feat: in-room DMs UI + riverctl (#243 Phase 2/3) + share-invite-via-DM picker (#252 partial)

[sanity]

Problem

#240 / Phase 1 shipped the in-room DM wire format and contract validation:
ChatRoomStateV1 now carries DirectMessagesV1 with sender-signed
AuthorizedDirectMessage + recipient-signed AuthorizedRecipientPurges,
validated by the room contract WASM. But neither the UI nor riverctl knew
how to compose, decrypt, or purge those messages — grep -rn "DirectMessage" ui/src/ cli/src/ returned nothing before this PR.

This PR closes #243 by adding both consumer surfaces in one go so they stay
in wire-format lockstep.

Approach

river-core

New helpers shared by both consumers so wire bytes are byte-identical
regardless of which client posted them:

• ecies::seal_dm_for_recipient / unseal_dm_from_sender — per-message
  randomized ECIES envelope. Fresh ephemeral X25519 keypair + random nonce
  per call. Wire format is [ephemeral_pub: 32 | nonce: 12 | aes_gcm: variable].
  Deliberately separate from the deterministic encrypt_secret_for_member
  helper — that one is safe only because the plaintext IS a 32-byte
  high-entropy secret; generalising it to attacker-controlled message
  bodies would leak plaintext_A XOR plaintext_B on key reuse.
• direct_messages::compose_direct_message — encrypt + sign + cap-check
  in one call.
• direct_messages::open_direct_message — recipient-side decrypt that
  works without the ecies-randomized feature (chat-delegate friendly).
• direct_messages::advance_recipient_purges — version-bump-and-union
  envelope builder used for both single-message and thread-wide purges.

6 new ECIES tests + 7 new end-to-end-helper tests covering: round-trip
through the full ComposableState, refusal of self-DMs, future-skew
rejection, body-cap enforcement, version monotonicity, recipient/key
mismatch, and a send → purge → re-send dance that confirms the tombstone
gate drops a re-delivered message.

UI (Phase 2)

• New components/direct_messages module with two modals:
  • DmThreadModal: per-pair thread, decrypt-on-display, composer with
    body-size guard, "Purge thread" button.
  • DmInboxModal: lists every open DM thread the local user has in the
    current room, unread-first then by recency.
• "Send Direct Message" button in the member-info modal opens the thread
  modal for that pair.
• "Direct Messages" button (unread-badged) in the members panel opens the
  inbox modal.
• In-memory DM_LAST_SEEN per-(room, peer) drives the unread badge; the
  thread modal advances it on render of inbound messages.

riverctl (Phase 3)

• riverctl dm send <owner_vk> <recipient> "<msg>"
• riverctl dm list <owner_vk> [--with <peer>] [--limit N] [--since-minutes M]
• riverctl dm purge <owner_vk> <hex_token_or_index>

All three go through the shared river-core helpers, so the bytes the
contract WASM sees are identical to what the UI emits. dm purge accepts
either a 32-character hex PurgeToken or a 1-based index into the most
recent dm list output, matching the issue's spec.

Added a small ApiClient::send_state_delta() helper so the new commands
don't have to duplicate the contract-key + serialize + recv dance.

Crate features

cli/Cargo.toml now enables ecies and ecies-randomized on river-core.
The UI already enabled them.

Testing

• cargo test -p river-core --features ecies-randomized: 254 pass (51 DM
  integration tests, 14 ECIES tests, and 189 others — no regressions).
• cargo test -p riverctl --lib: 8 pass (3 new DM tests).
• cargo build -p river-ui --target wasm32-unknown-unknown --release:
  succeeds.
• cargo clippy -p river-core -p riverctl --all-targets --features ecies-randomized -- -D warnings:
  clean.

Test plan (next steps once merged into a deployment)

• Two local riverctl identities exchange a DM end-to-end; verify
  dm list shows decrypted body on the receiver and ciphertext-only on
  the sender.
• UI: open the thread modal, send a message, confirm it round-trips
  through the synchronizer and shows up on a second browser session
  logged in as the recipient.
• UI: confirm "Purge thread" tombstones every inbound DM in the view
  and survives a refresh.

Out of scope

Per the issue:

• Cross-room DMs / DMs with non-co-members (deferred to freenet/mail).
• Multi-message threading beyond per-pair chronological list.
• Pre-quantum -> post-quantum migration (separate from this work).

