v1.0.1 — ◇Mirtazapine Shield

v1.0.1 — ◇Mirtazapine Shield · Desktop unlock password (macOS focus)

Added — desktop unlock password (macOS / Windows / Linux)

The desktop lock screen previously unlocked with a single click (the JVM has no unified biometric API, so the lock was UI-only). You can now set a real first-factor password in Settings → Shield:

• PBKDF2-HMAC-SHA256 (210,000 iterations, 16-byte salt, 32-byte output) with constant-time comparison
• Encrypted, atomic storage (~/.syna/unlock_pw, wiped by the self-destruct protocol)
• Stackable with TOTP: password (first factor) → 6-digit code (second factor) when 2FA is enabled
• Wrong passwords feed the existing brute-force protection (cooldown + self-destruct fallback)
• Settings UI: set / change / clear (change & clear require the current password); no recovery by design (stated on the lock screen)
• Unset password → previous one-click behavior is unchanged; Android is unaffected (biometrics)

This is the baseline for upcoming macOS-specific work.

Tests

• 91 automated desktop tests (added: password round-trip, controller unlock + brute-force counting, password + TOTP stacking)

Assets

• Syna-v1.0.1-macos.dmg — macOS desktop (this release's focus)
• Syna-v1.0.1-release.apk — Android
• Syna-v1.0.1-server.jar — headless private chat server (Windows / macOS / Linux)
• SHA256SUMS.txt — checksums for all assets

Full changelog: CHANGELOG.md · Security model: MIRTAZAPINE_SHIELD.md

v1.0.0 — ◇Mirtazapine Shield

v1.0.0 — ◇Mirtazapine Shield · Stable release after full code review & license audit

This release follows a complete code review (network + security layers, every high/medium candidate manually verified) and a license compliance audit. 19 issues fixed, 88 automated tests green, license audit clean.

Stability & correctness

• Outbox no longer drops failed sends — TCP failures rethrow into the flush loop; frames stay queued for reconnect instead of being marked "sent" and lost
• Server recall ownership check fixed — previously looked up the wrong field, letting any member forge recalls
• Encrypt-only completed: mesh group text and 1:1 file transfers no longer fall back to plaintext (queue / wait for key); receivers drop plaintext message frames (LAN fake-message injection defense)
• Mesh group file chunks routed to the correct member (index misalignment after keyless-member filtering)
• App upgrades no longer trigger self-destruct — the dex baseline is rewritten on versionCode change
• Session-key rotation hardened — atomic blob writes; migration key released only after a successful rewrite
• Biometric system errors (LOCKOUT/TIMEOUT…) no longer count toward brute-force self-destruct
• TOTP cancel button on the second-factor screen (unlock-cancel → LOCKED, disable-cancel → ARMED, never counts as brute force)
• Epoch recorded only after successful key pin (replay-poisoning closed); deduped frames re-ACKed; FILE_CHUNK cross-frame bounds; replay window extended to group frames; burn sweep marks cleaned; server-group BURN_ACK purge fixed; member public keys validated server-side; server crash auto-restart unblocked; audit-log truncation keeps the hash chain intact; exact-name module whitelist (no evil-linker.so bypass); atomic writes for key pins / master key / identity files; plaintext tmp fallback removed (fail-closed); first-launch wizard persisted; self-destruct also wipes the outbox cache; update checker ignores pre-release tags

License & legal (audit report: docs/REVISION_AND_LICENSE_AUDIT_v1.0.0.md)

• All ~140 runtime dependencies are Apache-2.0 / MIT — all GPL-3.0-compatible, no contamination
• OSV vulnerability check: 0 known vulnerabilities on all direct dependencies
• Copyright headers: 100% coverage (94 source files, GPL-3.0 SPDX); signing keystore/password confirmed never committed

Tests

• 88 automated desktop tests (added TOTP cancel flow tests)

Assets

• Syna-v1.0.0-release.apk — Android
• Syna-v1.0.0-server.jar — headless private chat server (Windows / macOS / Linux)
• Syna-v1.0.0-macos.dmg — macOS desktop
• Windows: build via CI MSI or the app-image in composeApp/build/compose/binaries/main/app/
• SHA256SUMS.txt — checksums for all assets

