE INDEX IF NOT EXISTS idx_messages_to_channel ON messages(to_channel_id, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);
 
 -- Spent hashcash tokens for replay prevention (1-year TTL)

internal/handlers/auth.go

@@ -8,12 +8,7 @@ import (
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-// A session password is 8 to 72 bytes; bcrypt cannot hash
+const minPasswordLength = 8
-// a longer one.
-const (
-	minPasswordLength = 8
-	maxPasswordLength = 72
-)
 
 // HandleLogin authenticates a user with nick and password.
 func (hdlr *Handlers) HandleLogin() http.HandlerFunc {
@@ -122,11 +117,11 @@ func (hdlr *Handlers) executeLogin(
 		request, clientID, sessionID, nick,
 	)
 
-	hdlr.setAuthCookie(writer, token)
+	hdlr.setAuthCookie(writer, request, token)
 
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":   sessionID,
-		nickKey: nick,
+		"nick": nick,
 	}, http.StatusOK)
 }
 
@@ -154,13 +149,12 @@ func (hdlr *Handlers) handlePass(
 
 	password := lines[0]
 
-	if len(password) < minPasswordLength ||
+	if len(password) < minPasswordLength {
-		len(password) > maxPasswordLength {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick,
 			[]string{irc.CmdPass},
-			"Password must be 8 to 72 bytes",
+			"Password must be at least 8 characters",
 		)
 
 		return
@@ -183,6 +177,6 @@ func (hdlr *Handlers) handlePass(
 	}
 
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }

internal/handlers/export_test.go

@@ -1,19 +0,0 @@
-package handlers
-
-import (
-	"context"
-
-	"sneak.berlin/go/neoirc/internal/db"
-)
-
-// SetPollMessages makes HandleGetMessages read the client
-// output queue with poll in place of Database.PollMessages.
-func (hdlr *Handlers) SetPollMessages(
-	poll func(
-		ctx context.Context,
-		clientID, afterQueueID int64,
-		limit int,
-	) ([]db.IRCMessage, int64, error),
-) {
-	hdlr.pollMessages = poll
-}

internal/handlers/handlers.go

@@ -24,14 +24,6 @@ import (
 
 var errUnauthorized = errors.New("unauthorized")
 
-// Field names and values used in many JSON responses.
-const (
-	statusKey   = "status"
-	statusError = "error"
-	errorKey    = "error"
-	nickKey     = "nick"
-)
-
 // Params defines the dependencies for creating Handlers.
 type Params struct {
 	fx.In
@@ -61,19 +53,10 @@ type Handlers struct {
 	broker          *broker.Broker
 	svc             *service.Service
 	hashcashVal     *hashcash.Validator
+	channelHashcash *hashcash.ChannelValidator
 	loginLimiter    *ratelimit.Limiter
 	stats           *stats.Tracker
 	cancelCleanup   context.CancelFunc
-
-	// pollMessages is Database.PollMessages, with which
-	// HandleGetMessages reads the client output queue. Tests
-	// replace it to act just after a read, or to make a read
-	// fail.
-	pollMessages func(
-		ctx context.Context,
-		clientID, afterQueueID int64,
-		limit int,
-	) ([]db.IRCMessage, int64, error)
 }
 
 // New creates a new Handlers instance.
@@ -103,9 +86,9 @@ func New(
 		broker:          params.Broker,
 		svc:             params.Service,
 		hashcashVal:     hashcash.NewValidator(resource),
+		channelHashcash: hashcash.NewChannelValidator(),
 		loginLimiter:    ratelimit.New(loginRate, loginBurst),
 		stats:           params.Stats,
-		pollMessages: params.Database.PollMessages,
 	}
 
 	lifecycle.Append(fx.Hook{
@@ -154,7 +137,7 @@ func (hdlr *Handlers) respondError(
 ) {
 	hdlr.respondJSON(
 		writer, request,
-		map[string]string{errorKey: msg},
+		map[string]string{"error": msg},
 		status,
 	)
 }

internal/handlers/utility.go

@@ -1,15 +1,56 @@
 package handlers
 
 import (
+	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 	"time"
 
+	"sneak.berlin/go/neoirc/internal/db"
+	"sneak.berlin/go/neoirc/internal/service"
 	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
-// dispatchOperCommand routes the server operator commands
+// maxUserhostNicks is the maximum number of nicks allowed
-// OPER, KILL and WALLOPS to their handlers.
+// in a single USERHOST query (RFC 2812).
+const maxUserhostNicks = 5
+
+// dispatchBodyOnlyCommand routes commands that take
+// (writer, request, sessionID, clientID, nick, bodyLines).
+func (hdlr *Handlers) dispatchBodyOnlyCommand(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, command string,
+	bodyLines func() []string,
+) {
+	switch command {
+	case irc.CmdAway:
+		hdlr.handleAway(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdNick:
+		hdlr.handleNick(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdPass:
+		hdlr.handlePass(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	case irc.CmdInvite:
+		hdlr.handleInvite(
+			writer, request,
+			sessionID, clientID, nick, bodyLines,
+		)
+	}
+}
+
+// dispatchOperCommand routes oper-related commands (OPER,
+// KILL, WALLOPS) to their handlers.
 func (hdlr *Handlers) dispatchOperCommand(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -36,8 +77,8 @@ func (hdlr *Handlers) dispatchOperCommand(
 	}
 }
 
-// handleUserhost handles USERHOST: user@host for each of
+// handleUserhost handles the USERHOST command.
-// up to five nicks given in the body.
+// Returns user@host info for up to 5 nicks.
 func (hdlr *Handlers) handleUserhost(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -45,6 +86,8 @@ func (hdlr *Handlers) handleUserhost(
 	nick string,
 	bodyLines func() []string,
 ) {
+	ctx := request.Context()
+
 	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
@@ -57,47 +100,107 @@ func (hdlr *Handlers) handleUserhost(
 		return
 	}
 
-	reply, err := hdlr.svc.UserhostReply(
+	// Limit to 5 nicks per RFC 2812.
-		request.Context(), lines, hdlr.serverName(),
+	nicks := lines
+	if len(nicks) > maxUserhostNicks {
+		nicks = nicks[:maxUserhostNicks]
+	}
+
+	infos, err := hdlr.params.Database.GetUserhostInfo(
+		ctx, nicks,
 	)
-	if hdlr.handleServiceError(
+	if err != nil {
-		writer, request, clientID, sessionID, nick, err,
+		hdlr.log.Error(
-	) {
+			"userhost query failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
 		return
 	}
 
+	replyStr := hdlr.buildUserhostReply(infos)
+
 	hdlr.enqueueNumeric(
-		request.Context(), clientID,
+		ctx, clientID, irc.RplUserHost, nick, nil,
-		irc.RplUserHost, nick, nil, reply,
+		replyStr,
 	)
+
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleVersion handles VERSION.
+// buildUserhostReply builds the RPL_USERHOST reply
+// string per RFC 2812.
+func (hdlr *Handlers) buildUserhostReply(
+	infos []db.UserhostInfo,
+) string {
+	replies := make([]string, 0, len(infos))
+
+	for idx := range infos {
+		info := &infos[idx]
+
+		username := info.Username
+		if username == "" {
+			username = info.Nick
+		}
+
+		hostname := info.Hostname
+		if hostname == "" {
+			hostname = hdlr.serverName()
+		}
+
+		operStar := ""
+		if info.IsOper {
+			operStar = "*"
+		}
+
+		awayPrefix := "+"
+		if info.AwayMessage != "" {
+			awayPrefix = "-"
+		}
+
+		replies = append(replies,
+			info.Nick+operStar+"="+
+				awayPrefix+username+"@"+hostname,
+		)
+	}
+
+	return strings.Join(replies, " ")
+}
+
+// handleVersion handles the VERSION command.
+// Returns the server version string.
 func (hdlr *Handlers) handleVersion(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick string,
 ) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+	version := hdlr.svc.ServerVersion()
+
+	// 351 RPL_VERSION
 	hdlr.enqueueNumeric(
-		request.Context(), clientID, irc.RplVersion, nick,
+		ctx, clientID, irc.RplVersion, nick,
-		[]string{
+		[]string{version + ".", srvName},
-			hdlr.svc.ServerVersion() + ".",
-			hdlr.serverName(),
-		},
 		"",
 	)
+
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleAdmin handles ADMIN.
+// handleAdmin handles the ADMIN command.
+// Returns server admin contact info.
 func (hdlr *Handlers) handleAdmin(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -106,28 +209,40 @@ func (hdlr *Handlers) handleAdmin(
 ) {
 	ctx := request.Context()
 	srvName := hdlr.serverName()
-	location1, location2, email := hdlr.svc.AdminLines(srvName)
 
+	// 256 RPL_ADMINME
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplAdminMe, nick,
-		[]string{srvName}, "Administrative info",
+		[]string{srvName},
+		"Administrative info",
 	)
+
+	// 257 RPL_ADMINLOC1
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminLoc1, nick, nil, location1,
+		ctx, clientID, irc.RplAdminLoc1, nick, nil,
+		"neoirc server",
 	)
+
+	// 258 RPL_ADMINLOC2
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminLoc2, nick, nil, location2,
+		ctx, clientID, irc.RplAdminLoc2, nick, nil,
+		"IRC over HTTP",
 	)
+
+	// 259 RPL_ADMINEMAIL
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplAdminEmail, nick, nil, email,
+		ctx, clientID, irc.RplAdminEmail, nick, nil,
+		"admin@"+srvName,
 	)
+
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleInfo handles INFO.
+// handleInfo handles the INFO command.
+// Returns server software information.
 func (hdlr *Handlers) handleInfo(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -137,41 +252,51 @@ func (hdlr *Handlers) handleInfo(
 	ctx := request.Context()
 
 	for _, line := range hdlr.svc.InfoLines() {
+		// 371 RPL_INFO
 		hdlr.enqueueNumeric(
-			ctx, clientID, irc.RplInfo, nick, nil, line,
+			ctx, clientID, irc.RplInfo, nick, nil,
+			line,
 		)
 	}
 
+	// 374 RPL_ENDOFINFO
 	hdlr.enqueueNumeric(
 		ctx, clientID, irc.RplEndOfInfo, nick, nil,
 		"End of /INFO list",
 	)
+
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleTime handles TIME: the server's local time.
+// handleTime handles the TIME command.
+// Returns the server's local time in RFC format.
 func (hdlr *Handlers) handleTime(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick string,
 ) {
+	ctx := request.Context()
+	srvName := hdlr.serverName()
+
+	// 391 RPL_TIME
 	hdlr.enqueueNumeric(
-		request.Context(), clientID, irc.RplTime, nick,
+		ctx, clientID, irc.RplTime, nick,
-		[]string{hdlr.serverName()},
+		[]string{srvName},
 		time.Now().Format(time.RFC1123),
 	)
+
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleKill handles KILL: the body is the target nick and
+// handleKill handles the KILL command.
-// an optional reason.
+// Forcibly disconnects a user (oper only).
 func (hdlr *Handlers) handleKill(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -179,9 +304,25 @@ func (hdlr *Handlers) handleKill(
 	nick string,
 	bodyLines func() []string,
 ) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
 	lines := bodyLines()
 
-	targetNick := ""
+	var targetNick string
 	if len(lines) > 0 {
 		targetNick = strings.TrimSpace(lines[0])
 	}
@@ -197,27 +338,52 @@ func (hdlr *Handlers) handleKill(
 		return
 	}
 
-	reason := ""
+	reason := "KILLed"
 	if len(lines) > 1 {
 		reason = lines[1]
 	}
 
-	err := hdlr.svc.KillUser(
+	targetSID, lookupErr := hdlr.params.Database.
-		request.Context(), sessionID, nick,
+		GetSessionByNick(ctx, targetNick)
-		targetNick, reason,
+	if lookupErr != nil {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoSuchNick, nick,
+			[]string{targetNick},
+			"No such nick/channel",
 		)
-	if hdlr.handleServiceError(
+
-		writer, request, clientID, sessionID, nick, err,
-	) {
 		return
 	}
 
+	// Do not allow killing yourself.
+	if targetSID == sessionID {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrCantKillServer, nick, nil,
+			"You cannot KILL yourself",
+		)
+
+		return
+	}
+
+	quitReason := "Killed (" + nick + " (" + reason + "))"
+
+	// KillSession broadcasts the QUIT, deletes the session
+	// and disconnects the victim's wire connection if it
+	// holds one.
+	hdlr.svc.KillSession(
+		ctx, targetSID, targetNick, quitReason,
+	)
+
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleWallops handles WALLOPS: the body is the message.
+// handleWallops handles the WALLOPS command.
+// Broadcasts a message to all users with +w usermode
+// (oper only).
 func (hdlr *Handlers) handleWallops(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -225,6 +391,22 @@ func (hdlr *Handlers) handleWallops(
 	nick string,
 	bodyLines func() []string,
 ) {
+	ctx := request.Context()
+
+	// Check oper status.
+	isOper, err := hdlr.params.Database.IsSessionOper(
+		ctx, sessionID,
+	)
+	if err != nil || !isOper {
+		hdlr.respondIRCError(
+			writer, request, clientID, sessionID,
+			irc.ErrNoPrivileges, nick, nil,
+			"Permission Denied- You're not an IRC operator",
+		)
+
+		return
+	}
+
 	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.respondIRCError(
@@ -237,24 +419,54 @@ func (hdlr *Handlers) handleWallops(
 		return
 	}
 
-	err := hdlr.svc.SendWallops(
+	message := strings.Join(lines, " ")
-		request.Context(), sessionID, nick,
+
-		strings.Join(lines, " "),
+	wallopsSIDs, err := hdlr.params.Database.
+		GetWallopsSessionIDs(ctx)
+	if err != nil {
+		hdlr.log.Error(
+			"get wallops sessions failed", "error", err,
 		)
-	if hdlr.handleServiceError(
+		hdlr.respondError(
-		writer, request, clientID, sessionID, nick, err,
+			writer, request,
-	) {
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
 		return
 	}
 
+	if len(wallopsSIDs) > 0 {
+		body, mErr := json.Marshal([]string{message})
+		if mErr != nil {
+			hdlr.log.Error(
+				"marshal wallops body", "error", mErr,
+			)
+			hdlr.respondError(
+				writer, request,
+				"internal error",
+				http.StatusInternalServerError,
+			)
+
+			return
+		}
+
+		_ = hdlr.fanOutSilent(
+			request, irc.CmdWallops, nick, "*",
+			json.RawMessage(body), wallopsSIDs,
+		)
+	}
+
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
 
-// handleUserMode handles MODE for a nick: a query when the
+// handleUserMode handles user mode queries and changes
-// body is empty, otherwise a change by the mode string in
+// (e.g., MODE nick, MODE nick +w). Delegates to the
-// the body. Only the caller's own nick is allowed.
+// shared service.ApplyUserMode / service.QueryUserMode so
+// that mode string processing is identical for both the
+// HTTP API and IRC wire protocol.
 func (hdlr *Handlers) handleUserMode(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -262,7 +474,14 @@ func (hdlr *Handlers) handleUserMode(
 	nick, target string,
 	bodyLines func() []string,
 ) {
-	if target != nick {
+	ctx := request.Context()
+
+	// Users can only query or change their own modes. The
+	// check is above the query/change split so that both
+	// forms are rejected, and uses EqualFold because IRC
+	// nicks are case-insensitive — matching the wire path
+	// in ircserver.handleUserMode.
+	if target != "" && !strings.EqualFold(target, nick) {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrUsersDoNotMatch, nick, nil,
@@ -272,33 +491,86 @@ func (hdlr *Handlers) handleUserMode(
 		return
 	}
 
-	ctx := request.Context()
-
-	var (
-		modes string
-		err   error
-	)
-
 	lines := bodyLines()
+
+	// Mode change requested.
 	if len(lines) > 0 {
-		modes, err = hdlr.svc.ApplyUserMode(
+		hdlr.changeUserMode(
-			ctx, sessionID, lines[0],
+			writer, request,
+			sessionID, clientID, nick, lines[0],
 		)
-	} else {
+
-		modes, err = hdlr.svc.QueryUserMode(ctx, sessionID)
+		return
 	}
 
-	if hdlr.handleServiceError(
+	// Mode query — delegate to shared service.
-		writer, request, clientID, sessionID, nick, err,
+	modeStr, err := hdlr.svc.QueryUserMode(ctx, sessionID)
-	) {
+	if err != nil {
+		hdlr.log.Error(
+			"query user mode failed", "error", err,
+		)
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
 		return
 	}
 
 	hdlr.enqueueNumeric(
-		ctx, clientID, irc.RplUmodeIs, nick, nil, modes,
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		modeStr,
 	)
 	hdlr.broker.Notify(sessionID)
 	hdlr.respondJSON(writer, request,
-		map[string]string{statusKey: "ok"},
+		map[string]string{"status": "ok"},
+		http.StatusOK)
+}
+
+// changeUserMode applies a mode string to the caller's own
+// session. The caller has already verified that the target
+// nick is the caller's own.
+func (hdlr *Handlers) changeUserMode(
+	writer http.ResponseWriter,
+	request *http.Request,
+	sessionID, clientID int64,
+	nick, modeStr string,
+) {
+	ctx := request.Context()
+
+	newModes, err := hdlr.svc.ApplyUserMode(
+		ctx, sessionID, modeStr,
+	)
+	if err != nil {
+		var ircErr *service.IRCError
+		if errors.As(err, &ircErr) {
+			hdlr.respondIRCError(
+				writer, request,
+				clientID, sessionID,
+				ircErr.Code, nick, ircErr.Params,
+				ircErr.Message,
+			)
+
+			return
+		}
+
+		hdlr.respondError(
+			writer, request,
+			"internal error",
+			http.StatusInternalServerError,
+		)
+
+		return
+	}
+
+	hdlr.enqueueNumeric(
+		ctx, clientID, irc.RplUmodeIs, nick, nil,
+		newModes,
+	)
+
+	hdlr.broker.Notify(sessionID)
+	hdlr.respondJSON(writer, request,
+		map[string]string{"status": "ok"},
 		http.StatusOK)
 }

internal/hashcash/hashcash.go

@@ -77,13 +77,9 @@ func NewValidator(resource string) *Validator {
 	return validator
 }
 
-// Check returns nil if requiredBits is not positive, or if
+// Validate checks a hashcash stamp. It returns nil if the
-// the stamp is a well-formed, recently dated proof of work
+// stamp is valid and has not been seen before.
-// for this resource with at least requiredBits. It does not
+func (v *Validator) Validate(
-// look at or change the set of spent stamps, so a request
-// can check its stamp first and Claim it after its other
-// checks.
-func (v *Validator) Check(
 	stamp string,
 	requiredBits int,
 ) error {
@@ -91,49 +87,9 @@ func (v *Validator) Check(
 		return nil
 	}
 
-	_, err := v.check(stamp, requiredBits)
-
-	return err
-}
-
-// Claim checks the stamp as Check does and, when
-// requiredBits is positive, records it as spent until it
-// expires. It returns an error if the stamp is already
-// spent. Release gives a claimed stamp back.
-func (v *Validator) Claim(
-	stamp string,
-	requiredBits int,
-) error {
-	if requiredBits <= 0 {
-		return nil
-	}
-
-	stampTime, err := v.check(stamp, requiredBits)
-	if err != nil {
-		return err
-	}
-
-	return v.checkAndRecordStamp(stamp, stampTime)
-}
-
-// Release forgets a claimed stamp so that it can be claimed
-// again, for a request that failed after its Claim.
-// Releasing a stamp that is not claimed does nothing.
-func (v *Validator) Release(stamp string) {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
-	delete(v.spent, stamp)
-}
-
-// check returns the stamp's date if Check accepts it.
-func (v *Validator) check(
-	stamp string,
-	requiredBits int,
-) (time.Time, error) {
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
-		return time.Time{}, fmt.Errorf(
+		return fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
@@ -144,29 +100,28 @@ func (v *Validator) check(
 	dateStr := parts[2]
 	resource := parts[3]
 
-	err := v.validateHeader(
+	if err := v.validateHeader(
 		version, bitsStr, resource, requiredBits,
-	)
+	); err != nil {
-	if err != nil {
+		return err
-		return time.Time{}, err
 	}
 
 	stampTime, err := parseStampDate(dateStr)
 	if err != nil {
-		return time.Time{}, err
+		return err
 	}
 
-	err = validateTime(stampTime)
+	if err := validateTime(stampTime); err != nil {
-	if err != nil {
+		return err
-		return time.Time{}, err
 	}
 
-	err = validateProof(stamp, requiredBits)
+	if err := validateProof(
-	if err != nil {
+		stamp, requiredBits,
-		return time.Time{}, err
+	); err != nil {
+		return err
 	}
 
-	return stampTime, nil
+	return v.checkAndRecordStamp(stamp, stampTime)
 }
 
 func (v *Validator) validateHeader(

internal/hashcash/hashcash_test.go

@@ -85,7 +85,7 @@ func TestMintAndValidate(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("valid stamp rejected: %v", err)
 	}
@@ -99,74 +99,17 @@ func TestReplayDetection(t *testing.T) {
 		t, testBits, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("first use failed: %v", err)
 	}
 
-	err = validator.Claim(stamp, testBits)
+	err = validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("replay not detected")
 	}
 }
 
