Merge pull request #423 from ZoiteChat/macos-build

begin rebuild of macos build

.github/workflows/appimage-build.yml

@@ -30,10 +30,10 @@ jobs:
             gettext \
             libcanberra-dev libglib2.0-dev \
             libarchive-dev \
-            libgtk-3-dev libfontconfig1-dev libpango1.0-dev xvfb xauth \
+            libgtk-3-dev libfontconfig1-dev libpango1.0-dev xvfb xauth dbus-daemon at-spi2-core \
             libwayland-client0 libwayland-cursor0 libwayland-egl1 \
             libxkbcommon0 \
-            libgtk-3-bin libglib2.0-bin shared-mime-info gsettings-desktop-schemas \
+            libgtk-3-bin libglib2.0-bin glib-networking shared-mime-info gsettings-desktop-schemas \
             liblua5.4-dev libpci-dev libperl-dev libssl-dev libayatana-appindicator3-dev \
             perl python3 python3-minimal python3-dev python3-cffi mono-devel desktop-file-utils \
             breeze-gtk-theme \
@@ -57,7 +57,7 @@ jobs:
           ninja -C build
 
       - name: Test emoji catalog, font coverage and picker
-        run: xvfb-run -a meson test -C build --print-errorlogs "Emoji Data Tests" "Emoji Font Tests" "Emoji UI Tests"
+        run: xvfb-run -a dbus-run-session -- meson test -C build --print-errorlogs "Emoji Data Tests" "Emoji Font Tests" "Emoji UI Tests"
 
       - name: Install to AppDir
         run: |
@@ -135,6 +135,20 @@ jobs:
             cp -a /usr/lib/gtk-3.0/modules AppDir/usr/lib/gtk-3.0/
           fi
 
+          # HTTPS inline-image downloads use GSocketClient TLS on Linux.
+          # GLib provides the API, but TLS and system-proxy support live in
+          # loadable GIO modules shipped by glib-networking. Bundle those
+          # modules so the AppImage does not depend on the host copy.
+          gio_module_dir="$(pkg-config --variable=giomoduledir gio-2.0)"
+
+          test -n "$gio_module_dir"
+          test -f "${gio_module_dir}/libgiognutls.so"
+          install -d "AppDir${gio_module_dir}"
+          cp -a "${gio_module_dir}"/libgio*.so "AppDir${gio_module_dir}/"
+          gio-querymodules "AppDir${gio_module_dir}"
+          test -f "AppDir${gio_module_dir}/libgiognutls.so"
+          test -s "AppDir${gio_module_dir}/giomodule.cache"
+
       - name: Verify bundled plugins
         run: |
           set -eux

.github/workflows/macos-build.yml

@@ -0,0 +1,168 @@
+name: macOS build
+
+on:
+  workflow_dispatch:
+    inputs:
+      sign_and_notarize:
+        description: 'Sign with Developer ID and notarize using release credentials'
+        type: boolean
+        default: false
+  push:
+    branches: [master]
+    tags: ['v*']
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'plugins/**'
+      - 'data/**'
+      - 'tools/**'
+      - 'po/**'
+      - 'meson*'
+      - 'VERSION'
+      - 'packaging/macos/**'
+      - '.github/workflows/macos-build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
+      (github.event_name == 'workflow_dispatch' && !inputs.sign_and_notarize)
+    name: Native ${{ matrix.arch }} bundle
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      # Desktop capture can be unavailable on a runner image. Preserve the
+      # existing build gate and publish the separate visual-check outcome.
+      - name: Exercise IRC and capture the macOS application window
+        continue-on-error: true
+        timeout-minutes: 5
+        run: python3 packaging/macos/visual-smoke.py dist/ZoiteChat.app
+      - name: Upload screenshot and visual-check evidence
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-visual-check
+          path: dist/visual-check/
+          if-no-files-found: ignore
+          retention-days: 14
+      - name: Create artifact preserving the application signature
+        run: ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-${{ matrix.arch }}.zip
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}
+          path: dist/ZoiteChat-${{ matrix.arch }}.zip
+          if-no-files-found: error
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore
+
+  release:
+    name: Signed and notarized ${{ matrix.arch }} release
+    if: >-
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_dispatch' && inputs.sign_and_notarize && github.ref == 'refs/heads/master')
+    environment: macos-release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    env:
+      HOMEBREW_NO_AUTO_UPDATE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Validate release settings before building
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: python3 packaging/macos/release.py --check-config
+      - name: Install native dependencies
+        run: brew bundle --file packaging/macos/Brewfile
+      - name: Test packaging and release logic
+        run: python3 -m unittest discover -s packaging/macos/tests -v
+      - name: Build and test application
+        run: python3 packaging/macos/build.py --build-number '${{ github.run_number }}'
+      - name: Verify relocated startup
+        run: python3 packaging/macos/smoke.py dist/ZoiteChat.app
+      - name: Sign, notarize, staple and verify release
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGNING_IDENTITY: ${{ vars.MACOS_SIGNING_IDENTITY || secrets.MACOS_SIGNING_IDENTITY }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: >-
+          python3 packaging/macos/release.py
+          --app dist/ZoiteChat.app
+          --output dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          --diagnostics dist/notarization
+          --notary-timeout 60m
+      - name: Upload signed and notarized application
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-signed-notarized
+          path: dist/ZoiteChat-${{ matrix.arch }}-signed-notarized.zip
+          if-no-files-found: error
+      - name: Upload notarization diagnostics
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-notarization-log
+          path: dist/notarization/*.json
+          if-no-files-found: ignore
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: ZoiteChat-macos-${{ matrix.arch }}-release-build-logs
+          path: build-macos/meson-logs/
+          if-no-files-found: ignore

.github/workflows/windows-build.yml

@@ -69,6 +69,30 @@ jobs:
           Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.20.0-alpha.1/GTK3_Gvsbuild_zoitechat-2.20.0-alpha.1_x64.zip -OutFile deps\gtk-${{ matrix.arch }}.zip
           Expand-Archive -LiteralPath deps\gtk-${{ matrix.arch }}.zip -DestinationPath C:\gtk-build\gtk\x64\release -Force
 
+          # The GTK3 archive omits librsvg. Add only its renderer, loader and
+          # license from the companion release, keeping the GTK3 DLLs intact.
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.20.0-alpha.1/GTK4_Gvsbuild_zoitechat-2.20.0-alpha.1_x64.zip -OutFile deps\svg-runtime.zip
+          if ((Get-FileHash deps\svg-runtime.zip -Algorithm SHA256).Hash -ne 'fb657f9ebae3a6807defb15e66091d643a703ee66cb37488e3e11e5646f45adb') {
+            throw 'Unexpected SVG runtime archive checksum'
+          }
+          $svgArchive = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path deps\svg-runtime.zip))
+          try {
+            foreach ($name in @('bin/rsvg-2-2.dll', 'lib/gdk-pixbuf-2.0/2.10.0/loaders/pixbufloader_svg.dll', 'share/doc/librsvg/COPYING.LIB')) {
+              $entry = $svgArchive.GetEntry($name)
+              if ($null -eq $entry) { throw "Missing SVG runtime file: $name" }
+              $destination = Join-Path 'C:\gtk-build\gtk\x64\release' $name
+              New-Item -ItemType Directory -Path (Split-Path $destination) -Force | Out-Null
+              [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destination, $true)
+            }
+          }
+          finally { $svgArchive.Dispose() }
+          # This loads the module now, catching missing DLLs before the build.
+          & C:\gtk-build\gtk\x64\release\bin\gdk-pixbuf-query-loaders.exe --update-cache
+          if ($LASTEXITCODE -ne 0) { throw 'Could not generate the pixbuf loader cache' }
+          if (-not (Select-String -LiteralPath 'C:\gtk-build\gtk\x64\release\lib\gdk-pixbuf-2.0\2.10.0\loaders.cache' -SimpleMatch '"svg"')) {
+            throw 'SVG loader could not be loaded with the GTK3 runtime'
+          }
+
           Download-WithRetry -Url https://repo.msys2.org/mingw/x86_64/mingw-w64-x86_64-hicolor-icon-theme-0.18-1-any.pkg.tar.zst -OutFile deps\hicolor-icon-theme.pkg.tar.zst
           python -c "import tarfile,zstandard,pathlib;archive=pathlib.Path(r'deps\\hicolor-icon-theme.pkg.tar.zst');target=pathlib.Path(r'C:\\gtk-build\\gtk\\x64\\release');dctx=zstandard.ZstdDecompressor();f=archive.open('rb');reader=dctx.stream_reader(f);tf=tarfile.open(fileobj=reader,mode='r|');[tf.extract(m,path=target) for m in tf if m.name.startswith('mingw64/share/icons/hicolor/')];tf.close();reader.close();f.close()"
 
@@ -179,6 +203,7 @@ jobs:
         run: |
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat"
           set "PATH=%CD%\..\zoitechat-build\x64\rel;%PATH%"
+          set "GDK_PIXBUF_MODULE_FILE=%CD%\..\zoitechat-build\x64\rel\lib\gdk-pixbuf-2.0\2.10.0\loaders.cache"
           set "ZOITECHAT_EMOJI_FONT=%CD%\..\zoitechat-build\x64\rel\share\fonts\zoitechat\NotoColorEmoji.ttf"
           fc /b data\fonts\NotoColorEmoji.ttf "%ZOITECHAT_EMOJI_FONT%"
           if errorlevel 1 exit /b 1

.github/workflows/windows-msi-build.yml

@@ -0,0 +1,428 @@
+name: Windows MSI/MSIX Build
+
+on:
+  push:
+    branches:
+      - master
+      - 'release/**'
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  windows_msi_build:
+    runs-on: windows-2022
+
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+
+    strategy:
+      matrix:
+        platform: [x64]
+        arch: [x64]
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.14.3'
+          architecture: ${{ matrix.arch }}
+
+      - name: Install Dependencies
+        shell: pwsh
+        run: |
+          New-Item -Name "deps" -ItemType "Directory" -Force | Out-Null
+
+          python -m pip install --upgrade pip
+          python -m pip install cffi
+          python -m pip install zstandard
+
+          $ProgressPreference = 'SilentlyContinue'
+          function Download-WithRetry {
+            param(
+              [string]$Url,
+              [string]$OutFile,
+              [int]$MaxAttempts = 5,
+              [int]$InitialDelaySeconds = 2
+            )
+            for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+              try {
+                Invoke-WebRequest -Uri $Url -OutFile $OutFile -ErrorAction Stop
+                return
+              }
+              catch {
+                if ($attempt -eq $MaxAttempts) {
+                  throw
+                }
+                Start-Sleep -Seconds ($InitialDelaySeconds * [math]::Pow(2, $attempt - 1))
+              }
+            }
+          }
+
+          # The existing solution includes installer.vcxproj, so Inno Setup is
+          # still required to build the unmodified solution. This workflow does
+          # not publish that EXE; it packages the same staged rel tree as MSI/MSIX.
+          Download-WithRetry -Url https://github.com/jrsoftware/issrc/releases/download/is-6_7_1/innosetup-6.7.1.exe -OutFile deps\innosetup-unicode.exe
+          & deps\innosetup-unicode.exe /VERYSILENT | Out-Null
+
+          # Use the same GTK runtime as the existing Windows EXE workflow.
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.20.0-alpha.1/GTK3_Gvsbuild_zoitechat-2.20.0-alpha.1_x64.zip -OutFile deps\gtk-${{ matrix.arch }}.zip
+          Expand-Archive -LiteralPath deps\gtk-${{ matrix.arch }}.zip -DestinationPath C:\gtk-build\gtk\x64\release -Force
+
+          # The GTK3 bundle does not contain librsvg. Restore the renderer,
+          # pixbuf loader, and license from the matching GTK4 bundle. Do not
+          # replace the rest of the GTK3 runtime with GTK4 libraries.
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.20.0-alpha.1/GTK4_Gvsbuild_zoitechat-2.20.0-alpha.1_x64.zip -OutFile deps\svg-runtime.zip
+          if ((Get-FileHash deps\svg-runtime.zip -Algorithm SHA256).Hash -ne 'fb657f9ebae3a6807defb15e66091d643a703ee66cb37488e3e11e5646f45adb') {
+            throw 'Unexpected SVG runtime archive checksum'
+          }
+          $svgArchive = [System.IO.Compression.ZipFile]::OpenRead((Resolve-Path deps\svg-runtime.zip))
+          try {
+            foreach ($name in @('bin/rsvg-2-2.dll', 'lib/gdk-pixbuf-2.0/2.10.0/loaders/pixbufloader_svg.dll', 'share/doc/librsvg/COPYING.LIB')) {
+              $entry = $svgArchive.GetEntry($name)
+              if ($null -eq $entry) { throw "Missing SVG runtime file: $name" }
+              $destination = Join-Path 'C:\gtk-build\gtk\x64\release' $name
+              New-Item -ItemType Directory -Path (Split-Path $destination) -Force | Out-Null
+              [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destination, $true)
+            }
+          }
+          finally { $svgArchive.Dispose() }
+
+          # Ensure SVG remains loadable before compiling or packaging.
+          & C:\gtk-build\gtk\x64\release\bin\gdk-pixbuf-query-loaders.exe --update-cache
+          if ($LASTEXITCODE -ne 0) { throw 'Could not generate the pixbuf loader cache' }
+          if (-not (Select-String -LiteralPath 'C:\gtk-build\gtk\x64\release\lib\gdk-pixbuf-2.0\2.10.0\loaders.cache' -SimpleMatch '"svg"')) {
+            throw 'SVG loader could not be loaded with the GTK3 runtime'
+          }
+
+          Download-WithRetry -Url https://repo.msys2.org/mingw/x86_64/mingw-w64-x86_64-hicolor-icon-theme-0.18-1-any.pkg.tar.zst -OutFile deps\hicolor-icon-theme.pkg.tar.zst
+          python -c "import tarfile,zstandard,pathlib;archive=pathlib.Path(r'deps\\hicolor-icon-theme.pkg.tar.zst');target=pathlib.Path(r'C:\\gtk-build\\gtk\\x64\\release');dctx=zstandard.ZstdDecompressor();f=archive.open('rb');reader=dctx.stream_reader(f);tf=tarfile.open(fileobj=reader,mode='r|');[tf.extract(m,path=target) for m in tf if m.name.startswith('mingw64/share/icons/hicolor/')];tf.close();reader.close();f.close()"
+
+          Download-WithRetry -Url https://repo.msys2.org/mingw/x86_64/mingw-w64-x86_64-libarchive-3.8.6-1-any.pkg.tar.zst -OutFile deps\libarchive.pkg.tar.zst
+          python -c "import tarfile,zstandard,pathlib;archive=pathlib.Path(r'deps\\libarchive.pkg.tar.zst');target=pathlib.Path(r'C:\\gtk-build\\gtk\\x64\\release');dctx=zstandard.ZstdDecompressor();f=archive.open('rb');reader=dctx.stream_reader(f);tf=tarfile.open(fileobj=reader,mode='r|');[tf.extract(m,path=target) for m in tf if m.name.startswith(('mingw64/include/archive','mingw64/lib/libarchive','mingw64/bin/libarchive'))];tf.close();reader.close();f.close()"
+
+          if (Test-Path C:\gtk-build\gtk\x64\release\mingw64\share\icons\hicolor) {
+            New-Item -Path C:\gtk-build\gtk\x64\release\share\icons -ItemType Directory -Force | Out-Null
+            Copy-Item -Path C:\gtk-build\gtk\x64\release\mingw64\share\icons\hicolor -Destination C:\gtk-build\gtk\x64\release\share\icons\hicolor -Recurse -Force
+          }
+          if (Test-Path C:\gtk-build\gtk\x64\release\mingw64\include) {
+            New-Item -Path C:\gtk-build\gtk\x64\release\include -ItemType Directory -Force | Out-Null
+            Copy-Item -Path C:\gtk-build\gtk\x64\release\mingw64\include\archive* -Destination C:\gtk-build\gtk\x64\release\include -Recurse -Force
+          }
+          if (Test-Path C:\gtk-build\gtk\x64\release\mingw64\lib) {
+            New-Item -Path C:\gtk-build\gtk\x64\release\lib -ItemType Directory -Force | Out-Null
+            Copy-Item -Path C:\gtk-build\gtk\x64\release\mingw64\lib\libarchive* -Destination C:\gtk-build\gtk\x64\release\lib -Force
+          }
+          if (Test-Path C:\gtk-build\gtk\x64\release\mingw64\bin) {
+            New-Item -Path C:\gtk-build\gtk\x64\release\bin -ItemType Directory -Force | Out-Null
+            Copy-Item -Path C:\gtk-build\gtk\x64\release\mingw64\bin\libarchive*.dll -Destination C:\gtk-build\gtk\x64\release\bin -Force
+          }
+          if (Test-Path C:\gtk-build\gtk\x64\release\mingw64) {
+            Remove-Item -Path C:\gtk-build\gtk\x64\release\mingw64 -Recurse -Force
+          }
+
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.18.0-pre4/gendef20260315.7z -OutFile deps\gendef.7z
+          & 7z.exe x deps\gendef.7z -oC:\gtk-build
+
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.18.0-pre4/WinSparkle-20260315.7z -OutFile deps\WinSparkle.7z
+          & 7z.exe x deps\WinSparkle.7z -oC:\gtk-build\WinSparkle
+
+          Download-WithRetry -Url https://github.com/ZoiteChat/gvsbuild/releases/download/zoitechat-2.18.0-pre4/perl-5.42.0.1-${{ matrix.arch }}.7z -OutFile deps\perl-${{ matrix.arch }}.7z
+          & 7z.exe x deps\perl-${{ matrix.arch }}.7z -oC:\gtk-build\perl-5.42.0.1\${{ matrix.platform }}
+
+          $pyRoot = $env:pythonLocation
+          if (-not $pyRoot) { $pyRoot = & python -c "import sys; print(sys.prefix)" }
+
+          foreach ($pyDir in @("C:\gtk-build\python-3.14.3", "C:\gtk-build\python-3.14")) {
+            New-Item -Path $pyDir -ItemType Directory -Force | Out-Null
+            $target = Join-Path $pyDir "${{ matrix.platform }}"
+            if (Test-Path $target) { Remove-Item $target -Recurse -Force }
+            New-Item -Path $pyDir -Name "${{ matrix.platform }}" -ItemType Junction -Value $pyRoot | Out-Null
+          }
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.8.10'
+          architecture: ${{ matrix.arch }}
+
+      - name: Prepare Python 3.8
+        shell: pwsh
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install cffi
+
+          $pyRoot = $env:pythonLocation
+          if (-not $pyRoot) { $pyRoot = & python -c "import sys; print(sys.prefix)" }
+
+          foreach ($pyDir in @("C:\gtk-build\python-3.8.10", "C:\gtk-build\python-3.8")) {
+            New-Item -Path $pyDir -ItemType Directory -Force | Out-Null
+            $target = Join-Path $pyDir "${{ matrix.platform }}"
+            if (Test-Path $target) { Remove-Item $target -Recurse -Force }
+            New-Item -Path $pyDir -Name "${{ matrix.platform }}" -ItemType Junction -Value $pyRoot | Out-Null
+          }
+
+      - name: Build
+        shell: cmd
+        run: |
+          call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat"
+
+          set "PYTHON_DIR=C:\gtk-build\python-3.14.3\${{ matrix.platform }}"
+          if not exist "%PYTHON_DIR%\libs\python314.lib" (
+            echo Missing %PYTHON_DIR%\libs\python314.lib
+            dir "%PYTHON_DIR%\libs"
+            exit /b 1
+          )
+
+          set "PYTHON38_DIR=C:\gtk-build\python-3.8\${{ matrix.platform }}"
+          if not exist "%PYTHON38_DIR%\libs\python38.lib" (
+            echo Missing %PYTHON38_DIR%\libs\python38.lib
+            dir "%PYTHON38_DIR%\libs"
+            exit /b 1
+          )
+          if not exist "%PYTHON38_DIR%\Lib\site-packages\_cffi_backend.cp38*.pyd" (
+            echo Missing %PYTHON38_DIR%\Lib\site-packages\_cffi_backend.cp38*.pyd
+            exit /b 1
+          )
+
+          set "LIB=%PYTHON_DIR%\libs;%LIB%"
+          set "INCLUDE=%PYTHON_DIR%\include;%INCLUDE%"
+
+          powershell -NoProfile -ExecutionPolicy Bypass -Command "$archiveLib='C:\gtk-build\gtk\x64\release\lib\libarchive.lib'; if (-not (Test-Path $archiveLib)) { $archiveDll = Get-ChildItem 'C:\gtk-build\gtk\x64\release\bin\libarchive*.dll' | Select-Object -First 1; if ($archiveDll) { Push-Location 'C:\gtk-build\gtk\x64\release\lib'; & 'C:\gtk-build\gendef\gendef.exe' $archiveDll.FullName | Out-Null; $archiveDef = Get-ChildItem 'libarchive*.def' | Select-Object -First 1; if ($archiveDef) { & lib /def:$archiveDef.Name /machine:${{ matrix.platform }} /out:libarchive.lib | Out-Null }; Pop-Location } }"
+
+          msbuild win32\zoitechat.sln /m /verbosity:minimal /p:Configuration=Release /p:Platform=${{ matrix.platform }}
+          if errorlevel 1 exit /b 1
+
+          if not exist "..\zoitechat-build\${{ matrix.platform }}\rel\plugins\hcpython38.dll" (
+            echo hcpython38.dll was not built
+            exit /b 1
+          )
+          if not exist "..\zoitechat-build\${{ matrix.platform }}\rel\_cffi_backend.cp38*.pyd" (
+            echo _cffi_backend for Python 3.8 was not staged for the installer
+            exit /b 1
+          )
+
+      # Master added native emoji font staging and tests after the release
+      # branch split. Run these before packaging so MSI/MSIX use verified files.
+      - name: Test emoji catalog, font coverage and picker
+        shell: cmd
+        run: |
+          call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat"
+          set "PATH=%CD%\..\zoitechat-build\x64\rel;%PATH%"
+          set "GDK_PIXBUF_MODULE_FILE=%CD%\..\zoitechat-build\x64\rel\lib\gdk-pixbuf-2.0\2.10.0\loaders.cache"
+          set "ZOITECHAT_EMOJI_FONT=%CD%\..\zoitechat-build\x64\rel\share\fonts\zoitechat\NotoColorEmoji.ttf"
+          fc /b data\fonts\NotoColorEmoji.ttf "%ZOITECHAT_EMOJI_FONT%"
+          if errorlevel 1 exit /b 1
+          for %%T in (data font ui) do (
+            msbuild win32\emoji-tests.vcxproj /m /verbosity:minimal /p:Configuration=Release /p:Platform=x64 /p:EmojiTestKind=%%T
+            if errorlevel 1 exit /b 1
+            ..\zoitechat-build\x64\tests\emoji-%%T-tests.exe --tap
+            if errorlevel 1 exit /b 1
+          )
+
+      - name: Install WiX Toolset
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          # Keep this pinned. WiX v6 introduced OSMF terms and WiX v7 adds
+          # explicit EULA acceptance; do not silently accept new terms in CI.
+          dotnet tool install --tool-path .wix wix --version 5.0.2
+          if ($LASTEXITCODE -ne 0) { throw 'Failed to install WiX Toolset 5.0.2' }
+          & .\.wix\wix.exe --version
+          if ($LASTEXITCODE -ne 0) { throw 'WiX Toolset could not be executed' }
+
+      - name: Build MSI
+        id: build_msi
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $rawVersion = (Get-Content VERSION -Raw).Trim()
+          if ($rawVersion -notmatch '^(\d+)\.(\d+)\.(\d+)') {
+            throw "VERSION '$rawVersion' does not begin with an MSI-compatible major.minor.patch version"
+          }
+
+          # Keep the full development version in the filename, while MSI's
+          # ProductVersion is numeric (e.g. 2.20.0-dev -> 2.20.0).
+          $msiVersion = "$($Matches[1]).$($Matches[2]).$($Matches[3])"
+          $safeVersion = $rawVersion -replace '[^0-9A-Za-z._-]', '-'
+          $sourceDir = (Resolve-Path "..\zoitechat-build\${{ matrix.platform }}\rel").Path
+          $outputPath = Join-Path $PWD "ZoiteChat-${safeVersion}_${{ matrix.arch }}.msi"
+
+          if (-not (Test-Path (Join-Path $sourceDir 'zoitechat.exe'))) {
+            throw "Staged ZoiteChat executable is missing from $sourceDir"
+          }
+
+          & .\.wix\wix.exe build win32\wix\zoitechat.wxs `
+            -arch x64 `
+            -d "SourceDir=$sourceDir" `
+            -d "ProductVersion=$msiVersion" `
+            -out $outputPath
+          if ($LASTEXITCODE -ne 0) { throw 'WiX MSI build failed' }
+
+          if (-not (Test-Path $outputPath)) {
+            throw "Expected MSI was not created: $outputPath"
+          }
+
+          "path=$outputPath" >> $env:GITHUB_OUTPUT
+          "filename=$(Split-Path $outputPath -Leaf)" >> $env:GITHUB_OUTPUT
+
+      - name: Test MSI administrative extraction
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = '${{ steps.build_msi.outputs.path }}'
+          $adminImage = Join-Path $PWD 'msi-admin-image'
+          New-Item -ItemType Directory -Path $adminImage -Force | Out-Null
+
+          $arguments = "/a `"$msi`" /qn TARGETDIR=`"$adminImage`""
+          $process = Start-Process -FilePath msiexec.exe -ArgumentList $arguments -Wait -PassThru
+          if ($process.ExitCode -ne 0) {
+            throw "MSI administrative extraction failed with exit code $($process.ExitCode)"
+          }
+
+          foreach ($requiredFile in @(
+            'zoitechat.exe',
+            'hclua.dll',
+            'hcupd.dll',
+            'WinSparkle.dll',
+            'hcchecksum.dll',
+            'hcexec.dll',
+            'hcfishlim.dll',
+            'hcsysinfo.dll',
+            'system.png',
+            'hcperl.dll',
+            'hcpython3.dll',
+            'hcpython38.dll',
+            'NotoColorEmoji.ttf',
+            'OFL.txt'
+          )) {
+            $match = Get-ChildItem -Path $adminImage -Filter $requiredFile -File -Recurse | Select-Object -First 1
+            if ($null -eq $match) {
+              throw "Administrative image does not contain required normal-install file: $requiredFile"
+            }
+          }
+
+          foreach ($requiredPattern in @('_cffi_backend.cp314*.pyd', '_cffi_backend.cp38*.pyd')) {
+            $match = Get-ChildItem -Path $adminImage -Filter $requiredPattern -File -Recurse | Select-Object -First 1
+            if ($null -eq $match) {
+              throw "Administrative image does not contain required Python support file: $requiredPattern"
+            }
+          }
+
+          foreach ($requiredPythonFile in @('zoitechat.py', '_zoitechat.py', 'hexchat.py', 'xchat.py')) {
+            $match = Get-ChildItem -Path $adminImage -Filter $requiredPythonFile -File -Recurse |
+              Where-Object { $_.Directory.Name -eq 'python' } |
+              Select-Object -First 1
+            if ($null -eq $match) {
+              throw "Administrative image does not contain required Python bridge file: $requiredPythonFile"
+            }
+          }
+
+          foreach ($excludedFile in @(
+            'portable-mode',
+            'zoitechat-text.exe'
+          )) {
+            $match = Get-ChildItem -Path $adminImage -Filter $excludedFile -File -Recurse | Select-Object -First 1
+            if ($null -ne $match) {
+              throw "MSI incorrectly contains Inno custom/portable-only file: $excludedFile"
+            }
+          }
+
+      - name: Build MSIX
+        id: build_msix
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $rawVersion = (Get-Content VERSION -Raw).Trim()
+          if ($rawVersion -notmatch '^(\d+)\.(\d+)\.(\d+)') {
+            throw "VERSION '$rawVersion' does not begin with a Store-compatible major.minor.build version"
+          }
+
+          $versionParts = @(
+            [int]$Matches[1],
+            [int]$Matches[2],
+            [int]$Matches[3]
+          )
+          if ($versionParts[0] -eq 0) {
+            throw 'The Microsoft Store requires a non-zero major package version.'
+          }
+          foreach ($part in $versionParts) {
+            if ($part -lt 0 -or $part -gt 65535) {
+              throw "MSIX version component '$part' is outside the Store-supported 0-65535 range."
+            }
+          }
+
+          # Partner Center reserves the fourth field as 0. A -dev version
+          # is packaged as a valid 2.20.0.0, without changing VERSION.
+          $packageVersion = "$($versionParts[0]).$($versionParts[1]).$($versionParts[2]).0"
+          $safeVersion = $rawVersion -replace '[^0-9A-Za-z._-]', '-'
+          $sourceDir = (Resolve-Path "..\zoitechat-build\${{ matrix.platform }}\rel").Path
+          $outputPath = Join-Path $PWD "ZoiteChat-${safeVersion}_${{ matrix.arch }}.msix"
+
+          # Reserved ZoiteChat identity from the release branch. Adjust only
+          # if the Product identity page in Partner Center changes.
+          $identityName = 'deependtilde.ZoiteChat'
+          $publisher = 'CN=6C7766BB-6AC6-488B-A09E-E3F8E68E63E4'
+          $publisherDisplayName = 'deepend_tilde'
+          $artifactName = 'MSIX Store Package ${{ matrix.arch }}'
+
+          Write-Host "Building Store MSIX for identity: $identityName"
+
+          & .\win32\msix\build-msix.ps1 `
+            -SourceDir $sourceDir `
+            -OutputPath $outputPath `
+            -PackageVersion $packageVersion `
+            -IdentityName $identityName `
+            -Publisher $publisher `
+            -PublisherDisplayName $publisherDisplayName `
+            -SelfSign
+          if ($LASTEXITCODE -ne 0) {
+            throw 'MSIX build script failed'
+          }
+
+          if (-not (Test-Path $outputPath)) {
+            throw "Expected MSIX was not created: $outputPath"
+          }
+
+          "path=$outputPath" >> $env:GITHUB_OUTPUT
+          "filename=$(Split-Path $outputPath -Leaf)" >> $env:GITHUB_OUTPUT
+          "package_version=$packageVersion" >> $env:GITHUB_OUTPUT
+          "store_ready=true" >> $env:GITHUB_OUTPUT
+          "artifact_name=$artifactName" >> $env:GITHUB_OUTPUT
+
+      - name: Upload MSI Installer
+        id: upload_msi
+        uses: actions/upload-artifact@v6
+        with:
+          name: MSI Installer ${{ matrix.arch }}
+          path: ${{ steps.build_msi.outputs.path }}
+          if-no-files-found: error
+
+      - name: Attest MSI Installer (Artifact Attestation)
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: MSI Installer ${{ matrix.arch }}
+          subject-digest: sha256:${{ steps.upload_msi.outputs.artifact-digest }}
+
+      - name: Upload MSIX Package
+        id: upload_msix
+        uses: actions/upload-artifact@v6
+        with:
+          name: ${{ steps.build_msix.outputs.artifact_name }}
+          path: ${{ steps.build_msix.outputs.path }}
+          if-no-files-found: error
+
+      - name: Attest MSIX Package (Artifact Attestation)
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ steps.build_msix.outputs.artifact_name }}
+          subject-digest: sha256:${{ steps.upload_msix.outputs.artifact-digest }}