Full changelog: CHANGELOG.md · Security model: MIRTAZAPINE_SHIELD.md

v0.9.9 RC — ◇Mirtazapine Shield

v0.9.9 RC — ◇Mirtazapine Shield · Forward secrecy & encrypt-only default

Security

• Forward secrecy (process epoch): every app start derives a fresh random epoch; session keys are derived as base|min(epoch)|max(epoch) — restarting the app rotates all session keys, so a stolen session key cannot decrypt traffic from a previous run
• Double-try decrypt (new epoch formula → legacy fallback): both sides stay symmetric regardless of key-exchange ordering, works with peers on older versions
• Encrypt-only is now the default (no silent plaintext fallback): if the peer key is not ready yet, messages queue and auto-send the moment the key arrives
• No more plaintext fallback in group chats (LAN mesh + private server groups): missing member keys → queue + key-exchange request
• Late-key frames are never stored as raw ciphertext: UDP-reordered key frames are handled by a bounded pending queue; ciphertext is decrypted the instant the key is pinned

Stability

• Outbox cap (500 frames per peer, drops oldest) — no unbounded memory growth for permanently-offline peers
• 6-engine message storm stress test (86 automated desktop tests in total)

UX

• Enter to send in chat input (Shift+Enter for newline)
• First-launch Shield onboarding wizard (4 steps: biometrics / TOTP / usage / boundaries; skippable)
• Message font size setting (small / medium / large)

Tooling

• Update checker: silent GitHub Releases check 10 s after launch — the app's only network egress (codebase audited: no backdoors, no hidden endpoints)
• FAQ_ZH.md; CI gains a non-blocking dependency-audit job (osv-scanner)

Assets

• Syna-v0.9.9-release.apk — Android
• Syna-v0.9.9-server.jar — headless private chat server (Windows / macOS / Linux)
• Syna-v0.9.9-macos.dmg — macOS desktop
• Windows build: run composeApp/build/compose/binaries/main/app/ app-image or build via CI MSI (per commit)
• SHA256SUMS.txt — checksums for all assets

Full changelog: CHANGELOG.md · Security model: MIRTAZAPINE_SHIELD.md

Syna v0.9.8

Syna v0.9.8 — JIT False-Positive Fix, Strong-Only Biometric Unlock, Signature-Learning Monitor Detection

Suspicous-module false positive fixed (your report)

• ART JIT caches (memfd:jit-cache, memfd:jit-zygote-cache) are now whitelisted —
  they are normal products of the Android ART JIT compiler, not injection. Enabling the
  Shield no longer locks the app on stock devices
• Detection is multi-dimensional, not name-only: any other executable memfd:
  mapping (Frida-style injection uses memfd or anonymous exec) is still flagged; a
  renamed/renamed-anything payload is caught by the memfd-type signal itself

Unlock hardening (no more "tap and it unlocks")

• The biometric prompt now requires BIOMETRIC_STRONG only (fingerprint/face) —
  previously the device-credential authentication window could auto-pass the prompt
  right after you unlocked the phone (that's why tapping sometimes "just unlocked")

Monitor-app detection: renames no longer bypass

• Package-fragment list expanded (screen-recorder families, spyware, family-lock tools)
• Signature-learning blacklist: the first time a known monitoring app is seen, its
  signing-certificate hash is recorded; afterwards any package carrying that signature
  (renamed / repackaged) is detected — changing the name doesn't help
• Name matching is case-insensitive (case-variant renames caught)

Tests

• 84 (new: ART-JIT memfd whitelist, non-JIT memfd injection detection)

Assets

• Syna-v0.9.8.apk · Syna-macos-arm64-v0.9.8.dmg · Syna-server-v0.9.8.jar · SynaServer-launcher-macos-arm64-v0.9.8.zip (+ SHA-256 manifest)

Syna v0.9.7

Syna v0.9.7 — Full Review Fix Release (3rd audit pass)

Three independent review passes found ~30 confirmed issues — all fixed.

Critical fixes

• Shield-off data lockout: the native heartbeat check only applies while the Shield
  is armed — previously, disabling the Shield (or never enabling it) let the native slot
  expire and all decryption failed (data unreadable)
• Audit-write recursion: the write-failure escalation could recurse
  (persistEvent → reportThreat → …) → potential stack overflow; now deferred and
  one-shot
• TCP heartbeat killed new connections: first-heartbeat check used 0 for
  never-PONGed sockets → every connection closed ~10 s after creation; now only
  judged after a PONG baseline exists
• Locked-state disk wipe: sweep's temp-chat purge could overwrite the whole on-disk
  history with empty memory while the app was locked; memory-wiped flag now blocks all
  disk writes, purge only writes when something was removed, and rewrite re-verifies
  before writing
• Group-file O(N²) fan-out + REQ_KEY storm: mesh group files now send each member's
  ciphertext directly to that member; group-frame decrypt failures no longer fire
  REQ_KEY (foreign ciphertext copies are dropped silently)
• Failed-message resend was dead code: senders never stored localPath — sendFile now
  keeps a send-copy in the cache dir and persists localPath; resend derives mime from
  the file name
• dex integrity hashing finally removed from the light scan (3 s full-APK read;
  three previous attempts had not actually removed the call)