-// TestCheckDoesNotSpendStamp checks that a stamp Check
-// accepts can still be claimed, and only once, and that
-// Check still accepts it once it is spent.
-func TestCheckDoesNotSpendStamp(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewValidator("test-resource")
-	stamp := mintStampWithDate(
-		t, testBits, "test-resource", todayDate(),
-	)
-
-	for range 2 {
-		err := validator.Check(stamp, testBits)
-		if err != nil {
-			t.Fatalf("valid stamp rejected: %v", err)
-		}
-	}
-
-	err := validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("claim after check failed: %v", err)
-	}
-
-	err = validator.Claim(stamp, testBits)
-	if err == nil {
-		t.Fatal("replay not detected")
-	}
-
-	err = validator.Check(stamp, testBits)
-	if err != nil {
-		t.Fatalf("spent stamp rejected by Check: %v", err)
-	}
-}
-
-// TestReleasedStampCanBeClaimedAgain checks that Release
-// gives a claimed stamp back.
-func TestReleasedStampCanBeClaimedAgain(t *testing.T) {
-	t.Parallel()
-
-	validator := hashcash.NewValidator("test-resource")
-	stamp := mintStampWithDate(
-		t, testBits, "test-resource", todayDate(),
-	)
-
-	err := validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("first claim failed: %v", err)
-	}
-
-	validator.Release(stamp)
-
-	err = validator.Claim(stamp, testBits)
-	if err != nil {
-		t.Fatalf("claim after release failed: %v", err)
-	}
-}
-
 func TestResourceMismatch(t *testing.T) {
 	t.Parallel()
 
@@ -175,7 +118,7 @@ func TestResourceMismatch(t *testing.T) {
 		t, testBits, "wrong-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected resource mismatch error")
 	}
@@ -186,7 +129,7 @@ func TestInvalidStampFormat(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Claim(
+	err := validator.Validate(
 		"not:a:valid:stamp", testBits,
 	)
 	if err == nil {
@@ -203,7 +146,7 @@ func TestBadVersion(t *testing.T) {
 		testBits, todayDate(), "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
@@ -219,7 +162,7 @@ func TestInsufficientDifficulty(t *testing.T) {
 		todayDate(), "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
@@ -235,7 +178,7 @@ func TestExpiredStamp(t *testing.T) {
 		t, testBits, "test-resource", oldDate,
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
@@ -246,14 +189,9 @@ func TestZeroBitsSkipsValidation(t *testing.T) {
 
 	validator := hashcash.NewValidator("test-resource")
 
-	err := validator.Check("garbage", 0)
+	err := validator.Validate("garbage", 0)
 	if err != nil {
-		t.Fatalf("zero bits should skip the check: %v", err)
+		t.Fatalf("zero bits should skip: %v", err)
-	}
-
-	err = validator.Claim("garbage", 0)
-	if err != nil {
-		t.Fatalf("zero bits should skip the claim: %v", err)
 	}
 }
 
@@ -266,7 +204,7 @@ func TestLongDateFormat(t *testing.T) {
 		t, testBits, "test-resource", longDate,
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("long date stamp rejected: %v", err)
 	}
@@ -281,7 +219,7 @@ func TestBadDateFormat(t *testing.T) {
 		testBits, "test-resource",
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad date error")
 	}
@@ -297,7 +235,7 @@ func TestMultipleUniqueStamps(t *testing.T) {
 			t, testBits, "test-resource", todayDate(),
 		)
 
-		err := validator.Claim(stamp, testBits)
+		err := validator.Validate(stamp, testBits)
 		if err != nil {
 			t.Fatalf("unique stamp rejected: %v", err)
 		}
@@ -313,7 +251,7 @@ func TestHigherBitsStillValid(t *testing.T) {
 		t, 4, "test-resource", todayDate(),
 	)
 
-	err := validator.Claim(stamp, testBits)
+	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf(
 			"higher-difficulty stamp rejected: %v",

internal/ircserver/commands.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -14,7 +13,7 @@ import (
 )
 
 // sendIRCError maps a service.IRCError to an IRC numeric
-// reply on the wire, and logs any other error.
+// reply on the wire.
 func (c *Conn) sendIRCError(err error) {
 	var ircErr *service.IRCError
 	if errors.As(err, &ircErr) {
@@ -22,11 +21,7 @@ func (c *Conn) sendIRCError(err error) {
 		args = append(args, ircErr.Params...)
 		args = append(args, ircErr.Message)
 		c.sendNumeric(ircErr.Code, args...)
-
-		return
 	}
-
-	c.log.Error("command failed", "error", err)
 }
 
 // handleCAP silently acknowledges CAP negotiation.
@@ -71,20 +66,15 @@ func (c *Conn) handleNick(
 	}
 
 	newNick := msg.Params[0]
-	if !service.ValidNick(newNick) {
+	if len(newNick) > maxNickLen {
-		c.sendNumeric(
+		newNick = newNick[:maxNickLen]
-			irc.ErrErroneusNickname,
-			newNick, "Erroneous nickname",
-		)
-
-		return
 	}
 
 	oldMask := c.hostmask()
-	oldNick := c.currentNick()
+	oldNick := c.nick
 
 	err := c.svc.ChangeNick(
-		ctx, c.sessionID, c.clientID, oldNick, newNick,
+		ctx, c.sessionID, oldNick, newNick,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -92,10 +82,9 @@ func (c *Conn) handleNick(
 		return
 	}
 
-	// Take the nick the session holds, not newNick: another
+	c.mu.Lock()
-	// client of the session may have changed it again since
+	c.nick = newNick
-	// ChangeNick stored newNick.
+	c.mu.Unlock()
-	c.loadSessionNick(ctx)
 
 	// Echo NICK change to the client on wire.
 	c.send(FormatMessage(oldMask, "NICK", newNick))
@@ -129,8 +118,8 @@ func (c *Conn) handlePrivmsg(
 	body, _ := json.Marshal([]string{text}) //nolint:errchkjson
 
 	if strings.HasPrefix(target, "#") {
-		_, err := c.svc.SendChannelMessage(
+		_, _, err := c.svc.SendChannelMessage(
-			ctx, c.sessionID, c.clientID, c.currentNick(),
+			ctx, c.sessionID, c.nick,
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -138,7 +127,7 @@ func (c *Conn) handlePrivmsg(
 		}
 	} else {
 		result, err := c.svc.SendDirectMessage(
-			ctx, c.sessionID, c.clientID, c.currentNick(),
+			ctx, c.sessionID, c.nick,
 			msg.Command, target, body, nil,
 		)
 		if err != nil {
@@ -156,9 +145,7 @@ func (c *Conn) handlePrivmsg(
 }
 
 // handleJoin joins one or more channels via the shared
-// service layer. The optional second parameter holds the
+// service layer.
-// channel keys, comma-separated in the order of the
-// channels.
 func (c *Conn) handleJoin(
 	ctx context.Context,
 	msg *Message,
@@ -172,24 +159,16 @@ func (c *Conn) handleJoin(
 		return
 	}
 
-	var keys []string
+	channels := strings.Split(msg.Params[0], ",")
-	if len(msg.Params) > 1 {
-		keys = strings.Split(msg.Params[1], ",")
-	}
 
-	for idx, chanName := range strings.Split(msg.Params[0], ",") {
+	for _, chanName := range channels {
 		chanName = strings.TrimSpace(chanName)
 
 		if !strings.HasPrefix(chanName, "#") {
 			chanName = "#" + chanName
 		}
 
-		key := ""
+		c.joinChannel(ctx, chanName)
-		if idx < len(keys) {
-			key = keys[idx]
-		}
-
-		c.joinChannel(ctx, chanName, key)
 	}
 }
 
@@ -197,10 +176,10 @@ func (c *Conn) handleJoin(
 // and delivers topic/names on the wire.
 func (c *Conn) joinChannel(
 	ctx context.Context,
-	channel, key string,
+	channel string,
 ) {
 	result, err := c.svc.JoinChannel(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, key,
+		ctx, c.sessionID, c.nick, channel, "",
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -326,7 +305,9 @@ func (c *Conn) handlePart(
 		reason = msg.Params[1]
 	}
 
-	for ch := range strings.SplitSeq(msg.Params[0], ",") {
+	channels := strings.Split(msg.Params[0], ",")
+
+	for _, ch := range channels {
 		ch = strings.TrimSpace(ch)
 		c.partChannel(ctx, ch, reason)
 	}
@@ -338,7 +319,7 @@ func (c *Conn) partChannel(
 	channel, reason string,
 ) {
 	err := c.svc.PartChannel(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, reason,
+		ctx, c.sessionID, c.nick, channel, reason,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -402,7 +383,7 @@ func (c *Conn) handleTopic(
 	newTopic := msg.Params[1]
 
 	err := c.svc.SetTopic(
-		ctx, c.sessionID, c.clientID, c.currentNick(), channel, newTopic,
+		ctx, c.sessionID, c.nick, channel, newTopic,
 	)
 	if err != nil {
 		c.sendIRCError(err)
@@ -641,8 +622,8 @@ func (c *Conn) applyChannelModes(
 ) {
 	adding := true
 	argIdx := 0
-
+	applied := ""
-	var applied, appliedArgs strings.Builder
+	appliedArgs := ""
 
 	for _, modeChar := range modeStr {
 		var res modeResult
@@ -694,34 +675,35 @@ func (c *Conn) applyChannelModes(
 		argIdx += res.consumed
 
 		if !res.skip {
-			applied.WriteString(res.applied)
+			applied += res.applied
-			appliedArgs.WriteString(res.appliedArgs)
+			appliedArgs += res.appliedArgs
 		}
 	}
 
-	if applied.Len() > 0 {
+	if applied != "" {
-		modeReply := applied.String() + appliedArgs.String()
+		modeReply := applied
+		if appliedArgs != "" {
+			modeReply += appliedArgs
+		}
 
-		params := slices.Concat(
+		c.send(FormatMessage(
-			[]string{channel}, strings.Fields(modeReply),
+			c.hostmask(), "MODE", channel, modeReply,
-		)
+		))
-
-		c.send(FormatMessage(c.hostmask(), "MODE", params...))
 
 		c.svc.BroadcastMode(
-			ctx, c.clientID, c.currentNick(), channel, chID, modeReply,
+			ctx, c.nick, channel, chID, modeReply,
 		)
 	}
 }
 
-// handleUserMode handles MODE for a nick: a query without a
+// handleUserMode handles MODE for users.
-// mode string, otherwise a change. Only the client's own
-// nick is allowed.
 func (c *Conn) handleUserMode(
 	ctx context.Context,
 	msg *Message,
 ) {
-	if msg.Params[0] != c.currentNick() {
+	target := msg.Params[0]
+
+	if !strings.EqualFold(target, c.currentNick()) {
 		c.sendNumeric(
 			irc.ErrUsersDoNotMatch,
 			"Can't change mode for other users",
@@ -730,26 +712,48 @@ func (c *Conn) handleUserMode(
 		return
 	}
 
-	var (
+	// Mode query (no mode string).
-		modes string
+	if len(msg.Params) < 2 { //nolint:mnd
-		err   error
+		modes, err := c.svc.QueryUserMode(
+			ctx, c.sessionID,
 		)
-
-	if len(msg.Params) == 1 {
-		modes, err = c.svc.QueryUserMode(ctx, c.sessionID)
-	} else {
-		modes, err = c.svc.ApplyUserMode(
-			ctx, c.sessionID, msg.Params[1],
-		)
-	}
-
 		if err != nil {
-		c.sendIRCError(err)
+			c.log.Error(
+				"query user mode failed", "error", err,
+			)
+			c.sendNumeric(
+				irc.ErrUmodeUnknownFlag,
+				"Unable to read user modes",
+			)
 
 			return
 		}
 
 		c.sendNumeric(irc.RplUmodeIs, modes)
+
+		return
+	}
+
+	newModes, err := c.svc.ApplyUserMode(
+		ctx, c.sessionID, msg.Params[1],
+	)
+	if err != nil {
+		var ircErr *service.IRCError
+		if errors.As(err, &ircErr) {
+			c.sendNumeric(ircErr.Code, ircErr.Message)
+
+			return
+		}
+
+		c.sendNumeric(
+			irc.ErrUmodeUnknownFlag,
+			"Unknown MODE flag",
+		)
+
+		return
+	}
+
+	c.sendNumeric(irc.RplUmodeIs, newModes)
 }
 
 // handleNames replies with channel member list.
@@ -781,11 +785,10 @@ func (c *Conn) handleNames(
 	c.deliverNames(ctx, channel, chID)
 }
 
-// handleList sends the channel list, leaving out +s
+// handleList sends the channel list.
-// channels the user is not on.
 func (c *Conn) handleList(ctx context.Context) {
-	channels, err := c.database.ListAllChannelsWithCountsFiltered(
+	channels, err := c.database.ListAllChannelsWithCounts(
-		ctx, c.sessionID,
+		ctx,
 	)
 	if err != nil {
 		c.sendNumeric(
@@ -905,15 +908,14 @@ func (c *Conn) whoisOper(
 	}
 }
 
-// whoisChannels sends 319 RPL_WHOISCHANNELS, leaving out
+// whoisChannels sends 319 RPL_WHOISCHANNELS.
-// +s channels the querier is not on.
 func (c *Conn) whoisChannels(
 	ctx context.Context,
 	target string,
 	targetID int64,
 ) {
-	userChannels, _ := c.database.GetSessionChannelsFiltered(
+	userChannels, _ := c.database.GetSessionChannels(
-		ctx, targetID, c.sessionID,
+		ctx, targetID,
 	)
 	if len(userChannels) == 0 {
 		return
@@ -1186,7 +1188,7 @@ func (c *Conn) handleKick(
 	}
 
 	err := c.svc.KickUser(
-		ctx, c.sessionID, c.clientID, c.currentNick(),
+		ctx, c.sessionID, c.nick,
 		channel, targetNick, reason,
 	)
 	if err != nil {
@@ -1217,16 +1219,17 @@ func (c *Conn) handlePassPostReg(
 	}
 
 	password := msg.Params[0]
-	if !c.checkPasswordLength(password) {
+	if len(password) < minPasswordLen {
+		c.sendFromServer("NOTICE", c.nick,
+			"Password must be at least 8 characters",
+		)
+
 		return
 	}
 
-	err := c.setPassword(ctx, password)
+	c.setPassword(ctx, password)
-	if err != nil {
-		return
-	}
 
-	c.sendFromServer("NOTICE", c.currentNick(),
+	c.sendFromServer("NOTICE", c.nick,
 		"Password set. You can reconnect using "+
 			"PASS <password> with your nick.",
 	)
@@ -1249,11 +1252,36 @@ func (c *Conn) handleInvite(
 	targetNick := msg.Params[0]
 	channel := msg.Params[1]
 
-	targetID, err := c.svc.InviteUser(
+	chID, err := c.database.GetChannelByName(ctx, channel)
-		ctx, c.sessionID, c.currentNick(), targetNick, channel,
+	if err != nil {
+		c.sendNumeric(
+			irc.ErrNoSuchChannel,
+			channel, "No such channel",
+		)
+
+		return
+	}
+
+	isMember, _ := c.database.IsChannelMember(
+		ctx, chID, c.sessionID,
+	)
+	if !isMember {
+		c.sendNumeric(
+			irc.ErrNotOnChannel,
+			channel, "You're not on that channel",
+		)
+
+		return
+	}
+
+	targetID, err := c.database.GetSessionByNick(
+		ctx, targetNick,
 	)
 	if err != nil {
-		c.sendIRCError(err)
+		c.sendNumeric(
+			irc.ErrNoSuchNick,
+			targetNick, "No such nick",
+		)
 
 		return
 	}
@@ -1262,126 +1290,235 @@ func (c *Conn) handleInvite(
 		irc.RplInviting, targetNick, channel,
 	)
 
-	// Queue the INVITE to the target with the body the HTTP
+	// Send INVITE notice to target via service fan-out.
-	// API uses.
+	body, _ := json.Marshal( //nolint:errchkjson
-	body, _ := json.Marshal([]string{channel}) //nolint:errchkjson
+		[]string{"You have been invited to " + channel},
+	)
 
 	_, _, _ = c.svc.FanOut( //nolint:dogsled // fire-and-forget broadcast
-		ctx, "INVITE", c.currentNick(), targetNick, targetID, 0,
+		ctx, "INVITE", c.nick, targetNick,
-		nil, body, nil, []int64{targetID}, 0,
+		nil, body, nil, []int64{targetID},
 	)
 }
 
-// handleUserhost replies with user@host for each of up to
+// handleUserhost replies with USERHOST info.
-// five nicks.
 func (c *Conn) handleUserhost(
 	ctx context.Context,
 	msg *Message,
 ) {
 	if len(msg.Params) < 1 {
-		c.sendNumeric(
-			irc.ErrNeedMoreParams,
-			irc.CmdUserhost, "Not enough parameters",
-		)
-
 		return
 	}
 
-	reply, err := c.svc.UserhostReply(
+	replies := make([]string, 0, len(msg.Params))
-		ctx, msg.Params, c.serverSfx,
+
-	)
+	for _, nick := range msg.Params {
+		sid, err := c.database.GetSessionByNick(ctx, nick)
 		if err != nil {
-		c.sendIRCError(err)
+			continue
-
-		return
 		}
 
-	c.sendNumeric(irc.RplUserHost, reply)
+		hostInfo, _ := c.database.GetSessionHostInfo(
+			ctx, sid,
+		)
+
+		host := "*"
+		if hostInfo != nil {
+			host = hostInfo.Hostname
+		}
+
+		isOper, _ := c.database.IsSessionOper(ctx, sid)
+
+		operStar := ""
+		if isOper {
+			operStar = "*"
+		}
+
+		replies = append(
+			replies,
+			nick+operStar+"=+"+nick+"@"+host,
+		)
+	}
+
+	c.sendNumeric(
+		irc.RplUserHost,
+		strings.Join(replies, " "),
+	)
 }
 
-// handleVersion replies with the server version.
+// handleVersion replies with the server version string.
 func (c *Conn) handleVersion() {
 	c.sendNumeric(
 		irc.RplVersion,
-		c.svc.ServerVersion()+".", c.serverSfx, "",
+		c.svc.ServerVersion()+".", c.serverSfx,
+		"",
 	)
 }
 
-// handleAdmin replies with the server's admin info.
+// handleAdmin replies with server admin info.
 func (c *Conn) handleAdmin() {
-	location1, location2, email := c.svc.AdminLines(c.serverSfx)
+	srvName := c.serverSfx
 
 	c.sendNumeric(
-		irc.RplAdminMe, c.serverSfx, "Administrative info",
+		irc.RplAdminMe,
+		srvName, "Administrative info",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminLoc1,
+		"neoirc server",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminLoc2,
+		"IRC over HTTP",
+	)
+
+	c.sendNumeric(
+		irc.RplAdminEmail,
+		"admin@"+srvName,
 	)
-	c.sendNumeric(irc.RplAdminLoc1, location1)
-	c.sendNumeric(irc.RplAdminLoc2, location2)
-	c.sendNumeric(irc.RplAdminEmail, email)
 }
 
-// handleInfo replies with the server's software info.
+// handleInfo replies with server software info.
 func (c *Conn) handleInfo() {
 	for _, line := range c.svc.InfoLines() {
 		c.sendNumeric(irc.RplInfo, line)
 	}
 
-	c.sendNumeric(irc.RplEndOfInfo, "End of /INFO list")
-}
-
-// handleTime replies with the server's local time.
-func (c *Conn) handleTime() {
 	c.sendNumeric(
-		irc.RplTime,
+		irc.RplEndOfInfo,
-		c.serverSfx, time.Now().Format(time.RFC1123),
+		"End of /INFO list",
 	)
 }
 
-// handleKill handles KILL <nick> [<reason>].
+// handleTime replies with the server's current time.
-func (c *Conn) handleKill(
+func (c *Conn) handleTime() {
+	srvName := c.serverSfx
+
+	c.sendNumeric(
+		irc.RplTime,
+		srvName, time.Now().Format(time.RFC1123),
+	)
+}
+
+// handleKillCmd forcibly disconnects a target user (oper
+// only).
+func (c *Conn) handleKillCmd(
 	ctx context.Context,
 	msg *Message,
 ) {
-	if len(msg.Params) < 1 {
+	isOper, err := c.database.IsSessionOper(
+		ctx, c.sessionID,
+	)
+	if err != nil || !isOper {
 		c.sendNumeric(
-			irc.ErrNeedMoreParams,
+			irc.ErrNoPrivileges,
-			irc.CmdKill, "Not enough parameters",
+			"Permission Denied- "+
+				"You're not an IRC operator",
 		)
 
 		return
 	}
 
-	reason := ""
+	if len(msg.Params) < 1 {
+		c.sendNumeric(
+			irc.ErrNeedMoreParams,
+			"KILL", "Not enough parameters",
+		)
+
+		return
+	}
+
+	targetNick := msg.Params[0]
+
+	reason := "KILLed"
 	if len(msg.Params) > 1 {
 		reason = msg.Params[1]
 	}
 
-	err := c.svc.KillUser(
+	killerNick := c.currentNick()
-		ctx, c.sessionID, c.currentNick(),
-		msg.Params[0], reason,
-	)
-	if err != nil {
-		c.sendIRCError(err)
-	}
-}
 