.gitignore

@@ -27,3 +27,9 @@ osx/.ZoiteChat.app
 *.dmg
 *.VC.db
 *.VC.opendb
+
+# Native macOS packaging output
+/build-macos*/
+/dist/
+/packaging/macos/__pycache__/
+/packaging/macos/tests/__pycache__/

VERSION

@@ -1 +1 @@
-2.19.0
+2.20.0-dev

data/misc/meson.build

@@ -2,6 +2,7 @@ appdir = join_paths(get_option('datadir'), 'applications')
 metainfodir = join_paths(get_option('datadir'), 'metainfo')
 mimedir = join_paths(get_option('datadir'), 'mime', 'packages')
 desktop_utils = find_program('desktop-file-validate', required: false)
+appstreamcli = find_program('appstreamcli', required: false)
 
 if get_option('gtk-frontend')
   if get_option('install-appdata')
@@ -13,7 +14,6 @@ if get_option('gtk-frontend')
       install_dir: metainfodir
     )
 
-    appstreamcli = find_program('appstreamcli', required: false)
     if appstreamcli.found()
       test('Validate net.zoite.Zoitechat.appdata.xml', appstreamcli,
         args: ['validate', zoitechat_appdata]

data/misc/net.zoite.Zoitechat.appdata.xml.in

@@ -29,6 +29,22 @@
     <id>zoitechat.desktop</id>
   </provides>
 <releases>
+<release date="2026-09-15" version="2.19.1">
+  <description>
+    <ul>
+      <li>Fixed /msg messages showing twice on servers using IRCv3 <code>echo-message</code>.</li>
+      <li>Fixed escaping a leading command slash so <code>//text</code> sends <code>/text</code> as normal chat.</li>
+      <li>Fixed automatic away clearing when sending messages on servers using <code>echo-message</code>.</li>
+      <li>Fixed other users' away status not updating until rejoining a channel when <code>away-notify</code> updates are missed.</li>
+      <li>Fixed private messages and <code>/me</code> actions being routed to the wrong window when using WeeChat's IRC relay, while preserving channel ACTION routing.</li>
+      <li>Fixed a Flatpak startup error caused by the D-Bus service still using the old HexChat app ID.</li>
+      <li>Fixed optional Windows 10 theme downloads in the Windows installer.</li>
+      <li>Fixed the GTK warning when switching from channel tabs to the channel tree.</li>
+      <li>Fixed GTK3 theme archive root detection so themes with an <code>index.theme</code> file are preferred correctly.</li>
+      <li>Fixed source-build configuration when plugin AppStream metadata installation is disabled, and corrected the minimum Meson version to 0.59.</li>
+    </ul>
+  </description>
+</release>
 <release date="2026-07-28" version="2.19.0">
   <description>
     <ul>

