Issues

• Rooms, direct messages, and ephemeral history

  enhancementfeature
  diorwave/cmd-chat#36 · Filter by author diorwave opened on Oct 23, 2026

• Versioned, typed WebSocket protocol with error frames

  enhancementprotocol
  diorwave/cmd-chat#35 · Filter by author diorwave opened on Oct 23, 2026

• Server limits and ops config (history cap, max users, message size, healthcheck)

  enhancementserver
  diorwave/cmd-chat#34 · Filter by author diorwave opened on Oct 23, 2026

• Proper TUI: persistent input line, scrollback, slash commands

  clientenhancementux
  diorwave/cmd-chat#33 · Filter by author diorwave opened on Oct 23, 2026

• Reconnect, keepalive and clear disconnect reasons in the client

  clientenhancement
  diorwave/cmd-chat#32 · Filter by author diorwave opened on Oct 23, 2026

• Redesign crypto for real E2E: server shouldn't hold the room secret; add sender authenticity, replay protection, forward secrecy

  designenhancementsecurity
  diorwave/cmd-chat#31 · Filter by author diorwave opened on Oct 23, 2026

• Packaging: mixed runtime/test deps, no pyproject or entry point

  chorepackagingpriority: low
  diorwave/cmd-chat#30 · Filter by author diorwave opened on Oct 23, 2026

• Test suite misses the protocol's real behavior; CI gaps

  cipriority: mediumtesting
  diorwave/cmd-chat#29 · Filter by author diorwave opened on Oct 23, 2026

• README makes security and architecture claims the code doesn't meet

  documentationpriority: medium
  diorwave/cmd-chat#28 · Filter by author diorwave opened on Oct 23, 2026

• Dead code left over from the RSA design

  chorepriority: low
  diorwave/cmd-chat#27 · Filter by author diorwave opened on Oct 23, 2026

• Password handling: empty passwords accepted, passwords exposed via argv

  priority: lowsecurity
  diorwave/cmd-chat#26 · Filter by author diorwave opened on Oct 23, 2026

• Weak input validation and error handling on the auth endpoints and WS loop

  bugpriority: low
  diorwave/cmd-chat#25 · Filter by author diorwave opened on Oct 23, 2026

• Any participant can wipe history for everyone; connected clients aren't told

  bugpriority: medium
  diorwave/cmd-chat#24 · Filter by author diorwave opened on Oct 23, 2026

• Client hangs after the server disconnects until Enter is pressed

  bugpriority: medium
  diorwave/cmd-chat#23 · Filter by author diorwave opened on Oct 23, 2026

• Server never announces joins, so the online list only shrinks

  bugpriority: medium
  diorwave/cmd-chat#22 · Filter by author diorwave opened on Oct 23, 2026

• Sessions outlive their WebSocket (stale "online" users, names stay taken, ids stay valid)

  bugpriority: medium
  diorwave/cmd-chat#21 · Filter by author diorwave opened on Oct 23, 2026

• Unbounded memory growth: message history, pending SRP sessions, no rate limits

  bugpriority: mediumsecurity
  diorwave/cmd-chat#20 · Filter by author diorwave opened on Oct 23, 2026

• "No logs" is false: access log records IPs and user_id credentials

  priority: mediumprivacysecurity
  diorwave/cmd-chat#19 · Filter by author diorwave opened on Oct 23, 2026

• Every participant's IP is broadcast to the room; X-Forwarded-For trusted blindly

  priority: mediumprivacysecurity
  diorwave/cmd-chat#18 · Filter by author diorwave opened on Oct 23, 2026

• Room key is cheap to brute-force offline; room_salt is given to unauthenticated callers

  priority: highsecurity
  diorwave/cmd-chat#17 · Filter by author diorwave opened on Oct 23, 2026

• No transport security (http/ws only)

  enhancementpriority: highsecurity
  diorwave/cmd-chat#16 · Filter by author diorwave opened on Oct 23, 2026

• SRP session key is returned to the client over plaintext HTTP

  bugpriority: highsecurity
  diorwave/cmd-chat#15 · Filter by author diorwave opened on Oct 23, 2026

• New clients cannot join once history exceeds 1 MiB

  bugpriority: high
  diorwave/cmd-chat#14 · Filter by author diorwave opened on Oct 23, 2026

• Duplicate connection for one user_id silently kills the original socket

  bugpriority: high
  diorwave/cmd-chat#13 · Filter by author diorwave opened on Oct 23, 2026

• Server cannot be stopped with Ctrl+C or docker stop

  bugpriority: high
  diorwave/cmd-chat#12 · Filter by author diorwave opened on Oct 23, 2026