v1.0.0

v1.0.0

Released: 17 Apr 2026
Commit: b22e4ad

Client

• Chrome: Terminal-native footer and banner UX (client/chrome.go, Lipgloss styling)
• Read receipts: Shown in the transcript where applicable
• Reconnect: Transcript reset on reconnect so stale lines do not linger after a dropped session
• Sending state: Clearer sending indicator after chat writes and related command-path fixes
• Rate limits: Notice when the server applies WebSocket rate limiting
• Unread: Unread count behavior refined alongside footer chrome
• Themes: Theme loader updates and THEMES.md example alignment

Server

• Admin WebSocket: Clear reply when an unknown admin command is received
• Client connection: Sending-state consistency with client after chat writes

Documentation

• ARCHITECTURE, PROTOCOL, README, TESTING updated for TUI/read-receipt/reconnect behavior and current test metrics

CI and packaging

• Release workflow: Optional publish-downstream-packages job pushes Homebrew tap, Scoop bucket, winget PR (Microsoft fork), and AUR after assets upload (requires PACKAGING_GITHUB_PAT / AUR_SSH_PRIVATE_KEY where used)
• Packaging docs: PACKAGING.md covers winget community listing, checksum sync via packaging/ci/render-release-manifests.sh, and guidance when Defender/VirusTotal flag portable zips

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-windows.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates), release workflow defaults, and templates under packaging/ set to v1.0.0
• Chocolatey: marchat.nuspec adds iconUrl (logo on main), clearer title, stable 1.0.0 version; chocolateyinstall.ps1 targets the v1.0.0 Windows zip (refresh checksum from the published asset before choco pack / push)
• Templates: Zip SHA256 placeholders in-repo must be replaced with values from render-release-manifests.sh after GitHub release zips exist (see PACKAGING.md)

Assets

• marchat-v1.0.0-linux-amd64.zip
• marchat-v1.0.0-linux-arm64.zip
• marchat-v1.0.0-windows-amd64.zip
• marchat-v1.0.0-darwin-amd64.zip
• marchat-v1.0.0-darwin-arm64.zip

Full Changelog: v0.11.0-beta.5...v1.0.0

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients.
• Keystore / database: No migration called out relative to v0.11.0-beta.5; backups before upgrades remain good practice.

Migration guide

• Binaries: use v1.0.0 archives or install.ps1 / install.sh defaults after publish
• Server / client: restart after upgrade
• Audits: run govulncheck ./... on Go 1.25.9+ when checking dependency exposure (see SECURITY.md for scanner vs reachability notes)

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v1.0.0
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.11.0-beta.5

v0.11.0-beta.5

Released: 10 Apr 2026
Commit: c9ad733

Server

• WebSocket: RFC 6455 close frames on handshake errors
• Plugins: Hub no longer drives plugin IPC directly; bounded plugin chat fan-out with documented best-effort, at-most-once delivery semantics

Client

• Experimental: Env-driven exthook and -doctor integration

Plugin SDK and examples

• Stdio: RunStdio and HandlePluginRequest for the JSON IPC loop; echo example uses the SDK path
• Docs: SDK stdio helpers, key file list fixes, README save-data example uses GetConfig and Marshal
• Repo: Ignore plugin/sdk/cov for coverage output

CI and testing

• CI: Run nested plugin Go modules; align nested Go versions; fmt and govulncheck on SDK; Dependabot Node 20 note in dependabot.yml
• Tests: Server loadverify benches and rate limit coverage; -doctor parallel tests serialize os.Environ hook

Documentation

• TESTING: Bench section; refreshed test metrics, coverage, and lines of code
• Hooks: Example hook nested under _example_hook
• Style: ASCII hyphens where prose was edited

Dependencies

• golang.org/x/crypto, golang.org/x/term, modernc.org/sqlite

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-windows.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates), and release workflow defaults set to v0.11.0-beta.5

Assets

• marchat-v0.11.0-beta.5-linux-amd64.zip
• marchat-v0.11.0-beta.5-linux-arm64.zip
• marchat-v0.11.0-beta.5-windows-amd64.zip
• marchat-v0.11.0-beta.5-darwin-amd64.zip
• marchat-v0.11.0-beta.5-darwin-arm64.zip

Full Changelog: v0.11.0-beta.4...v0.11.0-beta.5

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients.
• Keystore / database: No schema change called out beyond v0.11.0-beta.4; backups before upgrades remain good practice.