docs/README.md

@@ -33,10 +33,53 @@ Example:
         that is not visually indented
 ```
 
-## Read the Docs theme skin
+## HTML theme
 
-The HTML output keeps the existing `basicstrap` Sphinx theme, then applies the
+The `zoitechat` theme inherits Sphinx's built-in `basic` theme. It uses the
-ZoiteChat main-site skin from `_static/css/zoitechat-docs.css`.
+same compact layout, blue navigation, and system fonts as zoitechat.org.
+Appearance starts in System mode on each page. Light and Dark are available
+for the current page; no cookies or browser storage are used.
 
-Brand navigation links are set in `conf.py` through `html_context`, and the
+The theme's templates are in `_theme/zoitechat/`. Its readable CSS and
-header logo uses `_static/zoitechat-logo.svg`.
+JavaScript are in `_static/css/zoitechat-docs.css` and
+`_static/js/zoitechat-docs.js`. No minification, JavaScript package manager,
+external fonts, or CDN assets are required.
+
+Navigation URLs, including `zoite_atlas_url`, are configured through
+`html_context` in `conf.py`. The logo
+is `_static/zoitechat-logo.svg`. Standard Sphinx search, indexes, source
+links, anchors, translations, and previous/next links remain available.
+The HTML output also works as locally installed documentation; project-site
+links only access the network when clicked.
+
+Build from the repository root:
+
+```sh
+sphinx-build -b html docs docs/_build/html
+```
+
+Use a clean output directory when switching themes, so stale Basicstrap
+assets from an earlier build are not included in a package.
+
+## Debian packaging
+
+The active theme does not use the bundled Basicstrap, Bootstrap, jQuery,
+jQuery Cookie, Font Awesome, or icon fonts. Its font stack includes DejaVu
+Sans and DejaVu Sans Mono; no font files are bundled by the theme.
+
+Packagers may exclude `docs/_theme/basicstrap/` from the source package.
+The default theme continues to build without that directory. No pre-minified
+third-party assets need to be added or rebuilt for this theme.
+
+Build with the distribution's `python3-sphinx`. After installing the HTML
+into the package staging directory, use `dh_sphinxdoc` (or `dh --with
+sphinxdoc`) to replace Sphinx's standard JavaScript files with system
+symlinks. Include `${sphinxdoc:Depends}` in the package dependencies and
+`${sphinxdoc:Built-Using}` where required for generated assets. The custom
+`zoitechat-docs.js` remains a small, readable project source file.
+
+A built-in theme is still selectable with `-D html_theme=classic` if a
+packager needs a different layout. The old RST content has existing build
+diagnostics; changing the theme does not suppress or alter them.
+
+Shared website chrome is in `_static/css/zoitechat-site.css`, copied from the main site. Keep that readable stylesheet in sync when changing the shared header, navigation, typography, or colours.

docs/_static/css/zoitechat-site.css

@@ -0,0 +1,526 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/* Shared chrome copied from ZoiteChat/site assets/css/site.css (1df996a). */
+:root {
+    color-scheme: light;
+    --bg: #fff;
+    --surface: #fff;
+    --chrome: #f1f2f3;
+    --chrome2: #e3e5e7;
+    --text: #25282c;
+    --muted: #58616b;
+    --line: #bdc3c9;
+    --soft-line: #dce0e4;
+    --blue: #215a9e;
+    --link: #174f92;
+    --selection: #e6effa;
+    --success: #236741;
+    --code: #f2f4f6;
+    --shadow: none;
+    --mono: Consolas,"Liberation Mono",monospace;
+}
+
+html[data-theme=dark] {
+    color-scheme: dark;
+    --bg: #111416;
+    --surface: #191c1f;
+    --chrome: #25292d;
+    --chrome2: #30353a;
+    --text: #eef0f2;
+    --muted: #b2bbc4;
+    --line: #50575e;
+    --soft-line: #353c43;
+    --blue: #2865a8;
+    --link: #8dc0ff;
+    --selection: #233951;
+    --success: #92d5ab;
+    --code: #111518;
+    --shadow: none;
+}
+
+* {
+    box-sizing: border-box;
+}
+
+body {
+    margin: 0;
+    background: var(--bg);
+    color: var(--text);
+    font: 15px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif;
+}
+
+a {
+    color: var(--link);
+    text-underline-offset: 3px;
+}
+
+a:hover {
+    text-decoration: underline;
+}
+
+button, input, select {
+    font: inherit;
+}
+
+button, summary {
+    cursor: pointer;
+}
+
+img {
+    display: block;
+    max-width: 100%;
+    height: auto;
+}
+
+button, a, input, select, summary {
+    touch-action: manipulation;
+}
+
+:focus-visible {
+    outline: 3px solid var(--link);
+    outline-offset: 3px;
+}
+
+[hidden] {
+    display: none!important;
+}
+
+.sr-only {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip-path: inset(50%);
+    white-space: nowrap;
+    border: 0;
+}
+
+.skip-link {
+    position: absolute;
+    left: 12px;
+    top: -100px;
+    z-index: 10;
+    padding: 10px;
+    background: var(--surface);
+}
+
+.skip-link:focus {
+    top: 12px;
+}
+
+.topbar {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 20px;
+    padding: 0 0 16px;
+    background: var(--surface);
+    border-bottom: 1px solid var(--line);
+    border: 0;
+}
+
+.brand {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    color: var(--text);
+    text-decoration: none;
+}
+
+.brand img {
+    width: 38px;
+    height: 42px;
+}
+
+.brand strong {
+    font-size: 28px;
+    letter-spacing: -.8px;
+    font-weight: 650;
+}
+
+.brand small {
+    display: block;
+    font-size: 12px;
+    color: var(--muted);
+    line-height: 1.2;
+}
+
+.appearance {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    font-size: 11px;
+    color: var(--muted);
+}
+
+select {
+    border: 1px solid var(--line);
+    border-radius: 3px;
+    padding: 5px 8px;
+    background: var(--surface);
+    color: var(--text);
+}
+
+.navigation {
+    display: flex;
+    align-items: center;
+    justify-content: flex-start;
+    gap: 12px;
+    background: var(--chrome);
+    border-bottom: 1px solid var(--line);
+    padding: 0;
+    border: 1px solid var(--line);
+    border-radius: 0;
+}
+
+.nav-links {
+    display: flex;
+    align-items: stretch;
+    flex-wrap: wrap;
+    gap: 0;
+}
+
+.nav-links>a, .nav-menu summary {
+    display: flex;
+    align-items: center;
+    min-height: 36px;
+    padding: 6px 15px;
+    color: var(--text);
+    font-size: 13px;
+    text-decoration: none;
+    border-bottom: 0;
+}
+
+.nav-links>a[aria-current=page] {
+    color: #fff;
+    border-bottom-color: var(--blue);
+    font-weight: 500;
+    background: var(--blue);
+}
+
+.nav-links>a:hover, .nav-menu summary:hover {
+    background: var(--selection);
+}
+
+.nav-menu {
+    position: relative;
+}
+
+.nav-menu summary {
+    list-style: none;
+}
+
+.nav-menu summary::after {
+    content: "⌄";
+    margin-left: 9px;
+}
+
+.nav-menu summary::-webkit-details-marker {
+    display: none;
+}
+
+.nav-menu-panel {
+    position: absolute;
+    right: 0;
+    top: 100%;
+    z-index: 5;
+    min-width: 280px;
+    background: var(--surface);
+    border: 1px solid var(--line);
+    box-shadow: var(--shadow);
+    padding: 5px;
+}
+
+.nav-menu-panel a {
+    display: block;
+    padding: 10px 12px;
+    text-decoration: none;
+}
+
+.nav-menu-panel a:hover {
+    background: var(--selection);
+}
+
+.nav-menu-panel span {
+    display: block;
+    font-size: 12px;
+    color: var(--muted);
+}
+
+.site-main {
+    min-height: 0;
+}
+
+h1, h2, h3, p {
+    margin-top: 0;
+}
+
+h1 {
+    font-size: clamp(30px,3.9vw,46px);
+    line-height: 1.16;
+    letter-spacing: -1.5px;
+    font-weight: 650;
+    margin-bottom: 20px;
+}
+
+h2 {
+    font-size: 20px;
+    line-height: 1.3;
+    letter-spacing: 0;
+    margin-bottom: 12px;
+}
+
+h3 {
+    font-size: 16px;
+    line-height: 1.4;
+}
+
+p {
+    color: var(--text);
+    font-size: 14px;
+    line-height: 1.7;
+    margin-bottom: 15px;
+}
+
+.site-footer {
+    padding: 17px 0;
+    background: var(--surface);
+    border-top: 1px solid var(--line);
+}
+
+.footer-grid {
+    display: flex;
+    align-items: start;
+    justify-content: space-between;
+    gap: 20px;
+}
+
+.footer-copy {
+    font-size: 11px;
+    max-width: 62ch;
+    margin: 0;
+    color: var(--muted);
+}
+
+.footer-links {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 5px 14px;
+    max-width: 400px;
+    font-size: 11px;
+}
+
+@media (max-width:1000px) {
+.navigation {
+        padding: 0 15px;
+    }
+
+.nav-links>a, .nav-menu summary {
+        padding: 8px 10px;
+    }
+}
+
+@media (max-width:650px) {
+.topbar {
+        padding: 13px 16px;
+        gap: 8px;
+    }
+
+.brand strong {
+        font-size: 20px;
+    }
+
+.brand small {
+        font-size: 10px;
+    }
+
+.brand img {
+        width: 28px;
+        height: 31px;
+    }
+
+.appearance {
+        gap: 5px;
+    }
+
+.appearance>span {
+        display: none;
+    }
+
+.appearance select {
+        font-size: 12px;
+        max-width: 98px;
+    }
+
+.navigation {
+        padding: 0 6px;
+    }
+
+.nav-links {
+        gap: 0;
+    }
+
+.nav-links>a, .nav-menu summary {
+        min-height: 44px;
+        padding: 8px;
+        font-size: 12px;
+    }
+
+h1 {
+        font-size: 34px;
+        letter-spacing: -1px;
+    }
+
+.footer-grid {
+        display: grid;
+        gap: 20px;
+    }
+
+.site-footer {
+        padding: 20px 17px;
+    }
+
+.nav-menu-panel {
+        position: fixed;
+        right: 10px;
+        left: 10px;
+        top: auto;
+        min-width: 0;
+    }
+}
+
+@media (prefers-reduced-motion:reduce) {
+* {
+        scroll-behavior: auto!important;
+    }
+}
+
+.appearance select {
+    font-size: 12px;
+    padding: 3px 7px;
+}
+
+.nav-links>a:hover {
+    background: var(--selection);
+    color: var(--link);
+}
+
+h1 {
+    font-size: 28px;
+    font-weight: 600;
+    letter-spacing: -.5px;
+    line-height: 1.3;
+    margin: 0 0 16px;
+    max-width: none;
+}
+
+@media (max-width:1100px) {
+.navigation {
+        padding: 0;
+    }
+}
+
+@media (max-width:800px) {
+.nav-links>a, .nav-menu summary {
+        padding: 6px 10px;
+    }
+}
+
+@media (max-width:600px) {
+.topbar {
+        padding: 0 0 14px;
+    }
+
+.brand strong {
+        font-size: 25px;
+    }
+
+.brand img {
+        width: 32px;
+        height: 36px;
+    }
+
+.nav-links>a, .nav-menu summary {
+        padding: 7px 9px;
+        min-height: 38px;
+        font-size: 12px;
+    }
+
+.footer-grid {
+        display: block;
+    }
+
+.footer-links {
+        margin-top: 10px;
+        max-width: none;
+    }
+
+.site-footer {
+        padding: 14px 0;
+    }
+
+h1 {
+        font-size: 26px;
+    }
+}
+
+@media (prefers-color-scheme: dark) {
+:root:not([data-theme]) {
+        color-scheme: dark;
+        --bg: #111416;
+        --surface: #191c1f;
+        --chrome: #25292d;
+        --chrome2: #30353a;
+        --text: #eef0f2;
+        --muted: #b2bbc4;
+        --line: #50575e;
+        --soft-line: #353c43;
+        --blue: #2865a8;
+        --link: #8dc0ff;
+        --selection: #233951;
+        --success: #92d5ab;
+        --code: #111518;
+        --shadow: none;
+    }
+}
+
+.site-header, .site-main, .site-footer {
+    width: min(1040px, calc(100% - 48px));
+    margin-inline: auto;
+}
+
+.site-header {
+    margin-top: 32px;
+}
+
+.site-main {
+    padding-block: 28px 20px;
+}
+
+.site-header .topbar {
+    padding: 0 0 16px;
+}
+
+.site-header .navigation {
+    padding: 0;
+}
+
+@media (max-width: 600px) {
+.site-header, .site-main, .site-footer {
+        width: calc(100% - 30px);
+    }
+
+.site-header {
+        margin-top: 18px;
+    }
+
+.site-main {
+        padding-top: 23px;
+    }
+}
+
+/* Match the browser's heading defaults used by the main site. */
+h2, h3 { font-weight: bold; }
+h2 { margin-top: .83em; }
+h3 { margin-block: 1em; }

docs/_static/js/zoitechat-docs.js

@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+(() => {
+    'use strict';
+
+    const initialise = () => {
+        const picker = document.getElementById('theme-picker');
+        const preference = window.matchMedia('(prefers-color-scheme: dark)');
+
+        if (picker instanceof HTMLSelectElement) {
+            const applyTheme = () => {
+                const dark = picker.value === 'dark'
+                    || (picker.value === 'system' && preference.matches);
+                document.documentElement.dataset.theme = dark ? 'dark' : 'light';
+                document.querySelectorAll('meta[name="theme-color"]').forEach((meta) => {
+                    meta.setAttribute('content', dark ? '#111416' : '#ffffff');
+                });
+            };
+
+            // Follow the OS on every visit, including browser back/forward navigation.
+            const resetTheme = () => {
+                picker.value = 'system';
+                applyTheme();
+            };
+            picker.addEventListener('change', applyTheme);
+            preference.addEventListener('change', applyTheme);
+            window.addEventListener('pageshow', resetTheme);
+            resetTheme();
+        }
+
+        const navigation = document.getElementById('docs-navigation');
+        const compact = window.matchMedia('(max-width: 760px)');
+        if (navigation instanceof HTMLDetailsElement) {
+            const fitNavigation = () => { navigation.open = !compact.matches; };
+            compact.addEventListener('change', fitNavigation);
+            fitNavigation();
+        }
+    };
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', initialise, { once: true });
+    } else {
+        initialise();
+    }
+})();

docs/_theme/basicstrap/layout.html

@@ -209,6 +209,8 @@
     {%- endif %}
     <meta name="description" content="">
     <meta name="author" content="">
+    <meta name="theme-color" content="#eee5d3" media="(prefers-color-scheme: light)">
+    <meta name="theme-color" content="#161514" media="(prefers-color-scheme: dark)">
 
     {{ css() }}
     {%- if not embedded %}
@@ -260,8 +262,9 @@
         <nav class="site-nav" aria-label="Primary">
           <a href="https://zoitechat.org/">Home</a>
           <a href="https://zoitechat.org/addons.php">Addons</a>
+          <a href="https://zoitechat.org/announcements.php">Announcements</a>
           <a href="https://zoitechat.org/download.php">Download</a>
-          <a href="{{ pathto(master_doc) }}">Docs</a>
+          <a href="{{ pathto(master_doc) }}" aria-current="page">Docs</a>
           <a href="https://github.com/ZoiteChat/zoitechat" target="_blank" rel="noopener">GitHub</a>
           <details class="nav-menu">
             <summary>IRC Support</summary>
@@ -336,6 +339,7 @@
           <div class="footer-links">
             <a href="https://zoitechat.org/download.php">Download</a>
             <a href="https://zoitechat.org/addons.php">Addons</a>
+            <a href="https://zoitechat.org/announcements.php">Announcements</a>
             <a href="https://zoitechat.org/privacy.php">Privacy Policy</a>
             <a href="{{ pathto(master_doc) }}">Documentation</a>
             <a href="https://github.com/ZoiteChat/zoitechat" target="_blank" rel="noopener">Source code</a>

docs/_theme/zoitechat/globaltoc.html

@@ -0,0 +1,5 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+<nav class="global-toc" aria-label="{{ _('Documentation contents') }}">
+    <h2>{{ _('Contents') }}</h2>
+    {{ toctree(maxdepth=2, collapse=true, includehidden=true, titles_only=true) }}
+</nav>

docs/_theme/zoitechat/layout.html

@@ -0,0 +1,108 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% extends "basic/layout.html" %}
+{% set docs_root = root_doc|default(master_doc) %}
+
+{% block extrahead %}
+    {{ super() }}
+    <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
+    <meta name="theme-color" content="#111416" media="(prefers-color-scheme: dark)">
+{% endblock %}
+
+{% block body_tag %}<body id="top">{% endblock %}
+
+{% block header %}
+    <a class="skip-link" href="#main-content">{{ _('Skip to content') }}</a>
+    <header class="site-header">
+        <div class="topbar">
+            <a class="brand" href="{{ pathto(docs_root)|e }}">
+                <img src="{{ logo_url|default(pathto('_static/zoitechat-logo.svg', 1), true)|e }}" alt="" width="38" height="42">
+                <strong>{{ project|e }}</strong>
+            </a>
+            <label class="appearance" for="theme-picker">
+                <span>{{ _('Appearance') }}</span>
+                <select id="theme-picker" aria-label="{{ _('Documentation appearance') }}">
+                    <option value="system" selected>{{ _('System') }}</option>
+                    <option value="light">{{ _('Light') }}</option>
+                    <option value="dark">{{ _('Dark') }}</option>
+                </select>
+            </label>
+        </div>
+        <div class="navigation">
+            <nav class="nav-links" aria-label="{{ _('Primary') }}">
+                <a href="{{ zoite_site_url|e }}">{{ _('Home') }}</a>
+                <a href="{{ zoite_download_url|e }}">{{ _('Downloads') }}</a>
+                <a href="{{ zoite_addons_url|e }}">{{ _('Addons') }}</a>
+                <a href="{{ zoite_announcements_url|e }}">{{ _('Announcements') }}</a>
+                <a href="{{ pathto(docs_root)|e }}" aria-current="page">{{ _('Documentation') }}</a>
+                <a href="{{ zoite_atlas_url|e }}">{{ _('Atlas') }}</a>
+                <a href="{{ zoite_github_url|e }}" target="_blank" rel="noopener">{{ _('GitHub') }}</a>
+                <details class="nav-menu">
+                    <summary>{{ _('IRC support') }}</summary>
+                    <div class="nav-menu-panel" aria-label="{{ _('IRC support channels') }}">
+                        <a href="{{ zoite_irc_url|e }}" target="_blank" rel="noopener"><strong>{{ _('Zoite IRC') }}</strong><span>{{ _('Official support') }} · #zoitechat</span></a>
+                        <a href="{{ libera_irc_url|e }}" target="_blank" rel="noopener"><strong>{{ _('Libera.Chat') }}</strong><span>{{ _('Secondary support') }} · #zoitechat</span></a>
+                    </div>
+                </details>
+            </nav>
+        </div>
+    </header>
+{% endblock %}
+
+{% block relbar1 %}{% endblock %}
+{% block relbar2 %}{% endblock %}
+
+{% block content %}
+    <div class="docs-layout{% if not render_sidebar %} no-sidebar{% endif %}">
+        {% if render_sidebar %}
+            <aside class="docs-sidebar" aria-label="{{ _('Documentation navigation') }}">
+                <details class="docs-navigation" id="docs-navigation" open>
+                    <summary>{{ _('Documentation') }}</summary>
+                    <div class="sidebar-content">
+                        {% for sidebartemplate in sidebars %}
+                            {% include sidebartemplate %}
+                        {% endfor %}
+                    </div>
+                </details>
+            </aside>
+        {% endif %}
+        <main class="docs-content" id="main-content" tabindex="-1">
+            <div class="docs-location">
+                <nav aria-label="{{ _('Breadcrumbs') }}">
+                    <a href="{{ pathto(docs_root)|e }}">{{ _('Documentation') }}</a>
+                    {% for parent in parents %}
+                        <span aria-hidden="true">/</span> <a href="{{ parent.link|e }}">{{ parent.title }}</a>
+                    {% endfor %}
+                    {% if pagename != docs_root %}<span aria-hidden="true">/</span> <span>{{ title|striptags|e }}</span>{% endif %}
+                </nav>
+                <span class="docs-version">{{ release|e }}</span>
+            </div>
+
+            {% block body %}{% endblock %}
+            {% if prev or next %}
+                <nav class="page-relations" aria-label="{{ _('Related pages') }}">
+                    <div>
+                        {% if prev %}<small>{{ _('Previous') }}</small><a href="{{ prev.link|e }}" rel="prev">{{ prev.title }}</a>{% endif %}
+                    </div>
+                    <div>
+                        {% if next %}<small>{{ _('Next') }}</small><a href="{{ next.link|e }}" rel="next">{{ next.title }}</a>{% endif %}
+                    </div>
+                </nav>
+            {% endif %}
+        </main>
+    </div>
+{% endblock %}
+
+{% block footer %}
+    <footer class="site-footer">
+        <div class="footer-grid">
+            <p class="footer-copy">{{ project|e }} {{ _('documentation') }} · {{ release|e }}</p>
+            <nav class="footer-links" aria-label="{{ _('Footer navigation') }}">
+                <a href="{{ pathto(docs_root)|e }}">{{ _('Contents') }}</a>
+                <a href="{{ zoite_atlas_url|e }}">{{ _('Atlas') }}</a>
+                {% if hasdoc('search') %}<a href="{{ pathto('search')|e }}">{{ _('Search') }}</a>{% endif %}
+                {% if hasdoc('genindex') %}<a href="{{ pathto('genindex')|e }}">{{ _('Index') }}</a>{% endif %}
+                <a href="#top">{{ _('Back to top') }}</a>
+            </nav>
+        </div>
+    </footer>
+{% endblock %}

docs/_theme/zoitechat/localtoc.html

@@ -0,0 +1,7 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% if display_toc %}
+    <nav class="local-toc" aria-label="{{ _('On this page') }}">
+        <h2>{{ _('On this page') }}</h2>
+        {{ toc }}
+    </nav>
+{% endif %}

docs/_theme/zoitechat/searchbox.html

@@ -0,0 +1,10 @@
+{# SPDX-License-Identifier: GPL-2.0-or-later #}
+{% if pagename != "search" %}
+    <form class="docs-search" action="{{ pathto('search')|e }}" method="get" role="search">
+        <label for="docs-search-input">{{ _('Search documentation') }}</label>
+        <div class="search-inputs">
+            <input id="docs-search-input" type="search" name="q" placeholder="{{ _('Search documentation') }}" autocomplete="off" spellcheck="false">
+            <button type="submit">{{ _('Search') }}</button>
+        </div>
+    </form>
+{% endif %}

docs/_theme/zoitechat/theme.conf

@@ -0,0 +1,7 @@
+[theme]
+inherit = basic
+stylesheet = basic.css
+pygments_style = sphinx
+sidebars = searchbox.html, globaltoc.html, localtoc.html, sourcelink.html
+
+[options]

docs/changelog.rst

@@ -1,6 +1,20 @@
 ZoiteChat ChangeLog
 =================
 
+2.19.1 (2026-09-15)
+-------------------
+
+- Fixed ``/msg`` messages showing twice on servers using IRCv3 ``echo-message``.
+- Fixed escaping a leading command slash so ``//text`` sends ``/text`` as normal chat.
+- Fixed automatic away clearing when sending messages on servers using ``echo-message``.
+- Fixed other users' away status not updating until rejoining a channel when ``away-notify`` updates are missed.
+- Fixed private messages and ``/me`` actions being routed to the wrong window when using WeeChat's IRC relay, while preserving channel ACTION routing.
+- Fixed a Flatpak startup error caused by the D-Bus service still using the old HexChat app ID.
+- Fixed optional Windows 10 theme downloads in the Windows installer.
+- Fixed the GTK warning when switching from channel tabs to the channel tree.
+- Fixed GTK3 theme archive root detection so themes with an ``index.theme`` file are preferred correctly.
+- Fixed source-build configuration when plugin AppStream metadata installation is disabled, and corrected the minimum Meson version to 0.59.
+
 2.19.0 (2026-07-28)
 -------------------
 

docs/conf.py

@@ -99,7 +99,7 @@ trim_footnote_reference_space = True
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-html_theme = 'basicstrap'
+html_theme = 'zoitechat'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
@@ -127,13 +127,16 @@ html_context = {
     'zoite_site_url': 'https://zoitechat.org/',
     'zoite_download_url': 'https://zoitechat.org/download.php',
     'zoite_addons_url': 'https://zoitechat.org/addons.php',
+    'zoite_announcements_url': 'https://zoitechat.org/announcements.php',
+    'zoite_github_url': 'https://github.com/ZoiteChat/zoitechat',
+    'zoite_atlas_url': 'https://atlas.zoitechat.org/',
     'zoite_irc_url': 'https://zoite.net/webchat/?join=%23zoitechat',
     'libera_irc_url': 'https://web.libera.chat/#zoitechat',
 }
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
-html_logo = 'zoitechat-logo.svg'
+html_logo = '_static/zoitechat-logo.svg'
 
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
@@ -145,8 +148,9 @@ html_favicon = '_static/favicon.ico'
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = ['_static']
 
-# Main-site visual skin for Read the Docs/Sphinx HTML output.
+# Local, readable assets shared by hosted and offline HTML documentation.
-html_css_files = ['css/zoitechat-docs.css']
+html_css_files = ['css/zoitechat-docs.css', 'css/zoitechat-site.css']
+html_js_files = ['js/zoitechat-docs.js']
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.

meson.build

@@ -1,6 +1,6 @@
 project('zoitechat', 'c',
   version: run_command('cat', 'VERSION', check: true).stdout().strip(),
-  meson_version: '>= 0.55.0',
+  meson_version: '>= 0.59.0',
   default_options: [
