Consume the duration text token by token instead of validating the
whole string with a nested-quantifier regex, which could backtrack
exponentially on crafted input.
New listNotificationProfiles command to show the notification profiles
of the account and the current manual override, and a new
setNotificationProfile command to manually turn a profile on for a
duration or until a point in time, turn it off, or clear the manual
override. The override is written to the account storage record and
synced to the other devices, the same way the official clients do it.
Durations accept compact forms (90m, 1h37m), words (2 hours 30 minutes),
h:mm and ISO-8601. End times accept times of day, dates, ISO timestamps,
unix timestamps and "forever".
Notification profiles are stored as their own record type in the
storage service. Until now they were treated as unknown records, which
also meant they were dropped from the manifest on every force push.
Store them locally in a new notification_profile table and handle them
like the other synced record types (sticker packs in particular), so
they survive force pushes and can be read locally.
* Show and enforce the terminated state of a group
A group admin can permanently terminate a group. Afterwards the group is
read-only for everyone, not even an admin can send messages or start calls;
members keep access to the existing history. Other clients silently drop
messages sent to a terminated group.
Read the DecryptedGroup.terminated flag through GroupInfo.isTerminated() and:
- surface it in listGroups (json and plain text) and as the DBus IsTerminated
group property
- refuse to send to a terminated group locally (messages, reactions, typing and
group stories) rather than send one that other clients ignore
- drop incoming messages addressed to a terminated group
* Add terminateGroup command to terminate a group for everyone
Let a group admin permanently terminate a GroupV2 group via the
TerminateGroupAction (Groups.proto field 28, change epoch 7) the pinned library
already exposes as GroupsV2Operations.createTerminateGroup().
- GroupV2Helper.terminateGroup builds and commits the change
- GroupHelper.terminateGroup resolves/refreshes the group (v2 only), sends the
update to members and syncs storage, with the same conflict-retry as
updateGroup
- exposed through Manager.terminateGroup, the terminateGroup CLI/JSON-RPC command
and the DBus Group.terminateGroup method
---------
Co-authored-by: FailSpy <FailSpy@users.noreply.github.com>
* Add group story support to core library layer
Extend Manager.sendStory() with an optional GroupId parameter and add
SendHelper.sendGroupStoryMessage() for endorsement-aware group story
delivery, laying the groundwork for group story support (task 1 of 4).
The existing My Story code path is unchanged.
* Add --group-id support to SendStoryCommand
Passes an optional GroupId through to Manager.sendStory so stories can
be posted to a group instead of only My Story, and surfaces
GroupNotFoundException / NotAGroupMemberException as user errors.
* Update stubs for 3-parameter sendStory and add empty-recipient guard
Updates DbusManagerImpl and StubManager (in SubscribeCallEventsTest) to
match the new 3-parameter sendStory signature: (String attachment,
boolean allowsReplies, Optional<GroupId> groupId).
Also includes the empty-recipient guard added after Task 1 review to
prevent stories from being sent to groups where the user is the only member.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MR2KF56Qcf9qNH1URj3XWs
* Document group story support in man page and changelog
- Add --group-id (-g) option to sendStory command in man page
- Update CHANGELOG to mention group story support via --group-id
- Maintain alphabetical order of options in sendStory section
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MR2KF56Qcf9qNH1URj3XWs
* Address review findings: endorsement safety and error handling
- Filter group story recipients by ACI type and endorsement availability
to prevent ClassCastException and NPE on edge cases
- Add empty-recipient guard after endorsement filtering
- Skip known-unregistered recipients before address resolution, matching
the pattern from sendGroupMessageInternal
- Add debug logging when recipients are filtered out
- Fix redundant error message prefixing in SendStoryCommand
- Add .superpowers/ to .gitignore
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MR2KF56Qcf9qNH1URj3XWs
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Fix HTTP handler to accept ACI/UUID account parameter in SSE endpoint
MultiAccountManagerImpl.getManager() only looked up accounts by phone
number, causing HTTP 400 errors when the SSE events endpoint was called
with ?account=<ACI-UUID> (e.g., cc528f93-527e-4566-8c62-d12dc99dbce0).