Closes #243

[AI-assisted - Claude]

[sanity]

Multi-model review pass complete (4 internal reviewer agents + Codex CLI). Findings addressed in 67ca488:

Blocking — fixed

• P1 (Codex): open_direct_message referenced the feature-gated crate::ecies unconditionally. Room contract WASM build failed (could not find \ecies` in the crate root). Gated the helper on \ecies`. Confirmed with `cargo check -p room-contract --target wasm32-unknown-unknown`.
• High (skeptical): per-pair cap silently dropped messages over 100; CLI printed "DM sent" and UI cleared the composer for messages that never landed. Added `pair_message_count` helper in `river-core` and pre-flight checks in both UI and CLI. New test `pair_message_count_only_counts_the_ordered_pair`.
• High (skeptical): "Purge thread" captured the token list at render time, so DMs arriving between render and click survived. Re-read inside the click closure.
• Important (code-first): `dm purge ` was ambiguous when `dm list` was filtered with `--with`/`--limit` — could silently purge the wrong DM. Dropped the index form; `dm purge` is hex-token-only. `dm list` already prints the token under each inbound DM. Also added "already purged" guard so a no-op purge errors instead of silently bumping the version.

Should-fix — fixed

• (big-picture) Plumbed inbound DM unread into `count_total_unread_messages` so the tab-title badge tracks DMs.
• (code-first / skeptical) `DmInboxModal` now sorts on `u64` timestamp, not formatted minute-precision string. Empty threads sort last.
• (code-first) Trimmed dead `self_id == owner_id && peer == owner_id` disjunct.
• (big-picture) Updated `AGENTS.md` to reflect Phase 2+3 shipped in feat: in-room DMs UI + riverctl (#243 Phase 2/3) + share-invite-via-DM picker (#252 partial) #244.

Deferred (with reasoning)

• (skeptical) `ApiClient::send_state_delta` recv misattribution: pre-existing pattern across all `api.rs` callers; out of scope here.
• (skeptical) Send-to-newly-banned-recipient TOCTOU: would require a fetch-after-send round trip on every DM. Documented limitation rather than added latency.
• (skeptical) `advance_recipient_purges` with empty `new_tokens`: low risk, not exploitable; new "already purged" check in `execute_purge` prevents the CLI from triggering it.

Tests + builds + clippy on `river-core`/`riverctl` and `cargo check -p room-contract --target wasm32-unknown-unknown` + UI release build all green.

[AI-assisted - Claude]

[sanity]

Manual end-to-end verification via Playwright caught a runtime-only WASM bug — fixed in 88d5820.

Test setup: Published the branch under a separate test web-container keypair (contract `yeWSLGJC2BLuuCJ1uhRTM673evsRVjrcB9jCiZPbp89`, generated via the existing `cargo make generate-test-keys` / `publish-river-test` flow) so production River (`raAqMhMG7KUpXBU2SxgCQ3Vh4PYjttxdSWd9ftV7RLv`) was unaffected.

Bug found: `dm_thread_modal.rs::unix_now` was using `SystemTime::now()`, which panics at runtime on `wasm32-unknown-unknown` ("time not implemented on this platform"). Unit tests pass because they run on native. Now routed through the existing `crate::util::get_current_system_time` helper that wraps `Date.now()` via `wasm_bindgen`.

End-to-end DM round trip verified after the fix:

1. Alice (browser UI) creates room "DM Test Room", invites Bob.
2. Bob (`riverctl --config-dir /tmp/riverctl-bob invite accept`) joins.
3. Bob → Alice (riverctl): `riverctl dm send <owner_vk> QOKAODNJ "hello alice, this is bob via riverctl"`
4. Alice's UI: Synchronizer pushes the new state, the "Direct Messages" button gets a `1` unread badge, opening the inbox lists "Bob (1)", clicking the thread decrypts and displays the plaintext on Alice's screen, mark-thread-read clears the badge.
5. Alice → Bob (UI composer): "hi bob, alice here from the browser UI" — sent via the new `compose_direct_message` path.
6. Bob (`riverctl dm list`): shows the decrypted reply with a hex purge token.
7. Bob (`riverctl dm purge <hex_token>`): Bob's next `dm list` no longer shows it.
8. Alice (UI "Purge thread"): Bob's DM tombstoned in Alice's view — thread modal now reads "No messages yet. Say hello!".

Wire-format symmetry between `river-ui` (Wasm) and `riverctl` (native) confirmed in both directions, as designed. Both consumers go through the shared `compose_direct_message` / `open_direct_message` / `advance_recipient_purges` helpers in `river-core`.

Screenshots saved locally; CI is re-running.