     'c_std=c17',
     'buildtype=debugoptimized',
@@ -13,7 +13,9 @@ gnome = import('gnome')
 cc = meson.get_compiler('c')
 
 
-libgio_dep = dependency('gio-2.0', version: '>= 2.36.0')
+# The relocatable macOS runtime sets the GIO TLS database explicitly.
+libgio_dep = dependency('gio-2.0',
+  version: host_machine.system() == 'darwin' ? '>= 2.60.0' : '>= 2.36.0')
 libgmodule_dep = dependency('gmodule-2.0')
 
 libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
@@ -29,7 +31,13 @@ else
                           required: get_option('tls'))
 endif
 
+gtk_mac_dep = disabler()
+if host_machine.system() == 'darwin' and get_option('gtk-frontend')
+  gtk_mac_dep = dependency('gtk-mac-integration-gtk3', required: get_option('mac-integration'))
+endif
+
 config_h = configuration_data()
+config_h.set('HAVE_GTK_MAC', host_machine.system() == 'darwin' and gtk_mac_dep.found())
 config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
 config_h.set_quoted('PACKAGE_NAME', meson.project_name())
 config_h.set_quoted('GETTEXT_PACKAGE', 'zoitechat')
@@ -99,6 +107,12 @@ global_cflags = [
   '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_36',
   '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_36',
 ]
+if host_machine.system() == 'darwin'
+  global_cflags = [
+    '-DGLIB_VERSION_MAX_ALLOWED=GLIB_VERSION_2_60',
+    '-DGLIB_VERSION_MIN_REQUIRED=GLIB_VERSION_2_60',
+  ]
+endif
 test_cflags = [
   '-funsigned-char',
   '-Wno-conversion',
@@ -159,6 +173,10 @@ foreach ldflag : test_ldflags
     global_ldflags += ldflag
   endif
 endforeach
+if host_machine.system() == 'darwin'
+  # Leave room for install_name_tool to rewrite packaged dependencies.
+  global_ldflags += '-Wl,-headerpad_max_install_names'
+endif
 add_project_link_arguments(global_ldflags, language: 'c')
 
 subdir('src')

meson_options.txt

@@ -23,6 +23,10 @@ option('appindicator', type: 'feature', value: 'auto',
   description: 'Use Ayatana/AppIndicator-based tray backend for GTK frontend (non-Windows only)'
 )
 
+# macOS only; ignored by other platforms.
+option('mac-integration', type: 'feature', value: 'auto',
+  description: 'Native macOS menu bar, Dock and application lifecycle')
+
 # Install options
 option('dbus-service-use-appid', type: 'boolean', value: false,
   description: 'Rename dbus service to match app-id, required for Flatpak'

packaging/macos/Brewfile

@@ -0,0 +1,15 @@
+brew "meson"
+brew "ninja"
+brew "pkgconf"
+brew "python"
+brew "gettext"
+brew "gtk+3"
+brew "gtk-mac-integration"
+brew "libarchive"
+brew "openssl@3"
+brew "lua"
+brew "librsvg"
+brew "glib-networking"
+brew "adwaita-icon-theme"
+brew "enchant"
+brew "ca-certificates"

packaging/macos/README.md

@@ -0,0 +1,371 @@
+# Native macOS build and distribution
+
+This builds GTK3 with the native Quartz backend, macOS menus/Dock integration,
+UserNotifications, translations, bundled emoji, TLS, image loaders and supported
+native plugins. It creates a self-contained `ZoiteChat.app`; end users do not
+need Homebrew, XQuartz or Python. No system-wide ZoiteChat installation occurs.
+
+The source changes are conditional on Darwin. Windows and Linux retain their
+existing notification backends and feature defaults. This adds a separate
+macOS workflow; it does not replace existing workflows.
+
+## 1. Install build prerequisites
+
+Use a Mac with a currently supported macOS release and native Homebrew. On Apple
+Silicon, use ARM Homebrew (`/opt/homebrew`), not Intel Homebrew under Rosetta.
+Intel builds use Intel Homebrew (`/usr/local`). Install Xcode command-line tools
+and Homebrew from https://brew.sh if absent. Full current Xcode is recommended
+for distribution and needed to meet the current App Store submission SDK rules.
+
+```sh
+xcode-select --install
+# Run once if the command-line tools are not installed; let installation finish.
+
+cd /path/to/zoitechat
+brew bundle --file packaging/macos/Brewfile
+python3 packaging/macos/build.py
+open dist/ZoiteChat.app
+```
+
+The build compiles the app, runs its Meson tests, stages an installation within
+`build-macos/macos-stage`, bundles and rewrites every non-system Mach-O dependency,
+creates the icon and plist, audits the result, and signs it ad hoc for local use.
+It refuses to overwrite an existing output app. For another build, choose a new
+output path, or explicitly delete your old generated app before rebuilding:
+
+```sh
+python3 packaging/macos/build.py --output dist/ZoiteChat-test2.app --build-number 2
+```
+
+The same build directory can be reconfigured. Use a different build directory
+for another architecture or the experimental store variant. Do not change
+architectures within one Meson build directory.
+
+Homebrew packages change over time; this is a repeatable procedure, not a
+bit-for-bit reproducible dependency lock. The bundle records dependency versions
+in `Contents/Resources/homebrew-dependencies.json`. Retain that record and the
+release's source commit. For a reproducible release, archive the exact dependency
+sources and build them in a controlled prefix, or maintain pinned Homebrew formulae.
+
+## 2. Verify portability and behavior
+
+```sh
+python3 -m unittest discover -s packaging/macos/tests -v
+python3 packaging/macos/bundle.py audit dist/ZoiteChat.app
+python3 packaging/macos/smoke.py dist/ZoiteChat.app
+```
+
+The smoke check copies the app to a path containing spaces, verifies its signature,
+runs `--version`, and keeps an isolated GUI process alive for ten seconds without
+connecting to IRC. It tests startup, not interaction or long-running stability.
+
+### Screenshots and a loopback IRC check without owning a Mac
+
+The ordinary ARM and Intel workflow jobs also run a separate visual check.
+After pushing this change to a pull request, open the new **macOS build** run
+and download `ZoiteChat-macos-arm64-visual-check` and
+`ZoiteChat-macos-x86_64-visual-check` from **Artifacts**. Each contains:
+
+- `zoitechat.png`: the actual running application's window on that architecture.
+- `result.json`: the checks completed, window dimensions, architecture and commit.
+- `irc.log`: the temporary loopback server's registration, channel and PING/PONG traffic.
+- `startup.log`: the application's startup diagnostics.
+
+The check copies the built app to a path containing spaces, verifies its
+signature, starts it with temporary settings, connects to a server bound only
+to `127.0.0.1`, joins `#ci-smoke`, receives sample text and verifies its PONG
+response. It captures the largest visible window owned by that app's process
+and rejects failed or nearly uniform captures. No public IRC server or account
+is used. The original application artifact is not modified.
+
+This is a supplemental check with `continue-on-error`: a green build alone
+does **not** mean the visual check passed. Inspect `result.json` for
+`"status": "passed"` and view the PNG. If the runner has no desktop or denies
+Screen Recording, the step reports failure and publishes diagnostics instead
+of claiming a screenshot. No signing secrets are needed. The check runs in
+the ordinary build job; it does not alter the release-signing job.
+
+It can also run on a Mac with a logged-in desktop:
+
+```sh
+python3 packaging/macos/visual-smoke.py dist/ZoiteChat.app --output dist/visual-check
+```
+
+Use a new output directory for each run. This verifies a narrow set of startup,
+IRC and rendering behavior; it does not test keyboard/clipboard interaction,
+TLS, notifications, Gatekeeper distribution, or long-running stability.
+
+The audit verifies the entire dependency closure, including GTK image/input
+modules, GIO TLS, Enchant providers, OpenSSL providers and ZoiteChat plugins. It
+fails on missing libraries, external symlinks/search paths, architecture mismatches
+or unresolved load commands. The minimum macOS version in the plist is derived
+from **all** bundled binaries, including Homebrew libraries. Lowering that plist
+value does not make newer dependency bottles run on an older Mac.
+
+Before releasing, test on a second Mac without Homebrew installed:
+
+- Launch from Finder and from a relocated/read-only location; verify Dock and
+  menu bar, preferences persistence, dark/light themes and normal shutdown.
+- Connect with verified TLS, exercise SASL authentication and reconnect.
+- Send Unicode/emoji, render SVG/PNG/JPEG icons/images, and test HTTPS image previews.
+- Verify clipboard shortcuts, input methods, notifications/permission denial,
+  detach/reattach tabs, focus changes, unread highlights and notification clicks.
+- Send/receive/resume DCC, write downloads and logs, import/export themes/settings.
+- Test FiSH, Lua and DCC checksum plugins in the direct build.
+- Exercise accessibility with VoiceOver and keyboard-only navigation.
+
+Direct builds include Lua, FiSH and checksum, and retain the plugin loader.
+Python/Perl are explicitly not bundled: reliable redistribution requires packaging
+and auditing their interpreter runtimes, standard libraries and extensions.
+Linux `/proc`/PCI sysinfo is not built on macOS. These are macOS build choices;
+other platforms' plugin defaults are unchanged. macOS uses the existing password
+storage fallback; this patch does not add a Keychain backend. Audit credentials
+storage before adopting a stronger macOS security claim.
+
+Desktop URL registration (`irc://` in Finder/browser) is not advertised by the
+plist; command-line IRC URLs continue to work. A native open-URL event handler
+and single-instance forwarding need separate integration before registering those
+schemes. AppIndicator and Linux D-Bus scripting/single-instance support are not
+used on macOS.
+
+## 3. Sign and notarize for direct downloads
+
+Local ad-hoc builds are for testing; they are not notarized releases. For public
+release, enroll in Apple's Developer Program, install your **Developer ID
+Application** certificate with its private key, then sign using that identity.
+Use your actual certificate identity in place of the example:
+
+```sh
+python3 packaging/macos/bundle.py sign dist/ZoiteChat.app \
+  --identity 'Developer ID Application: YOUR NAME (TEAMID)' \
+  --entitlements packaging/macos/direct.entitlements
+
+# Store credentials once in your login Keychain; enter your own values interactively.
+xcrun notarytool store-credentials ZoiteChat-notary
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-notarization.zip
+xcrun notarytool submit dist/ZoiteChat-notarization.zip \
+  --keychain-profile ZoiteChat-notary --wait
+
+# Only after notarization has succeeded:
+xcrun stapler staple dist/ZoiteChat.app
+xcrun stapler validate dist/ZoiteChat.app
+spctl --assess --type execute --verbose=2 dist/ZoiteChat.app
+
+ditto -c -k --keepParent dist/ZoiteChat.app dist/ZoiteChat-macos.zip
+```
+
+Signing runs inside-out, verifies the final bundle and enables hardened runtime.
+It does not use `codesign --deep` to sign. `--deep` is used only for verification.
+The direct entitlement allows users' independently signed native plugins; it
+relaxes library validation, not the entire hardened runtime. No JIT or executable
+memory entitlements are added. Do not change bundle contents after signing; signing
+again is required after any code/resource edit. Stapling is Apple's supported
+post-signing operation.
+
+Publish exact corresponding source for ZoiteChat and satisfy the applicable
+licenses of each bundled dependency. Notices and dependency metadata are included,
+but those alone do not satisfy every source-distribution obligation. Review the
+notarization log if rejected; the script does not silently bypass Gatekeeper.
+
+### Automate signing and notarization with GitHub Actions
+
+The workflow now has a separate signed/notarized release job for both
+architectures. It uses Developer ID distribution for direct downloads, not Mac
+App Store signing. You can manage it from Windows/Linux; GitHub's macOS runners
+perform all signing, notarization and stapling.
+
+Prepare these repository Actions secrets under **Settings → Secrets and
+variables → Actions**, or store them as environment secrets in **macos-release**.
+The certificate setting names are unchanged from the original instructions.
+The three `APPLE_API_*` settings are new notarization credentials:
+
+| Name | Type | Value |
+| --- | --- | --- |
+| `MACOS_CERTIFICATE_P12_BASE64` | Secret | Base64-encoded Developer ID Application `.p12`, including its private key |
+| `MACOS_CERTIFICATE_PASSWORD` | Secret | Password used to export that `.p12` |
+| `MACOS_SIGNING_IDENTITY` | Variable, or Secret | Exact `Developer ID Application: YOUR NAME (TEAMID)` identity; the matching certificate's SHA-1 fingerprint is also accepted |
+| `APPLE_API_KEY_P8` | Secret | Entire plain-text App Store Connect **Team API key** `.p8` file, including PEM header/footer and newlines |
+| `APPLE_API_KEY_ID` | Secret | That API key's Key ID |
+| `APPLE_API_ISSUER_ID` | Secret | The Team API key's Issuer ID UUID; this is **not** your Apple Team ID |
+
+Repository variables are under the **Variables** tab. If the identity is entered
+as both a variable and a secret, the variable takes precedence. No separate
+keychain password is needed; the job generates a temporary random password.
+The `.p8` is the notarization API key; it does not replace the signing `.p12`.
+No Apple ID password or app-specific password is used by this configuration.
+
+To obtain the API key, open **App Store Connect → Users and Access → Integrations
+→ App Store Connect API → Team Keys → Generate API Key**. Choose **Developer**
+access for notarization. If API access is not enabled, the Account Holder must
+request it first. Download the `.p8` and record the Key ID and Issuer ID. Use a
+**Team** key with this workflow: individual API keys use different authentication
+and are not supported by this issuer-based configuration. Apple allows the
+private key download only once, so retain your copy securely.
+
+For the certificate, export the Developer ID Application identity (certificate
+plus private key) from Keychain Access as a password-protected `.p12`.
+If you generated the CSR with OpenSSL on Linux/WSL, you can also create it there.
+Assuming Apple's downloaded DER certificate has been saved as
+`developerID_application.cer`, and you retained `zoitechat-signing.key`:
+
+```sh
+openssl x509 -inform DER -in developerID_application.cer \
+  -out zoitechat-signing.pem
+openssl pkcs12 -export -inkey zoitechat-signing.key \
+  -in zoitechat-signing.pem -out ZoiteChat-signing.p12
+
+# Enter the existing private-key password, then choose the .p12 export password.
+# Copy the resulting Base64 text into MACOS_CERTIFICATE_P12_BASE64:
+openssl base64 -A -in ZoiteChat-signing.p12 -out ZoiteChat-signing.p12.base64
+
+# Read the certificate's commonName to obtain MACOS_SIGNING_IDENTITY:
+openssl x509 -in zoitechat-signing.pem -noout -subject -nameopt multiline
+```
+
+Upload only the public CSR to Apple. Put the `.p12` Base64, export password and
+API credentials in GitHub settings, never in the repository or build artifacts.
+
+Once these patches are committed to `master` and the settings are ready:
+
+1. Open **Actions → macOS build → Run workflow**.
+2. Select **master** and enable **Sign with Developer ID and notarize using
+   release credentials**.
+3. Run the workflow. It creates separate Apple Silicon and Intel release jobs.
+4. After success, download `ZoiteChat-macos-arm64-signed-notarized` or
+   `ZoiteChat-macos-x86_64-signed-notarized`. The ZIP inside contains the signed,
+   stapled app. Actions artifacts wrap it in their own download archive.
+
+A push of a `v*` tag also triggers the signed release jobs automatically, so wait
+until credentials are configured before pushing a release tag. Normal branch
+pushes, pull requests and manual runs with the checkbox off continue to build
+ad-hoc test artifacts without any signing secrets. Manual credentialed releases
+are restricted to `master`; pull requests cannot invoke the release job.
+Missing/malformed release settings fail before the Homebrew/build steps rather
+than producing an unsigned artifact marked as a release.
+
+The release jobs use the GitHub environment **macos-release**. Repository secrets
+work with it; environment secrets can override them. Configure environment
+branch/tag restrictions or required reviewers if that fits your repository's
+release process. This workflow does not automatically create a GitHub Release,
+publish to zoitechat.org, or upload to App Store Connect; it produces downloadable
+signed/notarized artifacts for you to publish.
+
+The job imports the `.p12` into a temporary keychain, installs Apple's public
+Developer ID intermediate certificates, verifies a valid matching identity,
+and signs inside-out with hardened runtime and the direct plugin entitlement.
+It uses the existing bundle audit and then submits a ZIP with `notarytool`.
+After Apple reports **Accepted**, it staples the ticket to the `.app`, verifies
+stapling/signatures and Gatekeeper acceptance, and creates a **new** final ZIP.
+Private credential files and the temporary keychain are cleaned up on normal
+success/failure paths; hosted runner VMs are also discarded after the job.
+
+The default Apple wait limit is **60 minutes** within a **180-minute** release
+job. A rejected, failed or still-pending submission produces no final release
+ZIP. The `ZoiteChat-macos-<arch>-notarization-log` artifact retains the submission
+ID, status and Apple's available diagnostic log. First submissions can take
+longer; check the saved ID with `notarytool info` and your API credentials. An
+accepted submission still requires stapling and repackaging before publication;
+rerunning this workflow starts a new build and submission. To increase the wait
+limit, update `--notary-timeout` and allow adequate job timeout for build plus wait.
+
+Both architecture builds receive the same bundle build number for one workflow
+run. The API credentials are supplied only to the config-check/release steps,
+not to Homebrew, compiler tests, ordinary builds or pull-request jobs.
+
+## 4. Mac App Store: experimental groundwork, not submission-ready
+
+A working direct-download app is not sufficient for App Store submission. This
+repository inherits GPL-2.0-or-later code from XChat/HexChat and other contributors.
+App Store terms and GPL obligations require a licensing review; do not assume
+that signing, a custom EULA, or relicensing only your new changes resolves rights
+to inherited code. This patch changes no licenses or copyright permissions.
+
+An isolated sandbox-test build is provided:
+
+```sh
+python3 packaging/macos/build.py --store-experimental \
+  --build-dir build-macos-store --output dist/ZoiteChat-store-test.app \
+  --build-number 1
+
+# Local sandbox experimentation (not an uploadable distribution signature):
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity - --entitlements packaging/macos/store-experimental.entitlements
+open dist/ZoiteChat-store-test.app
+```
+
+The separate store variant excludes loadable plugins and scripting runtimes.
+The template grants sandboxed client/server networking, user-selected files and
+Downloads. The direct version retains its plugin functionality. This is an
+explicit experimental variant, not a change to Windows/Linux or direct builds.
+
+Before a store package can be regarded as a release candidate:
+
+1. Resolve the inherited GPL/dependency-license distribution question and review
+   Apple's current SDK, content/chat moderation, privacy and accessibility rules.
+2. Register `org.Zoitechat` (or change the plist identifier consistently if already
+   owned by another developer), create App Store Connect metadata, and choose a
+   unique incrementing build number. Use a stable release, not a `-dev` snapshot.
+3. Test sandboxed settings/logs, notifications, SASL/TLS, HTTPS and DCC on a real
+   Mac. GTK dialogs are not assumed to grant Powerbox access. Add native
+   `NSOpenPanel`/`NSSavePanel` integration and security-scoped bookmarks for
+   persistent access to user-selected files. The entitlement template alone does
+   not solve persistent file access. `/EXEC`, custom external commands, user
+   plugin loading and arbitrary external paths cannot be promised under sandbox.
+4. Add required privacy manifest declarations based on an actual API audit of the
+   app and dependencies; do not submit an invented empty compliance declaration.
+5. Obtain matching App Store distribution application/installer certificates and
+   a matching provisioning profile. Generate team-specific signing entitlements
+   from the profile with Xcode; do not use Developer ID or the generic local-test
+   template as a store distribution identity/profile.
+6. Embed the matching profile as `Contents/embedded.provisionprofile` **before**
+   final signing. Sign embedded libraries with the distribution identity, then
+   the app with its profile-authorized entitlements (use `bundle.py sign` with
+   that identity and generated entitlement file). Package with Apple's
+   `productbuild`, validate and upload with Transporter/App Store Connect, then
+   test the App Store processed build via TestFlight before submission.
+
+Example **after those prerequisites are satisfied**:
+
+```sh
+# Use the actual prepared profile and team-specific entitlements:
+cp /path/to/ZoiteChat.provisionprofile \
+  dist/ZoiteChat-store-test.app/Contents/embedded.provisionprofile
+python3 packaging/macos/bundle.py sign dist/ZoiteChat-store-test.app \
+  --identity 'YOUR APP STORE APPLICATION CERTIFICATE IDENTITY' \
+  --entitlements /path/to/ZoiteChat-distribution.entitlements
+productbuild --component dist/ZoiteChat-store-test.app /Applications \
+  --sign 'YOUR APP STORE INSTALLER CERTIFICATE IDENTITY' dist/ZoiteChat-store.pkg
+```
+
+No App Store approval, sandbox compatibility or legal compatibility is asserted.
+For an initial macOS release, the signed/notarized direct build is the practical
+path while those issues are resolved.
+
+## 5. CI and architecture support
+
+`.github/workflows/macos-build.yml` adds independent Apple Silicon and Intel jobs.
+Ordinary jobs install prerequisites, run tests, create/audit/ad-hoc-sign the
+bundle, check relocated startup and upload test ZIPs. They need no Apple secrets.
+The separate release jobs add Developer ID signing, Apple notarization, stapling
+and final verification. Only their successful output is named signed/notarized.
+
+Homebrew may build unsupported Intel bottles from source; that can be slower.
+The workflow uses native runners and does not claim a universal application.
+Do not merge only the main executable with `lipo`: a universal release must merge
+and validate every bundled dylib, module and plugin plus matching resources.
+Signing must happen after that merge. Publish separate architecture downloads
+until a full universal dependency pipeline is available.
+
+## References
+
+- GTK on macOS: https://www.gtk.org/docs/installations/macos
+- GTK macOS backend: https://docs.gtk.org/gtk3/macos.html
+- Apple distribution signing: https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac
+- Apple packaging: https://developer.apple.com/documentation/xcode/packaging-mac-software-for-distribution
+- GitHub certificate import: https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
+- Apple notarization authentication: https://developer.apple.com/documentation/technotes/tn3147-migrating-to-the-latest-notarization-tool
+- App Store Connect API keys: https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/
+- Apple review rules (especially 1.2 and 2.4.5): https://developer.apple.com/app-store/review/guidelines/
+- Apple sandbox file access: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox
+- FSF discussion of GPL and App Store terms (historical, not a current legal determination): https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement

packaging/macos/build.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Compile, test, stage and package ZoiteChat on the host Mac."""
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+
+from bundle import ROOT, package, run
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--build-dir", type=Path, default=Path("build-macos"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--build-number", default="1")
+    parser.add_argument("--store-experimental", action="store_true", help="Build a separate sandbox test variant without loadable plugins; not submission approval")
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("Build on macOS; cross-compiling from Linux is not supported")
+    if args.output.exists():
+        parser.error("Output already exists; use a new --output or explicitly remove the old app")
+    build = args.build_dir.resolve()
+    if build == ROOT or ROOT.is_relative_to(build):