Changes:
- SignalAccountFiles: Add initManagerByAci() method for ACI-based lookup
- MultiAccountManagerImpl: getManager() now tries ACI lookup when
phone number lookup fails
- HttpServerHandler: getManagerFromQuery() falls back to returning all
managers when the specific account identifier is not found (instead of
HTTP 400)
* Fix SSE endpoint for UUID account parameter & preserve '+' in phone numbers
Three interrelated fixes for the HTTP SSE endpoint:
1. **SignalAccountFiles** — Replace ACI.parseOrThrow() with UUID-string
lookup from accountsStore.getAllAccounts(). The old approach failed when
a raw UUID string (from URL query param) was passed. Added
getAccountNumberByAci() helper to reduce duplication.
2. **MultiAccountManagerImpl** — Catch IllegalArgumentException in
getManager() for both phone number and ACI lookup paths. Also check if
the UUID corresponds to an already-loaded manager before trying to
initByAci(), preventing OverlappingFileLockException when SSE requests
arrive with a UUID for an account that was loaded at startup.
3. **Util.getQueryMap()** — Preserve '+' characters in query parameter
values by escaping them before URLDecoder.decode(). Without this,
URLDecoder converts '+' to space, breaking phone numbers like
'+4915422389' which become ' 4915422389'.
* fix: address AsamK's review comments
- HttpServerHandler.getManagerFromQuery(): return null when account not
found instead of falling back to all managers (AsamK: 'should stay
return null here')
- MultiAccountManagerImpl.getManager(): use UuidUtil.isUuid() to branch
early on ACI vs phone number, eliminating the try-number-then-fallback
pattern (AsamK: 'check if identifier is a uuid first')
---------
Co-authored-by: Till L T <tilllt@users.noreply.github.com>
* Add sendStory method for posting file attachment stories to My Story
Adds Manager.sendStory(attachment, allowsReplies), which uploads a file
attachment, builds a SignalServiceStoryMessage, and sends it to all
registered, non-blocked, non-hidden contacts that haven't opted out of
seeing the user's story (Contact.hideStory), excluding self. SendHelper
gains sendStoryMessage(), which resolves recipient addresses and
unidentified access and delegates to
SignalServiceMessageSender.sendGroupStory() against
DistributionId.MY_STORY, following the same address/access resolution
pattern used for group sends. A sync transcript is sent afterwards via
sendStorySyncMessage() so linked devices see the story was posted.
This is core library plumbing only; no CLI command, stub
implementations, or documentation are added yet.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MR2KF56Qcf9qNH1URj3XWs
* Add sendStory command for posting stories via CLI and JSON-RPC
Implements SendStoryCommand to allow users to post stories through the
CLI and JSON-RPC interfaces. Command accepts an attachment file path
(required) and optional --no-replies flag to disable replies on the story.
Handles AttachmentInvalidException and IOException appropriately and
outputs results using SendMessageResultUtils.
Registered in Commands.java in alphabetical order.
* Add sendStory stubs to DbusManagerImpl and StubManager
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MR2KF56Qcf9qNH1URj3XWs
* Document sendStory in man page and changelog
* Validate story attachment MIME type and fix D-Bus stub
- Reject non-image/video attachments before uploading, since stories
only support image and video content
- Change DbusManagerImpl.sendStory to throw UnsupportedOperationException
to match the pattern used by all other unimplemented D-Bus methods
* Resolve recipients before uploading story attachment
Move recipient resolution ahead of the attachment upload so that an
empty contact list is caught early without wasting bandwidth on an
upload that would reach nobody.
* Address review feedback: fix hideStory filter and remove redundant sync
- Fix hideStory filter to require contact exists (!=null &&) instead of
permitting null contacts (==null ||), matching the intent of filtering
to contacts who haven't hidden stories
- Remove manual sendStorySyncMessage call, as the library's sendStory
already handles sync internally
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHzM2XLKQoX9iraEdhoh3h
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Without an initial flush(), the JVM HttpServer buffers all
output until the first flush() in the 15-second keep-alive loop.