-// handleWallops handles WALLOPS <message>.
+	if strings.EqualFold(targetNick, killerNick) {
-func (c *Conn) handleWallops(
-	ctx context.Context,
-	msg *Message,
-) {
-	if len(msg.Params) < 1 {
 		c.sendNumeric(
-			irc.ErrNeedMoreParams,
+			irc.ErrCantKillServer,
-			irc.CmdWallops, "Not enough parameters",
+			"You cannot KILL yourself",
 		)
 
 		return
 	}
 
-	err := c.svc.SendWallops(
+	targetSID, lookupErr := c.database.GetSessionByNick(
-		ctx, c.sessionID, c.currentNick(), msg.Params[0],
+		ctx, targetNick,
+	)
+	if lookupErr != nil {
+		c.sendNumeric(
+			irc.ErrNoSuchNick,
+			targetNick, "No such nick/channel",
+		)
+
+		return
+	}
+
+	quitReason := "Killed (" + killerNick +
+		" (" + reason + "))"
+
+	// KillSession broadcasts the QUIT, deletes the session
+	// and disconnects the victim's wire connection.
+	c.svc.KillSession(
+		ctx, targetSID, targetNick, quitReason,
+	)
+}
+
+// handleWallopsCmd broadcasts to all +w users (oper only).
+func (c *Conn) handleWallopsCmd(
+	ctx context.Context,
+	msg *Message,
+) {
+	isOper, err := c.database.IsSessionOper(
+		ctx, c.sessionID,
+	)
+	if err != nil || !isOper {
+		c.sendNumeric(
+			irc.ErrNoPrivileges,
+			"Permission Denied- "+
+				"You're not an IRC operator",
+		)
+
+		return
+	}
+
+	if len(msg.Params) < 1 {
+		c.sendNumeric(
+			irc.ErrNeedMoreParams,
+			"WALLOPS", "Not enough parameters",
+		)
+
+		return
+	}
+
+	message := msg.Params[0]
+
+	wallopsSIDs, wallErr := c.database.
+		GetWallopsSessionIDs(ctx)
+	if wallErr != nil {
+		c.log.Error(
+			"get wallops sessions failed",
+			"error", wallErr,
+		)
+
+		return
+	}
+
+	if len(wallopsSIDs) > 0 {
+		body, mErr := json.Marshal([]string{message})
+		if mErr != nil {
+			return
+		}
+
+		_, _, _ = c.svc.FanOut(
+			ctx, irc.CmdWallops, c.currentNick(), "*",
+			nil, body, nil, wallopsSIDs,
 		)
-	if err != nil {
-		c.sendIRCError(err)
 	}
 }

internal/ircserver/conn.go

@@ -20,14 +20,15 @@ import (
 
 const (
 	maxLineLen      = 512
+	readTimeout     = 5 * time.Minute
 	writeTimeout    = 30 * time.Second
 	killWriteWindow = 2 * time.Second
 	dnsTimeout      = 3 * time.Second
 	pollInterval    = 100 * time.Millisecond
 	pingInterval    = 90 * time.Second
 	pongDeadline    = 30 * time.Second
+	maxNickLen      = 32
 	minPasswordLen  = 8
-	maxPasswordLen  = 72 // bcrypt cannot hash a longer one
 	maxHashcashBits = 40
 )
 
@@ -46,9 +47,10 @@ type Conn struct {
 	serverSfx string
 	commands  map[string]cmdHandler
 
-	// writeMu serializes writes to conn, which come from
+	// writeMu serializes writes to conn.  A connection is
-	// serve(), from the relay goroutine and, for KILL, from
+	// written to by its own read loop, by its relay
-	// Disconnect.
+	// goroutine, and — when an operator KILLs it — by
+	// another client's goroutine.
 	writeMu sync.Mutex
 
 	mu        sync.Mutex
@@ -63,15 +65,16 @@ type Conn struct {
 	registered bool
 	gotNick    bool
 	gotUser    bool
-	gotPass    bool
 	passWord   string
 
 	lastQueueID int64
 	closed      bool
 	killed      bool
+	cancel      context.CancelFunc
 }
 
 func newConn(
+	ctx context.Context,
 	tcpConn net.Conn,
 	log *slog.Logger,
 	database *db.Database,
@@ -95,6 +98,7 @@ func newConn(
 		svc:       svc,
 		serverSfx: srvName,
 		remoteIP:  host,
+		hostname:  resolveHost(ctx, host),
 	}
 
 	conn.commands = conn.buildCommandMap()
@@ -102,12 +106,25 @@ func newConn(
 	return conn
 }
 
-// Disconnect ends the connection for an operator KILL from
+// Disconnect terminates the connection on behalf of an
-// either transport: the victim is sent KILL and ERROR, then
+// operator KILL issued from either transport.  The victim
-// its socket is closed, which ends serve() and with it the
+// is told why, then its socket is closed so that the read
-// relay goroutine. It is called from the killer's goroutine
+// loop unblocks and serve() returns; without the close the
-// and does not wait for the writes, so a victim that has
+// victim would keep a socket that looks alive but silently
-// stopped reading cannot stall the killer.
+// delivers nothing.  Disconnect is called from the killer's
+// goroutine, never the victim's.
+//
+// The notify-and-close half runs on its own goroutine and
+// under a short deadline.  There is no per-client send
+// queue: send() writes straight to the victim's socket, so
+// a victim that has stopped reading would otherwise stall
+// the killer for the full writeTimeout on each of the two
+// writes -- wedging the operator's own serve() loop on the
+// IRC path, or the API request on the HTTP path.  Any
+// client could trigger that deliberately.  Disconnect
+// therefore returns as soon as the victim is marked closed;
+// the socket is closed shortly afterwards regardless of
+// whether the notification could be delivered.
 func (c *Conn) Disconnect(reason string) {
 	c.mu.Lock()
 
@@ -127,18 +144,24 @@ func (c *Conn) Disconnect(reason string) {
 		nick = "*"
 	}
 
-	go func() {
+	// Stop the relay goroutine, which would otherwise keep
-		c.notifyKilledAndClose(nick, host, reason)
+	// polling a queue belonging to a deleted session.
-	}()
+	if c.cancel != nil {
+		c.cancel()
+	}
+
+	go c.notifyKilledAndClose(nick, host, reason)
 }
 
-// notifyKilledAndClose sends a killed victim the KILL and
+// notifyKilledAndClose delivers the KILL and ERROR lines to
-// ERROR lines, each bounded by killWriteWindow, and then
+// a killed victim and then closes its socket.  It runs on a
-// closes its socket.
+// goroutine owned by neither the killer nor the victim, and
+// bounds both writes with killWriteWindow so an unresponsive
+// victim cannot hold the socket open indefinitely.
 func (c *Conn) notifyKilledAndClose(
 	nick, host, reason string,
 ) {
-	defer func() { _ = c.conn.Close() }()
+	defer c.conn.Close() //nolint:errcheck
 
 	c.sendWithin(
 		killWriteWindow,
@@ -185,13 +208,13 @@ func (c *Conn) buildCommandMap() map[string]cmdHandler {
 		"CAP": func(_ context.Context, msg *Message) {
 			c.handleCAP(msg)
 		},
-		irc.CmdUserhost: c.handleUserhost,
+		"USERHOST":     c.handleUserhost,
 		irc.CmdVersion: func(context.Context, *Message) { c.handleVersion() },
 		irc.CmdAdmin:   func(context.Context, *Message) { c.handleAdmin() },
 		irc.CmdInfo:    func(context.Context, *Message) { c.handleInfo() },
 		irc.CmdTime:    func(context.Context, *Message) { c.handleTime() },
-		irc.CmdKill:     c.handleKill,
+		irc.CmdKill:    c.handleKillCmd,
-		irc.CmdWallops:  c.handleWallops,
+		irc.CmdWallops: c.handleWallopsCmd,
 	}
 }
 
@@ -212,42 +235,16 @@ func resolveHost(ctx context.Context, addr string) string {
 }
 
 // serve is the main loop for a single IRC client connection.
-// It first sets the client's hostname to what resolve returns
+func (c *Conn) serve(ctx context.Context) {
-// for the client's address.
+	ctx, c.cancel = context.WithCancel(ctx)
-// Cancelling ctx when it returns stops the relay goroutine.
+	defer c.cleanup(ctx)
-// When nothing has been read for interval the client is sent
-// a PING, and when nothing is read within deadline after that
-// the connection is closed.
-func (c *Conn) serve(
-	ctx context.Context,
-	resolve func(ctx context.Context, addr string) string,
-	interval, deadline time.Duration,
-) {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	// Stopping the server cancels ctx, and the cleanup must
-	// still end the session then.
-	defer c.cleanup(context.WithoutCancel(ctx))
-
-	// The hostname is looked up here, on this connection's
-	// goroutine, and not when the connection is accepted, so
-	// that a slow lookup holds up only this client.
-	c.hostname = resolve(ctx, c.remoteIP)
-
-	ping := time.AfterFunc(interval, func() {
-		c.send("PING :" + c.serverSfx)
-	})
-	defer ping.Stop()
 
 	scanner := bufio.NewScanner(c.conn)
 	scanner.Buffer(make([]byte, maxLineLen), maxLineLen)
 
 	for {
-		// Every line read starts both waits again.
-		ping.Reset(interval)
-
 		_ = c.conn.SetReadDeadline(
-			time.Now().Add(interval + deadline),
+			time.Now().Add(readTimeout),
 		)
 
 		if !scanner.Scan() {
@@ -284,8 +281,9 @@ func (c *Conn) cleanup(ctx context.Context) {
 	if wasRegistered && sessID > 0 {
 		c.svc.UnregisterWireConn(sessID, c)
 
-		// KILL has already sent the QUIT and deleted the
+		// A KILLed session has already been broadcast and
-		// session.
+		// deleted by the killer; broadcasting again would
+		// fan out a QUIT for a session row that is gone.
 		if !wasKilled {
 			c.svc.BroadcastQuit(
 				ctx, sessID, nick, "Connection closed",
@@ -296,8 +294,8 @@ func (c *Conn) cleanup(ctx context.Context) {
 	c.conn.Close() //nolint:errcheck,gosec
 }
 
-// isClosed reports whether QUIT or KILL has ended the
+// isClosed reports whether the connection has been marked
-// connection.
+// for teardown, either by QUIT or by an operator KILL.
 func (c *Conn) isClosed() bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -305,7 +303,9 @@ func (c *Conn) isClosed() bool {
 	return c.closed
 }
 
-// currentNick returns c.nick, read under c.mu.
+// currentNick returns the connection's registered nick.
+// c.nick is written under c.mu during registration and
+// NICK changes, so every read must take the mutex.
 func (c *Conn) currentNick() string {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -313,39 +313,19 @@ func (c *Conn) currentNick() string {
 	return c.nick
 }
 
-// loadSessionNick sets c.nick to the nick the connection's
-// session holds in the database, read by session ID. The
-// connection's own NICK and the relay passing on a NICK line
-// both call it, and it reads and sets the nick under c.mu, so
-// whichever runs last leaves the connection on its session's
-// nick. If the read fails, c.nick is left as it is.
-func (c *Conn) loadSessionNick(ctx context.Context) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	nick, err := c.database.GetSessionNick(ctx, c.sessionID)
-	if err == nil {
-		c.nick = nick
-	}
-}
-
 // send writes a formatted IRC line to the connection.
 func (c *Conn) send(line string) {
 	c.sendWithin(writeTimeout, line)
 }
 
-// sendWithin writes a formatted IRC line to the connection,
+// sendWithin writes a formatted IRC line to the connection
-// giving up after timeout. CR, LF and NUL are removed first,
+// under the given write deadline.  Callers that must not be
-// as FormatMessage does for each parameter, so that a line
+// held hostage by an unresponsive peer pass a shorter window
-// built without it cannot end early either.
+// than writeTimeout.
 func (c *Conn) sendWithin(
 	timeout time.Duration,
 	line string,
 ) {
-	line = strings.ReplaceAll(line, "\r", "")
-	line = strings.ReplaceAll(line, "\n", "")
-	line = strings.ReplaceAll(line, "\x00", "")
-
 	c.writeMu.Lock()
 	defer c.writeMu.Unlock()
 
@@ -361,7 +341,7 @@ func (c *Conn) sendNumeric(
 	code irc.IRCMessageType,
 	params ...string,
 ) {
-	nick := c.currentNick()
+	nick := c.nick
 	if nick == "" {
 		nick = "*"
 	}
@@ -385,11 +365,9 @@ func (c *Conn) sendFromServer(
 // hostmask returns the client's full hostmask
 // (nick!user@host).
 func (c *Conn) hostmask() string {
-	nick := c.currentNick()
-
 	user := c.username
 	if user == "" {
-		user = nick
+		user = c.nick
 	}
 
 	host := c.hostname
@@ -397,7 +375,7 @@ func (c *Conn) hostmask() string {
 		host = c.remoteIP
 	}
 
-	return nick + "!" + user + "@" + host
+	return c.nick + "!" + user + "@" + host
 }
 
 // handleMessage dispatches a parsed IRC message using
@@ -407,24 +385,13 @@ func (c *Conn) handleMessage(
 	msg *Message,
 ) {
 	// Before registration, only NICK, USER, PASS, PING,
-	// PONG, QUIT, and CAP are accepted.
+	// QUIT, and CAP are accepted.
 	if !c.registered {
 		c.handlePreRegistration(ctx, msg)
 
 		return
 	}
 
-	// Every command is activity, so the idle cleanup must not
-	// remove this user.
-	err := c.database.UpdateLastSeen(
-		ctx, c.sessionID, c.clientID,
-	)
-	if err != nil {
-		c.log.Error(
-			"failed to update last_seen", "error", err,
-		)
-	}
-
 	handler, ok := c.commands[msg.Command]
 	if !ok {
 		c.sendNumeric(
@@ -456,7 +423,6 @@ func (c *Conn) handlePreRegistration(
 		}
 
 		c.passWord = msg.Params[0]
-		c.gotPass = true
 	case irc.CmdNick:
 		if len(msg.Params) < 1 {
 			c.sendNumeric(
@@ -467,16 +433,11 @@ func (c *Conn) handlePreRegistration(
 			return
 		}
 
-		if !service.ValidNick(msg.Params[0]) {
+		c.nick = msg.Params[0]
-			c.sendNumeric(
+		if len(c.nick) > maxNickLen {
-				irc.ErrErroneusNickname,
+			c.nick = c.nick[:maxNickLen]
-				msg.Params[0], "Erroneous nickname",
-			)
-
-			return
 		}
 
-		c.nick = msg.Params[0]
 		c.gotNick = true
 	case irc.CmdUser:
 		if len(msg.Params) < 4 { //nolint:mnd
@@ -494,10 +455,6 @@ func (c *Conn) handlePreRegistration(
 	case irc.CmdPing:
 		c.handlePing(msg)
 
-		return
-	case irc.CmdPong:
-		// The answer to serve's PING, which unregistered
-		// clients are sent too.
 		return
 	case irc.CmdQuit:
 		c.handleQuit(msg)
@@ -568,23 +525,21 @@ func (c *Conn) completeRegistration(ctx context.Context) {
 	c.registered = true
 	c.mu.Unlock()
 
-	// So that KILL, from either transport, can close it.
+	// Make this connection reachable by session ID so that
+	// KILL from either transport can disconnect it.
 	c.svc.RegisterWireConn(sessionID, c)
 
+	// If PASS was provided before registration, set the
+	// session password.
+	if c.passWord != "" && len(c.passWord) >= minPasswordLen {
+		c.setPassword(ctx, c.passWord)
+	}
+
 	// Send welcome burst.
 	c.deliverWelcome()
 	c.deliverLusers(ctx)
 	c.deliverMOTD()
 
-	// If PASS was given before registration, store its
-	// password now, after the welcome burst, so that a
-	// NOTICE refusing it reaches a registered client. A
-	// failure to store it is only logged, as it is for PASS
-	// after registration.
-	if c.gotPass && c.checkPasswordLength(c.passWord) {
-		_ = c.setPassword(ctx, c.passWord)
-	}
-
 	// Start the message relay goroutine.
 	go c.relayMessages(ctx)
 }
@@ -658,7 +613,7 @@ func (c *Conn) deliverMOTD() {
 		"- %s Message of the Day -", c.serverSfx,
 	))
 
-	for line := range strings.SplitSeq(motd, "\n") {
+	for _, line := range strings.Split(motd, "\n") {
 		c.sendNumeric(irc.RplMotd, "- "+line)
 	}
 
@@ -667,33 +622,13 @@ func (c *Conn) deliverMOTD() {
 	)
 }
 
-// checkPasswordLength reports whether pw is 8 to 72 bytes
+// setPassword sets a bcrypt password on the session.
-// long, and sends the client a NOTICE saying so when it is
+func (c *Conn) setPassword(ctx context.Context, pw string) {
-// not.
-func (c *Conn) checkPasswordLength(pw string) bool {
-	if len(pw) >= minPasswordLen && len(pw) <= maxPasswordLen {
-		return true
-	}
-
-	c.sendFromServer("NOTICE", c.currentNick(),
-		"Password must be 8 to 72 bytes",
-	)
-
-	return false
-}
-
-// setPassword sets a bcrypt password on the session, and
-// logs and returns the error when it was not stored.
-func (c *Conn) setPassword(ctx context.Context, pw string) error {
 	// Use the database's auth module to hash and store.
 	err := c.database.SetPassword(ctx, c.sessionID, pw)
 	if err != nil {
 		c.log.Error(
 			"failed to set password", "error", err,
 		)
-
-		return err
 	}
-
-	return nil
 }

internal/ircserver/conn_test.go

@@ -5,7 +5,6 @@ import (
 	"log/slog"
 	"net"
 	"os"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -14,39 +13,43 @@ import (
 	"sneak.berlin/go/neoirc/internal/ircserver"
 )
 
-// newKillVictim returns a Conn for the nick victim whose
+// disconnectBudget is how long Disconnect is allowed to
-// socket is one end of a net.Pipe, and the other end, from
+// take when the victim never reads.  It is far below the
-// which the test reads what the victim is sent. A write to
+// 30s writeTimeout that the old synchronous implementation
-// the pipe blocks until the other end reads.
+// would have burned on each of its two writes.
-func newKillVictim(t *testing.T) (*ircserver.Conn, net.Conn) {
+const disconnectBudget = 2 * time.Second
-	t.Helper()
 
-	serverSide, clientSide := net.Pipe()
+// TestDisconnectDoesNotBlockOnUnresponsiveVictim proves
-
+// that an operator KILL cannot be stalled by its target.
-	t.Cleanup(func() { _ = clientSide.Close() })
+// The victim's socket is a net.Pipe, so every write blocks
-
+// until the peer reads and the peer here never does.  The
-	log := slog.New(slog.NewTextHandler(
+// old implementation performed both notification writes on
-		os.Stderr,
+// the killer's goroutine, which wedged the operator's own
-		&slog.HandlerOptions{Level: slog.LevelError},
+// serve() loop on the IRC path and the API request on the
-	))
+// HTTP path for as long as the victim cared to stay silent.
-	cfg := &config.Config{ServerName: testServerName}
-
-	return ircserver.NewTestConn(
-		log, cfg, serverSide, "victim",
-	), clientSide
-}
-
-// TestDisconnectDoesNotBlockOnUnresponsiveVictim checks
-// that Disconnect returns although the victim never reads,
-// so a KILL cannot stall the operator who sent it. The
-// limit is well below one KillWriteWindow, so a Disconnect
-// that waits on any write to the victim fails.
 func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
 	t *testing.T,
 ) {
 	t.Parallel()
 
-	victim, _ := newKillVictim(t)
+	serverSide, clientSide := net.Pipe()
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
 	returned := make(chan struct{})
 
 	go func() {
@@ -56,44 +59,66 @@ func TestDisconnectDoesNotBlockOnUnresponsiveVictim(
 
 	select {
 	case <-returned:
-	case <-time.After(ircserver.KillWriteWindow / 4):
+	case <-time.After(disconnectBudget):
-		t.Fatal("Disconnect waited for the victim to read")
+		t.Fatal(
+			"Disconnect blocked on the victim's socket; " +
+				"the killer must not be held hostage",
+		)
 	}
 }
 
-// TestDisconnectNotifiesAndClosesVictim checks that a
+// TestDisconnectNotifiesAndClosesVictim is the other half
-// victim that reads is sent KILL and ERROR, and that its
+// of the contract: moving the notification off the killer's
-// connection is then closed.
+// goroutine must not lose it.  A victim that does read gets
+// both the KILL and the ERROR line, and then its socket is
+// closed so its read loop unblocks.
 func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
 	t.Parallel()
 
-	victim, clientSide := newKillVictim(t)
+	serverSide, clientSide := net.Pipe()
-	received := make(chan []string, 1)
+
+	t.Cleanup(func() {
+		_ = clientSide.Close()
+	})
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelError}, //nolint:exhaustruct
+	))
+	cfg := &config.Config{ //nolint:exhaustruct
+		ServerName: "test.irc",
+	}
+
+	victim := ircserver.NewTestConn(
+		log, cfg, serverSide, "victim",
+	)
+
+	lines := make(chan []string, 1)
 
 	go func() {
-		var lines []string
+		var got []string
 
 		scanner := bufio.NewScanner(clientSide)
 		for scanner.Scan() {
-			lines = append(lines, scanner.Text())
+			got = append(got, scanner.Text())
 		}
 
-		received <- lines
+		lines <- got
 	}()
 
 	victim.Disconnect("killed by oper")
 
-	var lines []string
+	var got []string
 
 	select {
-	case lines = <-received:
+	case got = <-lines:
-	case <-time.After(testTimeout):
+	case <-time.After(5 * time.Second):
-		t.Fatal("the victim's connection was not closed")
+		t.Fatal("victim socket was never closed")
 	}
 
-	joined := strings.Join(lines, "\n")
+	joined := strings.Join(got, "\n")
 