[AI-assisted - Claude]

[sanity]

Follow-ups from review discussion:

• Filed feat: share invite via DM #252 "feat: share invite via DM" for the convenient cross-room invite-via-DM UX.
• Added e662ea5 — DM bodies now go through the same conversation::message_to_html path as room messages, so a pasted invite URL becomes a clickable anchor (target=_blank, Freenet web-contract URLs host-stripped to a same-origin path so the recipient's gateway serves them). Outbound DMs still show as ciphertext-only. The existing linkify tests in conversation::tests (bare URL / code-span / markdown link / Freenet URL label) cover the same function the DM bubble now calls.

[AI-assisted - Claude]

[sanity]

Pass 2 review consolidated + #252 implementation.

Implemented #252 (Share invite via DM): member-info modal now has a "Share an invite via DM…" button below "Send Direct Message". Opens a picker listing other rooms the local user is in; pick one → generates an invite for that room → pre-fills a DM in the current room with the invite URL → user reviews + sends. Linkified via e662ea5. Factored invite_member_modal::get_invitation_base_url to pub(crate) so URLs match byte-for-byte.

Review findings addressed:

• Codex P2: ambiguous prefix DM recipient routing → now collects all candidates and rejects ambiguity. New resolve_recipient_vk_rejects_ambiguous_prefix test.
• Skeptical High: sticky DM unread on reload → seed_dm_last_seen_from_rooms() called at App() startup, seeds DM_LAST_SEEN to current max inbound timestamp per (room, peer).
• Skeptical Medium: <sent: ciphertext only> markdown-mangled → BodyKind::{Plaintext, Placeholder} routes placeholders through a plain muted text node, skipping markdown.
• Skeptical Medium: cap-check race in deferred apply → in-defer re-check under ROOMS.with_mut write-lock with an ApplyOutcome enum.
• Skeptical Low: try_read instead of .read() on DM_LAST_SEEN in count_unread_dms.
• Code-first: multi-paragraph DM spacing → added prose prose-sm wrapper to match room messages.
• Code-first: dropped unused dm-body class.
• Testing: clippy.toml workspace-level disallowed_methods rule banning std::time::SystemTime::now with a reason pointing at the wasm-safe helper (the 88d5820 incident otherwise has no structural guard). Clippy isn't gating in CI today but cargo clippy --target wasm32-unknown-unknown locally now catches it.
• Big-picture: .gitignore ignores dm-*.png (manual e2e screenshots).

Deferred:

• TOTAL_UNREAD_COUNT dead state (pre-existing, not introduced by feat: in-room DMs UI + riverctl (#243 Phase 2/3) + share-invite-via-DM picker (#252 partial) #244).
• O(rooms × all DM messages) cost of count_unread_dms on render path (acceptable for first cut; the cheap fix is a per-room cached count which is a follow-up).

[AI-assisted - Claude]

[sanity]

Pass 3 review consolidated (4 internal + Codex):

Critical (fixed in 2c69ff1):

• Codex + Skeptical: seed_dm_last_seen_from_rooms regression — effect didn't subscribe to ROOMS, ran once against an empty map, never re-ran → unread-on-reload "fix" was a no-op. AND naively subscribing would have re-seeded on every inbound DM, breaking unread entirely. Fixed with a one-shot DM_LAST_SEEN_SEEDED flag + explicit subscription. Factored compute_dm_last_seen(&Rooms) -> HashMap as a pure helper; added 3 unit tests.

Medium (fixed):

• Code-first + Skeptical: DM_DRAFT clobbered already-typed composer — now appends.
• Skeptical: picker self-DM guard added to open_invite_via_dm_picker.
• Skeptical: resolve_recipient_vk spurious "ambiguous" on owner-as-member duplicate — now dedupes by VerifyingKey.
• Codex: workspace clippy.toml broke cargo make clippy (existing native call sites trigger -D warnings). Removed the lint; doubled-down on the util::get_current_system_time docstring so future contributors see the wasm-safe pattern at the API surface.

Docs:

• AGENTS.md gains a "Phase 4 (feat: share invite via DM #252 partial)" bullet.
• PR title updated to reflect feat: share invite via DM #252 scope.
• feat: share invite via DM #252 remains OPEN after merge — member-info entry point shipped; Invite-Member-modal "Send to a co-member" tab + cross-room member-filter deferred (per-room identities make the filter structurally infeasible without a global-identity layer; will note in feat: share invite via DM #252 separately).

[AI-assisted - Claude]