Clients with shorter timeouts (e.g. 10 s) abort before receiving
any data.
Add a flush() call directly after creating ServerSentEventSender,
before the wait loop, so the HTTP 200 response and headers reach the
client immediately upon connection.
Adds regression test SseInitialFlushTest that verifies at least one
byte arrives within 2 seconds of connecting to GET /api/v1/events.
* Add distinct JSON-RPC error code for captcha rejection
Previously submitRateLimitChallenge mapped CaptchaRejectedException to
the generic USER_ERROR code (-1), making it indistinguishable from any
other user error (bad params, unknown command, etc.).
Introduce CaptchaRejectedErrorException and wire it to a new error code
(-6 / CAPTCHA_REJECTED_ERROR) throughout the JSON-RPC layer. Callers can
now reliably distinguish a rejected captcha token (user must obtain a
fresh token) from a network failure (transient, worth retrying) or a
generic argument error.
The CLI exit code for this path becomes 6, consistent with the existing
per-error-type exit code convention.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add exit code 6 to man page
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add OpenAPIDocs
* Remove the json prefix from the names
* Format file
* Rename models to schemas
* Add required = true to all the required attributes
* Add missing required = true schemas
* Deprecated fields are not required
* switch to micronout json generation
* Fix generator for JsonUnwrapped files
* Fix layout of manual schemas
* Pretty print the json files
* Remove @JsonProperty(required = true)
* Make references local
* Updated the readme
* Removed uneeded import
* Remove extra empty lines
* Clean readme
* Add docs depedency only when needed
* Revert uneeded changes
* Revert more changes
* Better formatting
* Simplified name
* fix: remove jsonunwrapped workaround by upgrading to micronaut-json-schema version 2.0.0-M6
* Simplified jsonSchemas task definition
* Updated readme with the new schemas path
* typo fixing
* Remove empty space from merge
* Surface retry-after seconds for plain rate-limit failures
libsignal-service's RateLimitException exposes retryAfterMilliseconds
for HTTP 413 responses, but signal-cli only forwarded retry-after for
ProofRequired (428) failures. Clients had no signal for when it was
safe to retry plain rate-limited sends, so every failed retry
potentially extended the server-side window.
SendMessageResult now carries an optional rateLimitRetryAfterSeconds,
populated from the upstream Optional<Long>. JsonSendMessageResult
exposes it for RATE_LIMIT_FAILURE type. Text output includes the
window when known. Aggregate RateLimitErrorException now carries the
real nextAttemptTimestamp (was hardcoded to 0).
Closes#1996.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address review: include proof-required retry-after and ceiling-round millis
Codex adversarial review flagged two issues in the phase 1 retry-after
plumbing:
* Aggregate retry-after ignored proof-required failures. Because
isRateLimitFailure is true for proof-required cases but
rateLimitRetryAfterSeconds was only populated from plain 413s, an
all-proof-required batch (or a mixed batch where the proof-required
delay was longer) could flow into outputResult() and produce a
RateLimitException(0), telling callers to retry immediately.
* Millisecond Retry-After values were truncated by integer division,
so 1..999ms became 0 and non-second-aligned values lost up to 999ms.
A retry suggested from the floored value can land before the
server's real deadline and re-trigger the limit.
SendMessageResult.from(...) now populates rateLimitRetryAfterSeconds
from either the proof-required seconds or the plain rate-limit ms
(converted via ceiling division), giving maxRateLimitRetryAfterSeconds
a single source of truth. JsonSendMessageResult.from(...) reads the
unified field. New millisToCeilingSeconds helper plus boundary test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Preserve source compat and document retry-after field change
Add a non-canonical 8-arg SendMessageResult constructor that delegates
to the canonical form with null retry-after. This keeps source
compatibility for any downstream code that constructs the record
directly (tests, mocks) without changing the canonical shape. Records
permit additional constructors alongside the canonical one.
Document the retryAfterSeconds meaning change in the CHANGELOG. The
field was previously populated only for proof-required failures; it
is now populated whenever the server sends a Retry-After header. The
canonical proof-required discriminator is still token != null.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