+        parser.error("Build directory must not contain the source checkout")
+    run("xcrun", "--find", "clang")
+    env = os.environ.copy()
+    prefixes = [Path(run("brew", "--prefix", name)) for name in ("gettext", "openssl@3", "libarchive", "lua", "gtk+3", "gtk-mac-integration")]
+    brew = Path(run("brew", "--prefix"))
+    # Keg-only gettext, OpenSSL and libarchive are not necessarily in PATH/pkg-config.
+    env["PATH"] = os.pathsep.join([str(p / "bin") for p in prefixes] + [str(brew / "bin"), env.get("PATH", "")])
+    env["PKG_CONFIG_PATH"] = os.pathsep.join([str(p / "lib/pkgconfig") for p in prefixes] + [str(brew / "lib/pkgconfig"), str(brew / "share/pkgconfig"), env.get("PKG_CONFIG_PATH", "")])
+    # Native dependency bottles determine the true deployment target; the bundle
+    # auditor derives the final minimum rather than promising an arbitrary old OS.
+    env.setdefault("MACOSX_DEPLOYMENT_TARGET", "11.0")
+    backend = run("pkg-config", "--variable=targets", "gtk+-3.0", env=env).split()
+    if "quartz" not in backend:
+        parser.error(f"GTK must provide the native Quartz backend, got {backend}")
+    # Do not silently select an XQuartz GTK stack or mix Intel/ARM Homebrew prefixes.
+    machine = platform.machine()
+    if machine not in ("arm64", "x86_64"):
+        parser.error(f"Unsupported architecture: {machine}")
+    options = [
+        "--prefix=/", "--libdir=lib", "--buildtype=release", "-Dgtk-frontend=true",
+        "-Dtext-frontend=false", "-Dmac-integration=enabled", "-Ddbus=disabled",
+        "-Dlibcanberra=disabled", "-Dappindicator=disabled", "-Dinstall-appdata=false",
+        "-Dwith-sysinfo=false", "-Dwith-python=false", "-Dwith-perl=false",
+        "-Dwith-lua=lua", "-Dwith-fishlim=true", "-Dwith-checksum=true",
+        "-Dplugin=" + ("false" if args.store_experimental else "true"),
+    ]
+    if (build / "meson-private/coredata.dat").exists():
+        options.insert(0, "--reconfigure")
+    subprocess.run(["meson", "setup", str(build), str(ROOT), *options], env=env, check=True)
+    subprocess.run(["meson", "compile", "-C", str(build)], env=env, check=True)
+    subprocess.run(["meson", "test", "-C", str(build), "--print-errorlogs"], env=env, check=True)
+    stage = build / "macos-stage"
+    if stage.exists():
+        shutil.rmtree(stage)
+    subprocess.run(["meson", "install", "-C", str(build), "--destdir", str(stage)], env=env, check=True)
+    package(stage, args.output.resolve(), args.build_number)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS build failed: {error}")

packaging/macos/bundle.py

@@ -0,0 +1,374 @@
+#!/usr/bin/env python3
+"""Build and audit a relocatable GTK3 application. No third-party Python packages."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import platform
+import plistlib
+import re
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+ROOT = Path(__file__).resolve().parents[2]
+MACH_MAGIC = {bytes.fromhex(h) for h in ("feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca")}
+SYSTEM_ROOTS = ("/usr/lib/", "/System/Library/")
+
+
+def run(*args: str | Path, env: dict[str, str] | None = None) -> str:
+    return subprocess.check_output([str(arg) for arg in args], env=env, text=True).strip()
+
+
+def is_macho(path: Path) -> bool:
+    if not path.is_file() or path.is_symlink():
+        return False
+    with path.open("rb") as stream:
+        return stream.read(4) in MACH_MAGIC
+
+
+def dependencies(path: Path) -> list[str]:
+    # Paths may contain spaces; splitting on whitespace would corrupt them.
+    return re.findall(r"^\s+(.+?) \(compatibility version", run("otool", "-L", path), re.M)
+
+
+def rpaths(path: Path) -> list[str]:
+    return re.findall(r"cmd LC_RPATH\s+cmdsize \d+\s+path (.+?) \(offset", run("otool", "-l", path))
+
+
+def dylib_id(path: Path) -> str | None:
+    lines = run("otool", "-D", path).splitlines()
+    return lines[1].strip() if len(lines) > 1 else None
+
+
+def system_library(name: str) -> bool:
+    return name.startswith(SYSTEM_ROOTS)
+
+
+def expand_path(name: str, loader: Path, executable: Path) -> Path:
+    return Path(name.replace("@loader_path", str(loader.parent)).replace("@executable_path", str(executable.parent)))
+
+
+def resolve_dependency(name: str, loader: Path, executable: Path, search: list[Path]) -> Path:
+    if name.startswith("@rpath/"):
+        suffix = name[len("@rpath/"):]
+        candidates = [directory / suffix for directory in search]
+    else:
+        candidates = [expand_path(name, loader, executable)]
+    for candidate in candidates:
+        if candidate.is_absolute() and candidate.is_file():
+            return candidate.resolve()
+    raise RuntimeError(f"Cannot resolve {name!r} from {loader}; searched {candidates}")
+
+
+class Relocator:
+    def __init__(self, app: Path, executable: Path):
+        self.app = app
+        self.executable = executable
+        self.frameworks = app / "Contents/Frameworks"
+        self.frameworks.mkdir(parents=True)
+        self.sources: dict[Path, Path] = {}
+        self.names: dict[str, Path] = {}
+        self.visited: set[Path] = set()
+
+    def copy_dependency(self, source: Path) -> Path:
+        source = source.resolve()
+        if ".framework/" in str(source):
+            raise RuntimeError(f"Third-party frameworks require separate packaging support: {source}")
+        if source in self.sources:
+            return self.sources[source]
+        existing = self.names.get(source.name)
+        if existing and existing != source:
+            raise RuntimeError(f"Conflicting library basename: {existing} and {source}")
+        target = self.frameworks / source.name
+        shutil.copy2(source, target)
+        target.chmod(target.stat().st_mode | 0o200)
+        self.sources[source] = target
+        self.names[source.name] = source
+        return target
+
+    def relocate(self, source: Path, target: Path, inherited: list[Path] | None = None) -> None:
+        source = source.resolve()
+        if target in self.visited:
+            return
+        self.visited.add(target)
+        local = [expand_path(name, source, self.executable) for name in rpaths(source)]
+        search = local + (inherited or [])
+        identity = dylib_id(source)
+        # Keep the existing signature allocation while editing: stripping it
+        # first can leave __LINKEDIT padding that install_name_tool rejects.
+        # The final inside-out codesign --force pass replaces stale signatures.
+        edits: list[str | Path] = []
+        for name in dependencies(source):
+            if name == identity or system_library(name):
+                continue
+            dependency = resolve_dependency(name, source, self.executable, search)
+            destination = self.copy_dependency(dependency)
+            relative = os.path.relpath(destination, target.parent)
+            edits += ["-change", name, "@loader_path/" + relative]
+            self.relocate(dependency, destination, search)
+        if identity:
+            edits += ["-id", "@rpath/" + target.name]
+        for name in sorted(set(rpaths(target))):
+            edits += ["-delete_rpath", name]
+        if edits:
+            run("install_name_tool", *edits, target)
+
+
+def copy_tree(source: Path, target: Path) -> None:
+    if source.is_dir():
+        # Dereference symlinks: never leave links into the builder's Cellar.
+        shutil.copytree(source, target, dirs_exist_ok=True, symlinks=False)
+
+
+def write_fontconfig(resources: Path, fontconfig_prefix: Path) -> None:
+    # Noto Color Emoji has fixed-size color bitmaps. Fontconfig supplies the
+    # requested-size/strike-size matrix; without it glyphs render at 109px.
+    rule = fontconfig_prefix / "share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf"
+    if not rule.is_file():
+        raise RuntimeError(f"Required Fontconfig bitmap scaling rules not found: {rule}")
+    resources.mkdir(parents=True, exist_ok=True)
+    config = ET.fromstring('''<fontconfig>
+  <dir>/System/Library/Fonts</dir><dir>/Library/Fonts</dir><dir>~/Library/Fonts</dir>
+  <cachedir prefix="xdg">fontconfig</cachedir>
+  <alias><family>sans-serif</family><prefer><family>Helvetica</family></prefer></alias>
+  <alias><family>monospace</family><prefer><family>Menlo</family></prefer></alias>
+</fontconfig>
+''')
+    # Embed the standard rules so they work after relocation without depending
+    # on Homebrew or Fontconfig's host configuration search paths.
+    for element in reversed(list(ET.parse(rule).getroot())):
+        config.insert(0, element)
+    (resources / "fonts.conf").write_text(
+        '<?xml version="1.0"?>\n<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">\n' +
+        ET.tostring(config, encoding="unicode") + "\n", encoding="utf-8")
+
+
+def audit(app: Path) -> dict[str, object]:
+    binary = app / "Contents/MacOS/zoitechat"
+    architectures = set(run("lipo", "-archs", binary).split())
+    minimum = (11, 0, 0)
+    entries = []
+    for path in sorted(app.rglob("*")):
+        if path.is_symlink():
+            resolved = path.resolve()
+            if not resolved.is_relative_to(app.resolve()):
+                raise RuntimeError(f"External symlink: {path} -> {resolved}")
+        if not is_macho(path):
+            continue
+        if not architectures.issubset(set(run("lipo", "-archs", path).split())):
+            raise RuntimeError(f"Architecture mismatch: {path}")
+        identity = dylib_id(path)
+        for name in dependencies(path):
+            if name == identity or system_library(name):
+                continue
+            if not name.startswith("@loader_path/"):
+                raise RuntimeError(f"Non-relocatable dependency: {path}: {name}")
+            target = expand_path(name, path, binary).resolve()
+            if not target.is_relative_to(app.resolve()) or not target.is_file():
+                raise RuntimeError(f"Missing or external dependency: {path}: {name}")
+        if rpaths(path):
+            raise RuntimeError(f"Unexpected runtime search paths: {path}")
+        load_commands = run("otool", "-l", path)
+        versions = re.findall(r"\bminos (\d+(?:\.\d+){0,2})", load_commands)
+        versions += re.findall(r"cmd LC_VERSION_MIN_MACOSX\s+cmdsize \d+\s+version (\d+(?:\.\d+){0,2})", load_commands)
+        if not versions:
+            raise RuntimeError(f"Missing deployment version: {path}")
+        for version in versions:
+            parts = tuple(int(value) for value in version.split("."))
+            minimum = max(minimum, parts + (0,) * (3 - len(parts)))
+        entries.append({"path": str(path.relative_to(app))})
+    return {"architectures": sorted(architectures), "minimum_macos": ".".join(map(str, minimum if minimum[2] else minimum[:2])), "mach_o": entries}
+
+
+def package(stage: Path, app: Path, build_number: str) -> None:
+    if not re.fullmatch(r"[1-9]\d*(?:\.\d+){0,2}", build_number):
+        raise RuntimeError("Build number must be a positive Apple CFBundleVersion (for example 1 or 12.3)")
+    if app.exists():
+        raise RuntimeError(f"Output already exists; choose another --output or remove it explicitly: {app}")
+    app.mkdir(parents=True)
+    resources = app / "Contents/Resources"
+    resources.mkdir(parents=True)
+    binary = app / "Contents/MacOS/zoitechat"
+    binary.parent.mkdir()
+    shutil.copy2(stage / "bin/zoitechat", binary)
+    copy_tree(stage / "share", resources / "share")
+    copy_tree(stage / "lib/zoitechat/plugins", resources / "lib/zoitechat/plugins")
+    relocator = Relocator(app, stage / "bin/zoitechat")
+    seeds: list[tuple[Path, Path]] = [(stage / "bin/zoitechat", binary)]
+    for source in (stage / "lib/zoitechat/plugins").glob("*"):
+        if is_macho(source):
+            seeds.append((source, resources / "lib/zoitechat/plugins" / source.name))
+
+    prefixes = {formula: Path(run("brew", "--prefix", formula)) for formula in (
+        "gtk+3", "gdk-pixbuf", "glib", "glib-networking", "librsvg", "enchant", "adwaita-icon-theme", "hicolor-icon-theme", "gsettings-desktop-schemas", "ca-certificates", "openssl@3", "lua", "libarchive", "gtk-mac-integration", "fontconfig")}
+    # Runtime-loaded code is not visible in the main executable's otool output.
+    module_groups = [
+        (prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["librsvg"] / "lib/gdk-pixbuf-2.0/2.10.0/loaders", "lib/gdk-pixbuf-2.0/2.10.0/loaders"),
+        (prefixes["gtk+3"] / "lib/gtk-3.0/3.0.0/immodules", "lib/gtk-3.0/3.0.0/immodules"),
+        (prefixes["glib-networking"] / "lib/gio/modules", "lib/gio/modules"),
+        (prefixes["enchant"] / "lib/enchant-2", "lib/enchant-2"),
+        (prefixes["openssl@3"] / "lib/ossl-modules", "lib/ossl-modules"),
+    ]
+    for source_dir, relative in module_groups:
+        target_dir = resources / relative
+        target_dir.mkdir(parents=True, exist_ok=True)
+        for source in sorted(source_dir.glob("*")):
+            if source.suffix not in (".so", ".dylib") or not source.is_file():
+                continue
+            target = target_dir / source.name
+            if target.exists() and target.read_bytes() != source.read_bytes():
+                raise RuntimeError(f"Conflicting module: {target}")
+            shutil.copy2(source.resolve(), target)
+            seeds.append((source.resolve(), target))
+    enchant = (prefixes["enchant"] / "lib/libenchant-2.dylib").resolve()
+    # Register Enchant at Resources/lib so its public prefix relocation API
+    # finds Resources/lib/enchant-2 and Resources/share/enchant.
+    enchant_alias = resources / "lib/libenchant-2.dylib"
+    shutil.copy2(enchant, enchant_alias)
+    relocator.sources[enchant] = enchant_alias
+    relocator.names[enchant.name] = enchant
+    seeds.append((enchant, enchant_alias))
+    for formula, prefix in prefixes.items():
+        for name in ("icons", "glib-2.0/schemas", "locale", "enchant", "hunspell"):
+            copy_tree(prefix / "share" / name, resources / "share" / name)
+    ca = prefixes["ca-certificates"] / "share/ca-certificates/cacert.pem"
+    if not ca.is_file():
+        raise RuntimeError(f"CA bundle not found: {ca}")
+    (resources / "certs").mkdir()
+    shutil.copy2(ca, resources / "certs/ca-bundle.crt")
+    schemas = resources / "share/glib-2.0/schemas"
+    run(prefixes["glib"] / "bin/glib-compile-schemas", schemas)
+    pixbuf_modules = sorted((resources / "lib/gdk-pixbuf-2.0/2.10.0/loaders").glob("*"))
+    if not any("svg" in path.name for path in pixbuf_modules):
+        raise RuntimeError("SVG loader missing: install librsvg")
+    if list((resources / "lib/zoitechat/plugins").glob("fishlim.*")) and not list((resources / "lib/ossl-modules").glob("legacy.*")):
+        raise RuntimeError("FiSH needs the OpenSSL legacy provider in the bundle")
+    if not list((resources / "lib/gio/modules").glob("*tls*")):
+        raise RuntimeError("GIO TLS backend missing: install glib-networking")
+    # Query original binaries before relocation, then rewrite only the cached paths.
+    pixbuf_query = prefixes["gdk-pixbuf"] / "bin/gdk-pixbuf-query-loaders"
+    if not pixbuf_query.exists():
+        pixbuf_query = prefixes["gdk-pixbuf"] / "lib/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
+    for tool, module_dir, cache in (
+        (pixbuf_query, "lib/gdk-pixbuf-2.0/2.10.0/loaders", "pixbuf-loaders.cache"),
+        (prefixes["gtk+3"] / "bin/gtk-query-immodules-3.0", "lib/gtk-3.0/3.0.0/immodules", "gtk-immodules.cache"),
+    ):
+        originals = [(source, target) for source, target in seeds if target.parent == resources / module_dir]
+        # Never call a query tool with zero arguments: it would scan global modules.
+        data = run(tool, *(source for source, _ in originals)) if originals else "# No external input-method modules\n"
+        for source, target in originals:
+            data = data.replace(str(source), "@ZOITECHAT_RESOURCES@/" + str(target.relative_to(resources)))
+        (resources / cache).write_text(data + "\n")
+    # The private font map loads the bundled Noto font; ordinary GTK fonts stay local.
+    write_fontconfig(resources, prefixes["fontconfig"])
+    (resources / "zoitechat-bundle").write_text("1\n")
+    licenses = resources / "licenses"
+    licenses.mkdir()
+    shutil.copy2(ROOT / "COPYING", licenses / "ZoiteChat-COPYING")
+    # Preserve the notices shipped with every installed Homebrew dependency.
+    # brew deps traverses dependencies by default; --recursive is not an option.
+    wanted = set(prefixes)
+    for formula in prefixes:
+        wanted.update(run("brew", "deps", "--formula", formula).splitlines())
+    installed = [item for item in json.loads(run("brew", "info", "--json=v2", "--installed"))["formulae"]
+                 if item["name"] in wanted]
+    for formula in installed:
+        prefix = Path(run("brew", "--prefix", formula["name"]))
+        notices = [p for p in prefix.iterdir() if p.is_file() and re.match(r"(?i)(copying|license|copyright|notice)", p.name)]
+        if notices:
+            target = licenses / formula["name"].replace("/", "-")
+            target.mkdir(exist_ok=True)
+            for notice in notices:
+                shutil.copy2(notice, target / notice.name)
+    (resources / "homebrew-dependencies.json").write_text(json.dumps(installed, indent=2) + "\n")
+    for source, target in seeds:
+        relocator.relocate(source, target)
+    report = audit(app)
+    (resources / "bundle-audit.json").write_text(json.dumps(report, indent=2) + "\n")
+    # Use the actual highest deployment target of the executable and all dylibs.
+    # Setting an older plist version cannot make newer Homebrew bottles compatible.
+    version = (ROOT / "VERSION").read_text().strip()
+    release = re.match(r"\d+\.\d+\.\d+", version)
+    if not release:
+        raise RuntimeError(f"Unsupported release version: {version}")
+    plist = {
+        "CFBundleIdentifier": "org.Zoitechat", "CFBundleExecutable": "zoitechat",
+        "CFBundleName": "ZoiteChat", "CFBundleDisplayName": "ZoiteChat",
+        "CFBundlePackageType": "APPL", "CFBundleShortVersionString": release.group(),
+        "CFBundleVersion": build_number, "CFBundleIconFile": "ZoiteChat.icns",
+        "LSMinimumSystemVersion": report["minimum_macos"], "NSHighResolutionCapable": True,
+        "NSPrincipalClass": "NSApplication",
+        "LSApplicationCategoryType": "public.app-category.social-networking",
+        "DTSDKName": "macosx" + run("xcrun", "--sdk", "macosx", "--show-sdk-version"),
+        "DTSDKBuild": run("xcrun", "--sdk", "macosx", "--show-sdk-build-version"),
+    }
+    with (app / "Contents/Info.plist").open("wb") as stream:
+        plistlib.dump(plist, stream)
+    iconset = app.parent / (app.stem + ".iconset")
+    if iconset.exists():
+        raise RuntimeError(f"Icon staging directory already exists: {iconset}")
+    iconset.mkdir()
+    try:
+        # Rasterize the original vector at 1024px, then generate every icon size.
+        large = iconset / "source.png"
+        run(prefixes["librsvg"] / "bin/rsvg-convert", "-w", "1024", "-h", "1024", "-o", large, ROOT / "data/icons/zoitechat.svg")
+        for size in (16, 32, 128, 256, 512):
+            for scale in (1, 2):
+                name = f"icon_{size}x{size}" + ("@2x" if scale == 2 else "") + ".png"
+                run("sips", "-z", str(size * scale), str(size * scale), large, "--out", iconset / name)
+        large.unlink()
+        run("iconutil", "-c", "icns", iconset, "-o", resources / "ZoiteChat.icns")
+    finally:
+        shutil.rmtree(iconset)
+    # Local builds need an ad-hoc signature after install_name_tool changes.
+    sign(app, "-", None)
+    print(f"Created {app}: {', '.join(report['architectures'])}, macOS {report['minimum_macos']}+")
+
+
+def sign(app: Path, identity: str, entitlements: Path | None, *, keychain: Path | None = None) -> None:
+    audit(app)
+    binaries = [p for p in app.rglob("*") if is_macho(p) and p != app / "Contents/MacOS/zoitechat"]
+    options = [] if identity == "-" else ["--timestamp", "--options", "runtime"]
+    if keychain is not None:
+        options += ["--keychain", str(keychain)]
+    for binary in sorted(binaries, key=lambda p: len(p.parts), reverse=True):
+        run("codesign", "--force", "--sign", identity, *options, binary)
+    main_options = ["--entitlements", str(entitlements)] if entitlements else []
+    run("codesign", "--force", "--sign", identity, *options, *main_options, app)
+    run("codesign", "--verify", "--deep", "--strict", "--verbose=2", app)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="action", required=True)
+    create = sub.add_parser("create")
+    create.add_argument("--stage", type=Path, required=True)
+    create.add_argument("--app", type=Path, required=True)
+    create.add_argument("--build-number", default="1")
+    verify = sub.add_parser("audit")
+    verify.add_argument("app", type=Path)
+    signing = sub.add_parser("sign")
+    signing.add_argument("app", type=Path)
+    signing.add_argument("--identity", required=True)
+    signing.add_argument("--entitlements", type=Path)
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("This tool requires macOS and the Xcode command-line tools")
+    if args.action == "create":
+        package(args.stage.resolve(), args.app.resolve(), args.build_number)
+    elif args.action == "audit":
+        print(json.dumps(audit(args.app.resolve()), indent=2))
+    else:
+        sign(args.app.resolve(), args.identity, args.entitlements)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, subprocess.CalledProcessError, OSError) as error:
+        sys.exit(f"macOS packaging failed: {error}")

packaging/macos/capture-window.swift

@@ -0,0 +1,72 @@
+// Capture only the tested process's window; a desktop-only image is not evidence.
+import AppKit
+import CoreGraphics
+import Foundation
+
+func fail(_ message: String) -> Never {
+    FileHandle.standardError.write(Data((message + "\n").utf8))
+    exit(1)
+}
+
+guard CommandLine.arguments.count == 3,
+      let pid = Int32(CommandLine.arguments[1]) else {
+    fail("Usage: capture-window PID OUTPUT.png")
+}
+let output = URL(fileURLWithPath: CommandLine.arguments[2])
+let deadline = Date().addingTimeInterval(30)
+var chosen: [String: Any]?
+while Date() < deadline {
+    guard let app = NSRunningApplication(processIdentifier: pid), !app.isTerminated else {
+        fail("ZoiteChat is not running")
+    }
+    app.activate(options: [])
+    RunLoop.current.run(until: Date().addingTimeInterval(0.2))
+    let windows = CGWindowListCopyWindowInfo([.optionOnScreenOnly, .excludeDesktopElements],
+                                            kCGNullWindowID) as? [[String: Any]] ?? []
+    let owned = windows.filter { window in
+        guard (window[kCGWindowOwnerPID as String] as? NSNumber)?.int32Value == pid,
+              (window[kCGWindowLayer as String] as? NSNumber)?.intValue == 0,
+              let bounds = window[kCGWindowBounds as String] as? [String: Any],
+              let width = bounds["Width"] as? NSNumber,
+              let height = bounds["Height"] as? NSNumber else { return false }
+        return width.doubleValue >= 600 && height.doubleValue >= 300
+    }
+    chosen = owned.max { left, right in
+        func area(_ window: [String: Any]) -> Double {
+            let bounds = window[kCGWindowBounds as String] as? [String: NSNumber] ?? [:]
+            return (bounds["Width"]?.doubleValue ?? 0) * (bounds["Height"]?.doubleValue ?? 0)
+        }
+        return area(left) < area(right)
+    }
+    if chosen != nil { break }
+}
+guard let window = chosen,
+      let identifier = window[kCGWindowNumber as String] as? NSNumber else {
+    fail("No visible ZoiteChat window found in this runner's desktop session")
+}
+let capture = Process()
+capture.executableURL = URL(fileURLWithPath: "/usr/sbin/screencapture")
+capture.arguments = ["-x", "-o", "-t", "png", "-l", identifier.stringValue, output.path]
+do { try capture.run() } catch { fail("Cannot start screencapture: \(error)") }
+capture.waitUntilExit()
+guard capture.terminationStatus == 0,
+      let png = try? Data(contentsOf: output),
+      let bitmap = NSBitmapImageRep(data: png),
+      bitmap.pixelsWide >= 600, bitmap.pixelsHigh >= 300 else {
+    fail("Application window capture failed; check runner Screen Recording permissions")
+}
+var colors = Set<String>()
+for y in stride(from: 0, to: bitmap.pixelsHigh, by: max(1, bitmap.pixelsHigh / 60)) {
+    for x in stride(from: 0, to: bitmap.pixelsWide, by: max(1, bitmap.pixelsWide / 80)) {
+        if let color = bitmap.colorAt(x: x, y: y)?.usingColorSpace(.deviceRGB) {
+            colors.insert("\(Int(color.redComponent * 255)),\(Int(color.greenComponent * 255)),\(Int(color.blueComponent * 255))")