-	if !strings.Contains(joined, "KILL victim :killed by oper") {
+	if !strings.Contains(joined, "KILL victim") {
 		t.Errorf("missing KILL line, got: %q", joined)
 	}
 
@@ -101,48 +126,3 @@ func TestDisconnectNotifiesAndClosesVictim(t *testing.T) {
 		t.Errorf("missing ERROR line, got: %q", joined)
 	}
 }
-
-// TestDisconnectReasonCannotStartLine checks that CR, LF and
-// NUL in a KILL reason are removed from both the KILL line
-// and the ERROR line, so the victim gets exactly those two
-// lines. The ERROR line is not built with FormatMessage, so
-// only the removal in sendWithin protects it.
-func TestDisconnectReasonCannotStartLine(t *testing.T) {
-	t.Parallel()
-
-	victim, clientSide := newKillVictim(t)
-	received := make(chan []string, 1)
-
-	go func() {
-		var lines []string
-
-		scanner := bufio.NewScanner(clientSide)
-		for scanner.Scan() {
-			lines = append(lines, scanner.Text())
-		}
-
-		received <- lines
-	}()
-
-	victim.Disconnect("bye\r\nPRIVMSG victim :forged\x00")
-
-	var lines []string
-
-	select {
-	case lines = <-received:
-	case <-time.After(testTimeout):
-		t.Fatal("the victim's connection was not closed")
-	}
-
-	// The test connection has no host name, hence the two
-	// spaces after "Closing Link:".
-	want := []string{
-		":" + testServerName +
-			" KILL victim :byePRIVMSG victim :forged",
-		"ERROR :Closing Link:  (byePRIVMSG victim :forged)",
-	}
-
-	if !slices.Equal(lines, want) {
-		t.Errorf("got lines %q, want %q", lines, want)
-	}
-}

internal/ircserver/export_test.go

@@ -13,18 +13,13 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
-// NewTestServer creates a Server suitable for testing, whose
+// NewTestServer creates a Server suitable for testing.
-// connections use interval and deadline in place of
-// pingInterval and pongDeadline, and resolve in place of
-// resolveHost.
 // The caller must call Stop() when finished.
 func NewTestServer(
 	log *slog.Logger,
 	cfg *config.Config,
 	database *db.Database,
 	brk *broker.Broker,
-	interval, deadline time.Duration,
-	resolve func(ctx context.Context, addr string) string,
 ) *Server {
 	globs := &globals.Globals{
 		Appname:   "neoirc",
@@ -43,19 +38,9 @@ func NewTestServer(
 		brk:      brk,
 		svc:      svc,
 		conns:    make(map[*Conn]struct{}),
-
-		pingInterval: interval,
-		pongDeadline: deadline,
-		resolveHost:  resolve,
 	}
 }
 
-// ResolveHost is the reverse DNS lookup that a server made by
-// New does for each client.
-func ResolveHost(ctx context.Context, addr string) string {
-	return resolveHost(ctx, addr)
-}
-
 // Start exposes the unexported start method for tests.
 func (s *Server) Start(addr string) error {
 	return s.start(context.Background(), addr)
@@ -71,47 +56,19 @@ func (s *Server) Listener() net.Listener {
 	return s.listener
 }
 
-// Service returns the service the server's connections use.
+// NewTestConn wraps an already-established net.Conn in a
-func (s *Server) Service() *service.Service {
+// Conn so tests can drive connection-level behaviour such
-	return s.svc
+// as Disconnect without standing up a whole server.
-}
-
-// PingTimes returns how long the server's connections wait
-// with nothing read before they are sent a PING, and after it
-// before they are closed.
-func (s *Server) PingTimes() (time.Duration, time.Duration) {
-	return s.pingInterval, s.pongDeadline
-}
-
-// KillWriteWindow is how long Disconnect allows each write
-// to a killed victim.
-const KillWriteWindow = killWriteWindow
-
-// PollInterval is how often the relay checks the client
-// output queue when no broker notification arrives.
-const PollInterval = pollInterval
-
-// PingInterval is how long the server waits with nothing read
-// from a connection before it sends a PING.
-const PingInterval = pingInterval
-
-// PongDeadline is how long the server waits after the PING
-// for a line before it closes the connection.
-const PongDeadline = pongDeadline
-
-// StopTimeout is the longest Stop waits for the connections'
-// cleanup.
-const StopTimeout = stopTimeout
-
-// NewTestConn returns a Conn for nick on tcpConn, without a
-// server, database or service behind it.
 func NewTestConn(
 	log *slog.Logger,
 	cfg *config.Config,
 	tcpConn net.Conn,
 	nick string,
 ) *Conn {
-	conn := newConn(tcpConn, log, nil, nil, cfg, nil)
+	conn := newConn(
+		context.Background(), tcpConn, log,
+		nil, nil, cfg, nil,
+	)
 	conn.nick = nick
 
 	return conn

internal/ircserver/integration_test.go

@@ -4,8 +4,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"sneak.berlin/go/neoirc/internal/config"
 )
 
 // TestIntegrationTwoClients is a comprehensive integration
@@ -284,7 +282,6 @@ func TestIntegrationTwoClients(t *testing.T) {
 
 	// Both nicks should appear in the name list.
 	foundBothNames := false
-
 	for _, line := range aliceNames {
 		if strings.Contains(line, " 353 ") &&
 			strings.Contains(line, "alice") &&
@@ -674,7 +671,6 @@ func TestIntegrationTwoClients(t *testing.T) {
 	})
 
 	foundPartErr := false
-
 	for _, line := range bobPartFail {
 		if strings.Contains(line, " 403 ") ||
 			strings.Contains(line, " 442 ") {
@@ -779,28 +775,39 @@ func TestIntegrationUserhost(t *testing.T) {
 	bob := env.dial(t)
 	bob.register("bob")
 
-	bob.send("AWAY :lunch")
+	// Query single nick.
-	bob.readUntil(func(l string) bool {
+	alice.send("USERHOST bob")
-		return strings.Contains(l, " 306 ")
-	})
 
-	for _, step := range []struct {
+	aliceReply := alice.readUntil(func(l string) bool {
-		line, want string
+		return strings.Contains(l, " 302 ")
-	}{
-		{"USERHOST alice", " 302 alice alice=+alice@"},
-		{"USERHOST alice bob", " :alice=+alice@"},
-		{"USERHOST alice bob", " bob=-bob@"},
-		{"USERHOST nobody", " 302 alice :"},
-		{"USERHOST", " 461 alice USERHOST :"},
-	} {
-		alice.send(step.line)
-
-		reply := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, " 302 ") ||
-				strings.Contains(l, " 461 ")
 	})
-		assertContains(t, reply, step.want, step.line)
+	assertContains(
-	}
+		t, aliceReply, " 302 ",
+		"RPL_USERHOST",
+	)
+	assertContains(
+		t, aliceReply, "bob",
+		"USERHOST contains queried nick",
+	)
+
+	// Query multiple nicks.
+	bob.send("USERHOST alice bob")
+
+	bobReply := bob.readUntil(func(l string) bool {
+		return strings.Contains(l, " 302 ")
+	})
+	assertContains(
+		t, bobReply, " 302 ",
+		"RPL_USERHOST multi-nick",
+	)
+	assertContains(
+		t, bobReply, "alice",
+		"USERHOST multi contains alice",
+	)
+	assertContains(
+		t, bobReply, "bob",
+		"USERHOST multi contains bob",
+	)
 }
 
 // TestIntegrationVersion verifies the VERSION command
@@ -910,54 +917,17 @@ func TestIntegrationTime(t *testing.T) {
 		"RPL_TIME",
 	)
 	assertContains(
-		t, aliceReply, testServerName,
+		t, aliceReply, "test.irc",
 		"TIME reply includes server name",
 	)
 }
 
-// becomeOper sends OPER with newTestEnvWithOper's
+// TestIntegrationKill verifies the KILL command: oper can
-// credentials and waits for RPL_YOUREOPER.
+// kill a user, non-oper cannot, and — most importantly —
-func (tc *testClient) becomeOper() {
+// that the victim is actually disconnected rather than
-	tc.t.Helper()
+// merely announced as having quit.
-
+//
-	tc.send("OPER testoper testpass")
+//nolint:funlen // one KILL scenario asserted end to end
-	tc.readUntil(func(l string) bool {
-		return strings.Contains(l, " 381 ")
-	})
-}
-
-// TestIntegrationKillRefused covers the KILL errors: not an
-// operator, no such nick, and killing yourself.
-func TestIntegrationKillRefused(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnvWithOper(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	for _, step := range []struct {
-		line, numeric string
-	}{
-		{"KILL bob :nope", " 481 "},
-		{"OPER testoper testpass", " 381 "},
-		{"KILL nobody123 :gone", " 401 "},
-		{"KILL alice :me", " 483 "},
-	} {
-		alice.send(step.line)
-
-		reply := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, step.numeric)
-		})
-		assertContains(t, reply, step.numeric, step.line)
-	}
-}
-
-// TestIntegrationKill checks that the victim of a KILL is
-// told why, is disconnected, and is gone from its channels.
 func TestIntegrationKill(t *testing.T) {
 	t.Parallel()
 
@@ -969,6 +939,7 @@ func TestIntegrationKill(t *testing.T) {
 	bob := env.dial(t)
 	bob.register("bob")
 
+	// Both join a channel so KILL's QUIT is visible.
 	alice.joinAndDrain("#killtest")
 	bob.joinAndDrain("#killtest")
 
@@ -978,9 +949,30 @@ func TestIntegrationKill(t *testing.T) {
 			strings.Contains(l, "bob")
 	})
 
-	alice.becomeOper()
+	// Non-oper KILL should fail.
+	alice.send("KILL bob :nope")
+
+	aliceKillFail := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 481 ")
+	})
+	assertContains(
+		t, aliceKillFail, " 481 ",
+		"ERR_NOPRIVILEGES for non-oper KILL",
+	)
+
+	// alice becomes oper.
+	alice.send("OPER testoper testpass")
+	alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 381 ")
+	})
+
+	// Oper KILL should succeed.
 	alice.send("KILL bob :bad behavior")
 
+	// The victim must be told why and then disconnected.
+	// Reading to EOF is the assertion that matters: a KILL
+	// that only broadcasts a QUIT leaves bob holding a
+	// socket that looks alive but delivers nothing.
 	bobLines := bob.readUntilClosed()
 	assertContains(
 		t, bobLines, "KILL",
@@ -1030,6 +1022,17 @@ func TestIntegrationKill(t *testing.T) {
 		t, aliceWho, "bob",
 		"killed user must not appear in WHO",
 	)
+
+	// KILL nonexistent nick.
+	alice.send("KILL nobody123 :gone")
+
+	aliceNoSuch := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 401 ")
+	})
+	assertContains(
+		t, aliceNoSuch, " 401 ",
+		"ERR_NOSUCHNICK for KILL missing target",
+	)
 }
 
 // TestIntegrationWallops verifies the WALLOPS command:
@@ -1056,7 +1059,11 @@ func TestIntegrationWallops(t *testing.T) {
 		"ERR_NOPRIVILEGES for non-oper WALLOPS",
 	)
 
-	alice.becomeOper()
+	// alice becomes oper.
+	alice.send("OPER testoper testpass")
+	alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 381 ")
+	})
 
 	// bob sets +w to receive wallops.
 	bob.send("MODE bob +w")
@@ -1083,54 +1090,6 @@ func TestIntegrationWallops(t *testing.T) {
 	)
 }
 
-// TestIntegrationUserMode covers MODE for a nick: changes
-// and queries of your own modes, refusal for another nick,
-// even one that differs from yours only in letter case, and
-// a rejected mode string changing nothing.
-func TestIntegrationUserMode(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	const (
-		notYours = " 502 alice :Can't change mode for other users"
-		unknown  = " 501 alice :Unknown MODE flag"
-	)
-
-	for _, step := range []struct {
-		line, want string
-	}{
-		{"MODE alice +w", " 221 alice +w"},
-		{"MODE Alice", notYours},
-		{"MODE Alice -w", notYours},
-		{"MODE bob", notYours},
-		{"MODE bob -w", notYours},
-		{"MODE alice xw", unknown},
-		{"MODE alice -w+z", unknown},
-		{"MODE alice", " 221 alice +w"},
-		{"MODE alice +w-w", " 221 alice +"},
-	} {
-		alice.send(step.line)
-
-		reply := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, " 221 ") ||
-				strings.Contains(l, " 501 ") ||
-				strings.Contains(l, " 502 ")
-		})
-
-		last := reply[len(reply)-1]
-		if !strings.HasSuffix(last, step.want) {
-			t.Errorf("%s: want %q, got %q", step.line, step.want, last)
-		}
-	}
-}
-
 // TestIntegrationModeSecret tests +s (secret) channel
 // mode — verifies that +s can be set and the mode is
 // reflected in MODE queries.
@@ -1204,7 +1163,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	})
 
 	foundModErr := false
-
 	for _, line := range bobLines {
 		if strings.Contains(line, " 404 ") ||
 			strings.Contains(line, " 482 ") {
@@ -1231,7 +1189,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	})
 
 	bob.send("PRIVMSG #modtest :voiced message")
-
 	aliceLines := alice.readUntil(func(l string) bool {
 		return strings.Contains(l, "voiced message")
 	})
@@ -1241,252 +1198,6 @@ func TestIntegrationModeModerated(t *testing.T) {
 	)
 }
 
-// TestIntegrationModeKey checks that JOIN takes the key of
-// a +k channel as its second parameter, and that with
-// several channels each key goes to the channel in the
-// same position.
-func TestIntegrationModeKey(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#keyed")
-	alice.joinAndDrain("#vault")
-
-	// The IRC listener cannot set +k, so the test sets the
-	// keys directly.
-	for channel, key := range map[string]string{
-		"#keyed": "sesame",
-		"#vault": "barley",
-	} {
-		chID, err := env.database.GetChannelByName(
-			t.Context(), channel,
-		)
-		if err != nil {
-			t.Fatalf("get channel %s: %v", channel, err)
-		}
-
-		err = env.database.SetChannelKey(t.Context(), chID, key)
-		if err != nil {
-			t.Fatalf("set key of %s: %v", channel, err)
-		}
-	}
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bob.sendAndExpect("JOIN #keyed", " 475 ")
-	bob.sendAndExpect("JOIN #keyed wrong", " 475 ")
-
-	lines := bob.sendAndExpect("JOIN #keyed sesame", " 366 ")
-	assertContains(
-		t, lines, "JOIN #keyed", "bob joins with the key",
-	)
-
-	carol := env.dial(t)
-	carol.register("carol")
-
-	lines = carol.sendAndExpect(
-		"JOIN #keyed,#vault sesame,barley", " 366 carol #vault ",
-	)
-	assertContains(t, lines, "JOIN #keyed", "carol joins #keyed")
-	assertContains(t, lines, "JOIN #vault", "carol joins #vault")
-	assertNotContains(t, lines, " 475 ", "carol's JOIN")
-}
-
-// TestIntegrationModeInviteOnly checks that INVITE lets a
-// user into a +i channel.
-func TestIntegrationModeInviteOnly(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#invonly")
-	alice.sendAndExpect("MODE #invonly +i", "+i")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bob.sendAndExpect("JOIN #invonly", " 473 ")
-
-	alice.sendAndExpect("INVITE bob #invonly", " 341 ")
-
-	lines := bob.sendAndExpect("JOIN #invonly", " 366 ")
-	assertContains(
-		t, lines, "JOIN #invonly", "bob joins once invited",
-	)
-}
-
-// TestIntegrationModeInviteOnlyNeedsOperator checks that on
-// a +i channel an INVITE from a member who is not a channel
-// operator gets 482 and does not let the invited user in.
-func TestIntegrationModeInviteOnlyNeedsOperator(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#invonly")
-
-	// Bob joins before +i is set, so he is a member but
-	// not an operator.
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#invonly")
-
-	alice.sendAndExpect("MODE #invonly +i", "+i")
-
-	carol := env.dial(t)
-	carol.register("carol")
-
-	lines := bob.sendAndExpect("INVITE carol #invonly", " 482 ")
-	assertContains(
-		t, lines, " 482 bob #invonly ", "bob's INVITE refused",
-	)
-
-	carol.sendAndExpect("JOIN #invonly", " 473 ")
-}
-
-// TestIntegrationInviteUserOnChannel checks that inviting a
-// user who is already on the channel gets 443.
-func TestIntegrationInviteUserOnChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#room")
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#room")
-
-	lines := alice.sendAndExpect("INVITE bob #room", " 443 ")
-	assertContains(
-		t, lines, " 443 alice bob #room ", "alice's INVITE refused",
-	)
-}
-
-// TestIntegrationInviteLine checks that an IRC listener user
-// invited by an IRC listener user, and then over the HTTP
-// API, gets an INVITE line from the inviter for the channel
-// each time.
-func TestIntegrationInviteLine(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#inv")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	alice.sendAndExpect("INVITE bob #inv", " 341 ")
-
-	got := bob.readLine()
-	want := ":alice!alice@* INVITE bob #inv"
-
-	if got != want {
-		t.Errorf("from the IRC listener: got %q, want %q", got, want)
-	}
-
-	// The HTTP API queues an INVITE with the channel as its body.
-	env.queueMessage(t, "bob", "INVITE", "carol", "bob", []string{"#inv"})
-
-	got = bob.readLine()
-	want = ":carol!carol@* INVITE bob #inv"
-
-	if got != want {
-		t.Errorf("over the HTTP API: got %q, want %q", got, want)
-	}
-}
-
-// TestIntegrationModeSecretList checks that LIST shows a +s
-// channel only to its members.
-func TestIntegrationModeSecretList(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#hidden")
-	alice.joinAndDrain("#visible")
-	alice.sendAndExpect("MODE #hidden +s", "+s")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bobList := bob.sendAndExpect("LIST", " 323 ")
-	assertContains(
-		t, bobList, " 322 bob #visible ", "bob's LIST",
-	)
-	assertNotContains(t, bobList, "#hidden", "bob's LIST")
-
-	aliceList := alice.sendAndExpect("LIST", " 323 ")
-	assertContains(
-		t, aliceList, " 322 alice #hidden ", "alice's LIST",
-	)
-}
-
-// TestIntegrationModeSecretWhois checks that WHOIS names a
-// +s channel only to users on it.
-func TestIntegrationModeSecretWhois(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#hidden")
-	alice.joinAndDrain("#visible")
-	alice.sendAndExpect("MODE #hidden +s", "+s")
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	bobWhois := bob.sendAndExpect("WHOIS alice", " 318 ")
-	assertContains(t, bobWhois, "@#visible", "bob's WHOIS")
-	assertNotContains(t, bobWhois, "#hidden", "bob's WHOIS")
-
-	carol := env.dial(t)
-	carol.register("carol")
-	carol.joinAndDrain("#hidden")
-
-	carolWhois := carol.sendAndExpect("WHOIS alice", " 318 ")
-	assertContains(t, carolWhois, "@#hidden", "carol's WHOIS")
-}
-
-// TestIntegrationModeHashcash checks that PRIVMSG to a +H
-// channel is refused, since an IRC client cannot attach a
-// hashcash stamp.
-func TestIntegrationModeHashcash(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#stamped")
-	alice.sendAndExpect("MODE #stamped +H 2", "+H")
-
-	lines := alice.sendAndExpect(
-		"PRIVMSG #stamped :hello", " 404 ",
-	)
-	assertContains(
-		t, lines, " 404 alice #stamped :Channel requires hashcash",
-		"PRIVMSG refused",
-	)
-}
-
 // TestIntegrationThirdClientObserver verifies that a third
 // client observing the same channel receives messages from
 // the other two.
@@ -1531,29 +1242,79 @@ func TestIntegrationThirdClientObserver(t *testing.T) {
 	)
 }
 
-// TestIntegrationDefaultServerNameFallback checks that with
+// assertNoEmptyParam fails if any line contains a doubled
-// SERVER_NAME unset, as it is by default, VERSION, ADMIN and
+// space, which is what FormatMessage emits for an empty
-// TIME name the server "neoirc".
+// non-trailing parameter.  A numeric whose server-name
+// parameter came out empty is malformed on the wire even
+// though it still contains the numeric code, so the other
+// assertions in this file would not catch it.
+func assertNoEmptyParam(
+	t *testing.T,
+	lines []string,
+	context string,
+) {
+	t.Helper()
+
+	for _, line := range lines {
+		if strings.Contains(line, "  ") {
+			t.Errorf(
+				"%s: empty parameter in wire line: %q",
+				context, line,
+			)
+		}
+	}
+}
+
+// TestIntegrationDefaultServerNameFallback runs the wire
+// server with SERVER_NAME unset, which is the shipped
+// default from config.go, and verifies that VERSION, ADMIN
+// and TIME fall back to "neoirc" exactly as the HTTP path
+// does instead of emitting an empty server-name parameter.
+//
+// Every other wire test hardcodes ServerName: "test.irc",
+// so none of them exercise the default configuration.
 func TestIntegrationDefaultServerNameFallback(t *testing.T) {
 	t.Parallel()
 
-	env := newTestEnvWithConfig(t, &config.Config{})
+	env := newTestEnvWithServerName(t, "")
 
 	alice := env.dial(t)
 	alice.register("alice")
 
-	for _, step := range []struct {
+	alice.send("VERSION")
-		line, lastNumeric, want string
-	}{
-		{"VERSION", " 351 ", " 351 alice neoirc-test. neoirc "},
-		{"ADMIN", " 259 ", " 256 alice neoirc "},
-		{"TIME", " 391 ", " 391 alice neoirc "},
-	} {
-		alice.send(step.line)
 