Migration guide

• Binaries: use v0.11.0-beta.5 archives or install.ps1 / install.sh defaults after publish
• Server / client: restart after upgrade
• Audits: run govulncheck ./... on Go 1.25.9+ when checking dependency exposure (see SECURITY.md for scanner vs reachability notes)

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.11.0-beta.5
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.11.0-beta.4

v0.11.0-beta.4

Released: 9 Apr 2026
Commit: 62e3ca0

E2E and message state

• Message edits: Encrypted payloads keep ciphertext and is_encrypted consistent after edit (no stale plain text or wrong encryption flag on the wire)

Client

• Themes: Deterministic cycle order for :themes and Ctrl+T (built-ins system → patriot → retro → modern, then custom themes by JSON key in themes.json); documented in THEMES.md, README, and ARCHITECTURE.md

Documentation

• README / SECURITY.md: Clearer distinction between container/SBOM scanners and govulncheck reachability; pgx advisory metadata (CVE-2026-33815 / CVE-2026-33816) and Fixed in: N/A lag called out where relevant
• Prose: em dashes normalized to ASCII hyphens where edited

Repository hygiene

• .gitattributes: enforce LF for text sources; tree renormalized for consistent line endings

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-windows.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates), and release workflow defaults set to v0.11.0-beta.4

Assets

• marchat-v0.11.0-beta.4-linux-amd64.zip
• marchat-v0.11.0-beta.4-linux-arm64.zip
• marchat-v0.11.0-beta.4-windows-amd64.zip
• marchat-v0.11.0-beta.4-darwin-amd64.zip
• marchat-v0.11.0-beta.4-darwin-arm64.zip

Full Changelog: v0.11.0-beta.3...v0.11.0-beta.4

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients.
• Keystore / database: No change in this release beyond v0.11.0-beta.3 behavior; routine backups before upgrades remain good practice.

Migration guide

• Binaries: use v0.11.0-beta.4 archives or install.ps1 / install.sh defaults after publish
• Server / client: restart after upgrade
• Audits: run govulncheck ./... on Go 1.25.9+ when checking dependency exposure (see SECURITY.md for scanner vs reachability notes)

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.11.0-beta.4
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.11.0-beta.3

v0.11.0-beta.3

Released: 9 Apr 2026
Commit: b6bf24e

Toolchain and security documentation

• Go 1.25.9 required in go.mod, CI, Dockerfile, and docs (README, TESTING.md, QUICKSTART, deploy/CADDY-REVERSE-PROXY.md, etc.); addresses govulncheck findings for Go 1.25.8 standard library (crypto/tls, crypto/x509, archive/tar, html/template, and related)
• SECURITY.md: version line v0.11.0-beta.3; notes on govulncheck and package-level pgx advisories (Fixed in: N/A; no reachable symbols in default govulncheck ./...)

Client and configuration

• Profile display name dedupe on load; default Profile-N when adding profiles
• GetConfigPath honors MARCHAT_CONFIG_DIR (aligned with ResolveClientConfigDir())
• Keystore v3 (embedded PBKDF2 salt in file header); legacy path-salted files migrate on unlock (ARCHITECTURE.md, PROTOCOL.md)
• GetKeystorePath prefers resolved config directory and standard per-user keystore.dat before legacy ./keystore.dat in the working directory (avoids stray repo keystores when developing)
• Broader client UX and crypto-path hardening alongside server send-path hardening

Server and web admin

• Startup validation and admin list normalization refactored into shared helpers (cmd/server, config validation)
• Web admin: sidebar navigation, dark theme, confirmation modals (server/admin_web.html and related Go)
• MARCHAT_SESSION_SECRET for web admin sessions (MARCHAT_JWT_SECRET remains deprecated alias); assorted documentation fixes

