v3.38.0

Haven v3.38.0

A feature release: bulk message deletion, ban appeals, a configurable channel-creator role, and a working AI noise suppression, plus a batch of voice/screen-share stability fixes and anti-bot tools that landed since v3.37.2.

Added

• Delete several messages at once (#5460). The "Select messages" tool (mods/admins) now has a Delete button next to "Move to", so you can multi-select and remove a batch in one go with an "are you sure" confirm. Deletion runs through the same per-message permission rules as a single delete, so it can never remove more than you could delete one at a time.
• Configurable channel-creator role (#5461). When a non-admin who has permission to create channels makes one, they are auto-granted a role inside that channel so they can manage it. That already happened for top-level channels using the highest channel-scoped role; it is now a setting in Admin -> Roles (pick a specific role, keep the default, or turn it off) and also applies to sub-channels. Admins are never auto-assigned anything.
• Ban appeals (#5457). A banned user who signs in with the correct password now sees the ban reason and a box to send the admins an appeal, instead of a dead-end error. Appeals show up next to the user in the Banned Users list with an option to unban or dismiss, and online admins get a heads-up when one arrives. The reason is only revealed after the password is verified, so it never leaks on a bare username guess.
• Opt-in Cloudflare Turnstile CAPTCHA on registration. Admins can require a Turnstile challenge on the sign-up form to slow automated account creation. Off by default; needs a site key and secret.
• Opt-in global registration rate limit. A server-wide cap on new accounts per hour to blunt bot waves. Off by default and configurable in Admin -> Settings.
• Admin bulk cleanup tool for bot-wave accounts. Review and remove batches of recently-created spam/bot accounts at once, with a vetting checklist before anything is deleted.

Fixed

• AI noise suppression (RNNoise) was a silent no-op (#5458). The main thread posted a WebAssembly.Module into the AudioWorklet, but Module objects do not survive structured clone into the worklet, so suppression sat in pass-through forever while the UI still looked healthy. The worklet now receives raw WASM bytes and compiles internally, reports ready/error back, checks the rnnoise.wasm response, and prefers a 48 kHz AudioContext so a 96 kHz headset does not defeat the model. Thanks to @Serionard for the full diagnosis.
• Voice roster no longer strobes empty while you are still in voice. Transient empty snapshots (prune/rejoin races) are ignored while you are in voice on that channel, with a follow-up poll to refresh the real list. The right VOICE panel follows the channel you are viewing.
• Screen shares that appeared at join then vanished are recovered more aggressively. renegotiate-screen retries when the peer is not ready yet, the viewer watchdog runs longer and re-checks live tiles, and ICE heal / fast-path rejoin re-arm screen recovery.
• Maximizing or resizing the window no longer looks like it drops you from a call. A same-socket voice-rejoin is now a no-op, healthy peers are never torn down on a spurious roster update, and the Desktop app owns its view bounds so a first maximize cannot stack a hidden view over the active one.
• Voice users are no longer pruned during their reconnect grace window (#5444). A brief socket flap could evict someone before their reconnect landed, so others saw them drop and rejoin. The prune now respects the grace window.

Changed

• Desktop image copy from the lightbox is more reliable. It uses main-process clipboard IPC (base64 payload, window focus, DOM decode fallback) and no longer shows a browser-only error toast inside the desktop app. Pairs with Haven Desktop v1.4.26.

---

Update by pulling main (or the tagged source zip) and restarting the server. Full details in CHANGELOG.md.