-		reply := alice.readUntil(func(l string) bool {
+	versionReply := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, step.lastNumeric)
+		return strings.Contains(l, " 351 ")
 	})
-		assertContains(t, reply, step.want, step.line)
+	assertNoEmptyParam(t, versionReply, "VERSION")
-	}
+	assertContains(
+		t, versionReply, "neoirc",
+		"VERSION falls back to default server name",
+	)
+
+	alice.send("ADMIN")
+
+	adminReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 259 ")
+	})
+	assertNoEmptyParam(t, adminReply, "ADMIN")
+	assertContains(
+		t, adminReply, " 256 alice neoirc ",
+		"RPL_ADMINME names the default server",
+	)
+	assertContains(
+		t, adminReply, "admin@neoirc",
+		"RPL_ADMINEMAIL is a well-formed address",
+	)
+
+	alice.send("TIME")
+
+	timeReply := alice.readUntil(func(l string) bool {
+		return strings.Contains(l, " 391 ")
+	})
+	assertNoEmptyParam(t, timeReply, "TIME")
+	assertContains(
+		t, timeReply, " 391 alice neoirc ",
+		"RPL_TIME names the default server",
+	)
 }

internal/ircserver/parser.go

@@ -90,10 +90,7 @@ func ParseMessage(line string) *Message {
 }
 
 // FormatMessage formats an IRC message into wire protocol
-// format (without the trailing CR-LF). CR, LF and NUL are
+// format (without the trailing CR-LF).
-// removed from each parameter, because on the wire they would
-// end the line early; this happens before deciding whether
-// the last parameter needs a leading ':'.
 func FormatMessage(
 	prefix, command string,
 	params ...string,
@@ -109,10 +106,6 @@ func FormatMessage(
 	buf.WriteString(command)
 
 	for i, param := range params {
-		param = strings.ReplaceAll(param, "\r", "")
-		param = strings.ReplaceAll(param, "\n", "")
-		param = strings.ReplaceAll(param, "\x00", "")
-
 		buf.WriteByte(' ')
 
 		isLast := i == len(params)-1

internal/ircserver/parser_test.go

@@ -4,18 +4,12 @@ import (
 	"testing"
 
 	"sneak.berlin/go/neoirc/internal/ircserver"
-	"sneak.berlin/go/neoirc/pkg/irc"
 )
 
 //nolint:funlen // table-driven test
 func TestParseMessage(t *testing.T) {
 	t.Parallel()
 
-	const (
-		nick    = "alice"
-		channel = "#general"
-	)
-
 	tests := []struct {
 		name    string
 		input   string
@@ -30,10 +24,10 @@ func TestParseMessage(t *testing.T) {
 		},
 		{
 			name:  "simple command",
-			input: irc.CmdPing,
+			input: "PING",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPing,
+				Command: "PING",
 				Params:  nil,
 			},
 			wantNil: false,
@@ -44,7 +38,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "NICK",
-				Params:  []string{nick},
+				Params:  []string{"alice"},
 			},
 			wantNil: false,
 		},
@@ -63,8 +57,8 @@ func TestParseMessage(t *testing.T) {
 			input: "PRIVMSG #general :hello world",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPrivmsg,
+				Command: "PRIVMSG",
-				Params:  []string{channel, "hello world"},
+				Params:  []string{"#general", "hello world"},
 			},
 			wantNil: false,
 		},
@@ -74,7 +68,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "server.example.com",
 				Command: "001",
-				Params:  []string{nick, "Welcome to IRC"},
+				Params:  []string{"alice", "Welcome to IRC"},
 			},
 			wantNil: false,
 		},
@@ -85,7 +79,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "USER",
 				Params: []string{
-					nick, "0", "*", "Alice Smith",
+					"alice", "0", "*", "Alice Smith",
 				},
 			},
 			wantNil: false,
@@ -96,7 +90,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "JOIN",
-				Params:  []string{channel},
+				Params:  []string{"#general"},
 			},
 			wantNil: false,
 		},
@@ -105,17 +99,17 @@ func TestParseMessage(t *testing.T) {
 			input: "QUIT :leaving now",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdQuit,
+				Command: "QUIT",
 				Params:  []string{"leaving now"},
 			},
 			wantNil: false,
 		},
 		{
 			name:  "quit without reason",
-			input: irc.CmdQuit,
+			input: "QUIT",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdQuit,
+				Command: "QUIT",
 				Params:  nil,
 			},
 			wantNil: false,
@@ -126,7 +120,7 @@ func TestParseMessage(t *testing.T) {
 			want: &ircserver.Message{
 				Prefix:  "",
 				Command: "MODE",
-				Params:  []string{channel},
+				Params:  []string{"#general"},
 			},
 			wantNil: false,
 		},
@@ -137,7 +131,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "KICK",
 				Params: []string{
-					channel, "bob", "misbehaving",
+					"#general", "bob", "misbehaving",
 				},
 			},
 			wantNil: false,
@@ -147,8 +141,8 @@ func TestParseMessage(t *testing.T) {
 			input: "PRIVMSG #general :",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPrivmsg,
+				Command: "PRIVMSG",
-				Params:  []string{channel, ""},
+				Params:  []string{"#general", ""},
 			},
 			wantNil: false,
 		},
@@ -167,7 +161,7 @@ func TestParseMessage(t *testing.T) {
 			input: "PING :irc.example.com",
 			want: &ircserver.Message{
 				Prefix:  "",
-				Command: irc.CmdPing,
+				Command: "PING",
 				Params:  []string{"irc.example.com"},
 			},
 			wantNil: false,
@@ -179,7 +173,7 @@ func TestParseMessage(t *testing.T) {
 				Prefix:  "",
 				Command: "TOPIC",
 				Params: []string{
-					channel,
+					"#general",
 					"Welcome to the channel!",
 				},
 			},
@@ -243,12 +237,6 @@ func TestParseMessage(t *testing.T) {
 func TestFormatMessage(t *testing.T) {
 	t.Parallel()
 
-	const (
-		nick       = "alice"
-		channel    = "#general"
-		serverName = "server"
-	)
-
 	tests := []struct {
 		name    string
 		prefix  string
@@ -259,35 +247,35 @@ func TestFormatMessage(t *testing.T) {
 		{
 			name:    "simple command",
 			prefix:  "",
-			command: irc.CmdPing,
+			command: "PING",
 			params:  nil,
-			want:    irc.CmdPing,
+			want:    "PING",
 		},
 		{
 			name:    "with prefix",
-			prefix:  serverName,
+			prefix:  "server",
 			command: "PONG",
-			params:  []string{serverName},
+			params:  []string{"server"},
 			want:    ":server PONG server",
 		},
 		{
 			name:    "privmsg with trailing",
 			prefix:  "alice!alice@host",
-			command: irc.CmdPrivmsg,
+			command: "PRIVMSG",
-			params:  []string{channel, "hello world"},
+			params:  []string{"#general", "hello world"},
 			want:    ":alice!alice@host PRIVMSG #general :hello world",
 		},
 		{
 			name:    "numeric reply",
-			prefix:  serverName,
+			prefix:  "server",
 			command: "001",
-			params:  []string{nick, "Welcome to IRC"},
+			params:  []string{"alice", "Welcome to IRC"},
 			want:    ":server 001 alice :Welcome to IRC",
 		},
 		{
 			name:    "empty trailing",
-			prefix:  serverName,
+			prefix:  "server",
-			command: irc.CmdPrivmsg,
+			command: "PRIVMSG",
 			params:  []string{"#chan", ""},
 			want:    ":server PRIVMSG #chan :",
 		},
@@ -314,7 +302,7 @@ func TestParseFormatRoundTrip(t *testing.T) {
 	// parameter either contains a space (gets ':' prefix
 	// on format) or is a non-trailing single token.
 	lines := []string{
-		irc.CmdPing,
+		"PING",
 		"NICK alice",
 		"PRIVMSG #general :hello world",
 		"JOIN #general",

internal/ircserver/relay.go

@@ -3,7 +3,6 @@ package ircserver
 import (
 	"context"
 	"encoding/json"
-	"slices"
 	"strings"
 	"time"
 
@@ -27,30 +26,22 @@ func (c *Conn) relayMessages(ctx context.Context) {
 		default:
 		}
 
-		// Register with the broker before draining, so that a
-		// message queued after the drain has read the queue
-		// still signals waitCh.
-		waitCh := c.brk.Wait(c.sessionID)
-
 		// Drain any available messages.
 		delivered := c.drainQueue(ctx)
 
 		if delivered {
-			c.brk.Remove(c.sessionID, waitCh)
-
 			// Tight loop while there are messages.
 			continue
 		}
 
 		// Wait for notification or timeout.
+		waitCh := c.brk.Wait(c.sessionID)
+
 		select {
 		case <-waitCh:
 			// New message notification — loop back.
 		case <-ticker.C:
-			// Periodic check. Nothing used waitCh, so take it
+			// Periodic check.
-			// out of the broker before the next pass adds
-			// another.
-			c.brk.Remove(c.sessionID, waitCh)
 		case <-ctx.Done():
 			c.brk.Remove(c.sessionID, waitCh)
 
@@ -92,7 +83,7 @@ func (c *Conn) drainQueue(ctx context.Context) bool {
 //
 //nolint:cyclop // dispatch table
 func (c *Conn) deliverIRCMessage(
-	ctx context.Context,
+	_ context.Context,
 	msg *db.IRCMessage,
 ) {
 	command := msg.Command
@@ -114,13 +105,13 @@ func (c *Conn) deliverIRCMessage(
 	case isNumeric(command):
 		c.deliverNumeric(msg, text)
 	case command == irc.CmdPrivmsg || command == irc.CmdNotice:
-		c.deliverTextMessage(msg, command, bodyLines)
+		c.deliverTextMessage(msg, command, text)
 	case command == irc.CmdJoin:
 		c.deliverJoin(msg)
 	case command == irc.CmdPart:
 		c.deliverPart(msg, text)
 	case command == irc.CmdNick:
-		c.deliverNickChange(ctx, msg, text)
+		c.deliverNickChange(msg, text)
 	case command == irc.CmdQuit:
 		c.deliverQuitMsg(msg, text)
 	case command == irc.CmdTopic:
@@ -132,18 +123,14 @@ func (c *Conn) deliverIRCMessage(
 	case command == irc.CmdWallops:
 		c.deliverWallops(msg, text)
 	case command == irc.CmdMode:
-		c.deliverMode(msg, bodyLines)
+		c.deliverMode(msg, text)
 	case command == irc.CmdPing:
 		// Server-originated PING — reply with PONG.
 		c.sendFromServer("PING", c.serverSfx)
 	default:
 		// Unknown command — deliver as server notice.
 		if text != "" {
-			c.mu.Lock()
+			c.sendFromServer("NOTICE", c.nick, text)
-			nick := c.nick
-			c.mu.Unlock()
-
-			c.sendFromServer("NOTICE", nick, text)
 		}
 	}
 }
@@ -173,12 +160,8 @@ func (c *Conn) deliverNumeric(
 		_ = json.Unmarshal(msg.Params, &params)
 	}
 
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
 	allParams := make([]string, 0, 1+len(params)+1)
-	allParams = append(allParams, nick)
+	allParams = append(allParams, c.nick)
 	allParams = append(allParams, params...)
 
 	if text != "" {
@@ -188,28 +171,35 @@ func (c *Conn) deliverNumeric(
 	c.send(FormatMessage(from, msg.Command, allParams...))
 }
 
-// deliverTextMessage sends PRIVMSG or NOTICE, one line for
+// deliverTextMessage sends PRIVMSG or NOTICE.
-// each line of the body.
 func (c *Conn) deliverTextMessage(
 	msg *db.IRCMessage,
-	command string,
+	command, text string,
-	bodyLines []string,
 ) {
 	from := msg.From
 	target := msg.To
 
+	// Don't echo our own messages back.
+	if strings.EqualFold(from, c.nick) {
+		return
+	}
+
 	prefix := from
 	if !strings.Contains(prefix, "!") {
 		prefix = from + "!" + from + "@*"
 	}
 
-	for _, line := range bodyLines {
+	c.send(FormatMessage(prefix, command, target, text))
-		c.send(FormatMessage(prefix, command, target, line))
-	}
 }
 
 // deliverJoin sends a JOIN notification.
 func (c *Conn) deliverJoin(msg *db.IRCMessage) {
+	// Don't echo our own JOINs (we already sent them
+	// during joinChannel).
+	if strings.EqualFold(msg.From, c.nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -218,6 +208,10 @@ func (c *Conn) deliverJoin(msg *db.IRCMessage) {
 
 // deliverPart sends a PART notification.
 func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
+	if strings.EqualFold(msg.From, c.nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 	channel := msg.To
 
@@ -230,17 +224,14 @@ func (c *Conn) deliverPart(msg *db.IRCMessage, text string) {
 	}
 }
 
-// deliverNickChange sends a NICK change notification. The
+// deliverNickChange sends a NICK change notification.
-// change may be its own session's, made from another client,
-// so the connection first takes the nick its session holds
-// now. It does not go by the line's old nick: the connection
-// may have taken that nick after another user gave it up.
 func (c *Conn) deliverNickChange(
-	ctx context.Context,
 	msg *db.IRCMessage,
 	newNick string,
 ) {
-	c.loadSessionNick(ctx)
+	if strings.EqualFold(msg.From, c.nick) {
+		return
+	}
 
 	prefix := msg.From + "!" + msg.From + "@*"
 
@@ -252,6 +243,10 @@ func (c *Conn) deliverQuitMsg(
 	msg *db.IRCMessage,
 	text string,
 ) {
+	if strings.EqualFold(msg.From, c.nick) {
+		return
+	}
+
 	prefix := msg.From + "!" + msg.From + "@*"
 
 	if text != "" {
@@ -304,24 +299,12 @@ func (c *Conn) deliverKickMsg(
 	}
 }
 
-// deliverInviteMsg sends an INVITE line from the inviter
+// deliverInviteMsg sends an INVITE notification.
-// for the channel named in text, or nothing when text names
-// no channel.
 func (c *Conn) deliverInviteMsg(
-	msg *db.IRCMessage,
+	_ *db.IRCMessage,
 	text string,
 ) {
-	if text == "" {
+	c.sendFromServer("NOTICE", c.nick, text)
-		return
-	}
-
-	c.mu.Lock()
-	nick := c.nick
-	c.mu.Unlock()
-
-	prefix := msg.From + "!" + msg.From + "@*"
-
-	c.send(FormatMessage(prefix, "INVITE", nick, text))
 }
 
 // deliverWallops sends a WALLOPS notification.
@@ -336,26 +319,15 @@ func (c *Conn) deliverWallops(
 	))
 }
 
-// deliverMode sends a MODE change notification. The first
+// deliverMode sends a MODE change notification.
-// body line is the change, possibly followed by its values
-// separated by spaces ("+o bob"); any further lines are
-// values ("+k", "secret"). Each goes out as its own
-// parameter, as IRC sends them.
 func (c *Conn) deliverMode(
 	msg *db.IRCMessage,
-	bodyLines []string,
+	text string,
 ) {
-	if len(bodyLines) == 0 || bodyLines[0] == "" {
-		return
-	}
-
 	prefix := msg.From + "!" + msg.From + "@*"
+	target := msg.To
 
-	params := slices.Concat(
+	if text != "" {
-		[]string{msg.To},
+		c.send(FormatMessage(prefix, "MODE", target, text))
-		strings.Fields(bodyLines[0]),
+	}
-		bodyLines[1:],
-	)
-
-	c.send(FormatMessage(prefix, "MODE", params...))
 }