Plugins

• plugin/sdk Message: channel, encryption, and DM context fields
• Plugin replies routed through ConvertPluginMessage; StopPlugin data race fixed; decode loop exits cleanly on closed pipe (quieter CI logs)
• Documentation for plugin message routing, type chaining, and encrypted delivery

Documentation and demos

• README: five current GIF demos with section headings (replaces older demo assets)
• E2E documentation aligned with global ChaCha20-Poly1305; unused X25519 API removed from the tree
• Troubleshooting and -doctor / diagnostics text refreshed for current flags and environment behavior

CI and release workflow

• gh release upload / gh release edit for matrix .zip assets and Docker Hub blurb; workflow documentation; shell/Docker sources normalized to LF where appropriate
• database-smoke job: Postgres and MySQL InitDB / CreateSchema / table checks; MySQL CI DSN uses mysql: / mysql:// prefix for driver detection
• Expanded server and plugin manager tests

Install and local build scripts

• build-release.ps1: darwin/arm64 build target (alongside existing matrix expectations)

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-windows.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates), and release workflow defaults set to v0.11.0-beta.3

Assets

• marchat-v0.11.0-beta.3-linux-amd64.zip
• marchat-v0.11.0-beta.3-linux-arm64.zip
• marchat-v0.11.0-beta.3-windows-amd64.zip
• marchat-v0.11.0-beta.3-darwin-amd64.zip
• marchat-v0.11.0-beta.3-darwin-arm64.zip

Full Changelog: v0.11.0-beta.2...v0.11.0-beta.3

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients.
• Keystore: v3 portable format; very old clients may need a current build after peers migrate legacy path-salted files.
• Database: No schema change in this release; routine backups before upgrades remain good practice.

Migration guide

• Binaries: use v0.11.0-beta.3 archives or install.ps1 / install.sh defaults
• Web admin: prefer MARCHAT_SESSION_SECRET; plan to drop reliance on MARCHAT_JWT_SECRET
• E2E / keystore: if you kept ./keystore.dat in a repo tree while a real profile keystore exists under app data, resolution now prefers the profile path—remove or relocate stray keystore.dat files if you still intend to use cwd-only legacy layout
• Server / client: restart after upgrade; run govulncheck ./... on Go 1.25.9+ when auditing dependencies

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.11.0-beta.3
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.11.0-beta.2

v0.11.0-beta.2

Released: 6 Apr 2026
Commit: 319cb0b

Toolchain and security documentation

• Go 1.25.8 required in CI, Dockerfile, and docs (README, TESTING.md, etc.)
• SECURITY.md: supported-versions table uses Yes / No; notes edwards25519 advisory context and aligns with release messaging

Client and TUI

• Terminal-native labels replace decorative chrome; reaction and in-message emoji behavior unchanged; lock emoji removed from help session line
• Alt+M and :msginfo toggle message metadata in the chat view
• Colorized server startup banner and client pre-TUI output; respects NO_COLOR

Doctor

• Text report is colorized when stdout is a TTY; NO_COLOR and -doctor-json documented (ARCHITECTURE.md)
• Server marchat-server -doctor: MARCHAT_* listing reflects config/.env after godotenv.Overload (documented vs client doctor)

Server and data paths

• Hardened plugin license cache, username reservation, and database backup SQL; behavior documented

CI and release workflow

• .github/workflows/release.yml: documented resolve-version / static build expectations; CGO_ENABLED=0 on the build job
• FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: opts JS actions (including action-gh-release) into Node 24

Install scripts

• Termux / Android aarch64 maps to linux-arm64 release assets (install.sh, install.ps1)

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-windows.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates), and release workflow defaults set to v0.11.0-beta.2

Assets

• marchat-v0.11.0-beta.2-linux-amd64.zip
• marchat-v0.11.0-beta.2-linux-arm64.zip
• marchat-v0.11.0-beta.2-windows-amd64.zip
• marchat-v0.11.0-beta.2-darwin-amd64.zip
• marchat-v0.11.0-beta.2-darwin-arm64.zip

Full Changelog: v0.11.0-beta.1...v0.11.0-beta.2

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients.
• Database: No schema change in this release; routine backups before upgrades remain good practice.