+        }
+    }
+}
+guard colors.count >= 8 else { fail("Window capture is blank or nearly uniform") }
+let evidence: [String: Any] = ["pid": pid, "window_id": identifier.intValue,
+    "width": bitmap.pixelsWide, "height": bitmap.pixelsHigh, "sampled_colors": colors.count]
+do {
+    let data = try JSONSerialization.data(withJSONObject: evidence, options: [.sortedKeys])
+    print(String(decoding: data, as: UTF8.self))
+} catch { fail("Cannot serialize screenshot evidence: \(error)") }

packaging/macos/direct.entitlements

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <!-- User-installed native plugins need library validation disabled. -->
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+</dict></plist>

packaging/macos/release.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Developer ID sign, notarize and staple a built app using CI environment secrets."""
+from __future__ import annotations
+
+import argparse
+import base64
+import binascii
+from contextlib import contextmanager
+from dataclasses import dataclass
+import json
+import os
+from pathlib import Path
+import platform
+import re
+import secrets
+import shlex
+import subprocess
+import sys
+import tempfile
+import urllib.request
+import uuid
+
+from bundle import sign
+
+REQUIRED = (
+    "MACOS_CERTIFICATE_P12_BASE64", "MACOS_CERTIFICATE_PASSWORD",
+    "MACOS_SIGNING_IDENTITY", "APPLE_API_KEY_P8", "APPLE_API_KEY_ID", "APPLE_API_ISSUER_ID",
+)
+
+
+@dataclass(repr=False)
+class Credentials:
+    certificate: bytes
+    password: str
+    identity: str
+    api_key: str
+    key_id: str
+    issuer: str
+
+    @classmethod
+    def from_environment(cls) -> Credentials:
+        missing = [name for name in REQUIRED if not os.environ.get(name, "").strip()]
+        if missing:
+            raise RuntimeError("Missing release settings: " + ", ".join(missing))
+        try:
+            certificate = base64.b64decode("".join(os.environ[REQUIRED[0]].split()), validate=True)
+        except (binascii.Error, ValueError):
+            raise RuntimeError("MACOS_CERTIFICATE_P12_BASE64 must contain Base64-encoded .p12 bytes") from None
+        if not certificate:
+            raise RuntimeError("Signing certificate is empty")
+        identity = os.environ["MACOS_SIGNING_IDENTITY"].strip()
+        if not (identity.startswith("Developer ID Application:") or re.fullmatch(r"[a-fA-F0-9]{40}", identity)):
+            raise RuntimeError("MACOS_SIGNING_IDENTITY must identify a Developer ID Application certificate")
+        api_key = os.environ["APPLE_API_KEY_P8"].strip()
+        if not (api_key.startswith("-----BEGIN PRIVATE KEY-----") and api_key.endswith("-----END PRIVATE KEY-----")):
+            raise RuntimeError("APPLE_API_KEY_P8 must contain the complete, plain-text .p8 private key")
+        key_id = os.environ["APPLE_API_KEY_ID"].strip()
+        if not re.fullmatch(r"[A-Za-z0-9]{6,32}", key_id):
+            raise RuntimeError("APPLE_API_KEY_ID must be an App Store Connect key ID")
+        try:
+            issuer = str(uuid.UUID(os.environ["APPLE_API_ISSUER_ID"].strip()))
+        except ValueError:
+            raise RuntimeError("APPLE_API_ISSUER_ID must be the Team API key issuer UUID") from None
+        return cls(certificate, os.environ["MACOS_CERTIFICATE_PASSWORD"], identity, api_key, key_id, issuer)
+
+
+def execute(args: list[str | Path], operation: str, *, check: bool = True) -> subprocess.CompletedProcess[str]:
+    # Do not print argv or CalledProcessError: security commands contain passwords.
+    try:
+        result = subprocess.run([str(arg) for arg in args], capture_output=True, text=True, check=False)
+    except OSError:
+        raise RuntimeError(f"{operation}: could not start the required tool") from None
+    if check and result.returncode != 0:
+        raise RuntimeError(f"{operation} failed (exit {result.returncode})")
+    return result
+
+
+def write_private(path: Path, data: bytes) -> None:
+    with path.open("xb") as stream:
+        path.chmod(0o600)
+        stream.write(data)
+
+
+def resolve_identity(output: str, requested: str) -> str:
+    for fingerprint, name in re.findall(r'\b([A-Fa-f0-9]{40})\s+"([^"\n]+)"', output):
+        if name.startswith("Developer ID Application:") and (requested == name or requested.upper() == fingerprint.upper()):
+            return fingerprint
+    raise RuntimeError("Imported .p12 has no valid Developer ID Application identity matching MACOS_SIGNING_IDENTITY; check its private key, password, expiry and certificate chain")
+
+
+@contextmanager
+def signing_keychain(credentials: Credentials):
+    original = shlex.split(execute(["security", "list-keychains", "-d", "user"], "Read keychain search list").stdout)
+    with tempfile.TemporaryDirectory(prefix="zoitechat-signing-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        directory = Path(temporary)
+        keychain = directory / "signing.keychain-db"
+        keychain_password = secrets.token_urlsafe(32)
+        certificate = directory / "signing.p12"
+        api_key = directory / "notary.p8"
+        write_private(certificate, credentials.certificate)
+        write_private(api_key, (credentials.api_key + "\n").encode())
+        try:
+            execute(["security", "create-keychain", "-p", keychain_password, keychain], "Create signing keychain")
+            execute(["security", "set-keychain-settings", "-lut", "21600", keychain], "Configure signing keychain")
+            execute(["security", "unlock-keychain", "-p", keychain_password, keychain], "Unlock signing keychain")
+            # Include both public Developer ID intermediates so signing does not
+            # depend on the runner having cached the leaf certificate's issuer.
+            for name in ("DeveloperIDCA.cer", "DeveloperIDG2CA.cer"):
+                intermediate = directory / name
+                try:
+                    with urllib.request.urlopen("https://www.apple.com/certificateauthority/" + name, timeout=60) as response:
+                        write_private(intermediate, response.read())
+                except OSError:
+                    raise RuntimeError("Download of Apple's public Developer ID intermediate failed") from None
+                execute(["security", "import", intermediate, "-k", keychain], "Import Developer ID intermediate")
+            execute(["security", "import", certificate, "-P", credentials.password,
+                     "-k", keychain, "-T", "/usr/bin/codesign", "-T", "/usr/bin/security"], "Import signing .p12")
+            execute(["security", "set-key-partition-list", "-S", "apple-tool:,apple:",
+                     "-k", keychain_password, keychain], "Allow non-interactive code signing")
+            execute(["security", "list-keychains", "-d", "user", "-s", keychain, *original], "Add temporary signing keychain")
+            identities = execute(["security", "find-identity", "-v", "-p", "codesigning", keychain], "Find signing identity").stdout
+            yield keychain, api_key, resolve_identity(identities, credentials.identity)
+        finally:
+            # Hosted runners are discarded too, but clean up on every ordinary
+            # success/failure path and restore the original search list.
+            execute(["security", "list-keychains", "-d", "user", "-s", *original], "Restore keychain search list", check=False)
+            if keychain.exists():
+                result = execute(["security", "delete-keychain", keychain], "Delete signing keychain", check=False)
+                if result.returncode:
+                    print("Warning: keychain deletion failed; temporary files will still be removed.", file=sys.stderr)
+
+
+def decode_response(result: subprocess.CompletedProcess[str], operation: str) -> dict:
+    try:
+        response = json.loads(result.stdout)
+    except (json.JSONDecodeError, TypeError):
+        raise RuntimeError(f"{operation} did not return valid JSON (exit {result.returncode})") from None
+    if not isinstance(response, dict):
+        raise RuntimeError(f"{operation} returned an unexpected response")
+    return response
+
+
+def save_json(path: Path, response: dict) -> None:
+    path.write_text(json.dumps(response, indent=2) + "\n")
+
+
+def notarize(app: Path, output: Path, diagnostics: Path, credentials: Credentials, api_key: Path, timeout: str) -> None:
+    diagnostics.mkdir(parents=True, exist_ok=True)
+    authentication = ["--key", str(api_key), "--key-id", credentials.key_id, "--issuer", credentials.issuer]
+    with tempfile.TemporaryDirectory(prefix="zoitechat-notary-", dir=os.environ.get("RUNNER_TEMP")) as temporary:
+        submission_zip = Path(temporary) / "ZoiteChat-submission.zip"
+        execute(["ditto", "-c", "-k", "--keepParent", app, submission_zip], "Package notarization submission")
+        result = execute(["xcrun", "notarytool", "submit", submission_zip, *authentication,
+                          "--output-format", "json"], "Submit notarization", check=False)
+        submission = decode_response(result, "Notarization submission")
+        save_json(diagnostics / "submission.json", submission)
+        if result.returncode or not submission.get("id"):
+            raise RuntimeError("Apple rejected the notarization submission; see submission.json")
+        try:
+            submission_id = str(uuid.UUID(submission["id"]))
+        except (ValueError, TypeError, AttributeError):
+            raise RuntimeError("Apple returned an invalid notarization submission ID") from None
+        print(f"Notarization submitted: {submission_id}", flush=True)
+        waited = execute(["xcrun", "notarytool", "wait", submission_id, *authentication,
+                          "--timeout", timeout, "--output-format", "json"], "Wait for notarization", check=False)
+        try:
+            status = decode_response(waited, "Notarization wait")
+        except RuntimeError:
+            status = {"id": submission_id, "status": "Unknown", "exit_code": waited.returncode}
+        save_json(diagnostics / "status.json", status)
+        # Apple can provide a diagnostic log after processing. Fetch it for both
+        # successful and rejected submissions; never include credential files.
+        execute(["xcrun", "notarytool", "log", submission_id, *authentication,
+                 diagnostics / "notary-log.json"], "Fetch notarization log", check=False)
+        if waited.returncode or status.get("status") != "Accepted":
+            raise RuntimeError("Notarization was not accepted or exceeded the wait limit; see the notarization diagnostic artifact. No release ZIP will be published")
+        execute(["xcrun", "stapler", "staple", app], "Staple notarization ticket")
+        execute(["xcrun", "stapler", "validate", app], "Validate notarization ticket")
+        execute(["codesign", "--verify", "--deep", "--strict", "--verbose=2", app], "Verify stapled app signature")
+        execute(["spctl", "--assess", "--type", "execute", "--verbose=2", app], "Assess Gatekeeper acceptance")
+        output.parent.mkdir(parents=True, exist_ok=True)
+        # Repack only after stapling. The submission ZIP is not the distributable ZIP.
+        execute(["ditto", "-c", "-k", "--keepParent", app, output], "Package notarized release")
+    print(f"Signed and notarized release: {output}", flush=True)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--check-config", action="store_true", help="Validate release settings without accessing Apple or a keychain")
+    parser.add_argument("--app", type=Path, default=Path("dist/ZoiteChat.app"))
+    parser.add_argument("--output", type=Path, default=Path("dist/ZoiteChat-signed-notarized.zip"))
+    parser.add_argument("--diagnostics", type=Path, default=Path("dist/notarization"))
+    parser.add_argument("--notary-timeout", default="60m")
+    args = parser.parse_args()
+    credentials = Credentials.from_environment()
+    if args.check_config:
+        print("Release signing and notarization settings are present and correctly formatted.")
+        return
+    if platform.system() != "Darwin":
+        parser.error("Signing/notarization requires the macOS runner and Xcode command-line tools")
+    if not args.app.is_dir() or args.output.exists():
+        parser.error("Provide a built .app and an output ZIP path that does not already exist")
+    if not re.fullmatch(r"[1-9]\d*[smh]", args.notary_timeout):
+        parser.error("Use a positive notarization timeout, such as 60m")
+    with signing_keychain(credentials) as (keychain, api_key, identity):
+        sign(args.app.resolve(), identity, Path(__file__).with_name("direct.entitlements"), keychain=keychain)
+        notarize(args.app.resolve(), args.output.resolve(), args.diagnostics.resolve(), credentials, api_key, args.notary_timeout)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (RuntimeError, OSError):
+        # RuntimeError messages are authored above and do not contain secret argv.
+        error = sys.exc_info()[1]
+        if isinstance(error, RuntimeError):
+            sys.exit(f"macOS release failed: {error}")
+        sys.exit("macOS release failed: file or network operation failed")
+    except subprocess.CalledProcessError:
+        sys.exit("macOS release failed: code signing or bundle audit failed")

packaging/macos/smoke.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Run the relocated bundle with temporary settings and no IRC auto-connect."""
+from __future__ import annotations
+import argparse
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("app", type=Path)
+    args = parser.parse_args()
+    with tempfile.TemporaryDirectory(prefix="zoitechat-macos-smoke-") as directory:
+        # Include spaces to exercise dyld and GTK module-cache path handling.
+        app = Path(directory) / "Relocated App" / "ZoiteChat.app"
+        shutil.copytree(args.app.resolve(), app)
+        binary = app / "Contents/MacOS/zoitechat"
+        subprocess.run(["codesign", "--verify", "--deep", "--strict", str(app)], check=True)
+        subprocess.run([str(binary), "--version"], check=True, timeout=30)
+        config = Path(directory) / "test-config"
+        with (Path(directory) / "startup.log").open("w+") as log:
+            process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config)], stdout=log, stderr=log)
+            try:
+                process.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                # Stop the isolated process after checking for early startup failure.
+                process.terminate()
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.wait()
+                    raise RuntimeError("GUI startup process did not terminate")
+            else:
+                log.seek(0)
+                raise RuntimeError(f"GUI exited before smoke interval (code {process.returncode}):\n{log.read()}")
+            log.seek(0)
+            messages = log.read()
+            print(messages)
+            for failure in ("Library not loaded:", "Symbol not found:", "cannot open display", "Cannot load bundled HTTPS trust database", "Bundled emoji font is missing", "Cannot relocate", "Error loading plugin:"):
+                if failure.lower() in messages.lower():
+                    raise RuntimeError(f"Startup failure found: {failure}")
+        print("Relocated bundle stayed running for 10 seconds; manual interaction testing is still required.")
+
+
+if __name__ == "__main__":
+    main()

packaging/macos/store-experimental.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>com.apple.security.app-sandbox</key><true/>
+  <key>com.apple.security.network.client</key><true/>
+  <!-- DCC listening sockets and the optional ident service. -->
+  <key>com.apple.security.network.server</key><true/>
+  <key>com.apple.security.files.user-selected.read-write</key><true/>
+  <key>com.apple.security.files.downloads.read-write</key><true/>
+</dict></plist>

packaging/macos/tests/test_bundle.py

@@ -0,0 +1,172 @@
+"""Dependency parsing, relocation guards and release audit tests without a Mac SDK."""
+from pathlib import Path
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+from xml.sax.saxutils import escape
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import bundle
+
+
+class BundleTests(unittest.TestCase):
+    def test_missing_bitmap_scaling_rules_fail_packaging(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            with self.assertRaisesRegex(RuntimeError, "bitmap scaling rules not found"):
+                bundle.write_fontconfig(directory / "Resources", directory / "missing-prefix")
+
+    @unittest.skipUnless(shutil.which("fc-match"), "requires Fontconfig's matching tool")
+    def test_bundled_bitmap_scaling_survives_relocation(self):
+        prefix = Path(bundle.run("brew", "--prefix", "fontconfig")) if sys.platform == "darwin" else Path("/usr")
+        rule = prefix / "share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf"
+        if not rule.is_file():
+            self.skipTest("Fontconfig bitmap scaling configuration unavailable")
+        font = bundle.ROOT / "data/fonts/NotoColorEmoji.ttf"
+        with tempfile.TemporaryDirectory(prefix="zoitechat font scaling ") as temporary:
+            directory = Path(temporary)
+            source = directory / "build-prefix/share/fontconfig/conf.avail" / rule.name
+            source.parent.mkdir(parents=True)
+            shutil.copy2(rule, source)
+            resources = directory / "Resources"
+            bundle.write_fontconfig(resources, directory / "build-prefix")
+            relocated = directory / "Relocated Resources"
+            shutil.move(resources, relocated)
+            source.unlink()
+            # Exercise the shipped configuration without consulting host font
+            # rules. Only the bundled font is visible after reset-dirs.
+            wrapper = directory / "probe.conf"
+            wrapper.write_text(
+                '<fontconfig><include>' + escape(str(relocated / "fonts.conf")) +
+                '</include><reset-dirs/><dir>' + escape(str(font.parent)) + '</dir></fontconfig>')
+            env = os.environ.copy()
+            env["FONTCONFIG_FILE"] = str(wrapper)
+            env["XDG_CACHE_HOME"] = str(directory / "cache")
+            for requested in (12, 16, 24):
+                output = subprocess.check_output(
+                    ["fc-match", "-f", "%{pixelsize}\\n%{matrix}\\n%{file}\\n",
+                     f"Noto Color Emoji:pixelsize={requested}"], env=env, cwd=directory, text=True)
+                pixels, matrix, matched = output.splitlines()
+                self.assertEqual(Path(matched).resolve(), font.resolve())
+                values = [float(value) for value in matrix.split()]
+                self.assertEqual(len(values), 4, "bitmap scaling matrix missing")
+                self.assertAlmostEqual(float(pixels) * values[0], requested, places=3)
+                self.assertAlmostEqual(float(pixels) * values[3], requested, places=3)
+                self.assertEqual(values[1:3], [0.0, 0.0])
+
+    @unittest.skipUnless(sys.platform == "darwin", "requires Apple's Mach-O tools")
+    def test_signed_binary_relocation_and_resigning(self):
+        with tempfile.TemporaryDirectory(prefix="zoitechat relocation ") as temporary:
+            directory = Path(temporary)
+            library_source = directory / "answer.c"
+            library_source.write_text("int answer(void) { return 42; }\n")
+            library = directory / "libanswer.dylib"
+            main_source = directory / "main.c"
+            main_source.write_text(
+                "#include <stdio.h>\n"
+                "extern int answer(void);\n"
+                "int main(void) { printf(\"%d\\n\", answer()); return 0; }\n"
+            )
+            executable = directory / "original"
+            bundle.run("xcrun", "clang", "-dynamiclib", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-install_name," + str(library), library_source, "-o", library)
+            bundle.run("xcrun", "clang", "-Wl,-headerpad_max_install_names",
+                       "-Wl,-rpath," + str(directory), main_source, library, "-o", executable)
+            for binary in (library, executable):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+            app = directory / "Test.app"
+            target = app / "Contents/MacOS/zoitechat"
+            target.parent.mkdir(parents=True)
+            shutil.copy2(executable, target)
+            relocator = bundle.Relocator(app, executable)
+            relocator.relocate(executable, target)
+            # Remove the original dependency so execution proves relocation.
+            library.unlink()
+            for binary in (app / "Contents/Frameworks/libanswer.dylib", target):
+                bundle.run("codesign", "--force", "--sign", "-", binary)
+                bundle.run("codesign", "--verify", "--strict", binary)
+            self.assertEqual(bundle.run(target), "42")
+            self.assertEqual(len(bundle.audit(app)["mach_o"]), 2)
+
+    def test_otool_preserves_paths_with_spaces(self):
+        output = "app:\n\t/opt/Build Dependencies/lib/liba.dylib (compatibility version 1.0.0, current version 1.0.0)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)"
+        with patch.object(bundle, "run", return_value=output):
+            self.assertEqual(bundle.dependencies(Path("app")), ["/opt/Build Dependencies/lib/liba.dylib", "/usr/lib/libSystem.B.dylib"])
+
+    def test_lc_rpaths_preserve_spaces(self):
+        with patch.object(bundle, "run", return_value="cmd LC_RPATH\n cmdsize 48\n path @loader_path/../Build Dependencies (offset 12)\n"):
+            self.assertEqual(bundle.rpaths(Path("app")), ["@loader_path/../Build Dependencies"])
+
+    def test_inherited_rpath_resolution(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            library = directory / "with spaces/libtest.dylib"
+            library.parent.mkdir()
+            library.write_bytes(b"library")
+            self.assertEqual(bundle.resolve_dependency("@rpath/libtest.dylib", directory / "libparent.dylib", directory / "app", [library.parent]), library.resolve())
+
+    def test_unresolved_rpath_fails(self):
+        with self.assertRaisesRegex(RuntimeError, "Cannot resolve"):
+            bundle.resolve_dependency("@rpath/missing.dylib", Path("/tmp/parent"), Path("/tmp/app"), [])
+
+    def test_conflicting_basename_fails(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            directory = Path(temporary)
+            sources = [directory / name / "libtest.dylib" for name in ("one", "two")]
+            for source in sources:
+                source.parent.mkdir()
+                source.write_bytes(b"library")
+            relocator = bundle.Relocator(directory / "App.app", directory / "executable")
+            relocator.copy_dependency(sources[0])
+            with self.assertRaisesRegex(RuntimeError, "Conflicting library basename"):
+                relocator.copy_dependency(sources[1])
+
+    def test_audit_rejects_external_symlink(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            app.mkdir()
+            (app / "outside").symlink_to("/usr/lib")
+            with patch.object(bundle, "run", return_value="arm64"), self.assertRaisesRegex(RuntimeError, "External symlink"):
+                bundle.audit(app)
+
+    def test_audit_raises_minimum_for_dependencies(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe") + b"payload")
+            def fake_run(*args):
+                if args[0] == "lipo":
+                    return "arm64"
+                if args[1] == "-D":
+                    return str(args[2]) + ("\n@rpath/libtest.dylib" if args[2] == library else "")
+                if args[1] == "-L":
+                    name = "@loader_path/../Frameworks/libtest.dylib" if args[2] == binary else "@rpath/libtest.dylib"
+                    return f"{args[2]}:\n\t{name} (compatibility version 1.0.0, current version 1.0.0)"
+                return "cmd LC_BUILD_VERSION\n cmdsize 32\n platform 1\n minos " + ("15.0.1" if args[2] == library else "11.0")
+            with patch.object(bundle, "run", side_effect=fake_run):
+                report = bundle.audit(app)
+            self.assertEqual(report["minimum_macos"], "15.0.1")
+            self.assertEqual(report["architectures"], ["arm64"])
+            self.assertEqual(len(report["mach_o"]), 2)
+
+    def test_audit_rejects_wrong_architecture(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary) / "App.app"
+            binary = app / "Contents/MacOS/zoitechat"
+            library = app / "Contents/Frameworks/libtest.dylib"
+            for path in (binary, library):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(bytes.fromhex("cffaedfe"))