internal/ircserver/relay_test.go

@@ -1,697 +0,0 @@
-package ircserver_test
-
-import (
-	"context"
-	"encoding/json"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/neoirc/internal/ircserver"
-	"sneak.berlin/go/neoirc/internal/service"
-)
-
-// queueMessage queues a message for the user with nick
-// recipient the way the HTTP API sends one: stored once, then
-// queued to the recipient's session.
-func (env *testEnv) queueMessage(
-	t *testing.T,
-	recipient, command, from, to string,
-	body []string,
-) {
-	t.Helper()
-
-	ctx := t.Context()
-
-	bodyJSON, err := json.Marshal(body)
-	if err != nil {
-		t.Fatalf("marshal body: %v", err)
-	}
-
-	msgID, _, err := env.database.InsertMessage(
-		ctx, command, from, to, 0, 0, nil, bodyJSON, nil,
-	)
-	if err != nil {
-		t.Fatalf("insert message: %v", err)
-	}
-
-	sessionID, err := env.database.GetSessionByNick(ctx, recipient)
-	if err != nil {
-		t.Fatalf("get session of %s: %v", recipient, err)
-	}
-
-	err = env.database.EnqueueToSession(ctx, sessionID, msgID, 0)
-	if err != nil {
-		t.Fatalf("enqueue: %v", err)
-	}
-
-	env.brk.Notify(sessionID)
-}
-
-// TestRelayKeepsOneWaitChannel checks that an IRC listener
-// connection holds at most one broker wait channel across
-// several relay ticks, both while idle and after the relay
-// has delivered it a message, and none once it closes.
-func TestRelayKeepsOneWaitChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	client := env.dial(t)
-	client.register("idle")
-
-	sessionID, err := env.database.GetSessionByNick(t.Context(), "idle")
-	if err != nil {
-		t.Fatalf("get session of idle: %v", err)
-	}
-
-	env.checkOneWaitChannel(t, sessionID)
-
-	env.queueMessage(
-		t, "idle", "PRIVMSG", "carol", "idle", []string{"hello"},
-	)
-
-	client.readUntil(func(l string) bool {
-		return strings.Contains(l, "hello")
-	})
-
-	env.checkOneWaitChannel(t, sessionID)
-
-	err = client.conn.Close()
-	if err != nil {
-		t.Fatalf("close: %v", err)
-	}
-
-	deadline := time.Now().Add(testTimeout)
-
-	for env.brk.ListenerCount(sessionID) != 0 {
-		if time.Now().After(deadline) {
-			t.Fatalf("after close: got %d wait channels, want 0",
-				env.brk.ListenerCount(sessionID))
-		}
-
-		time.Sleep(relayCheckStep)
-	}
-}
-
-// checkOneWaitChannel fails the test if the session
-// sessionID holds more than one broker wait channel at any of
-// several relay ticks.
-func (env *testEnv) checkOneWaitChannel(
-	t *testing.T,
-	sessionID int64,
-) {
-	t.Helper()
-
-	const ticks = 5
-
-	for tick := range ticks {
-		time.Sleep(ircserver.PollInterval)
-
-		got := env.brk.ListenerCount(sessionID)
-		if got > 1 {
-			t.Fatalf("tick %d: got %d wait channels, want at most 1",
-				tick+1, got)
-		}
-	}
-}
-
-// TestRelayMultiLineBody checks that each line of a PRIVMSG
-// or NOTICE body sent over the HTTP API reaches an IRC
-// listener user as its own line.
-func TestRelayMultiLineBody(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-
-	for _, command := range []string{"PRIVMSG", "NOTICE"} {
-		env.queueMessage(
-			t, "alice", command, "carol", "alice",
-			[]string{"first line", "second line"},
-		)
-
-		lines := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, "second line")
-		})
-
-		want := []string{
-			":carol!carol@* " + command + " alice :first line",
-			":carol!carol@* " + command + " alice :second line",
-		}
-
-		got := lines[max(0, len(lines)-len(want)):]
-		if !slices.Equal(got, want) {
-			t.Errorf("%s: got %q, want %q", command, got, want)
-		}
-	}
-}
-
-// TestRelayModeParameters checks that a MODE change reaches
-// IRC listener members with its values as separate
-// parameters, both for the bodies the HTTP API stores and
-// for a change made on the IRC listener.
-func TestRelayModeParameters(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-
-	for _, step := range []struct {
-		body []string
-		want string
-	}{
-		{[]string{"+k", "secret"}, "+k secret"},
-		{[]string{"-k", "*"}, "-k *"},
-		{[]string{"+l", "50"}, "+l 50"},
-		{[]string{"-l"}, "-l"},
-		{[]string{"+b", "*!*@*.example.com"}, "+b *!*@*.example.com"},
-		{[]string{"-b", "*!*@*.example.com"}, "-b *!*@*.example.com"},
-		{[]string{"+o bob"}, "+o bob"},
-		{[]string{"+m"}, "+m"},
-	} {
-		env.queueMessage(t, "alice", "MODE", "op", "#modes", step.body)
-
-		lines := alice.readUntil(func(l string) bool {
-			return strings.Contains(l, " MODE ")
-		})
-
-		got := lines[len(lines)-1]
-		want := ":op!op@* MODE #modes " + step.want
-
-		if got != want {
-			t.Errorf("body %q: got %q, want %q", step.body, got, want)
-		}
-	}
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	alice.joinAndDrain("#modes")
-	bob.joinAndDrain("#modes")
-
-	alice.send("MODE #modes +v bob")
-
-	const change = " MODE #modes +v bob"
-
-	for name, client := range map[string]*testClient{
-		"alice": alice, "bob": bob,
-	} {
-		lines := client.readUntil(func(l string) bool {
-			return strings.Contains(l, " MODE ")
-		})
-
-		got := lines[len(lines)-1]
-		if !strings.HasSuffix(got, change) {
-			t.Errorf("%s: got %q, want it to end in %q", name, got, change)
-		}
-	}
-}
-
-// TestRelayInviteWithoutChannel checks that an INVITE whose
-// body names no channel sends the invited IRC listener user
-// no INVITE line.
-func TestRelayInviteWithoutChannel(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	// A nil body is stored as JSON null, which is not an array.
-	for _, body := range [][]string{nil, {}, {""}} {
-		env.queueMessage(t, "bob", "INVITE", "carol", "bob", body)
-	}
-
-	// The relay sends a user's queue in order, so this arrives
-	// after anything sent for the INVITEs above.
-	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
-		[]string{"the end"})
-
-	lines := bob.readUntil(func(l string) bool {
-		return strings.HasSuffix(l, " :the end")
-	})
-
-	for _, line := range lines {
-		if strings.Contains(line, " INVITE ") {
-			t.Errorf("got %q, want no INVITE line", line)
-		}
-	}
-}
-
-// TestRelayLineBreaks checks that a CR, LF or NUL in a stored
-// body line, key or mask never reaches an IRC listener user
-// as a line break, so no extra line arrives, and that a body
-// line keeps its parameter and leading ':' once they are
-// removed.
-func TestRelayLineBreaks(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	bob := env.dial(t)
-	bob.register("bob")
-
-	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob", []string{
-		"one\r\n:admin!a@b PRIVMSG bob :hi",
-		"two\n:admin!a@b NOTICE bob :hi\x00",
-	})
-	env.queueMessage(t, "bob", "MODE", "op", "#breaks",
-		[]string{"+k", "key\r\nERROR :Closing link"})
-	env.queueMessage(t, "bob", "MODE", "op", "#breaks",
-		[]string{"+b", "*!*@*\r\n:admin!a@b KICK #breaks bob"})
-	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
-		[]string{"\r\n", "\x00:hi"})
-	env.queueMessage(t, "bob", "PRIVMSG", "carol", "bob",
-		[]string{"the end"})
-
-	lines := bob.readUntil(func(l string) bool {
-		return strings.HasSuffix(l, " :the end")
-	})
-
-	want := []string{
-		":carol!carol@* PRIVMSG bob :one:admin!a@b PRIVMSG bob :hi",
-		":carol!carol@* PRIVMSG bob :two:admin!a@b NOTICE bob :hi",
-		":op!op@* MODE #breaks +k :keyERROR :Closing link",
-		":op!op@* MODE #breaks +b :*!*@*:admin!a@b KICK #breaks bob",
-		":carol!carol@* PRIVMSG bob :",
-		":carol!carol@* PRIVMSG bob ::hi",
-		":carol!carol@* PRIVMSG bob :the end",
-	}
-
-	got := lines[max(0, len(lines)-len(want)):]
-	if !slices.Equal(got, want) {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}
-
-// TestRelayNickDiffersOnlyInCase checks that an IRC listener
-// user alice receives a JOIN, PRIVMSG, PART, NICK and QUIT
-// from Alice in a channel they share: nicks are
-// case-sensitive, so Alice is someone else.
-func TestRelayNickDiffersOnlyInCase(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.joinAndDrain("#case")
-
-	capitalAlice := env.dial(t)
-	capitalAlice.register("Alice")
-
-	for _, step := range []struct {
-		line, want string
-	}{
-		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
-		{"PRIVMSG #case :hi there", ":Alice!Alice@* PRIVMSG #case :hi there"},
-		{"PART #case :see you", ":Alice!Alice@* PART #case :see you"},
-		{"JOIN #case", ":Alice!Alice@* JOIN #case"},
-		{"NICK Alicia", ":Alice!Alice@* NICK Alicia"},
-		{"NICK Alice", ":Alicia!Alicia@* NICK Alice"}, // back for QUIT
-		{"QUIT", ":Alice!Alice@* QUIT :Quit: Connection closed"},
-	} {
-		capitalAlice.send(step.line)
-
-		got := alice.readLine()
-		if got != step.want {
-			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
-		}
-	}
-}
-
-// TestRelayOwnChangeOnce checks that an IRC listener user who
-// sets a topic, changes a channel mode or kicks gets one TOPIC,
-// MODE or KICK line for it, and so does the other member.
-func TestRelayOwnChangeOnce(t *testing.T) {
-	t.Parallel()
-
-	for _, step := range []struct {
-		command, line string
-	}{
-		{"TOPIC", "TOPIC #dup :new topic"},
-		{"MODE", "MODE #dup +m"},
-		{"KICK", "KICK #dup carl :bye"},
-	} {
-		t.Run(step.command, func(t *testing.T) {
-			t.Parallel()
-
-			env := newTestEnv(t)
-
-			alice := env.dial(t)
-			alice.register("alice")
-			alice.joinAndDrain("#dup")
-
-			carl := env.dial(t)
-			carl.register("carl")
-			carl.joinAndDrain("#dup")
-
-			alice.send(step.line)
-
-			// The reply to alice's next command comes after her
-			// command has finished, so her own copy comes before it.
-			beforePong := alice.sendAndExpect("PING :done", "PONG")
-
-			// The relay sends a user's queue in order, so a message
-			// queued now arrives after any relayed copy.
-			for nick, client := range map[string]*testClient{
-				"alice": alice, "carl": carl,
-			} {
-				env.queueMessage(
-					t, nick, "PRIVMSG", "dave", nick,
-					[]string{"after the change"},
-				)
-
-				lines := client.readUntil(func(l string) bool {
-					return strings.HasSuffix(l, " :after the change")
-				})
-
-				if client == alice {
-					lines = slices.Concat(beforePong, lines)
-				}
-
-				var changes []string
-
-				for _, line := range lines {
-					if strings.Contains(line, " "+step.command+" #dup ") {
-						changes = append(changes, line)
-					}
-				}
-
-				if len(changes) != 1 {
-					t.Errorf("%s got %q, want one %s line",
-						nick, changes, step.command)
-				}
-			}
-		})
-	}
-}
-
-// TestRelayOwnSessionOnce checks that a command a user makes
-// from one client of their session reaches each of the
-// session's clients once: an IRC listener connection and an
-// HTTP API client. The connection that sent a command gets
-// only its own echo, and none for PRIVMSG and NOTICE, which
-// IRC does not echo.
-//
-//nolint:funlen // table-driven test
-func TestRelayOwnSessionOnce(t *testing.T) {
-	t.Parallel()
-
-	hello := json.RawMessage(`["hello"]`)
-
-	for _, step := range []struct {
-		// line is the command as alice sends it on the IRC
-		// listener.
-		line string
-		// api makes the same command for her session the way
-		// the HTTP API does.
-		api func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error
-		// echoes is how many copies alice's connection gets of
-		// line when it sends line itself.
-		echoes int
-	}{
-		{"PRIVMSG #chan :hello", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.SendChannelMessage(
-				ctx, sessionID, 0, "alice", "PRIVMSG", "#chan", hello, nil,
-			)
-
-			return err
-		}, 0},
-		{"NOTICE bob :hello", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.SendDirectMessage(
-				ctx, sessionID, 0, "alice", "NOTICE", "bob", hello, nil,
-			)
-
-			return err
-		}, 0},
-		{"JOIN #other", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			_, err := svc.JoinChannel(ctx, sessionID, 0, "alice", "#other", "")
-
-			return err
-		}, 1},
-		{"PART #chan :bye", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.PartChannel(ctx, sessionID, 0, "alice", "#chan", "bye")
-		}, 1},
-		{"NICK alice2", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.ChangeNick(ctx, sessionID, 0, "alice", "alice2")
-		}, 1},
-		{"TOPIC #chan :new topic", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.SetTopic(
-				ctx, sessionID, 0, "alice", "#chan", "new topic",
-			)
-		}, 1},
-		{"MODE #chan +m", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			chID, err := svc.ValidateChannelOp(ctx, sessionID, "#chan")
-			if err != nil {
-				return err
-			}
-
-			err = svc.SetChannelFlag(ctx, chID, 'm', true)
-			if err != nil {
-				return err
-			}
-
-			svc.BroadcastMode(ctx, 0, "alice", "#chan", chID, "+m")
-
-			return nil
-		}, 1},
-		{"KICK #chan bob :bye", func(
-			ctx context.Context, svc *service.Service, sessionID int64,
-		) error {
-			return svc.KickUser(
-				ctx, sessionID, 0, "alice", "#chan", "bob", "bye",
-			)
-		}, 1},
-	} {
-		command := strings.Fields(step.line)[0]
-
-		t.Run(command+" from IRC", func(t *testing.T) {
-			t.Parallel()
-
-			ircCopies, httpCopies := ownSessionCopies(t, step.line, nil)
-			if ircCopies != step.echoes || httpCopies != 1 {
-				t.Errorf("connection got %d, HTTP client got %d, want %d and 1",
-					ircCopies, httpCopies, step.echoes)
-			}
-		})
-
-		t.Run(command+" from the HTTP API", func(t *testing.T) {
-			t.Parallel()
-
-			ircCopies, httpCopies := ownSessionCopies(t, step.line, step.api)
-			if ircCopies != 1 || httpCopies != 1 {
-				t.Errorf("connection got %d, HTTP client got %d, want 1 and 1",
-					ircCopies, httpCopies)
-			}
-		})
-	}
-}
-
-// ownSessionCopies sets up alice with aliceWithHTTPClient. It
-// makes the command line from her connection, or with api from
-// the HTTP API client when api is not nil, and returns how many
-// copies of it her connection and her HTTP API client got.
-func ownSessionCopies(
-	t *testing.T,
-	line string,
-	api func(ctx context.Context, svc *service.Service, sessionID int64) error,
-) (int, int) {
-	t.Helper()
-
-	ctx := t.Context()
-	env := newTestEnv(t)
-	alice, _, sessionID, httpClientID := aliceWithHTTPClient(t, env)
-
-	var lines []string
-
-	if api == nil {
-		alice.send(line)
-
-		// Her echo comes before the reply to her next command.
-		lines = alice.sendAndExpect("PING :done", "PONG")
-	} else {
-		err := api(ctx, env.srv.Service(), sessionID)
-		if err != nil {
-			t.Fatalf("%s over the HTTP API: %v", line, err)
-		}
-	}
-
-	msgs, _, err := env.database.PollMessages(ctx, httpClientID, 0, 0)
-	if err != nil {
-		t.Fatalf("poll the HTTP API client: %v", err)
-	}
-
-	httpCopies := 0
-
-	for _, msg := range msgs {
-		if msg.Command == strings.Fields(line)[0] {
-			httpCopies++
-		}
-	}
-
-	// The relay sends a queue in order, so this arrives after any
-	// copy. It is queued by session, as NICK changes her nick.
-	endID, _, err := env.database.InsertMessage(
-		ctx, "PRIVMSG", "dave", "alice", 0, 0,
-		nil, json.RawMessage(`["the end"]`), nil,
-	)
-	if err != nil {
-		t.Fatalf("insert message: %v", err)
-	}
-
-	err = env.database.EnqueueToSession(ctx, sessionID, endID, 0)
-	if err != nil {
-		t.Fatalf("enqueue: %v", err)
-	}
-
-	env.brk.Notify(sessionID)
-
-	lines = append(lines, alice.readUntil(func(l string) bool {
-		return strings.HasSuffix(l, " :the end")
-	})...)
-
-	// A copy starts with the command and its first parameter.
-	start := " " + strings.Join(strings.Fields(line)[:2], " ")
-	ircCopies := strings.Count(strings.Join(lines, "\n"), start)
-
-	return ircCopies, httpCopies
-}
-
-// aliceWithHTTPClient connects alice to the IRC listener and
-// has her join #chan, which bob is on too, then adds an HTTP API
-// client to her session with the password her connection set,
-// as POST /api/v1/login does. It returns her connection, bob's
-// connection, her session and her HTTP API client.
-func aliceWithHTTPClient(
-	t *testing.T, env *testEnv,
-) (*testClient, *testClient, int64, int64) {
-	t.Helper()
-
-	const password = "alicepass"
-
-	alice := env.dial(t)
-	alice.send("PASS " + password)
-	alice.register("alice")
-	// Registration stores the password before the JOIN runs.
-	alice.joinAndDrain("#chan")
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.joinAndDrain("#chan")
-
-	sessionID, httpClientID, _, err := env.database.LoginUser(
-		t.Context(), "alice", password, "127.0.0.1", "localhost",
-	)
-	if err != nil {
-		t.Fatalf("log in as alice: %v", err)
-	}
-
-	return alice, bob, sessionID, httpClientID
-}
-
-// TestRelayNickChangeFromHTTPAPI checks that once alice's nick
-// is changed from her HTTP API client, her IRC listener
-// connection uses the new nick: what she then sends from it
-// reaches bob under the new nick.
-func TestRelayNickChangeFromHTTPAPI(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-	alice, bob, sessionID, _ := aliceWithHTTPClient(t, env)
-
-	bob.joinAndDrain("#other")
-
-	// As the HTTP API does.
-	err := env.srv.Service().ChangeNick(
-		t.Context(), sessionID, 0, "alice", "alice2",
-	)
-	if err != nil {
-		t.Fatalf("change nick over the HTTP API: %v", err)
-	}
-
-	// Her connection has taken the new nick once it has sent her
-	// the change.
-	const change = ":alice!alice@* NICK alice2"
-
-	alice.readUntil(func(l string) bool { return l == change })
-	bob.readUntil(func(l string) bool { return l == change })
-
-	for _, step := range []struct {
-		line, want string
-	}{
-		{"PRIVMSG #chan :hi there", ":alice2!alice2@* PRIVMSG #chan :hi there"},
-		{"JOIN #other", ":alice2!alice2@* JOIN #other"},
-		{"NICK alice3", ":alice2!alice2@* NICK alice3"},
-	} {
-		alice.send(step.line)
-
-		got := bob.readLine()
-		if got != step.want {
-			t.Errorf("%s: got %q, want %q", step.line, got, step.want)
-		}
-	}
-}
-
-// TestRelayNickChangeKeepsTakenNick checks that an IRC
-// listener connection which takes a nick another user has
-// given up keeps it when that user's change reaches it
-// afterwards: what it then sends goes out under the nick its
-// session holds.
-func TestRelayNickChangeKeepsTakenNick(t *testing.T) {
-	t.Parallel()
-
-	env := newTestEnv(t)
-
-	bob := env.dial(t)
-	bob.register("bob")
-	bob.sendAndExpect("NICK bob2", " NICK bob2")
-
-	alice := env.dial(t)
-	alice.register("alice")
-	alice.sendAndExpect("NICK bob", " NICK bob")
-	alice.joinAndDrain("#chan")
-
-	bob.joinAndDrain("#chan")
-
-	// Bob's change reaches alice only now, as it does when she
-	// takes his old nick before her connection has passed the
-	// change on. She holds bob now, so it is queued to bob.
-	env.queueMessage(t, "bob", "NICK", "bob", "", []string{"bob2"})
-
-	alice.readUntil(func(l string) bool {
-		return l == ":bob!bob@* NICK bob2"
-	})
-
-	alice.send("PRIVMSG #chan :hi there")
-
-	const want = ":bob!bob@* PRIVMSG #chan :hi there"
-
-	got := bob.readLine()
-	if got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}

internal/ircserver/server.go

@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"net"
 	"sync"
-	"time"
 
 	"go.uber.org/fx"
 	"sneak.berlin/go/neoirc/internal/broker"
@@ -16,10 +15,6 @@ import (
 	"sneak.berlin/go/neoirc/internal/service"
 )
 
-// stopTimeout is the longest stop waits for the connections'
-// cleanup, which ends their sessions.
-const stopTimeout = 5 * time.Second
-
 // Params defines the dependencies for creating an IRC
 // Server.
 type Params struct {
@@ -43,19 +38,6 @@ type Server struct {
 	mu       sync.Mutex
 	conns    map[*Conn]struct{}
 	cancel   context.CancelFunc
-
-	// serving counts the connections whose serve, cleanup
-	// included, has not returned yet.
-	serving sync.WaitGroup
-
-	// pingInterval and pongDeadline are the constants of the
-	// same names, except in tests, which shorten them.
-	pingInterval time.Duration
-	pongDeadline time.Duration
-
-	// resolveHost is the function of the same name, except in
-	// tests, which replace it with one that blocks.
-	resolveHost func(ctx context.Context, addr string) string
 }
 
 // New creates a new IRC Server and registers its lifecycle
@@ -75,11 +57,6 @@ func New(
 		listener: nil,
 		cancel:   nil,
 		mu:       sync.Mutex{},
-		serving:  sync.WaitGroup{},
-
-		pingInterval: pingInterval,
-		pongDeadline: pongDeadline,
-		resolveHost:  resolveHost,
 	}
 
 	listenAddr := params.Config.IRCListenAddr
@@ -104,32 +81,27 @@ func New(
 // start begins listening for TCP connections.
 //
 //nolint:contextcheck // long-lived server ctx, not the short Fx one
-func (s *Server) start(ctx context.Context, addr string) error {
+func (s *Server) start(_ context.Context, addr string) error {
-	var listenConfig net.ListenConfig
+	ln, err := net.Listen("tcp", addr)
-
-	ln, err := listenConfig.Listen(ctx, "tcp", addr)
 	if err != nil {
 		return fmt.Errorf("irc listen: %w", err)
 	}
 
 	s.listener = ln
 
-	serverCtx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
 	s.cancel = cancel
 
 	s.log.Info(
 		"irc server listening", "addr", addr,
 	)
 
-	go s.acceptLoop(serverCtx)
+	go s.acceptLoop(ctx)
 
 	return nil
 }
 
-// stop shuts down the listener and all connections, then
+// stop shuts down the listener and all connections.
-// waits up to stopTimeout for every connection's cleanup to
-// finish, so that their sessions are ended before the
-// database closes.
 func (s *Server) stop() {
 	if s.cancel != nil {
 		s.cancel()
@@ -144,22 +116,6 @@ func (s *Server) stop() {
 		c.conn.Close() //nolint:errcheck,gosec
 	}
 	s.mu.Unlock()
-
-	done := make(chan struct{})
-
-	go func() {
-		s.serving.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-	case <-time.After(stopTimeout):
-		s.log.Error(
-			"irc connections not cleaned up before stop timeout",
-			"timeout", stopTimeout,
-		)
-	}
 }
 
 // acceptLoop accepts new connections.
@@ -180,39 +136,22 @@ func (s *Server) acceptLoop(ctx context.Context) {
 		}
 
 		client := newConn(
-			tcpConn, s.log,
+			ctx, tcpConn, s.log,
 			s.database, s.brk, s.cfg, s.svc,
 		)
 
 		s.mu.Lock()
-
-		// stop cancels ctx before it takes s.mu to close the
-		// connections, so a connection accepted while stop
-		// runs is either closed and waited for by stop or
-		// closed here.
-		if ctx.Err() != nil {
-			s.mu.Unlock()
-			tcpConn.Close() //nolint:errcheck,gosec
-
-			return
-		}
-
 		s.conns[client] = struct{}{}
-		s.serving.Add(1)
 		s.mu.Unlock()
 
 		go func() {
-			defer s.serving.Done()
 			defer func() {
 				s.mu.Lock()
 				delete(s.conns, client)
 				s.mu.Unlock()
 			}()
 
-			client.serve(
+			client.serve(ctx)
-				ctx, s.resolveHost,
-				s.pingInterval, s.pongDeadline,
-			)
 		}()
 	}
 }

internal/server/export_test.go

@@ -1,22 +0,0 @@
-package server
-
-import (
-	"net"
-
-	"github.com/go-chi/chi/v5"
-)
-
-// NewTestSPAServer creates a Server whose router serves only
-// the embedded web client.
-func NewTestSPAServer() *Server {
-	srv := &Server{router: chi.NewRouter()}
-	srv.setupSPA()
-
-	return srv
-}
-
-// ServeUntilShutdown runs serveUntilShutdown, which serves the
-// HTTP server on listener, and returns when it does.
-func (srv *Server) ServeUntilShutdown(listener net.Listener) {
-	srv.serveUntilShutdown(listener)
-}

internal/server/routes.go

@@ -3,7 +3,6 @@ package server
 import (
 	"io/fs"
 	"net/http"
-	"strings"
 	"time"
 
 	"sneak.berlin/go/neoirc/web"
@@ -138,10 +137,8 @@ func (srv *Server) setupSPA() {
 			return
 		}
 
-		// The path is empty, not "/", for a request line such
-		// as "GET http://host HTTP/1.1".
 		fileData, readErr := readFS.ReadFile(
-			strings.TrimPrefix(request.URL.Path, "/"),
+			request.URL.Path[1:],
 		)
 		if readErr != nil || len(fileData) == 0 {
 			indexHTML, indexErr := readFS.ReadFile(

internal/server/routes_test.go

@@ -1,41 +0,0 @@
-package server_test
-
-import (
-	"io/fs"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"sneak.berlin/go/neoirc/internal/server"
-	"sneak.berlin/go/neoirc/web"
-)
-
-// An absolute-form request line with no path, such as
-// "GET http://example.com HTTP/1.1", leaves URL.Path empty.
-func TestSPAServesIndexForEmptyPath(t *testing.T) {
-	t.Parallel()
-
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "http://example.com", nil,
-	)
-	if request.URL.Path != "" {
-		t.Fatalf("URL.Path is %q, want it empty", request.URL.Path)
-	}
-
-	recorder := httptest.NewRecorder()
-
-	server.NewTestSPAServer().ServeHTTP(recorder, request)
-
-	if recorder.Code != http.StatusOK {
-		t.Fatalf("status %d, want %d", recorder.Code, http.StatusOK)
-	}
-
-	indexHTML, err := fs.ReadFile(web.Dist, "dist/index.html")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if recorder.Body.String() != string(indexHTML) {
-		t.Errorf("body is not the index page")
-	}
-}

internal/server/server.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -40,7 +39,6 @@ type Params struct {
 	Config     *config.Config
 	Middleware *middleware.Middleware
 	Handlers   *handlers.Handlers
-	Shutdowner fx.Shutdowner
 }
 