Migration guide

• Binaries: use v0.11.0-beta.2 archives or install.ps1 / install.sh defaults
• Server / client: restart after upgrade; set NO_COLOR=1 if you need plain doctor or CLI output
• Doctor: run marchat-server -doctor after changing config/.env to confirm env resolution matches expectations

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.11.0-beta.2
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.11.0-beta.1

v0.11.0-beta.1

Released: 3 Apr 2026
Commit: c23648e

Multi-DB backends and durable state (PR #83)

This release is anchored by Pull Request #83; merge commit 47c52e1 (feat/server-multi-db-durable-state). It is a major server and persistence change, not a small patch.

• SQL backends: First-class support and dialect-aware behavior for SQLite (default), PostgreSQL, and MySQL/MariaDB (server/db_dialect.go, schema and query paths in server/db.go)
• Durable reactions and read receipts: Reactions and read receipts are stored and reconciled with the new message-state model (server/message_state.go, handler integration in server/handlers.go)
• Retention and correctness: Message-state retention uses dialect-safe deletes; MySQL index DDL and retention DELETE behavior were fixed for compatibility (de59e2f)
• Documentation: ARCHITECTURE.md and PROTOCOL.md updated for multi-DB operation and durable state; extra notes on validation and MySQL/MariaDB schema expectations

Doctor and operations

• marchat-server -doctor / -doctor-json: Reports database dialect and DSN validity; includes checks for empty durable-state tables (internal/doctor/db_checks.go)

Reliability and admin UI

• WebSocket: Per-connection serialized writes to prevent concurrent ping / write races and panics (83175e0)
• Admin TUI: Layout, logs view, and heading alignment fixes (66d7d47)

Tests

• Reaction removal by target id; db_dialect and message_state unit tests

Dependencies

• filippo.io/edwards25519 v1.1.0 to v1.1.1 (indirect dependency; patch release)

Version and packaging

• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-*.ps1, scripts/build-linux.sh, README (badge, install snippets, Docker tag, Latest Updates / Recent releases), and release workflow defaults set to v0.11.0-beta.1

Assets

• marchat-v0.11.0-beta.1-linux-amd64.zip
• marchat-v0.11.0-beta.1-linux-arm64.zip
• marchat-v0.11.0-beta.1-windows-amd64.zip
• marchat-v0.11.0-beta.1-darwin-amd64.zip
• marchat-v0.11.0-beta.1-darwin-arm64.zip
• marchat-v0.11.0-beta.1-android-arm64.zip

Full Changelog: v0.10.0-beta.3...v0.11.0-beta.1

Breaking changes

• WebSocket JSON protocol: No intentional breaking change for normal chat clients; operators should still read PROTOCOL.md after upgrading.
• Database: New or extended tables/columns for durable reactions, read receipts, and message state may be created on startup depending on backend. Back up production databases before upgrading.

Migration guide

• Binaries: use v0.11.0-beta.1 archives or install.ps1 / install.sh defaults
• Server: restart after upgrade; if you use PostgreSQL or MySQL/MariaDB, confirm MARCHAT_DB_PATH / DSN and permissions per README and ARCHITECTURE.md
• Doctor: run marchat-server -doctor (or -doctor-json) to confirm dialect and DSN resolution after changing database settings

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.11.0-beta.1
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.10.0-beta.3

v0.10.0-beta.3

Released: 31 Mar 2026
Commit: 5737ba8

WebSocket TLS (Caddy)

• Client dials wss:// reliably behind a TLS reverse proxy: ALPN http/1.1, optional --skip-tls-verify, and SNI handling for loopback IPs vs hostnames
• Repo adds docker-compose.proxy.yml, deploy/caddy/Caddyfile, deploy/caddy/proxy.env.example, and deploy/CADDY-REVERSE-PROXY.md (Unix shell and PowerShell)
• Optional gitignored deploy/caddy/proxy.env sets MARCHAT_CADDY_EXTRA_HOSTS so Caddy internal certs include your public IP or DNS name