+            with patch.object(bundle, "run", side_effect=["arm64", "x86_64"]), self.assertRaisesRegex(RuntimeError, "Architecture mismatch"):
+                bundle.audit(app)
+
+
+if __name__ == "__main__":
+    unittest.main()

packaging/macos/tests/test_release.py

@@ -0,0 +1,153 @@
+"""Release failure gates, private-key handling and notarization result checks."""
+from contextlib import redirect_stdout
+import base64
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import release
+
+FINGERPRINT = "A" * 40
+IDENTITY = "Developer ID Application: Test Only (NOTAREALID)"
+SUBMISSION = "a8c9438a-b972-455e-aedc-278070349394"
+ENVIRONMENT = {
+    "MACOS_CERTIFICATE_P12_BASE64": base64.b64encode(b"not-a-real-certificate").decode(),
+    "MACOS_CERTIFICATE_PASSWORD": "unit-test-password",
+    "MACOS_SIGNING_IDENTITY": IDENTITY,
+    "APPLE_API_KEY_P8": "-----BEGIN PRIVATE KEY-----\nunit-test-only\n-----END PRIVATE KEY-----",
+    "APPLE_API_KEY_ID": "TESTKEY123",
+    "APPLE_API_ISSUER_ID": SUBMISSION,
+}
+
+
+class ReleaseTests(unittest.TestCase):
+    def credentials(self):
+        with patch.dict(os.environ, ENVIRONMENT, clear=True):
+            return release.Credentials.from_environment()
+
+    def test_config_reports_names_and_never_values(self):
+        with patch.dict(os.environ, {}, clear=True), self.assertRaisesRegex(RuntimeError, "MACOS_CERTIFICATE_P12_BASE64"):
+            release.Credentials.from_environment()
+
+    def test_config_accepts_multiline_certificate_base64(self):
+        env = ENVIRONMENT.copy()
+        text = env["MACOS_CERTIFICATE_P12_BASE64"]
+        env["MACOS_CERTIFICATE_P12_BASE64"] = text[:10] + "\n" + text[10:]
+        with patch.dict(os.environ, env, clear=True):
+            self.assertEqual(release.Credentials.from_environment().certificate, b"not-a-real-certificate")
+
+    def test_config_rejects_development_certificate(self):
+        env = {**ENVIRONMENT, "MACOS_SIGNING_IDENTITY": "Apple Development: Test"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "Developer ID Application"):
+            release.Credentials.from_environment()
+
+    def test_config_rejects_base64_instead_of_plain_p8(self):
+        env = {**ENVIRONMENT, "APPLE_API_KEY_P8": "not-the-pem-contents"}
+        with patch.dict(os.environ, env, clear=True), self.assertRaisesRegex(RuntimeError, "complete, plain-text"):
+            release.Credentials.from_environment()
+
+    def test_execute_does_not_expose_secret_argv_or_stderr(self):
+        result = subprocess.CompletedProcess([], 1, stdout="", stderr="secret-password")
+        with patch.object(release.subprocess, "run", return_value=result):
+            with self.assertRaises(RuntimeError) as error:
+                release.execute(["security", "import", "-P", "secret-password"], "Import certificate")
+        self.assertNotIn("secret-password", str(error.exception))
+
+    def test_matching_identity_requires_developer_id_and_private_key(self):
+        output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+        self.assertEqual(release.resolve_identity(output, IDENTITY), FINGERPRINT)
+        with self.assertRaisesRegex(RuntimeError, "no valid Developer ID"):
+            release.resolve_identity("0 valid identities found", IDENTITY)
+
+    def test_private_files_have_restricted_permissions(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "private.p8"
+            release.write_private(path, b"test-only")
+            self.assertEqual(path.stat().st_mode & 0o777, 0o600)
+
+    def test_keychain_and_private_files_are_cleaned_up_after_signing_failure(self):
+        calls = []
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            output = ''
+            if args[:3] == ["security", "list-keychains", "-d"] and len(args) == 4:
+                output = '"/tmp/original.keychain-db"\n'
+            if args[:2] == ["security", "create-keychain"]:
+                Path(args[-1]).touch()
+            if args[:2] == ["security", "find-identity"]:
+                output = f'  1) {FINGERPRINT} "{IDENTITY}"\n'
+            return subprocess.CompletedProcess(args, 0, output, "")
+        temporary_path = None
+        with patch.object(release, "execute", side_effect=fake_execute), patch.object(release.urllib.request, "urlopen", side_effect=lambda *args, **kwargs: io.BytesIO(b"public-test-ca")):
+            with self.assertRaisesRegex(RuntimeError, "test signing failed"):
+                with release.signing_keychain(self.credentials()) as (keychain, api_key, identity):
+                    temporary_path = keychain.parent
+                    self.assertEqual(identity, FINGERPRINT)
+                    self.assertTrue(api_key.is_file())
+                    raise RuntimeError("test signing failed")
+        self.assertFalse(temporary_path.exists())
+        self.assertIn(["security", "list-keychains", "-d", "user", "-s", "/tmp/original.keychain-db"], calls)
+        self.assertTrue(any(call[:2] == ["security", "delete-keychain"] for call in calls))
+
+    def run_notary(self, status, returncode=0):
+        calls = []
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        directory = Path(temporary.name)
+        app = directory / "ZoiteChat.app"
+        app.mkdir()
+        output = directory / "release.zip"
+        diagnostics = directory / "diagnostics"
+        def fake_execute(args, operation, **kwargs):
+            calls.append([str(value) for value in args])
+            text = ""
+            code = 0
+            if args[:3] == ["xcrun", "notarytool", "submit"]:
+                text = json.dumps({"id": SUBMISSION})
+            elif args[:3] == ["xcrun", "notarytool", "wait"]:
+                text = json.dumps({"id": SUBMISSION, "status": status})
+                code = returncode
+            elif args[:3] == ["xcrun", "notarytool", "log"]:
+                Path(args[-1]).write_text('{"issues": []}')
+            elif args[0] == "ditto":
+                Path(args[-1]).write_bytes(b"test-zip")
+            return subprocess.CompletedProcess(args, code, text, "")
+        with patch.object(release, "execute", side_effect=fake_execute), redirect_stdout(io.StringIO()):
+            if status == "Accepted" and not returncode:
+                release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+            else:
+                with self.assertRaisesRegex(RuntimeError, "not accepted"):
+                    release.notarize(app, output, diagnostics, self.credentials(), directory / "test.p8", "60m")
+        return calls, output, diagnostics
+
+    def test_accepted_notarization_staples_and_checks_before_final_zip(self):
+        calls, output, diagnostics = self.run_notary("Accepted")
+        self.assertTrue(output.is_file())
+        staple = next(i for i, call in enumerate(calls) if call[:3] == ["xcrun", "stapler", "staple"])
+        assess = next(i for i, call in enumerate(calls) if call[0] == "spctl")
+        final_zip = max(i for i, call in enumerate(calls) if call[0] == "ditto")
+        self.assertLess(staple, assess)
+        self.assertLess(assess, final_zip)
+        self.assertEqual(json.loads((diagnostics / "status.json").read_text())["status"], "Accepted")
+
+    def test_rejected_notarization_never_staples_or_publishes(self):
+        calls, output, diagnostics = self.run_notary("Invalid")
+        self.assertFalse(output.exists())
+        self.assertTrue((diagnostics / "notary-log.json").is_file())
+        self.assertFalse(any(call[:2] == ["xcrun", "stapler"] for call in calls))
+
+    def test_timeout_retains_submission_id_and_never_publishes(self):
+        calls, output, diagnostics = self.run_notary("In Progress", 1)
+        self.assertFalse(output.exists())
+        self.assertEqual(json.loads((diagnostics / "submission.json").read_text())["id"], SUBMISSION)
+
+
+if __name__ == "__main__":
+    unittest.main()

packaging/macos/tests/test_visual_smoke.py

@@ -0,0 +1,85 @@
+"""Check that visual-test evidence requires a real IRC handshake and reply."""
+import importlib.util
+from pathlib import Path
+import socket
+import threading
+import unittest
+
+spec = importlib.util.spec_from_file_location(
+    "visual_smoke", Path(__file__).resolve().parents[1] / "visual-smoke.py")
+visual = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(visual)
+
+
+class VisualSmokeTests(unittest.TestCase):
+    def test_tls_clienthello_is_rejected_without_waiting_for_a_newline(self):
+        with visual.IRCServer() as server:
+            thread = threading.Thread(target=server.serve_forever, daemon=True)
+            thread.start()
+            try:
+                with socket.create_connection(server.server_address, timeout=3) as client:
+                    # A TLS handshake record, with no IRC line terminator.
+                    client.sendall(b"\x16\x03\x03\x00\x00")
+                    self.assertEqual(client.recv(1), b"")
+                self.assertIn("Received TLS", server.error)
+                self.assertFalse(server.joined.is_set())
+                self.assertFalse(server.pong.is_set())
+            finally:
+                server.shutdown()
+                thread.join(timeout=3)
+
+    def test_registration_join_and_challenge_reply(self):
+        with visual.IRCServer() as server:
+            thread = threading.Thread(target=server.serve_forever, daemon=True)
+            thread.start()
+            try:
+                with socket.create_connection(server.server_address, timeout=3) as client:
+                    stream = client.makefile("rb")
+
+                    def until(marker):
+                        lines = []
+                        for _ in range(30):
+                            line = stream.readline().decode("utf-8").rstrip()
+                            self.assertTrue(line, "server closed before expected response")
+                            lines.append(line)
+                            if marker in line:
+                                return lines
+                        self.fail("expected response missing: " + marker)
+
+                    client.sendall(b"CAP LS 302\r\nNICK MacTester\r\nUSER ci 0 * :CI\r\n")
+                    until(" CAP * LS :")
+                    self.assertFalse(server.joined.is_set())
+                    client.sendall(b"CAP END\r\n")
+                    until(" 376 MacTester ")
+                    client.sendall(b"JOIN #ci-smoke\r\n")
+                    messages = until("PING :" + server.token)
+                    self.assertTrue(any("PRIVMSG #ci-smoke" in line for line in messages))
+                    self.assertTrue(server.joined.wait(timeout=1))
+                    self.assertFalse(server.pong.is_set())
+                    client.sendall(b"PONG :wrong-token\r\nPING :barrier\r\n")
+                    until("PONG :barrier")
+                    self.assertFalse(server.pong.is_set())
+                    client.sendall(("PONG :" + server.token + "\r\n").encode())
+                    self.assertTrue(server.pong.wait(timeout=1))
+                    client.sendall(b"QUIT\r\n")
+                    stream.close()
+            finally:
+                server.shutdown()
+                thread.join(timeout=3)
+
+    def test_early_disconnect_is_not_success(self):
+        with visual.IRCServer() as server:
+            thread = threading.Thread(target=server.serve_forever, daemon=True)
+            thread.start()
+            try:
+                with socket.create_connection(server.server_address, timeout=3) as client:
+                    client.sendall(b"QUIT\r\n")
+                self.assertFalse(server.joined.is_set())
+                self.assertFalse(server.pong.is_set())
+            finally:
+                server.shutdown()
+                thread.join(timeout=3)
+
+
+if __name__ == "__main__":
+    unittest.main()

packaging/macos/visual-smoke.py

@@ -0,0 +1,182 @@
+#!/usr/bin/env python3
+"""Exercise a relocated Mac bundle against loopback IRC and capture its window."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import platform
+import secrets
+import shutil
+import socketserver
+import subprocess
+import tempfile
+import threading
+import time
+
+
+class IRCServer(socketserver.ThreadingTCPServer):
+    daemon_threads = True
+
+    def __init__(self):
+        self.joined = threading.Event()
+        self.pong = threading.Event()
+        self.error: str | None = None
+        self.token = secrets.token_hex(12)
+        self.transcript: list[str] = []
+        super().__init__(("127.0.0.1", 0), IRCHandler)
+
+
+class IRCHandler(socketserver.StreamRequestHandler):
+    def handle(self):
+        self.connection.settimeout(60)
+        nick, user, registered, negotiating = "", False, False, False
+
+        def send(line):
+            self.server.transcript.append("S: " + line)
+            self.wfile.write((line + "\r\n").encode("utf-8"))
+            self.wfile.flush()
+
+        try:
+            # A TLS ClientHello is binary and need not contain a newline. Do
+            # not leave the fixture waiting for an IRC line until its timeout.
+            if self.rfile.peek(1).startswith(b"\x16"):
+                self.server.error = "Received TLS on the plaintext loopback IRC fixture; launch with SERVER -insecure"
+                self.server.transcript.append("Error: " + self.server.error)
+                return
+            while raw := self.rfile.readline(8192):
+                line = raw.decode("utf-8", errors="replace").rstrip("\r\n")
+                self.server.transcript.append("C: " + line)
+                parts = line.split()
+                if not parts:
+                    continue
+                command = parts[0].upper()
+                if command == "CAP" and len(parts) > 1:
+                    if parts[1].upper() == "LS":
+                        negotiating = True
+                        send(":ci.local CAP * LS :")
+                    elif parts[1].upper() == "END":
+                        negotiating = False
+                    elif parts[1].upper() == "REQ":
+                        send(":ci.local CAP * NAK :" + line.partition(" :")[2])
+                elif command == "NICK" and len(parts) > 1:
+                    nick = parts[1].lstrip(":")
+                elif command == "USER":
+                    user = True
+                elif command == "PING" and len(parts) > 1:
+                    send("PONG :" + parts[-1].lstrip(":"))
+                elif command == "PONG" and parts[-1].lstrip(":") == self.server.token:
+                    self.server.pong.set()
+                elif command == "JOIN" and registered:
+                    channel = parts[1].lstrip(":").split(",")[0]
+                    send(f":{nick}!ci@localhost JOIN :{channel}")
+                    send(f":ci.local 332 {nick} {channel} :ZoiteChat native macOS visual check")
+                    send(f":ci.local 353 {nick} = {channel} :@CiGuide {nick}")
+                    send(f":ci.local 366 {nick} {channel} :End of names")
+                    for message in (
+                        "ZoiteChat is running on macOS " + platform.machine() + ".",
+                        "Connected to the temporary IRC server and joined this channel.",
+                        "Unicode rendering: café — 日本語 — 👋",
+                        "This screenshot is captured from the running application window.",
+                    ):
+                        send(f":CiGuide!ci@localhost PRIVMSG {channel} :{message}")
+                    send("PING :" + self.server.token)
+                    self.server.joined.set()
+                elif command == "QUIT":
+                    return
+                if nick and user and not registered and not negotiating:
+                    registered = True
+                    send(f":ci.local 001 {nick} :Welcome to the ZoiteChat CI test server")
+                    send(f":ci.local 005 {nick} CHANTYPES=# PREFIX=(ov)@+ NETWORK=ZoiteChat-CI :are supported")
+                    send(f":ci.local 376 {nick} :End of MOTD")
+        except (OSError, ValueError) as error:
+            self.server.transcript.append("Connection closed: " + str(error))
+
+
+def stop(process):
+    if process.poll() is None:
+        process.terminate()
+        try:
+            process.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.wait(timeout=5)
+
+
+def check(app: Path, output: Path):
+    report = {"status": "failed", "architecture": platform.machine(),
+              "source_commit": os.environ.get("GITHUB_SHA"),
+              "checks": [], "limitations": "Loopback IRC and window capture; no TLS, input, notifications or stability coverage."}
+    with IRCServer() as server, tempfile.TemporaryDirectory(prefix="ZoiteChat visual check ") as temporary:
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            directory = Path(temporary)
+            capture = directory / "capture-window"
+            subprocess.run(["xcrun", "swiftc", str(Path(__file__).with_name("capture-window.swift")),
+                            "-o", str(capture)], check=True, timeout=120)
+            relocated = directory / "Relocated App/ZoiteChat.app"
+            shutil.copytree(app.resolve(), relocated)
+            subprocess.run(["codesign", "--verify", "--deep", "--strict", str(relocated)], check=True, timeout=30)
+            report["checks"].append("relocated bundle signature verified")
+            config = directory / "config"
+            config.mkdir()
+            (config / "zoitechat.conf").write_text(
+                "gui_slist_skip = 1\ngui_win_width = 1100\ngui_win_height = 700\n"
+                "gui_win_left = 60\ngui_win_top = 60\n"
+                "irc_nick1 = MacTester\nirc_user_name = MacTester\nirc_real_name = Visual check\n"
+                "net_proxy_type = 0\nidentd_server = 0\n", encoding="utf-8")
+            binary = relocated / "Contents/MacOS/zoitechat"
+            with (output / "startup.log").open("w", encoding="utf-8") as log:
+                # SERVER defaults to TLS even for an irc:// URL in this branch.
+                # Explicit plaintext is restricted to our loopback-only fixture.
+                command = f"SERVER -insecure -noproxy irc://127.0.0.1:{server.server_address[1]}/ci-smoke"
+                process = subprocess.Popen([str(binary), "--no-auto", "--cfgdir", str(config),
+                                            "--command", command],
+                                           stdout=log, stderr=log)
+                try:
+                    deadline = time.monotonic() + 60
+                    while not (server.joined.is_set() and server.pong.is_set()):
+                        if server.error:
+                            raise RuntimeError(server.error)
+                        if process.poll() is not None:
+                            raise RuntimeError(f"Application exited with code {process.returncode}; see startup.log")
+                        if time.monotonic() >= deadline:
+                            raise RuntimeError("Timed out waiting for channel join and PING/PONG; see irc.log")
+                        time.sleep(0.2)
+                    report["checks"] += ["connected to loopback IRC", "joined channel", "answered server PING"]
+                    time.sleep(1)
+                    window = subprocess.check_output([str(capture), str(process.pid), str(output / "zoitechat.png")],
+                                                     text=True, timeout=40)
+                    report["window"] = json.loads(window)
+                    if process.poll() is not None:
+                        raise RuntimeError("Application exited during capture")
+                    report["checks"].append("captured a nonblank application window")
+                    report["status"] = "passed"
+                finally:
+                    stop(process)
+        except Exception as error:
+            report["error"] = str(error)
+            raise
+        finally:
+            server.shutdown()
+            thread.join(timeout=5)
+            (output / "irc.log").write_text("\n".join(server.transcript) + "\n", encoding="utf-8")
+            (output / "result.json").write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("app", type=Path)
+    parser.add_argument("--output", type=Path, default=Path("dist/visual-check"))
+    args = parser.parse_args()
+    if platform.system() != "Darwin":
+        parser.error("This check must run on macOS with a logged-in desktop")
+    args.output.mkdir(parents=True, exist_ok=False)
+    check(args.app, args.output.resolve())
+    print("Visual check passed; screenshot and evidence saved to " + str(args.output))
+
+
+if __name__ == "__main__":
+    main()

plugins/fishlim/plugin_zoitechat.c

@@ -710,6 +710,7 @@ static int handle_fishlim(char *word[], char *word_eol[], void *userdata) {
     gtk_box_pack_start(GTK_BOX(content), grid, TRUE, TRUE, 0);
 
     fishlim_target_entry = gtk_entry_new();
+    gtk_widget_set_hexpand(fishlim_target_entry, TRUE);
     if (target)
         gtk_entry_set_text(GTK_ENTRY(fishlim_target_entry), target);
     gtk_grid_attach(GTK_GRID(grid), gtk_label_new("Target nick or channel"), 0, 0, 1, 1);
@@ -760,6 +761,7 @@ static int handle_fishlim(char *word[], char *word_eol[], void *userdata) {
     g_signal_connect(view, "row-activated", G_CALLBACK(fishlim_gui_row_activated), NULL);
 
     scroll = gtk_scrolled_window_new(NULL, NULL);
+    gtk_widget_set_hexpand(scroll, TRUE);
     gtk_widget_set_vexpand(scroll, TRUE);
     gtk_container_add(GTK_CONTAINER(scroll), view);
     gtk_grid_attach(GTK_GRID(grid), scroll, 0, 6, 3, 1);

plugins/sysinfo/meson.build

@@ -26,7 +26,7 @@ if system == 'linux' or system == 'gnu' or system.startswith('gnu/') or system =
       sysinfo_cargs += '-DHAVE_LIBPCI'
       sysinfo_sources += 'unix/pci.c'
 
-      picidsdir = libpci.get_pkgconfig_variable('idsdir')
+      picidsdir = libpci.get_variable(pkgconfig : 'idsdir') 
       pciids = join_paths(picidsdir, 'pci.ids')
       sysinfo_cargs += '-DPCIIDS_FILE="@0@"'.format(pciids)
     endif

po/POTFILES

@@ -30,6 +30,7 @@ src/fe-gtk/fe-gtk.c
 src/fe-gtk/fkeys.c
 src/fe-gtk/gtkutil.c
 src/fe-gtk/ignoregui.c
+src/fe-gtk/inline-image.c
 src/fe-gtk/joind.c
 src/fe-gtk/maingui.c
 src/fe-gtk/menu.c

src/common/cfgfiles.c

@@ -443,6 +443,7 @@ const struct prefs vars[] =
 	{"gui_tab_chans", P_OFFINT (hex_gui_tab_chans), TYPE_BOOL},
 	{"gui_tab_dialogs", P_OFFINT (hex_gui_tab_dialogs), TYPE_BOOL},
 	{"gui_tab_dots", P_OFFINT (hex_gui_tab_dots), TYPE_BOOL},
+	{"gui_tab_font", P_OFFSET (hex_gui_tab_font), TYPE_STR},
 	{"gui_tab_icons", P_OFFINT (hex_gui_tab_icons), TYPE_BOOL},
 	{"gui_dark_mode", P_OFFINT (hex_gui_dark_mode), TYPE_INT},
 	{"gui_gtk3_variant", P_OFFINT (hex_gui_gtk3_variant), TYPE_INT},
@@ -565,6 +566,7 @@ const struct prefs vars[] =
 	{"net_proxy_use", P_OFFINT (hex_net_proxy_use), TYPE_INT},
 	{"net_proxy_user", P_OFFSET (hex_net_proxy_user), TYPE_STR},
 	{"net_reconnect_delay", P_OFFINT (hex_net_reconnect_delay), TYPE_INT},
+	{"net_remote_media", P_OFFINT (hex_net_remote_media), TYPE_BOOL},
 	{"net_throttle", P_OFFINT (hex_net_throttle), TYPE_BOOL},
 
 	{"notify_timeout", P_OFFINT (hex_notify_timeout), TYPE_INT},
@@ -588,6 +590,7 @@ const struct prefs vars[] =
 	{"gui_gtk3_theme", P_OFFSET (hex_gui_gtk3_theme), TYPE_STR},
 	{"text_indent", P_OFFINT (hex_text_indent), TYPE_BOOL},
 	{"text_max_indent", P_OFFINT (hex_text_max_indent), TYPE_INT},
+	{"text_wrap_align", P_OFFINT (hex_text_wrap_align), TYPE_INT},
 	{"text_max_lines", P_OFFINT (hex_text_max_lines), TYPE_INT},
 	{"text_replay", P_OFFINT (hex_text_replay), TYPE_BOOL},
 	{"text_search_case_match", P_OFFINT (hex_text_search_case_match), TYPE_BOOL},
@@ -778,6 +781,8 @@ load_default_config(void)
 	prefs.hex_gui_hide_menu = 1;
 #endif
 	prefs.hex_gui_ctrlq_quit = 1;
+	/* hex_net_remote_media stays 0: loading remote media can reveal the
+	   user's IP address, so it is strictly opt-in */
 	prefs.hex_gui_input_attr = 1;
 	prefs.hex_gui_input_icon = 1;
 	prefs.hex_gui_input_nick = 1;
@@ -877,6 +882,7 @@ load_default_config(void)
 	prefs.hex_net_reconnect_delay = 10;
 	prefs.hex_notify_timeout = 15;
 	prefs.hex_text_max_indent = 256;
+	prefs.hex_text_wrap_align = 0;
 	prefs.hex_text_max_lines = 5000;
 	prefs.hex_url_grabber_limit = 100; 		/* 0 means unlimited */
 

src/common/common.vcxproj

@@ -43,6 +43,7 @@
     <ClInclude Include="typedef.h" />
     <ClInclude Include="url.h" />
     <ClInclude Include="userlist.h" />
+    <ClInclude Include="hexcolor.h" />
     <ClInclude Include="util.h" />
     <ClInclude Include="zoitechat-plugin.h" />
     <ClInclude Include="zoitechat.h" />
@@ -79,6 +80,7 @@
     <ClCompile Include="tree.c" />
     <ClCompile Include="url.c" />
     <ClCompile Include="userlist.c" />
+    <ClCompile Include="hexcolor.c" />
     <ClCompile Include="util.c" />