 // Server is the main HTTP server.
@@ -49,6 +47,8 @@ type Server struct {
 	startupTime   time.Time
 	sentryEnabled bool
 	log           *slog.Logger
+	ctx           context.Context //nolint:containedctx // signal handling pattern
+	cancelFunc    context.CancelFunc
 	httpServer    *http.Server
 	router        *chi.Mux
 	params        Params
@@ -68,23 +68,23 @@ func New(
 	}
 
 	lifecycle.Append(fx.Hook{
-		OnStart: func(ctx context.Context) error {
+		OnStart: func(_ context.Context) error {
 			srv.startupTime = time.Now()
-
+			// Configure, enable Sentry, and build the router
-			// Build the router before OnStart returns, so srv can
+			// synchronously so that srv.router is fully initialized
-			// handle requests as soon as the app has started.
+			// before OnStart returns. Any HTTP traffic (including
+			// httptest harnesses that wrap srv as a handler) is
+			// therefore guaranteed to see an initialized router,
+			// eliminating the previous race between SetupRoutes
+			// and ServeHTTP.
 			srv.configure()
 			srv.enableSentry()
 			srv.SetupRoutes()
+			go srv.serve() //nolint:contextcheck
 
-			// A closed stdout or stderr must not end the process.
+			return nil
-			signal.Ignore(syscall.SIGPIPE)
-
-			return srv.startHTTP(ctx)
 		},
-		OnStop: func(ctx context.Context) error {
+		OnStop: func(_ context.Context) error {
-			srv.cleanShutdown(ctx)
-
 			return nil
 		},
 	})
@@ -129,15 +129,40 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
+func (srv *Server) serve() {
+	srv.ctx, srv.cancelFunc = context.WithCancel(
+		context.Background(),
+	)
+
+	go func() {
+		sigCh := make(chan os.Signal, 1)
+
+		signal.Ignore(syscall.SIGPIPE)
+		signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+
+		sig := <-sigCh
+
+		srv.log.Info("signal received", "signal", sig)
+
+		if srv.cancelFunc != nil {
+			srv.cancelFunc()
+		}
+	}()
+
+	go srv.serveUntilShutdown()
+
+	<-srv.ctx.Done()
+
+	srv.cleanShutdown()
+}
+
 func (srv *Server) cleanupForExit() {
 	srv.log.Info("cleaning up")
 }
 
-// cleanShutdown stops the HTTP server, waiting up to
+func (srv *Server) cleanShutdown() {
-// shutdownTimeout for the requests in progress to finish.
-func (srv *Server) cleanShutdown(ctx context.Context) {
 	ctxShutdown, shutdownCancel := context.WithTimeout(
-		ctx, shutdownTimeout,
+		context.Background(), shutdownTimeout,
 	)
 
 	err := srv.httpServer.Shutdown(ctxShutdown)
@@ -162,23 +187,11 @@ func (srv *Server) configure() {
 	// Server configuration placeholder.
 }
 
-// startHTTP binds the HTTP listen address, so that a port
+func (srv *Server) serveUntilShutdown() {
-// that is taken fails startup, then serves the HTTP server
-// from a new goroutine. srv.httpServer is set before that
-// goroutine starts and never changes, so it and cleanShutdown
-// read it without a lock.
-func (srv *Server) startHTTP(ctx context.Context) error {
 	listenAddr := fmt.Sprintf(
 		":%d", srv.params.Config.Port,
 	)
 
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(ctx, "tcp", listenAddr)
-	if err != nil {
-		return fmt.Errorf("http listen: %w", err)
-	}
-
 	srv.httpServer = &http.Server{ //nolint:exhaustruct // optional fields
 		Addr:           listenAddr,
 		ReadTimeout:    httpReadTimeout,
@@ -187,30 +200,16 @@ func (srv *Server) startHTTP(ctx context.Context) error {
 		Handler:        srv,
 	}
 
-	go func() {
-		srv.serveUntilShutdown(listener)
-	}()
-
-	return nil
-}
-
-// serveUntilShutdown serves the HTTP server on listener until
-// cleanShutdown stops it. If serving fails before then, it
-// stops the app with exit code 1.
-func (srv *Server) serveUntilShutdown(listener net.Listener) {
 	srv.log.Info(
-		"http begin listen", "listenaddr", srv.httpServer.Addr,
+		"http begin listen", "listenaddr", listenAddr,
 	)
 
-	err := srv.httpServer.Serve(listener)
+	err := srv.httpServer.ListenAndServe()
-	if errors.Is(err, http.ErrServerClosed) {
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
-		return
-	}
-
 		srv.log.Error("listen error", "error", err)
 
-	err = srv.params.Shutdowner.Shutdown(fx.ExitCode(1))
+		if srv.cancelFunc != nil {
-	if err != nil {
+			srv.cancelFunc()
-		srv.log.Error("shutdown failed", "error", err)
+		}
 	}
 }

internal/server/server_test.go

@@ -1,358 +0,0 @@
-// Tests use a global viper instance for configuration,
-// making parallel execution unsafe.
-//
-//nolint:paralleltest
-package server_test
-
-import (
-	"crypto/rand"
-	"fmt"
-	"net"
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"go.uber.org/fx"
-	"go.uber.org/fx/fxtest"
-	"sneak.berlin/go/neoirc/internal/broker"
-	"sneak.berlin/go/neoirc/internal/config"
-	"sneak.berlin/go/neoirc/internal/db"
-	"sneak.berlin/go/neoirc/internal/globals"
-	"sneak.berlin/go/neoirc/internal/handlers"
-	"sneak.berlin/go/neoirc/internal/healthcheck"
-	"sneak.berlin/go/neoirc/internal/logger"
-	"sneak.berlin/go/neoirc/internal/middleware"
-	"sneak.berlin/go/neoirc/internal/server"
-	"sneak.berlin/go/neoirc/internal/service"
-	"sneak.berlin/go/neoirc/internal/stats"
-)
-
-const (
-	testTimeout = 5 * time.Second
-
-	// checkStep is how often waitUntil checks again.
-	checkStep = 10 * time.Millisecond
-
-	// stopHoldTime is how long a test waits to see that the
-	// app has not stopped.
-	stopHoldTime = 200 * time.Millisecond
-)
-
-// TestStopWaitsForRequestInProgress checks that stopping the
-// app, which runs the stop hook server.New registers, waits
-// for a long poll the HTTP server is serving to finish, and
-// that the poll gets its response.
-func TestStopWaitsForRequestInProgress(t *testing.T) {
-	port := freePort(t)
-	addr := net.JoinHostPort("127.0.0.1", strconv.Itoa(port))
-
-	app, brk, database := startApp(t, port)
-
-	sessionID, _, token, err := database.CreateSession(
-		t.Context(), "poller", "poller", "", "",
-	)
-	if err != nil {
-		t.Fatalf("create session: %v", err)
-	}
-
-	waitUntil(t, "the HTTP server to listen", func() bool {
-		return canConnect(t, addr)
-	})
-
-	statuses := make(chan int, 1)
-
-	go func() {
-		statuses <- getAuthenticated(
-			t, "http://"+addr+"/api/v1/messages?timeout=30", token,
-		)
-	}()
-
-	waitUntil(t, "the long poll to wait for a message", func() bool {
-		return brk.ListenerCount(sessionID) == 1
-	})
-
-	var stopErr error
-
-	stopped := make(chan struct{})
-
-	go func() {
-		stopErr = app.Stop(t.Context())
-
-		close(stopped)
-	}()
-
-	select {
-	case <-stopped:
-		t.Error("the app stopped while a request was in progress")
-	case <-time.After(stopHoldTime):
-	}
-
-	brk.Notify(sessionID)
-
-	status := <-statuses
-	if status != http.StatusOK {
-		t.Errorf("status %d, want %d", status, http.StatusOK)
-	}
-
-	select {
-	case <-stopped:
-		if stopErr != nil {
-			t.Errorf("stop: %v", stopErr)
-		}
-	case <-time.After(testTimeout):
-		t.Fatal("the app did not stop after the request finished")
-	}
-}
-
-// TestStartFailsWhenHTTPPortIsTaken checks that starting the
-// app, which runs the start hook server.New registers,
-// returns an error naming the HTTP listen address when
-// something else is already listening on its port.
-func TestStartFailsWhenHTTPPortIsTaken(t *testing.T) {
-	var listenConfig net.ListenConfig
-
-	taken, err := listenConfig.Listen(t.Context(), "tcp", ":0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	t.Cleanup(func() { _ = taken.Close() })
-
-	tcpAddr, ok := taken.Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not TCP", taken.Addr())
-	}
-
-	app, _, _ := newApp(t, tcpAddr.Port)
-
-	err = app.Start(t.Context())
-	if err == nil {
-		app.RequireStop()
-		t.Fatal("the app started while its HTTP port was taken")
-	}
-
-	listenAddr := fmt.Sprintf(":%d", tcpAddr.Port)
-	if !strings.Contains(err.Error(), listenAddr) {
-		t.Errorf("start error %q does not name %s", err, listenAddr)
-	}
-}
-
-// TestServeFailureStopsApp checks that when serving HTTP fails
-// after the start hook has bound the listen address, the
-// server stops the app with exit code 1.
-func TestServeFailureStopsApp(t *testing.T) {
-	var srv *server.Server
-
-	app, _, _ := startApp(t, freePort(t), fx.Populate(&srv))
-
-	shutdowns := app.Wait()
-
-	srv.ServeUntilShutdown(closedListener(t))
-
-	select {
-	case shutdown := <-shutdowns:
-		if shutdown.ExitCode != 1 {
-			t.Errorf("exit code %d, want 1", shutdown.ExitCode)
-		}
-	default:
-		t.Error("the server did not stop the app")
-	}
-}
-
-// TestServeAfterStopDoesNotStopApp checks that serving HTTP
-// after the app has stopped, which ends at once because the
-// stop hook has shut the HTTP server down, does not stop the
-// app. Serving ends the same way on every normal stop.
-func TestServeAfterStopDoesNotStopApp(t *testing.T) {
-	var srv *server.Server
-
-	app, _, _ := startApp(t, freePort(t), fx.Populate(&srv))
-
-	shutdowns := app.Wait()
-
-	app.RequireStop()
-
-	srv.ServeUntilShutdown(closedListener(t))
-
-	select {
-	case shutdown := <-shutdowns:
-		t.Errorf(
-			"the server stopped the app with exit code %d",
-			shutdown.ExitCode,
-		)
-	default:
-	}
-}
-
-// startApp starts the app newApp builds, with the HTTP server
-// listening on port.
-func startApp(
-	t *testing.T,
-	port int,
-	options ...fx.Option,
-) (*fxtest.App, *broker.Broker, *db.Database) {
-	t.Helper()
-
-	app, brk, database := newApp(t, port, options...)
-
-	app.RequireStart()
-
-	// Stops the app if the test ends before stopping it.
-	t.Cleanup(app.RequireStop)
-
-	return app, brk, database
-}
-
-// newApp builds, without starting it, an app that runs the
-// server with the dependencies cmd/neoircd gives it, on a
-// fresh in-memory database, with the HTTP port set to port.
-// options are added to the app, for a test that needs more
-// from it than the broker and the database.
-func newApp(
-	t *testing.T,
-	port int,
-	options ...fx.Option,
-) (*fxtest.App, *broker.Broker, *db.Database) {
-	t.Helper()
-
-	var (
-		brk      *broker.Broker
-		database *db.Database
-	)
-
-	app := fxtest.New(t,
-		fx.Supply(&globals.Globals{
-			Appname:   "neoirc-test",
-			Version:   "test",
-			StartTime: time.Now(),
-		}),
-		fx.Provide(
-			broker.New,
-			config.New,
-			db.New,
-			handlers.New,
-			healthcheck.New,
-			logger.New,
-			middleware.New,
-			server.New,
-			service.New,
-			stats.New,
-		),
-		fx.Decorate(func(cfg *config.Config) *config.Config {
-			// A random name, so that no other test can share it.
-			cfg.DBURL = fmt.Sprintf(
-				"file:%s?mode=memory&cache=shared", rand.Text(),
-			)
-			cfg.Port = port
-
-			return cfg
-		}),
-		fx.Invoke(func(*server.Server) {}),
-		fx.Populate(&brk, &database),
-		fx.Options(options...),
-	)
-
-	return app, brk, database
-}
-
-// freePort returns a TCP port that nothing was listening on a
-// moment ago.
-func freePort(t *testing.T) int {
-	t.Helper()
-
-	listener := closedListener(t)
-
-	tcpAddr, ok := listener.Addr().(*net.TCPAddr)
-	if !ok {
-		t.Fatalf("listener address %v is not TCP", listener.Addr())
-	}
-
-	return tcpAddr.Port
-}
-
-// closedListener returns a TCP listener that has already been
-// closed, so that accepting a connection on it fails.
-func closedListener(t *testing.T) net.Listener {
-	t.Helper()
-
-	var listenConfig net.ListenConfig
-
-	listener, err := listenConfig.Listen(
-		t.Context(), "tcp", "127.0.0.1:0",
-	)
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-
-	err = listener.Close()
-	if err != nil {
-		t.Fatalf("close listener: %v", err)
-	}
-
-	return listener
-}
-
-// canConnect reports whether addr accepts a TCP connection.
-func canConnect(t *testing.T, addr string) bool {
-	t.Helper()
-
-	var dialer net.Dialer
-
-	conn, err := dialer.DialContext(t.Context(), "tcp", addr)
-	if err != nil {
-		return false
-	}
-
-	_ = conn.Close()
-
-	return true
-}
-
-// waitUntil calls done every checkStep until it returns true,
-// and fails the test if it does not within testTimeout.
-func waitUntil(t *testing.T, what string, done func() bool) {
-	t.Helper()
-
-	deadline := time.Now().Add(testTimeout)
-
-	for !done() {
-		if time.Now().After(deadline) {
-			t.Fatalf("timed out waiting for %s", what)
-		}
-
-		time.Sleep(checkStep)
-	}
-}
-
-// getAuthenticated sends a GET request to url as the session
-// whose auth token is token, and returns the response status,
-// or 0 if there was no response.
-func getAuthenticated(t *testing.T, url, token string) int {
-	t.Helper()
-
-	request, err := http.NewRequestWithContext(
-		t.Context(), http.MethodGet, url, nil,
-	)
-	if err != nil {
-		t.Errorf("new request: %v", err)
-
-		return 0
-	}
-
-	request.Header.Set("Cookie", "neoirc_auth="+token)
-
-	client := http.Client{Timeout: testTimeout}
-
-	response, err := client.Do(request)
-	if err != nil {
-		t.Errorf("get %s: %v", url, err)
-
-		return 0
-	}
-
-	_ = response.Body.Close()
-
-	return response.StatusCode
-}

package.json

@@ -1,6 +0,0 @@
-{
-    "private": true,
-    "devDependencies": {
-        "prettier": "3.8.1"
-    }
-}

pkg/irc/numerics.go

@@ -68,7 +68,6 @@ const (
 // Command responses (200-399).
 const (
 	// RFC 2812 trace/stats/links replies (200-219).
-
 	RplTraceLink       IRCMessageType = 200
 	RplTraceConnecting IRCMessageType = 201
 	RplTraceHandshake  IRCMessageType = 202
@@ -225,7 +224,7 @@ const (
 
 // names maps numeric codes to their standard IRC names.
 //
-//nolint:gochecknoglobals,gosec // G101: IRC numeric names, not credentials
+//nolint:gochecknoglobals
 var names = map[IRCMessageType]string{
 	RplWelcome:  "RPL_WELCOME",
 	RplYourHost: "RPL_YOURHOST",

schema/README.md

@@ -23,7 +23,7 @@ Structured: {"command": "PUBKEY", "body": {"alg": "ed25519", "key": "base64..."}
 Common fields (see `message.json` for full schema):
 
 | Field     | Type           | Description                                          |
-| --------- | --------------- | ---------------------------------------------------- |
+|-----------|----------------|------------------------------------------------------|
 | `id`      | string (uuid)  | Server-assigned message UUID                         |
 | `command` | string         | IRC command or 3-digit numeric code                  |
 | `from`    | string         | Source nick or server name (IRC prefix)              |
@@ -35,7 +35,6 @@ Common fields (see `message.json` for full schema):
 
 **Structured bodies:** `body` is always an array of strings (for text) or an
 object (for structured data like PUBKEY). Never a raw string. This enables:
-
 - Multiline messages without escape sequences
 - Deterministic canonicalization via RFC 8785 JCS for signing
 - Structured data where needed
@@ -45,7 +44,7 @@ object (for structured data like PUBKEY). Never a raw string. This enables:
 IRC commands used for client↔server and server↔server communication.
 
 | Command   | File                      | RFC       | Description                    |
-| --------- | ----------------------- | ----------- | -------------------------- |
+|-----------|---------------------------|-----------|--------------------------------|
 | `PRIVMSG` | `commands/PRIVMSG.json`  | 1459 §4.4.1 | Message to channel or user  |
 | `NOTICE`  | `commands/NOTICE.json`   | 1459 §4.4.2 | Notice (no auto-reply)      |
 | `JOIN`    | `commands/JOIN.json`     | 1459 §4.2.1 | Join a channel              |
@@ -66,7 +65,7 @@ Three-digit codes for server responses, per IRC convention.
 ### Success / Informational (0xx–3xx)
 
 | Code  | Name              | File                  | Description                    |
-| ----- | -------------- | ------------------- | ------------------------------ |
+|-------|-------------------|-----------------------|--------------------------------|
 | `001` | RPL_WELCOME       | `numerics/001.json`  | Welcome after session creation     |
 | `002` | RPL_YOURHOST      | `numerics/002.json`  | Server host info               |
 | `003` | RPL_CREATED       | `numerics/003.json`  | Server creation date           |
@@ -83,7 +82,7 @@ Three-digit codes for server responses, per IRC convention.
 ### Errors (4xx)
 
 | Code  | Name                 | File                  | Description                    |
-| ----- | -------------------- | ------------------- | ----------------------- |
+|-------|----------------------|-----------------------|--------------------------------|
 | `401` | ERR_NOSUCHNICK       | `numerics/401.json`  | No such nick/channel           |
 | `403` | ERR_NOSUCHCHANNEL    | `numerics/403.json`  | No such channel                |
 | `433` | ERR_NICKNAMEINUSE    | `numerics/433.json`  | Nickname already in use        |

script/bootstrap

@@ -1,143 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
-# used directly if installed; otherwise it is installed at a pinned
-# version via nvm (installing nvm itself first, from a hash-verified
-# release archive, never curl | sh).
-#
-# The Go install at the end of main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-06
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-ensure_node() {
-    if ! missing node; then return 0; fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-}
-
-ensure_yarn() {
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    if missing make; then pkg_install gnumake make make make; fi
-    if missing git; then pkg_install git git git git; fi
-
-    ensure_node
-    ensure_yarn
-    install_js_deps
-
-    # Go, for make build, script/precommit and the gofmt step of
-    # script/fmt and script/fmt-check. golangci-lint is not installed: it
-    # runs only in the Dockerfile's lint phase.
-    if missing go; then pkg_install go golang go go; fi
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. test and lint are Docker
-# phases; fmt-check is native, because a formatter writes the working
-# tree. Must not modify any files.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,28 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. It bootstraps first: a CI runner
-# checks out and runs this and nothing else, and script/fmt-check runs
-# the formatter on the host, which a pristine checkout cannot do.
-# --no-cache for the same reason as script/docker: the gate phases the
-# final stage depends on are RUN steps, and a cached one is a check that
-# did not run.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/check"
-    # Own line: a failing command substitution inside an argument does
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/docker

@@ -1,24 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# --no-cache because the gate phases the final stage depends on are RUN
-# steps, and a cached one is a check that did not run.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # Own line: a failing command substitution inside an argument does
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build --no-cache \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,35 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-#
-# The gofmt step in main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the pin in script/bootstrap.
-NODE_VERSION="22.17.0"
-
-# script/bootstrap installs node and yarn under nvm and leaves neither
-# on the PATH of the shell that called it, so resolve the pinned
-# toolchain here the way bootstrap's own install step does. nvm is a
-# bash script, hence the subshell.
-run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
-    fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
-}
-
-main() {
-    cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn.
-    gofmt -s -w .
-    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/fmt-check

@@ -1,40 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only).
-#
-# The gofmt check in main() is this repo's addition.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the pin in script/bootstrap.
-NODE_VERSION="22.17.0"
-
-# script/bootstrap installs node and yarn under nvm and leaves neither
-# on the PATH of the shell that called it, so resolve the pinned
-# toolchain here the way bootstrap's own install step does. nvm is a
-# bash script, hence the subshell.
-run_yarn() {
-    if command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
-    fi
-    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "fmt-check: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
-}
-
-main() {
-    cd "$ROOT"
-    # Before prettier, because run_yarn replaces this shell with yarn.
-    unformatted="$(gofmt -s -l .)"
-    if [ -n "$unformatted" ]; then
-        echo "fmt-check: run make fmt; gofmt would change:" >&2
-        echo "$unformatted" >&2
-        exit 1
-    fi
-    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/install-precommit