Server configuration

• config/.env is loaded with godotenv.Overload: keys present in the file override the same MARCHAT_* names already set in the process environment at startup (documented in env.example, README, ARCHITECTURE)

Client CLI

• If --server and --username are set (and --admin-key when --admin), the profile picker is skipped
• With --e2e and no --keystore-passphrase, the client prompts once for the keystore passphrase (hidden input via golang.org/x/term), unless --non-interactive (then --keystore-passphrase is required on the command line)
• --server values are trimmed of stray straight or curly quotes before dial
• Global E2E key remains MARCHAT_GLOBAL_E2E_KEY in the environment (there is no --e2e-key flag)

Build and helper scripts

• scripts/build-linux.sh: local Linux (or cross-compile via GOOS/GOARCH) with the same ldflags pattern as build-windows.ps1
• scripts/connect-local-wss.sh and updates to scripts/connect-local-wss.ps1 for local Caddy + E2E using config/.env

Documentation

• README: links to QUICKSTART.md, ARCHITECTURE.md, PROTOCOL.md, and the Caddy guide; Recent releases list tightened
• SECURITY.md, install.ps1, install.sh, build-release.ps1, scripts/build-*.ps1, scripts/build-linux.sh, and release workflow defaults set to v0.10.0-beta.3

Assets

• marchat-v0.10.0-beta.3-linux-amd64.zip
• marchat-v0.10.0-beta.3-linux-arm64.zip
• marchat-v0.10.0-beta.3-windows-amd64.zip
• marchat-v0.10.0-beta.3-darwin-amd64.zip
• marchat-v0.10.0-beta.3-darwin-arm64.zip
• marchat-v0.10.0-beta.3-android-arm64.zip

Full Changelog: v0.10.0-beta.2...v0.10.0-beta.3

Breaking changes

• None for WebSocket protocol or database schema

Migration guide

• Binaries: use v0.10.0-beta.3 archives or install.ps1 / install.sh defaults
• Server: restart after upgrading so Overload semantics apply; align config/.env with whether you want the file or the shell to win for overlapping keys
• Caddy / WSS: copy deploy/caddy/proxy.env.example to deploy/caddy/proxy.env if remote clients connect by public IP or hostname; recreate the Caddy container after edits
• Remote users: set MARCHAT_GLOBAL_E2E_KEY in the environment; use --e2e and keystore passphrase (flag or prompt)

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.10.0-beta.3
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.10.0-beta.2

v0.10.0-beta.2

Released: 30 Mar 2026
Commit: 9fc161e

CLI diagnostics

• marchat-client and marchat-server support -doctor and -doctor-json to print a structured summary of environment variables, resolved config paths, and related health hints, then exit (no server listen / no TUI)
• JSON mode is intended for scripts and automation; human-readable mode is the default

Build & release tooling

• build-release.ps1 sets CGO_ENABLED=0 for release builds so cross-compilation stays consistent with the Docker image (static Linux binaries without CGO SQLite)

Dependencies

• modernc.org/sqlite updated from 1.47.0 to 1.48.0 (Dependabot)

Docker & Compose

• docker-compose.yml continues to set only MARCHAT_PORT and MARCHAT_DB_PATH; you supply MARCHAT_ADMIN_KEY and MARCHAT_USERS yourself (README documents using a gitignored .env plus ${VAR} references in compose)
• Runtime image runs the entrypoint as root long enough to chown /marchat and /data, then starts the server as the marchat user via su-exec — named volumes mounted at /data work with MARCHAT_DB_PATH=/data/marchat.db
• entrypoint.sh is normalized for Unix (LF) line endings so images built on Windows do not fail with a bad shebang