Medium fixes

• serverGroupId is now a stored field (disconnect no longer nulls it → FAILED marking
  actually works; cleared on leave)
• Audit truncation re-seals the hash chain (GENESIS re-root) — history no longer lost
  after trimming
• Stealth mode re-applied after username refresh; BRUTE_FORCE cleared on successful
  unlock (no permanent re-lock loop); self-destruct wipes audit-seen/device baselines
• Native heartbeat: /dev/urandom seeding + monotonic clock (was predictable rand()
  seed + wall clock)
• UDP-mode file transfers now ride the reliable TCP channel (chunk loss was
  unrecoverable)
• Server: GROUP_JOIN/LEAVE body memberId verified (no forged membership events),
  BURN_ACK accepts receiver (was unreachable), empty-from frames only for PING,
  locked banned reads; client server-channel read timeout (dead-server detection)
• Load path synchronized; tmp remnants wiped on clear; purge only rewrites when needed;
  reload rebuilds conversation previews; residual emoji in pickers replaced; scan
  loop heavy-beat flag; group frames added to replay guard; audit never falls back to
  plaintext (counts as failure instead)

Tests

• 83 passing

Assets

• Syna-v0.9.7.apk · Syna-macos-arm64-v0.9.7.dmg · Syna-server-v0.9.7.jar · SynaServer-launcher-macos-arm64-v0.9.7.zip (+ SHA-256 manifest)

Syna v0.9.6

Syna v0.9.6 — ◇Mirtazapine Shield Self-Protection Hardening

Native heartbeat slot (JVM-hook immune)

• The ShieldGate heartbeat now runs in native C as well: every scan beat drives both
  the JVM slot and a native slot (timestamp + HMAC fingerprint)
• The decrypt path verifies both — an attacker who hooks the JVM beat() to fake
  freshness still hits the independently-stalled native slot and decryption is refused
• Native slot is part of the self-verifying export-entry list (hooking it is detected)

Scanner self-healing

• A single scan-round exception no longer kills the detection loop (previously a crash
  in one detector would stop all scanning; the gate still protected data but the Shield
  lost its responsiveness) — errors are logged and the loop continues

Audit-write failure detection

• If audit log writes keep failing (storage made read-only / filled to block
  recording), after 5 consecutive failures → CRITICAL SHIELD_TAMPERED with detail
  "审计日志写入失败（存储异常）"

Reinstall guard

• Device-identity change (reinstall / backup-restore) is now checked independently of
  the Shield being enabled: if the identity changed and the Shield is off, the app
  notifies the user to re-enable it — reinstalling can no longer silently disable
  protection

Tests

• 83 passing

Assets

• Syna-v0.9.6.apk · Syna-macos-arm64-v0.9.6.dmg · Syna-server-v0.9.6.jar · SynaServer-launcher-macos-arm64-v0.9.6.zip (+ SHA-256 manifest)

Syna v0.9.5

Syna v0.9.5 — Image Preview, Message Resend, Power-Saving Discovery, Shield Additions

UX

• Full-screen image preview: tap an image bubble → fullscreen view (tap anywhere to close)
• Resend failed messages: long-press a failed message → 重发 (text re-sends; image/file/voice re-send from local file; burn messages require biometric re-confirmation)
• Voice playback state: bubble shows "播放中" while playing, tap to stop; duration label kept

Power saving

• Discovery broadcast adapts: fast cadence for the first 10 announcements, then 3× slower; incoming announcements or manual refresh reset to fast — less battery on quiet networks

Shield additions

• Device identity detection (DEVICE_CHANGED, LOW advisory): ANDROID_ID differs from the encrypted baseline → reinstall / backup-restore hint
• Audit-integrity check: if the Shield ran before but the audit log was deleted/emptied (attacker wiping traces) → SHIELD_TAMPERED with detail "审计日志被清除"
• Decrypt-path integrity probing tightened (every 6th decrypt instead of 8th)
• dex-integrity hashing definitively moved to the heavy scan (was still running every 3 s)

