chirp v0.3.0

The first binaries: cmd/chirp, the one app both people run, and cmd/chirp-relay, the server. Chirp is still not a runnable product: a session has run on one machine, through the relay, not yet between two (#12; README, Status). There are no builds to download; build from source.

Breaking

• Go 1.26.9 is the declared minimum, for the standard library's security fixes.
• The relay keeps chirp.* message types to itself. Forward refuses them from a client with ErrReservedType (#60).
• A signalling message over 1 MiB closes its socket (MaxMessageSize, #60).
• The relay pings every WebSocket every 30 seconds, at most 40, and drops a peer that stops answering (#88).

New

• cmd/chirp, drawn with Fyne in the Warm look:
  • shows this machine's code and link, and takes someone else's code or pasted link; the link it copies is the whole usechirp.app/l#token (#65);
  • asks the owner for consent in Chirp's own prompt, with the controller's name shown as a claim;
  • serves an allowed session with remotekit's stream.Runner, granted exactly what the owner allowed, with STUN/TURN servers from -ice / CHIRP_ICE (#60);
  • shows the owner's screen on the controller's side with remotekit's stream.Viewer, over WebRTC only and decoded in Go, and sends mouse and keys back (#72);
  • shows the owner a bar for as long as a session lasts (#85).
• Signalling over Nostr relays, with -nostr / CHIRP_NOSTR (#43). The server only looks a code up, and never sees the signalling.
• A PAKE over the code's secret part (#21, #94). On the Nostr path a code has 6 + 4 digits, and the two Chirps run CPace over the last four before anyone is asked to consent. A link is given up after 3 failed or abandoned PAKEs.
• cmd/chirp-relay, with deploy files for a Proxmox LXC container, Podman or systemd, behind Caddy (#86; docs/relay.md). Flags: -addr (host:port, or unix:PATH), -socket-mode, -trusted-proxies, -healthcheck.
• usechirp.app, published from site/ on GitHub Pages (#64), behind Cloudflare's security headers (#74, #75).

Fixed

• The relay waits for the first owner socket before dialling a second (#70).
• The site refuses every HTML sink (#74), and Cloudflare no longer rewrites its pages (#75).
• The third-party licence gate sorts modules the same in every locale, and recognises an ISC licence written without a slash.
• The SBOM job can attach to a published release; for v0.2.0 it could not.

Decisions recorded

• usechirp.app is Chirp's domain (#62).
• Warm is the visual direction (docs/ux.md).
• Fyne's embedded fonts (OFL 1.1, Bitstream Vera) are accepted, and gated font by font (#54).
• Vulnerability reports go to security@fabrintek.com.br (#66).

Repository

• Public, with branch and release-tag rulesets (#17, #63, #68), code scanning, a Code of Conduct, issue templates and Discussions (#89, #95).
• The last release merged from develop. Since then Chirp is trunk-based: work lands on main, and a release is a tag on it (#98).

Merged in #97.

chirp v0.2.0

The product model, over remotekit's rendezvous. There is still no cmd/chirp binary. Chirp is two library packages, session and signalling (README, Status).

Breaking

• The session direction is inverted (#5). Each running Chirp registers as a peer (POST /api/peers) and gets its own code and share link. Whoever redeems the code (POST /api/redeem, POST /api/links/{token}/sessions) controls that peer, once its owner consents over its own socket.
• The technician-PIN endpoints are gone: POST /api/sessions and POST /api/sessions/{code}/consent (#13).
• RegisterPeer takes the origin: RegisterPeer(name, origin) (#38).
• Go 1.26.6 is the declared minimum (#29). With it, govulncheck reports no vulnerabilities.

New

• Per-origin limits (maintainer decisions, tunable, 429 when exceeded):
  • 30 open sessions per controller origin (#6);
  • 30 registered peers with a live code (#38).
• Abandoned peers are released. A peer away from its owner socket for 2 minutes loses its code, link and session (#41).
• The blind lookup (#45):
  • PUT /api/peers/{peer}/contact records an owner's Nostr key and relays;
  • POST /api/lookup and POST /api/links/{token}/lookup return exactly that contact, metered and single-use, with nothing relayed.
• Relay presence: chirp.peer_joined and chirp.peer_left.

Fixed

• WaitForConsent wakes every waiter (#30). It returns ErrSessionExpired or ErrSessionEnded when a session ends undecided, instead of hanging.
• Lazy expiry sets EndedAt and notifies subscribers, as the reaper does (#34).

Decisions recorded

• A share link reaches a new Chirp by being pasted (decision 4, #35).
• A blind public server over Nostr, with 6 + 4 digit codes and a PAKE, comes after the MVP and before any public relay (decision 5, #44).
• Fyne for the UI (#36).
• Consent enforcement moves out of remotekit tunnel (#40, barahn/remotekit#83).
• A bring-your-own STUN/TURN guide: docs/stun-turn.md (#39).

Full notes: #28.