Documentation

• README: expanded v0.10.0-beta.2 highlights; refreshed aggregate LOC and test coverage callouts where reported; trimmed duplicate diagnostics wording under the v0.10.0-beta.1 feature block now that -doctor ships as its own section
• SECURITY.md, install.ps1, install.sh, build-release.ps1, and release workflow defaults aligned to v0.10.0-beta.2

Assets

• marchat-v0.10.0-beta.2-linux-amd64.zip
• marchat-v0.10.0-beta.2-linux-arm64.zip
• marchat-v0.10.0-beta.2-windows-amd64.zip
• marchat-v0.10.0-beta.2-darwin-amd64.zip
• marchat-v0.10.0-beta.2-darwin-arm64.zip
• marchat-v0.10.0-beta.2-android-arm64.zip

Full Changelog: v0.10.0-beta.1...v0.10.0-beta.2

Breaking changes

• None for protocol or database schema

Migration guide

• Binaries: download the v0.10.0-beta.2 archives (or use install.ps1 / install.sh, which default to this version)
• Docker Compose: add MARCHAT_ADMIN_KEY and MARCHAT_USERS to the service environment (README shows a .env + ${VAR} pattern); the sample compose file does not embed secrets
• Docker named volume at /data: no manual chown on the host should be required; upgrade to this image and keep your existing volume mount
• Troubleshooting: run marchat-server -doctor or marchat-client -doctor on the host where you deploy to verify paths and env before starting the full process

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.10.0-beta.2
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.10.0-beta.1

v0.10.0-beta.1

Released: 24 Mar 2026
Commit: e485eb7

Message Management:

• Edit messages with :edit <id> <new text> — updates in-place for all connected clients
• Delete messages with :delete <id> — marks as deleted, shown as strikethrough
• Pin important messages with :pin <id> and view them with :pinned
• Search message history with :search <query>
• Messages now display unique IDs for referencing

Reactions:

• React to any message with :react <id> <emoji>
• Shorthand aliases for quick input: +1, heart, fire, party, laugh, sad, eyes, 100, check, x
• Reactions display inline below messages with aggregated counts

Direct Messages:

• Private conversations via :dm <user> <message>
• DM messages routed only to the recipient, displayed with a DM indicator
• Case-insensitive username matching

Channels:

• Multiple chat rooms with :join <channel> and :leave
• List active channels and user counts with :channels
• Messages scoped to the current channel
• Default general channel on connect

Typing Indicators:

• Real-time "user is typing..." display
• Automatic timeout after inactivity

Read Receipts:

• Optional read receipt broadcasting
• Toggle with :readreceipts

E2E Encrypted File Transfers:

• File uploads/downloads now support end-to-end encryption via EncryptRaw/DecryptRaw
• Uses the existing ChaCha20-Poly1305 session key

Client Refactor:

• Split monolithic client/main.go (was 4400+ lines) into focused modules:
  • render.go — message rendering, emoji handling, hyperlinks, code blocks
  • commands.go — command definitions, help text, admin/plugin/DB actions
  • hotkeys.go — key bindings and shortcut definitions
  • websocket.go — WebSocket connection, encryption, message delivery
  • notification_manager.go — bell, desktop, and focus-mode notifications
• Removed orphaned code and unused fields

Plugin System Wiring:

• Full plugin lifecycle: init handshake, message forwarding, user list updates, command routing
• Plugin store UI with install/uninstall/list commands
• License validation and enforcement for commercial plugins
• Download timeout protection and secure file handling

Server Enhancements:

• Channel-aware message broadcasting
• DM routing with recipient-only delivery
• Message edit/delete/pin persistence in SQLite (edited, deleted, pinned columns)
• WebSocket message rate limiting
• getChannelUsers API for channel membership queries

UX Improvements:

• Connection status indicator in the UI
• @mention tab completion
• Unread message count display
• Multi-line input via Alt+Enter / Ctrl+J (with paste detection)
• Chat history export with :export
• Notification system with configurable levels, quiet hours, and focus mode

CI/CD & Infrastructure:

• Pinned all third-party GitHub Actions to commit SHAs (Node.js 24 versions)
• Added docker-compose.yml for local development
• Bumped modernc.org/sqlite from 1.46.1 to 1.47.0