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter. Linting is a phase of the Dockerfile and
-# this builds that phase alone; the linter is never installed or run on
-# a developer host, where a shared result cache and a host-global lock
-# make its answer untrustworthy.
-#
-# The phase is not the last stage in the file, so it is built only when
-# --target names it. --no-cache because a cached lint layer is a lint
-# that did not run. The tag makes each build replace the previous image
-# instead of leaving a dangling one behind.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build --no-cache \
-        --target lint \
-        -t "$("$SCRIPT_DIR/projectname")-lint" .
-}
-
-main "$@"

script/precommit

@@ -1,23 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all.
-#
-# This repo's addition: go mod tidy runs first, failing the commit if it
-# changes go.mod or go.sum.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go mod tidy
-    git diff --exit-code -- go.mod go.sum || {
-        echo "precommit: go mod tidy changed go.mod or go.sum;" \
-            "stage the changes and retry" >&2
-        exit 1
-    }
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "neoirc"
-}
-
-main "$@"

script/setup

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies and the git pre-commit hook.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,19 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite. Testing is a phase of the Dockerfile
-# and this builds that phase alone, on the same terms as script/lint:
-# --target because a phase that is not the last stage is built only when
-# named, --no-cache because a cached test layer is a test that did not
-# run, and a tag so each build replaces the previous image.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build --no-cache \
-        --target test \
-        -t "$("$SCRIPT_DIR/projectname")-test" .
-}
-
-main "$@"

web/build.sh

@@ -2,16 +2,22 @@
 set -e
 cd "$(dirname "$0")"
 
-# The esbuild that yarn.lock pins, which yarn install puts in node_modules
+# Install esbuild if not present
-if [ ! -x node_modules/.bin/esbuild ]; then
+if ! command -v esbuild >/dev/null 2>&1; then
-  echo "esbuild not found. Install it: yarn install --frozen-lockfile"
+  if command -v npx >/dev/null 2>&1; then
+    NPX="npx"
+  else
+    echo "esbuild not found. Install it: npm install -g esbuild"
     exit 1
+  fi
+else
+  NPX=""
 fi
 
 mkdir -p dist
 
 # Build JS bundle — preact must be bundled (no CDN/external loader)
-node_modules/.bin/esbuild src/app.jsx \
+${NPX:+$NPX} esbuild src/app.jsx \
   --bundle \
   --minify \
   --format=esm \

web/package-lock.json

@@ -0,0 +1,513 @@
+{
+  "name": "web",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "web",
+      "version": "1.0.0",
+      "license": "ISC",
+      "dependencies": {
+        "preact": "^10.28.3"
+      },
+      "devDependencies": {
+        "esbuild": "^0.27.3"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
+      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
+      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
+      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
+      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.3",
+        "@esbuild/android-arm": "0.27.3",
+        "@esbuild/android-arm64": "0.27.3",
+        "@esbuild/android-x64": "0.27.3",
+        "@esbuild/darwin-arm64": "0.27.3",
+        "@esbuild/darwin-x64": "0.27.3",
+        "@esbuild/freebsd-arm64": "0.27.3",
+        "@esbuild/freebsd-x64": "0.27.3",
+        "@esbuild/linux-arm": "0.27.3",
+        "@esbuild/linux-arm64": "0.27.3",
+        "@esbuild/linux-ia32": "0.27.3",
+        "@esbuild/linux-loong64": "0.27.3",
+        "@esbuild/linux-mips64el": "0.27.3",
+        "@esbuild/linux-ppc64": "0.27.3",
+        "@esbuild/linux-riscv64": "0.27.3",
+        "@esbuild/linux-s390x": "0.27.3",
+        "@esbuild/linux-x64": "0.27.3",
+        "@esbuild/netbsd-arm64": "0.27.3",
+        "@esbuild/netbsd-x64": "0.27.3",
+        "@esbuild/openbsd-arm64": "0.27.3",
+        "@esbuild/openbsd-x64": "0.27.3",
+        "@esbuild/openharmony-arm64": "0.27.3",
+        "@esbuild/sunos-x64": "0.27.3",
+        "@esbuild/win32-arm64": "0.27.3",
+        "@esbuild/win32-ia32": "0.27.3",
+        "@esbuild/win32-x64": "0.27.3"
+      }
+    },
+    "node_modules/preact": {
+      "version": "10.28.3",
+      "resolved": "https://registry.npmjs.org/preact/-/preact-10.28.3.tgz",
+      "integrity": "sha512-tCmoRkPQLpBeWzpmbhryairGnhW9tKV6c6gr/w+RhoRoKEJwsjzipwp//1oCpGPOchvSLaAPlpcJi9MwMmoPyA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/preact"
+      }
+    }
+  }
+}

web/src/app.jsx

@@ -58,13 +58,13 @@ async function mintHashcash(bits, resource) {
   }
 }
 
-// Requests are authenticated by the auth cookie, which the browser
-// sends on its own.
 function api(path, opts = {}) {
+  const token = localStorage.getItem("neoirc_token");
   const headers = {
     "Content-Type": "application/json",
     ...(opts.headers || {}),
   };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
   const { signal, ...rest } = opts;
 
   return fetch(API + path, { ...rest, headers, signal }).then(async (r) => {
@@ -122,11 +122,12 @@ function LoginScreen({ onLogin }) {
         if (s.name) hashcashResourceRef.current = s.name;
       })
       .catch(() => {});
-    // Resume the session if the browser still holds a valid auth
+    const saved = localStorage.getItem("neoirc_token");
-    // cookie; a 401 leaves the login form up.
+    if (saved) {
       api("/state?initChannelState=1")
         .then((u) => onLogin(u.nick, true))
-      .catch(() => {});
+        .catch(() => localStorage.removeItem("neoirc_token"));
+    }
     inputRef.current?.focus();
   }, []);
 
@@ -151,6 +152,7 @@ function LoginScreen({ onLogin }) {
         method: "POST",
         body: JSON.stringify(reqBody),
       });
+      localStorage.setItem("neoirc_token", res.token);
       onLogin(res.nick);
     } catch (err) {
       setError(err.data?.error || "Connection failed");
@@ -225,9 +227,10 @@ function UserList({ members, onNickClick }) {
   const regular = [];
 
   for (const m of members) {
-    if (m.isOperator) {
+    const mode = m.mode || "";
+    if (mode === "o") {
       ops.push(m);
-    } else if (m.isVoiced) {
+    } else if (mode === "v") {
       voiced.push(m);
     } else {
       regular.push(m);
@@ -300,14 +303,11 @@ function App() {
     nickRef.current = nick;
   }, [nick]);
 
-  // Persist joined channels, once logged in: before then only the
+  // Persist joined channels.
-  // Server tab exists, and writing would erase the saved channels
-  // that onLogin rejoins.
   useEffect(() => {
-    if (!loggedIn) return;
     const channels = tabs.filter((t) => t.type === "channel").map((t) => t.name);
     localStorage.setItem("neoirc_channels", JSON.stringify(channels));
-  }, [loggedIn, tabs]);
+  }, [tabs]);
 
   // Clear unread on tab switch.
   useEffect(() => {
@@ -366,9 +366,7 @@ function App() {
         command: msg.command,
       };
 
-      // A numeric reply carries its number in `code` and its name in
+      switch (msg.command) {
-      // `command`; other messages have no `code`.
-      switch (msg.code || msg.command) {
         case "PRIVMSG":
         case "NOTICE": {
           let text = body;
@@ -466,18 +464,8 @@ function App() {
 
           break;
         }
-        case "MODE": {
+        case "353": {
-          // The body is the change, with its value where it has one:
+          // RPL_NAMREPLY — parse mode prefixes from names list.
-          // ["+o bob"], ["+m"], ["+k", "secretpass"].
-          const modes = Array.isArray(msg.body) ? msg.body.join(" ") : "";
-          const text = `${msg.from} sets mode ${modes} on ${msg.to}`;
-          if (msg.to) addMessage(msg.to, { ...base, text, system: true });
-
-          break;
-        }
-        case 353: {
-          // RPL_NAMREPLY — each name is a hostmask (nick!user@host),
-          // prefixed with @ for an operator or + for a voiced member.
           if (
             Array.isArray(msg.params) &&
             msg.params.length >= 2 &&
@@ -489,18 +477,21 @@ function App() {
               : String(msg.body);
             const names = namesStr.split(/\s+/).filter(Boolean);
             const parsed = names.map((n) => {
-              const isOperator = n.startsWith("@");
+              if (n.startsWith("@")) {
-              const isVoiced = n.startsWith("+");
+                return { nick: n.slice(1), mode: "o" };
-              const hostmask = isOperator || isVoiced ? n.slice(1) : n;
+              }
+              if (n.startsWith("+")) {
+                return { nick: n.slice(1), mode: "v" };
+              }
 
-              return { nick: hostmask.split("!")[0], isOperator, isVoiced };
+              return { nick: n, mode: "" };
             });
             setMembers((prev) => ({ ...prev, [channel]: parsed }));
           }
 
           break;
         }
-        case 332: {
+        case "332": {
           // RPL_TOPIC — set topic from server.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const channel = msg.params[0];
@@ -512,7 +503,7 @@ function App() {
 
           break;
         }
-        case 322: {
+        case "322": {
           // RPL_LIST — channel, member count, topic.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const chName = msg.params[0];
@@ -527,7 +518,7 @@ function App() {
 
           break;
         }
-        case 323:
+        case "323":
           addMessage("Server", {
             ...base,
             text: body || "End of channel list",
@@ -535,7 +526,7 @@ function App() {
           });
 
           break;
-        case 352: {
+        case "352": {
           // RPL_WHOREPLY — channel, user, host, server, nick, flags.
           if (Array.isArray(msg.params) && msg.params.length >= 5) {
             const whoCh = msg.params[0];
@@ -550,7 +541,7 @@ function App() {
 
           break;
         }
-        case 315:
+        case "315":
           addMessage("Server", {
             ...base,
             text: body || "End of /WHO list",
@@ -558,20 +549,20 @@ function App() {
           });
 
           break;
-        case 311: {
+        case "311": {
-          // RPL_WHOISUSER — params nick, user, host, *; body realname.
+          // RPL_WHOISUSER — nick, user, host, *, realname.
-          if (Array.isArray(msg.params) && msg.params.length >= 3) {
+          if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            const [wiNick, wiUser, wiHost] = msg.params;
+            const wiNick = msg.params[0];
             addMessage("Server", {
               ...base,
-              text: `${wiNick} is ${wiUser}@${wiHost} (${body})`,
+              text: `${wiNick} (${body})`,
               system: true,
             });
           }
 
           break;
         }
-        case 312: {
+        case "312": {
           // RPL_WHOISSERVER — nick, server, server info.
           if (Array.isArray(msg.params) && msg.params.length >= 2) {
             const wiNick = msg.params[0];
@@ -585,33 +576,7 @@ function App() {
 
           break;
         }
-        case 313: {
+        case "319": {
-          // RPL_WHOISOPERATOR — nick; body "is an IRC operator".
-          if (Array.isArray(msg.params) && msg.params.length >= 1) {
-            addMessage("Server", {
-              ...base,
-              text: `${msg.params[0]} ${body}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 317: {
-          // RPL_WHOISIDLE — nick, idle seconds, signon time (Unix).
-          if (Array.isArray(msg.params) && msg.params.length >= 3) {
-            const [wiNick, idle, signon] = msg.params;
-            const signedOn = new Date(Number(signon) * 1000).toLocaleString();
-            addMessage("Server", {
-              ...base,
-              text: `${wiNick} has been idle ${idle}s, signed on ${signedOn}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 319: {
           // RPL_WHOISCHANNELS — nick, channels.
           if (Array.isArray(msg.params) && msg.params.length >= 1) {
             const wiNick = msg.params[0];
@@ -624,7 +589,7 @@ function App() {
 
           break;
         }
-        case 318:
+        case "318":
           addMessage("Server", {
             ...base,
             text: body || "End of /WHOIS list",
@@ -632,21 +597,9 @@ function App() {
           });
 
           break;
-        case 324: {
+        case "375":
-          // RPL_CHANNELMODEIS — channel, mode string.
+        case "372":
-          if (Array.isArray(msg.params) && msg.params.length >= 2) {
+        case "376":
-            addMessage("Server", {
-              ...base,
-              text: `${msg.params[0]} modes: ${msg.params[1]}`,
-              system: true,
-            });
-          }
-
-          break;
-        }
-        case 375:
-        case 372:
-        case 376:
           addMessage("Server", { ...base, text: body, system: true });
 
           break;
@@ -684,14 +637,6 @@ function App() {
         } catch (err) {
           if (!alive) break;
           if (err.name === "AbortError") continue;
-          // 401: the session is gone (QUIT from another client, or
-          // expiry). Reloading drops this page's state and brings
-          // back the login screen.
-          if (err.status === 401) {
-            window.location.reload();
-
-            return;
-          }
           setConnected(false);
           await new Promise((r) => setTimeout(r, RECONNECT_DELAY));
         }
@@ -771,11 +716,6 @@ function App() {
 
   const onLogin = useCallback(
     async (userNick, isResumed) => {
-      // Read before setLoggedIn(true): from then on the effect under
-      // "Persist joined channels" writes the open channel tabs over it.
-      const saved = JSON.parse(
-        localStorage.getItem("neoirc_channels") || "[]",
-      );
       setNick(userNick);
       setLoggedIn(true);
       addSystemMessage("Server", `Connected as ${userNick}`);
@@ -800,6 +740,9 @@ function App() {
       }
 
       // Fresh session — join any previously saved channels.
+      const saved = JSON.parse(
+        localStorage.getItem("neoirc_channels") || "[]",
+      );
       for (const ch of saved) {
         try {
           await api("/messages", {
@@ -1029,22 +972,27 @@ function App() {
 
           break;
         }
-        // With no arguments MODE is a query. A change is one sign and
-        // letter, then its value where it takes one: +m, +o nick.
         const modeArgs = parts.slice(1);
-        const body =
+        if (modeArgs.length > 0) {
-          modeArgs.length > 0
-            ? { command: "MODE", to: tab.name, body: modeArgs }
-            : { command: "MODE", to: tab.name };
           try {
             await api("/messages", {
               method: "POST",
-            body: JSON.stringify(body),
+              body: JSON.stringify({
+                command: "MODE",
+                to: tab.name,
+                params: modeArgs,
+              }),
             });
           } catch (err) {
             addSystemMessage(
               "Server",
-            `MODE failed: ${err.data?.error || "error"}`,
+              `Mode change failed: ${err.data?.error || "error"}`,
+            );
+          }
+        } else {
+          addSystemMessage(
+            "Server",
+            "Usage: /mode <+/-mode> [params]",
           );
         }
 
@@ -1061,6 +1009,7 @@ function App() {
         } catch (e) {
           // Ignore.
         }
+        localStorage.removeItem("neoirc_token");
         localStorage.removeItem("neoirc_channels");
         window.location.reload();
 
@@ -1179,7 +1128,7 @@ function App() {
           "  /me action            — Send an action",
           "  /nick newnick         — Change your nickname",
           "  /topic [text]         — View or set channel topic",
-          "  /mode [+/-flag [arg]] — View or set channel modes",
+          "  /mode +/-flags        — Set channel modes",
           "  /motd                 — Display the message of the day",
           "  /list                 — List all channels",
           "  /who [#channel]       — List users in a channel",

web/yarn.lock

@@ -1,170 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-"@esbuild/aix-ppc64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz#815b39267f9bffd3407ea6c376ac32946e24f8d2"
-  integrity sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==
-
-"@esbuild/android-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz#19b882408829ad8e12b10aff2840711b2da361e8"
-  integrity sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==
-
-"@esbuild/android-arm@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/android-arm/-/android-arm-0.27.3.tgz#90be58de27915efa27b767fcbdb37a4470627d7b"
-  integrity sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==
-
-"@esbuild/android-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/android-x64/-/android-x64-0.27.3.tgz#d7dcc976f16e01a9aaa2f9b938fbec7389f895ac"
-  integrity sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==
-
-"@esbuild/darwin-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz#9f6cac72b3a8532298a6a4493ed639a8988e8abd"
-  integrity sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==
-
-"@esbuild/darwin-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz#ac61d645faa37fd650340f1866b0812e1fb14d6a"
-  integrity sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==
-
-"@esbuild/freebsd-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz#b8625689d73cf1830fe58c39051acdc12474ea1b"
-  integrity sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==
-
-"@esbuild/freebsd-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz#07be7dd3c9d42fe0eccd2ab9f9ded780bc53bead"
-  integrity sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==
-
-"@esbuild/linux-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz#bf31918fe5c798586460d2b3d6c46ed2c01ca0b6"
-  integrity sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==
-
-"@esbuild/linux-arm@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz#28493ee46abec1dc3f500223cd9f8d2df08f9d11"
-  integrity sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==
-
-"@esbuild/linux-ia32@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz#750752a8b30b43647402561eea764d0a41d0ee29"
-  integrity sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==
-
-"@esbuild/linux-loong64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz#a5a92813a04e71198c50f05adfaf18fc1e95b9ed"
-  integrity sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==
-
-"@esbuild/linux-mips64el@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz#deb45d7fd2d2161eadf1fbc593637ed766d50bb1"
-  integrity sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==
-
-"@esbuild/linux-ppc64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz#6f39ae0b8c4d3d2d61a65b26df79f6e12a1c3d78"
-  integrity sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==
-
-"@esbuild/linux-riscv64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz#4c5c19c3916612ec8e3915187030b9df0b955c1d"
-  integrity sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==
-
-"@esbuild/linux-s390x@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz#9ed17b3198fa08ad5ccaa9e74f6c0aff7ad0156d"
-  integrity sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==
-
-"@esbuild/linux-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz#12383dcbf71b7cf6513e58b4b08d95a710bf52a5"
-  integrity sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==
-
-"@esbuild/netbsd-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz#dd0cb2fa543205fcd931df44f4786bfcce6df7d7"
-  integrity sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==
-
-"@esbuild/netbsd-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz#028ad1807a8e03e155153b2d025b506c3787354b"
-  integrity sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==
-
-"@esbuild/openbsd-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz#e3c16ff3490c9b59b969fffca87f350ffc0e2af5"
-  integrity sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==
-
-"@esbuild/openbsd-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz#c5a4693fcb03d1cbecbf8b422422468dfc0d2a8b"
-  integrity sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==
-
-"@esbuild/openharmony-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz#082082444f12db564a0775a41e1991c0e125055e"
-  integrity sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==
-
-"@esbuild/sunos-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz#5ab036c53f929e8405c4e96e865a424160a1b537"
-  integrity sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==
-
-"@esbuild/win32-arm64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz#38de700ef4b960a0045370c171794526e589862e"
-  integrity sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==
-
-"@esbuild/win32-ia32@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz#451b93dc03ec5d4f38619e6cd64d9f9eff06f55c"
-  integrity sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==
-
-"@esbuild/win32-x64@0.27.3":
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz#0eaf705c941a218a43dba8e09f1df1d6cd2f1f17"
-  integrity sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==
-
-esbuild@^0.27.3:
-  version "0.27.3"
-  resolved "https://registry.yarnpkg.com/esbuild/-/esbuild-0.27.3.tgz#5859ca8e70a3af956b26895ce4954d7e73bd27a8"
-  integrity sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==
-  optionalDependencies:
-    "@esbuild/aix-ppc64" "0.27.3"
-    "@esbuild/android-arm" "0.27.3"
-    "@esbuild/android-arm64" "0.27.3"
-    "@esbuild/android-x64" "0.27.3"
-    "@esbuild/darwin-arm64" "0.27.3"
-    "@esbuild/darwin-x64" "0.27.3"
-    "@esbuild/freebsd-arm64" "0.27.3"
-    "@esbuild/freebsd-x64" "0.27.3"
-    "@esbuild/linux-arm" "0.27.3"
-    "@esbuild/linux-arm64" "0.27.3"
-    "@esbuild/linux-ia32" "0.27.3"
-    "@esbuild/linux-loong64" "0.27.3"
-    "@esbuild/linux-mips64el" "0.27.3"
-    "@esbuild/linux-ppc64" "0.27.3"
-    "@esbuild/linux-riscv64" "0.27.3"
-    "@esbuild/linux-s390x" "0.27.3"
-    "@esbuild/linux-x64" "0.27.3"
-    "@esbuild/netbsd-arm64" "0.27.3"
-    "@esbuild/netbsd-x64" "0.27.3"
-    "@esbuild/openbsd-arm64" "0.27.3"
-    "@esbuild/openbsd-x64" "0.27.3"
-    "@esbuild/openharmony-arm64" "0.27.3"
-    "@esbuild/sunos-x64" "0.27.3"
-    "@esbuild/win32-arm64" "0.27.3"
-    "@esbuild/win32-ia32" "0.27.3"
-    "@esbuild/win32-x64" "0.27.3"
-
-preact@^10.28.3:
-  version "10.28.3"
-  resolved "https://registry.yarnpkg.com/preact/-/preact-10.28.3.tgz#3c2171526b3e29628ad1a6c56a9e3ca867bbdee8"
-  integrity sha512-tCmoRkPQLpBeWzpmbhryairGnhW9tKV6c6gr/w+RhoRoKEJwsjzipwp//1oCpGPOchvSLaAPlpcJi9MwMmoPyA==

yarn.lock

@@ -1,8 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-prettier@3.8.1:
-  version "3.8.1"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
-  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==