Tests

• 83 (new: message resend round-trip; PROXY_SET/DEVICE_CHANGED severity)

Assets

• Syna-v0.9.5.apk · Syna-macos-arm64-v0.9.5.dmg · Syna-server-v0.9.5.jar · SynaServer-launcher-macos-arm64-v0.9.5.zip (+ SHA-256 manifest)

Syna v0.9.4

Syna v0.9.4 — Material Icons, Voice Duration, UI Polish

UI: icons instead of text where possible

• Send button → send icon · refresh → refresh icon · play voice → play icon ·
  encryption marker → lock icon · lock-screen unlock button → lock icon + label
• Semantic badges stay as text where no suitable core icon exists: 焚 / 群主 / 管理员 /
  禁言 / 指纹 / 录音 (recording shows ● seconds) / 图片 / 文件
• Fixed a duplicate "刷新 刷新" label introduced by the emoji pass

Voice messages

• Duration is now transmitted (FileChunk.durationMs) and shown on the bubble —
  "语音 12秒" instead of just a file size; filename carries the seconds for cross-version display

Tests

• 82 passing

Assets

• Syna-v0.9.4.apk · Syna-macos-arm64-v0.9.4.dmg · Syna-server-v0.9.4.jar · SynaServer-launcher-macos-arm64-v0.9.4.zip (+ SHA-256 manifest)

Syna v0.9.3

Syna v0.9.3 — Lock-Bypass Fix, 2FA Enable Fix, No-Emoji UI, Proxy Detection

Security fixes

• Lock bypass closed (critical): clearing a threat while LOCKED no longer returns to
  ARMED — previously, if the locking threat disappeared (e.g. VPN change recovered), the
  app silently unlocked without biometrics. Locked state now persists until a real
  verification; only UNLOCKED → threat cleared → ARMED. Regression test added.
• 2FA enable now always works or says why: stale/corrupt seed files are cleared
  before re-enabling (previously a bad file made the toggle silently fail); a failure
  now shows an explicit notice instead of a dead switch
• No-biometrics devices: unlock taps on devices without biometrics now show a clear
  notice instead of doing nothing (and still never count toward the self-destruct
  counter)

UI polish

• All emoji removed from the UI (replaced with text: 焚/图片/文件/锁/群主/管理员/
  禁言/播放/录音 etc.) — cleaner, less "cheap" look

Detection library

• System HTTP proxy detection (PROXY_SET, LOW advisory): global proxy configured →
  traffic may be relayed through a third party (shown with the proxy address)

Tests

• 82 (new: threat-cleared-while-locked stays locked; updated lock/unlock semantics)

Assets

• Syna-v0.9.3.apk · Syna-macos-arm64-v0.9.3.dmg · Syna-server-v0.9.3.jar · SynaServer-launcher-macos-arm64-v0.9.3.zip (+ SHA-256 manifest)

Syna v0.9.2

Syna v0.9.2 — Group-File Encryption, Stealth Mode, Module Details

Group file transfer now E2E-encrypted

• Files sent in groups are now encrypted per member (one ciphertext copy per member,
  same fan-out as group text) — mesh groups and server groups both covered; receivers
  only process the copy they can decrypt
• This closes the last plaintext transfer path (1:1 files were already encrypted)
• Fixed a latent bug: mesh-group file sends were misdetected as "server-group
  disconnected" and silently failed

Suspicious-module detection fixed & detailed

• Whitelist changed from a static library list to partition prefixes
  (/system /apex /vendor /product /system_ext /odm /data/app /data/user)
  — vendor ROM libraries (Xiaomi/Realme/HarmonyOS etc.) no longer false-trigger
  "可疑可执行模块" right after enabling the Shield
• The lock screen and audit now show the actual suspicious module paths/names
  (up to 5), so you can see what triggered the alert

Stealth mode

• New Settings switch: 隐身模式 — stop broadcasting your presence (you still
  discover others and can be found via manual refresh)

Group member fingerprints

• The group administration dialog now shows each member's key fingerprint
  (🔑 short code) for out-of-band verification — anti-impersonation within groups

Tests

• 81 tests (new: vendor-partition whitelist, anonymous-module detection, encrypted
  group-file byte-exact round-trip, stealth announce/stop)

Assets

• Syna-v0.9.2.apk · Syna-macos-arm64-v0.9.2.dmg · Syna-server-v0.9.2.jar · SynaServer-launcher-macos-arm64-v0.9.2.zip (+ SHA-256 manifest)