Testing:

• Added 40+ new test cases across client, server, and crypto packages
• New tests for: message rendering (edited/deleted/DM/reactions), hub channel management, DM broadcasting, EncryptRaw/DecryptRaw round-trips, emoji alias resolution, new message type constants, serialization
• Overall test coverage: 34.1% (up from 33.9%)

Documentation:

• Updated README with all new commands, keyboard shortcuts, features, and troubleshooting
• Rewrote ARCHITECTURE.md to reflect client module split, new server features, extended protocol types, and updated DB schema
• Updated PROTOCOL.md with all new message types and emoji alias documentation
• Updated TESTING.md with current coverage numbers and new test descriptions
• Updated ROADMAP.md with completed features and revised future phases
• Updated NOTIFICATIONS.md to reflect implemented DM support

Assets:

• marchat-v0.10.0-beta.1-linux-amd64.zip
• marchat-v0.10.0-beta.1-linux-arm64.zip
• marchat-v0.10.0-beta.1-windows-amd64.zip
• marchat-v0.10.0-beta.1-darwin-amd64.zip
• marchat-v0.10.0-beta.1-darwin-arm64.zip
• marchat-v0.10.0-beta.1-android-arm64.zip

Full Changelog: v0.9.0-beta.6...v0.10.0-beta.1

Breaking Changes:

• New WebSocket message types added (edit, delete, typing, reaction, read_receipt, pin, search, dm, channel_join, channel_leave, list_channels) — older clients will ignore unknown types gracefully
• server/schema.sql removed; schema is now embedded in Go code

Migration Guide:

• No configuration changes required for basic usage
• Existing keystores are fully compatible — no re-initialization needed
• New features (channels, DMs, reactions, etc.) work out of the box with no server-side config
• Database schema auto-migrates on server startup (adds edited, deleted, pinned columns)
• Note: Messages that were edited while encrypted under a previous build may show decryption errors on reconnect. This is a known edge case from a bug fixed in this release; newly edited encrypted messages will decrypt correctly going forward
• Multi-line input requires a terminal that supports Alt+Enter (some Windows terminals may need Ctrl+J instead)
• Binary users: download the new release for all new features

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.10.0-beta.1
# or use latest tag
docker pull codecodesxyz/marchat:latest

v0.9.0-beta.6

v0.9.0-beta.6

Released: 19 Mar 2026
Commit: 9b93f79

Security:

• Rebuilt with Go 1.25.8 to address CVE-2026-25679 (High, 7.5), CVE-2026-27142 (Medium, 6.1), CVE-2026-27139 (Low, 2.5)

Dependencies:

• Bumped golang.org/x/crypto from 0.48.0 to 0.49.0
• Bumped golang.org/x/sys from 0.41.0 to 0.42.0
• Bumped golang.org/x/text from 0.34.0 to 0.35.0
• Bumped golang.org/x/sync from 0.19.0 to 0.20.0
• Bumped modernc.org/sqlite from 1.45.0 to 1.46.1

Documentation Updates:

• README, installers, and build scripts now reference v0.9.0-beta.6 assets

Assets:

• marchat-v0.9.0-beta.6-linux-amd64.zip
• marchat-v0.9.0-beta.6-linux-arm64.zip
• marchat-v0.9.0-beta.6-windows-amd64.zip
• marchat-v0.9.0-beta.6-darwin-amd64.zip
• marchat-v0.9.0-beta.6-darwin-arm64.zip
• marchat-v0.9.0-beta.6-android-arm64.zip

Full Changelog: v0.9.0-beta.5...v0.9.0-beta.6

Breaking Changes:

• None

Migration Guide:

• No configuration changes required
• Docker users: pull the latest image to pick up Go 1.25.8 security fixes
• Binary users: download the new release to get the updated Go runtime

Docker Image

A multi-architecture Docker image (linux/amd64, linux/arm64) is available on Docker Hub:

docker pull codecodesxyz/marchat:v0.9.0-beta.6
# or use latest tag
docker pull codecodesxyz/marchat:latest