     <ClCompile Include="zoitechat.c" />
     <ClCompile Include="theme-service.c" />

src/common/common.vcxproj.filters

@@ -98,6 +98,9 @@
     <ClInclude Include="userlist.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="hexcolor.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="util.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -202,6 +205,9 @@
     <ClCompile Include="userlist.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="hexcolor.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="util.c">
       <Filter>Source Files</Filter>
     </ClCompile>

src/common/fe.h

@@ -70,6 +70,9 @@ void fe_add_rawlog (struct server *serv, char *text, int len, int outbound);
 #define FE_MSG_ERROR 8
 #define FE_MSG_MARKUP 16
 void fe_message (char *msg, int flags);
+#ifdef __linux__
+void fe_root_warning (void);
+#endif
 #define FIA_READ 1
 #define FIA_WRITE 2
 #define FIA_EX 4

src/common/gtk3-theme-service.c

@@ -858,8 +858,10 @@ path_depth_from_root (const char *base, const char *path)
 static gint
 theme_root_candidate_compare (gconstpointer a, gconstpointer b)
 {
-	const ThemeRootCandidate *ca = a;
+	/* g_ptr_array_sort() passes pointers to the array slots, not the values
-	const ThemeRootCandidate *cb = b;
+	 * stored in those slots. Dereference once before comparing candidates. */
+	const ThemeRootCandidate *ca = *(ThemeRootCandidate * const *) a;
+	const ThemeRootCandidate *cb = *(ThemeRootCandidate * const *) b;
 	if (ca->has_index_theme != cb->has_index_theme)
 		return ca->has_index_theme ? -1 : 1;
 	if (ca->depth != cb->depth)

src/common/hexcolor.c

@@ -0,0 +1,42 @@
+/* ZoiteChat
+ * Parsing of \004 (hex color) formatting codes: RRGGBB[,RRGGBB].
+ * Kept free of other application dependencies so the xtext widget tests can
+ * compile it on its own.
+ * Distributed under GPL-2.0-or-later; see COPYING. */
+
+#include "hexcolor.h"
+
+static int
+hexcolor_component (const char *s, int avail, guint32 *rgb)
+{
+	int i;
+	guint32 value = 0;
+
+	if (avail < 6)
+		return FALSE;
+	for (i = 0; i < 6; i++)
+	{
+		if (!g_ascii_isxdigit (s[i]))
+			return FALSE;
+		value = (value << 4) | g_ascii_xdigit_value (s[i]);
+	}
+	if (rgb)
+		*rgb = value;
+	return TRUE;
+}
+
+int
+hexcolor_parse (const char *s, int avail, guint32 *fg, guint32 *bg, int *has_bg)
+{
+	if (has_bg)
+		*has_bg = FALSE;
+	if (!hexcolor_component (s, avail, fg))
+		return 0;
+	if (avail >= 7 && s[6] == ',' && hexcolor_component (s + 7, avail - 7, bg))
+	{
+		if (has_bg)
+			*has_bg = TRUE;
+		return 13;
+	}
+	return 6;
+}

src/common/hexcolor.h

@@ -0,0 +1,16 @@
+/* ZoiteChat
+ * Parsing of \004 (hex color) formatting codes: RRGGBB[,RRGGBB].
+ * See https://modern.ircdocs.horse/formatting
+ * Distributed under GPL-2.0-or-later; see COPYING. */
+
+#ifndef ZOITECHAT_HEXCOLOR_H
+#define ZOITECHAT_HEXCOLOR_H
+
+#include <glib.h>
+
+/* Parses the parameters following a \004 byte. Returns the number of bytes
+ * consumed (6 or 13), or 0 if no valid RRGGBB follows. fg, bg and has_bg
+ * may be NULL. */
+int hexcolor_parse (const char *s, int avail, guint32 *fg, guint32 *bg, int *has_bg);
+
+#endif

src/common/ignore.c

@@ -271,7 +271,7 @@ ignore_read_next_entry (char *my_cfg, struct ignore *ignore)
 }
 
 void
-ignore_load ()
+ignore_load (void)
 {
 	struct ignore *ignore;
 	struct stat st;
@@ -302,7 +302,7 @@ ignore_load ()
 }
 
 void
-ignore_save ()
+ignore_save (void)
 {
 	char buf[1024];
 	int fh;

src/common/inbound.c

@@ -1880,38 +1880,51 @@ inbound_toggle_caps (server *serv, const char *extensions_str, gboolean enable)
 	char **extensions;
 	gsize i;
 
+	if (!extensions_str)
+		return;
+
 	extensions = g_strsplit (extensions_str, " ", 0);
 
 	for (i = 0; extensions[i]; i++)
 	{
 		const char *extension = extensions[i];
+		gboolean cap_enable = enable;
+
+		/* ACK prefixes disabled capabilities with '-', unlike CAP DEL. */
+		if (*extension == '-')
+		{
+			cap_enable = FALSE;
+			extension++;
+		}
 
 		if (!strcmp (extension, "solanum.chat/identify-msg"))
-			serv->have_idmsg = enable;
+			serv->have_idmsg = cap_enable;
 		else if (!strcmp (extension, "multi-prefix"))
-			serv->have_namesx = enable;
+			serv->have_namesx = cap_enable;
 		else if (!strcmp (extension, "account-notify"))
-			serv->have_accnotify = enable;
+			serv->have_accnotify = cap_enable;
 		else if (!strcmp (extension, "extended-join"))
-			serv->have_extjoin = enable;
+			serv->have_extjoin = cap_enable;
 		else if (!strcmp (extension, "userhost-in-names"))
-			serv->have_uhnames = enable;
+			serv->have_uhnames = cap_enable;
 		else if (!strcmp (extension, "server-time")
 				|| !strcmp (extension, "znc.in/server-time")
 				|| !strcmp (extension, "znc.in/server-time-iso"))
-			serv->have_server_time = enable;
+			serv->have_server_time = cap_enable;
 		else if (!strcmp (extension, "away-notify"))
-			serv->have_awaynotify = enable;
+			serv->have_awaynotify = cap_enable;
 		else if (!strcmp (extension, "account-tag"))
-			serv->have_account_tag = enable;
+			serv->have_account_tag = cap_enable;
 		else if (!strcmp (extension, "message-tags"))
-			serv->have_message_tags = enable;
+			serv->have_message_tags = cap_enable;
 		else if (!strcmp (extension, "echo-message"))
-			serv->have_echo_message = enable;
+			serv->have_echo_message = cap_enable;
 		else if (!strcmp (extension, "sasl"))
 		{
-			serv->have_sasl = enable;
+			gboolean start_auth = cap_enable && !serv->have_sasl;
-			if (enable)
+
+			serv->have_sasl = cap_enable;
+			if (start_auth)
 			{
 #ifdef USE_OPENSSL
 				if (serv->loginmethod == LOGIN_SASLEXTERNAL)
@@ -1962,10 +1975,15 @@ inbound_cap_ack (server *serv, char *nick, char *extensions,
 	inbound_toggle_caps (serv, extensions, TRUE);
 }
 
+static void inbound_request_new_caps (server *serv, const char *extensions_str,
+									 const message_tags_data *tags_data);
+
 void
 inbound_cap_new (server *serv, char *nick, char *extensions,
 					 const message_tags_data *tags_data)
 {
+	gboolean sts_upgrade_triggered = FALSE;
+
 	if (extensions)
 	{
 		char **tokens = g_strsplit (extensions, " ", 0);
@@ -1977,7 +1995,7 @@ inbound_cap_new (server *serv, char *nick, char *extensions,
 
 			if (!g_strcmp0 (parts[0], "sts") && parts[1] && parts[1][0])
 			{
-				sts_handle_capability (serv, parts[1]);
+				sts_upgrade_triggered |= sts_handle_capability (serv, parts[1]);
 			}
 
 			g_strfreev (parts);
@@ -1986,38 +2004,22 @@ inbound_cap_new (server *serv, char *nick, char *extensions,
 		g_strfreev (tokens);
 	}
 
-	EMIT_SIGNAL_TIMESTAMP (XP_TE_CAPACK, serv->server_session, nick, extensions,
+	EMIT_SIGNAL_TIMESTAMP (XP_TE_CAPLIST, serv->server_session, nick, extensions,
 								  NULL, NULL, 0, tags_data->timestamp);
 
-	inbound_toggle_caps (serv, extensions, TRUE);
+	/* NEW advertises availability; only ACK confirms an enabled capability. */
+	if (!sts_upgrade_triggered)
+		inbound_request_new_caps (serv, extensions, tags_data);
 }
 
 void
 inbound_cap_del (server *serv, char *nick, char *extensions,
 					 const message_tags_data *tags_data)
 {
-	if (extensions)
-	{
-		char **tokens = g_strsplit (extensions, " ", 0);
-		int i;
-
-		for (i = 0; tokens[i]; i++)
-		{
-			if (!g_strcmp0 (tokens[i], "sts") ||
-				g_str_has_prefix (tokens[i], "sts="))
-			{
-				/* STS cannot be disabled via CAP DEL. */
-				g_strfreev (tokens);
-				return;
-			}
-		}
-
-		g_strfreev (tokens);
-	}
-
 	EMIT_SIGNAL_TIMESTAMP (XP_TE_CAPDEL, serv->server_session, nick, extensions,
 								  NULL, NULL, 0, tags_data->timestamp);
 
+	/* STS has no toggle, but must not prevent other capabilities being removed. */
 	inbound_toggle_caps (serv, extensions, FALSE);
 }
 
@@ -2053,6 +2055,44 @@ static const char * const supported_caps[] = {
 	"solanum.chat/identify-msg",
 };
 
+static void
+inbound_request_new_caps (server *serv, const char *extensions_str,
+							 const message_tags_data *tags_data)
+{
+	char **extensions;
+	gsize i, x;
+
+	if (!extensions_str)
+		return;
+
+	extensions = g_strsplit (extensions_str, " ", 0);
+	for (i = 0; extensions[i]; i++)
+	{
+		char *value = strchr (extensions[i], '=');
+
+		if (value)
+			*value = '\0';
+	}
+
+	/* Request each supported capability once, keeping every IRC line bounded.
+	 * SASL is negotiated during login and is not in supported_caps. */
+	for (x = 0; x < G_N_ELEMENTS (supported_caps); x++)
+	{
+		for (i = 0; extensions[i]; i++)
+		{
+			if (!strcmp (extensions[i], supported_caps[x]))
+			{
+				EMIT_SIGNAL_TIMESTAMP (XP_TE_CAPREQ, serv->server_session,
+										  extensions[i], NULL, NULL, NULL, 0,
+										  tags_data->timestamp);
+				tcp_sendf (serv, "CAP REQ :%s\r\n", extensions[i]);
+				break;
+			}
+		}
+	}
+	g_strfreev (extensions);
+}
+
 static int
 get_supported_mech (server *serv, const char *list)
 {

src/common/macos.c

@@ -0,0 +1,127 @@
+/* Relocate resources before GTK, Fontconfig, GIO or OpenSSL initialize.
+ * GPL-2.0-or-later; see COPYING. */
+#include "config.h"
+#include "macos.h"
+#include <gio/gio.h>
+#include <mach-o/dyld.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char *locale_dir;
+
+static void
+set_path (const char *variable, const char *base, const char *relative)
+{
+    char *path = g_build_filename (base, relative, NULL);
+    g_setenv (variable, path, TRUE);
+    g_free (path);
+}
+
+static void
+relocate_cache (const char *resources, const char *name, const char *variable)
+{
+    char *input = g_build_filename (resources, name, NULL);
+    char *contents = NULL;
+    GError *error = NULL;
+
+    if (g_file_get_contents (input, &contents, NULL, &error))
+    {
+        /* GTK cache files require absolute module paths. Write only data to
+         * the user cache, never into the signed/read-only application bundle. */
+        char **parts = g_strsplit (contents, "@ZOITECHAT_RESOURCES@", -1);
+        char *escaped = g_strescape (resources, NULL);
+        char *relocated = g_strjoinv (escaped, parts);
+        g_free (escaped);
+        char *digest = g_compute_checksum_for_string (G_CHECKSUM_SHA256, relocated, -1);
+        char *directory = g_build_filename (g_get_user_cache_dir (), "zoitechat", "modules", digest, NULL);
+        char *output = g_build_filename (directory, name, NULL);
+        if (g_mkdir_with_parents (directory, 0700) == 0 &&
+            g_file_set_contents (output, relocated, -1, &error))
+            g_setenv (variable, output, TRUE);
+        else
+            g_warning ("Cannot relocate %s: %s", name, error ? error->message : "cannot create cache directory");
+        g_free (output);
+        g_free (directory);
+        g_free (digest);
+        g_free (relocated);
+        g_strfreev (parts);
+    }
+    else
+        g_warning ("Cannot read %s: %s", input, error->message);
+    g_clear_error (&error);
+    g_free (contents);
+    g_free (input);
+}
+
+void
+zoitechat_macos_init (void)
+{
+    uint32_t size = 0;
+    char *raw, *executable, *macos, *contents, *resources, *marker;
+    char *ca;
+    GTlsDatabase *database;
+    GError *error = NULL;
+
+    _NSGetExecutablePath (NULL, &size);
+    raw = g_malloc (size);
+    if (_NSGetExecutablePath (raw, &size) != 0)
+    {
+        g_free (raw);
+        return;
+    }
+    executable = realpath (raw, NULL);
+    g_free (raw);
+    if (!executable)
+        return;
+    macos = g_path_get_dirname (executable);
+    free (executable);
+    contents = g_path_get_dirname (macos);
+    resources = g_build_filename (contents, "Resources", NULL);
+    marker = g_build_filename (resources, "zoitechat-bundle", NULL);
+    g_free (macos);
+    g_free (contents);
+    if (!g_file_test (marker, G_FILE_TEST_IS_REGULAR))
+    {
+        g_free (marker);
+        g_free (resources);
+        return; /* Ordinary Meson installs and build-tree runs retain their paths. */
+    }
+    g_free (marker);
+    g_setenv ("GDK_BACKEND", "quartz", TRUE);
+    set_path ("ZOITECHAT_MACOS_SHARE", resources, "share");
+    set_path ("XDG_DATA_DIRS", resources, "share");
+    set_path ("GSETTINGS_SCHEMA_DIR", resources, "share/glib-2.0/schemas");
+    set_path ("FONTCONFIG_FILE", resources, "fonts.conf");
+    set_path ("GIO_EXTRA_MODULES", resources, "lib/gio/modules");
+    set_path ("GIO_MODULE_DIR", resources, "lib/gio/modules");
+    set_path ("ZOITECHAT_LIBDIR", resources, "lib/zoitechat/plugins");
+    set_path ("ZOITECHAT_EMOJI_FONT", resources, "share/fonts/zoitechat/NotoColorEmoji.ttf");
+    set_path ("ZOITECHAT_ENCHANT_LIBRARY", resources, "lib/libenchant-2.dylib");
+    g_setenv ("ZOITECHAT_ENCHANT_PREFIX", resources, TRUE);
+    set_path ("SSL_CERT_FILE", resources, "certs/ca-bundle.crt");
+    set_path ("OPENSSL_MODULES", resources, "lib/ossl-modules");
+    locale_dir = g_build_filename (resources, "share/locale", NULL);
+    relocate_cache (resources, "pixbuf-loaders.cache", "GDK_PIXBUF_MODULE_FILE");
+    relocate_cache (resources, "gtk-immodules.cache", "GTK_IM_MODULE_FILE");
+
+    /* HTTPS previews use GIO; IRC uses OpenSSL. Give both the same CA set. */
+    ca = g_build_filename (resources, "certs/ca-bundle.crt", NULL);
+    database = g_tls_file_database_new (ca, &error);
+    if (database)
+    {
+        g_tls_backend_set_default_database (g_tls_backend_get_default (), database);
+        g_object_unref (database);
+    }
+    else
+        g_warning ("Cannot load bundled HTTPS trust database: %s", error->message);
+    g_clear_error (&error);
+    g_free (ca);
+    g_free (resources);
+}
+
+const char *
+zoitechat_macos_locale_dir (void)
+{
+    return locale_dir ? locale_dir : LOCALEDIR;
+}

src/common/macos.h

@@ -0,0 +1,6 @@
+/* macOS bundle runtime; GPL-2.0-or-later, see COPYING. */
+#ifndef ZOITECHAT_MACOS_H
+#define ZOITECHAT_MACOS_H
+void zoitechat_macos_init (void);
+const char *zoitechat_macos_locale_dir (void);
+#endif

src/common/meson.build

@@ -25,9 +25,14 @@ common_sources = [
   'tree.c',
   'url.c',
   'userlist.c',
+  'hexcolor.c',
   'util.c'
 ]
 
+if host_machine.system() == 'darwin'
+  common_sources += 'macos.c'
+endif
+
 secretstore_sources = files('secretstore.c')
 
 common_sysinfo_deps = []
@@ -154,12 +159,19 @@ zoitechat_common = static_library('zoitechatcommon',
   pic: true
 )
 
+# zoitechat.h exposes OpenSSL types whenever TLS is enabled. Propagate its
+# header requirements even to standalone consumers that do not call OpenSSL.
+zoitechat_common_header_deps = [libgio_dep]
+if libssl_dep.found()
+  zoitechat_common_header_deps += libssl_dep.partial_dependency(compile_args: true, includes: true)
+endif
+
 zoitechat_common_dep = declare_dependency(
   sources: [textevents, public_suffix_data] + marshal,
   link_with: zoitechat_common,
   include_directories: common_includes,
   compile_args: common_cflags,
-  dependencies: libgio_dep,
+  dependencies: zoitechat_common_header_deps,
 )
 
 zoitechat_plugin_dep = declare_dependency(
@@ -175,7 +187,7 @@ gtk3_theme_service_tests = executable('gtk3_theme_service_tests',
     'gtk3-theme-service.c',
   ],
   include_directories: [config_h_include, include_directories('.')],
-  dependencies: [libgio_dep] + (libarchive_dep.found() ? [libarchive_dep] : []),
+  dependencies: zoitechat_common_header_deps + (libarchive_dep.found() ? [libarchive_dep] : []),
 )
 
 test('GTK3 Theme Service Tests', gtk3_theme_service_tests,
@@ -197,3 +209,18 @@ test('Emoji Data Tests', emoji_data_tests,
   protocol: 'tap',
   timeout: 120,
 )
+
+hexcolor_tests = executable('hexcolor_tests',
+  [
+    'tests/test-hexcolor.c',
+    'hexcolor.c',
+    'util.c',
+  ],
+  include_directories: [config_h_include, include_directories('.')],
+  dependencies: [libgio_dep] + (libssl_dep.found() ? [libssl_dep] : []),
+)
+
+test('Hex Color Tests', hexcolor_tests,
+  protocol: 'tap',
+  timeout: 120,
+)

src/common/notify.c

@@ -662,7 +662,7 @@ notify_isnotify (struct session *sess, char *name)
 }
 
 void
-notify_cleanup ()
+notify_cleanup (void)
 {
 	GSList *list = notify_list;
 	GSList *nslist, *srvlist;

src/common/outbound.c

@@ -2826,6 +2826,7 @@ static gboolean
 client_tag_allowed (server *serv, const char *tag)
 {
 	char **deny;
+	gboolean blocked = FALSE;
 	int i;
 
 	if (!serv->have_message_tags)
@@ -2837,15 +2838,16 @@ client_tag_allowed (server *serv, const char *tag)
 	deny = g_strsplit (serv->clienttagdeny, ",", 0);
 	for (i = 0; deny[i]; i++)
 	{
-		if (!strcmp (deny[i], "*") || !strcmp (deny[i], tag) || (deny[i][0] == '+' && !strcmp (deny[i] + 1, tag)))
+		if (!strcmp (deny[i], "*"))
-		{
+			blocked = TRUE;
-			g_strfreev (deny);
+		else if (deny[i][0] == '-' && !strcmp (deny[i] + 1, tag))
-			return FALSE;
+			blocked = FALSE;
-		}
+		else if (!strcmp (deny[i], tag) || (deny[i][0] == '+' && !strcmp (deny[i] + 1, tag)))
+			blocked = TRUE;
 	}
 
 	g_strfreev (deny);
-	return TRUE;
+	return !blocked;
 }
 
 static char *

src/common/proto-irc.c

@@ -1288,6 +1288,11 @@ process_named_msg (session *sess, char *type, char *word[], char *word_eol[],
 					char *user = net && net->user ? net->user : prefs.hex_irc_user_name;
 
 					response = challengeauth_response (user, serv->password, word[5]);
+					if (response == NULL)
+					{
+						PrintTextf (serv->server_session, _("Error building CHALLENGEAUTH for %s"), user);
+						return;
+					}
 
 					tcp_sendf (serv, "PRIVMSG %s :CHALLENGEAUTH %s %s %s\r\n",
 						CHALLENGEAUTH_NICK,

src/common/ssl.c

@@ -155,7 +155,7 @@ _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
 {
 	X509 *peer_cert;
 	const X509_PUBKEY *key;
-	X509_ALGOR *algor = NULL;
+	ASN1_OBJECT *obj = NULL;
 	EVP_PKEY *peer_pkey;
 	char notBefore[64];
 	char notAfter[64];
@@ -174,10 +174,10 @@ _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
 	broke_oneline (cert_info->issuer, cert_info->issuer_word);
 
 	key = X509_get_X509_PUBKEY(peer_cert);
-	if (!X509_PUBKEY_get0_param(NULL, NULL, 0, &algor, key))
+	if (!X509_PUBKEY_get0_param(&obj, NULL, NULL, NULL, key))
 		return 1;
 
-	alg = OBJ_obj2nid (algor->algorithm);
+	alg = OBJ_obj2nid (obj);
 #ifndef HAVE_X509_GET_SIGNATURE_NID
 	sign_alg = OBJ_obj2nid (peer_cert->sig_alg->algorithm);
 #else

src/common/tests/test-hexcolor.c

@@ -0,0 +1,117 @@
+/* ZoiteChat
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#include <string.h>
+
+#include <glib.h>
+
+#include "../hexcolor.h"
+#include "../util.h"
+
+static void
+test_parse_foreground (void)
+{
+	guint32 fg = 0, bg = 0xDEAD;
+	int has_bg = TRUE;
+
+	g_assert_cmpint (hexcolor_parse ("FF8800text", 10, &fg, &bg, &has_bg), ==, 6);
+	g_assert_cmphex (fg, ==, 0xFF8800);
+	g_assert_false (has_bg);
+	g_assert_cmphex (bg, ==, 0xDEAD);
+}
+
+static void
+test_parse_foreground_and_background (void)
+{
+	guint32 fg = 0, bg = 0;
+	int has_bg = FALSE;
+
+	g_assert_cmpint (hexcolor_parse ("112233,a0b0c0x", 14, &fg, &bg, &has_bg), ==, 13);
+	g_assert_cmphex (fg, ==, 0x112233);
+	g_assert_cmphex (bg, ==, 0xA0B0C0);
+	g_assert_true (has_bg);
+}
+
+static void
+test_parse_bad_background_keeps_foreground (void)
+{
+	guint32 fg = 0;
+	int has_bg = TRUE;
+
+	/* ",12" is plain text after a valid foreground, not a background */
+	g_assert_cmpint (hexcolor_parse ("112233,12 hi", 12, &fg, NULL, &has_bg), ==, 6);
+	g_assert_cmphex (fg, ==, 0x112233);
+	g_assert_false (has_bg);
+}
+
+static void
+test_parse_bare (void)
+{
+	/* a bare \004 resets colors, like a bare \003 */
+	g_assert_cmpint (hexcolor_parse (" text", 5, NULL, NULL, NULL), ==, 0);
+	g_assert_cmpint (hexcolor_parse ("12345G", 6, NULL, NULL, NULL), ==, 0);
+	g_assert_cmpint (hexcolor_parse ("", 0, NULL, NULL, NULL), ==, 0);
+}
+
+static void
+test_parse_respects_length (void)
+{
+	g_assert_cmpint (hexcolor_parse ("FF8800", 5, NULL, NULL, NULL), ==, 0);
+	g_assert_cmpint (hexcolor_parse ("FF8800,112233", 12, NULL, NULL, NULL), ==, 6);
+}
+
+static void
+assert_stripped (const char *in, int flags, const char *expected)
+{
+	char out[128];
+
+	strip_color2 (in, -1, out, flags);
+	g_assert_cmpstr (out, ==, expected);
+}
+
+static void
+test_strip (void)
+{
+	assert_stripped ("\004FF8800alice\017: hi", STRIP_ALL, "alice: hi");
+	assert_stripped ("\004112233,445566bg", STRIP_ALL, "bg");
+	assert_stripped ("a\004 b", STRIP_ALL, "a b");
+	assert_stripped ("\004FF8800\00312x", STRIP_ALL, "x");
+	/* a trailing code with too few digits leaves the rest as text */
+	assert_stripped ("x\004FF88", STRIP_ALL, "xFF88");
+}
+
+static void
+test_strip_keeps_hex_without_strip_color (void)
+{
+	assert_stripped ("\004FF8800red\002", STRIP_ATTRIB, "\004FF8800red");
+}
+
+int
+main (int argc, char *argv[])
+{
+	g_test_init (&argc, &argv, NULL);
+
+	g_test_add_func ("/hexcolor/parse/foreground", test_parse_foreground);
+	g_test_add_func ("/hexcolor/parse/foreground-and-background", test_parse_foreground_and_background);
+	g_test_add_func ("/hexcolor/parse/bad-background", test_parse_bad_background_keeps_foreground);
+	g_test_add_func ("/hexcolor/parse/bare", test_parse_bare);
+	g_test_add_func ("/hexcolor/parse/length", test_parse_respects_length);
+	g_test_add_func ("/hexcolor/strip/all", test_strip);
+	g_test_add_func ("/hexcolor/strip/attrib-only", test_strip_keeps_hex_without_strip_color);
+
+	return g_test_run ();
+}

src/common/text.c

@@ -1808,7 +1808,7 @@ pevent_check_all_loaded (void)
 }
 
 void
-load_text_events ()
+load_text_events (void)
 {
 	memset (&pntevts_text, 0, sizeof (char *) * (NUM_XP));
 	memset (&pntevts, 0, sizeof (char *) * (NUM_XP));
@@ -2488,7 +2488,7 @@ sound_load_event (char *evt, char *file)
 }
 
 void
-sound_load ()
+sound_load (void)
 {
 	int fd;
 	char buf[512];
@@ -2521,7 +2521,7 @@ sound_load ()
 }
 
 void
-sound_save ()
+sound_save (void)
 {
 	int fd, i;
 	char buf[512];

src/common/util.c

@@ -47,6 +47,7 @@
 #include "zoitechatc.h"
 #include <ctype.h>
 #include "util.h"
+#include "hexcolor.h"
 
 #if defined (__FreeBSD__) || defined (__APPLE__)
 #include <sys/sysctl.h>
@@ -330,6 +331,14 @@ strip_color2 (const char *src, int len, char *dst, int flags)
 				if (!(flags & STRIP_COLOR)) goto pass_char;
 				rcol = 2;
 				break;
+			case '\004':			  /*ATTR_HEXCOLOR: */
+				if (!(flags & STRIP_COLOR)) goto pass_char;
+				{
+					int skip = hexcolor_parse (src + 1, len, NULL, NULL, NULL);
+					src += skip;
+					len -= skip;
+				}
+				break;
 			case HIDDEN_CHAR:	/* CL: invisible text (for event formats only) */	/* this takes care of the topic */
 				if (!(flags & STRIP_HIDDEN)) goto pass_char;
 				break;
@@ -1444,7 +1453,7 @@ challengeauth_response (const char *username, const char *password, const char *
 	char *passhash;
 	char *key;
 	char *keyhash;
-	unsigned char *digest;
+	unsigned char digest[SHA256_DIGEST_LENGTH];
 	GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2);
 
 	user = rfc_strlower (username); /* convert username to lowercase as per the RFC */
@@ -1460,7 +1469,12 @@ challengeauth_response (const char *username, const char *password, const char *
 	keyhash = str_sha256hash (key);
 	g_free (key);
 
-	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
+	if (HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), digest, NULL) == NULL)
+	{
+		g_free (keyhash);
+		g_string_free (buf, TRUE);
+		return NULL;
+	}
 	g_free (keyhash);
 
 	for (i = 0; i < SHA256_DIGEST_LENGTH; i++)

src/common/zoitechat.c

@@ -54,6 +54,9 @@
 #include "text.h"
 #include "url.h"
 #include "zoitechatc.h"
+#ifdef __APPLE__
+#include "macos.h"
+#endif
 
 #if ! GLIB_CHECK_VERSION (2, 36, 0)
 #include <glib-object.h>			/* for g_type_init() */
@@ -95,6 +98,7 @@ int zoitechat_is_quitting = FALSE;
 /* command-line args */
 int arg_dont_autoconnect = FALSE;
 int arg_skip_plugins = FALSE;
+gint arg_run_as_root = FALSE;
 char *arg_url = NULL;
 char **arg_urls = NULL;
 char *arg_command = NULL;
@@ -463,7 +467,6 @@ doover:
 		while (list)
 		{
 			sess = list->data;
-			if (!sess->server->have_awaynotify)
 			sess->done_away_check = FALSE;
 			list = list->next;
 		}
@@ -1172,10 +1175,33 @@ main (int argc, char *argv[])
 	int i;
 	int ret;
 
+#ifdef __APPLE__
+	zoitechat_macos_init ();
+#endif
+
 #ifdef WIN32
 	HRESULT coinit_result;
 #endif
 
+#ifdef __linux__
+	for (i = 1; i < argc; i++)
+	{
+		if (strcmp (argv[i], "--") == 0)
+			break;
+		if (strcmp (argv[i], "--run-as-root") == 0)
+		{
+			arg_run_as_root = TRUE;
+			break;
+		}
+	}
+
+	if (geteuid () == 0 && !arg_run_as_root)
+	{
+		fe_root_warning ();
+		return EXIT_FAILURE;
+	}
+#endif
+
 	srand ((unsigned int) time (NULL)); /* CL: do this only once! */
 
 	/* We must check for the config dir parameter, otherwise load_config() will behave incorrectly.
@@ -1264,7 +1290,7 @@ main (int argc, char *argv[])
 #ifndef WIN32
 #ifndef __EMX__
 	/* OS/2 uses UID 0 all the time */
-	if (getuid () == 0)
+	if (getuid () == 0 && !arg_run_as_root)
 		fe_message (_("* Running IRC as root is stupid! You should\n"
 			      "  create a User Account and use that to login.\n"), FE_MSG_WARN|FE_MSG_WAIT);
 #endif

src/common/zoitechat.h

@@ -204,6 +204,7 @@ struct zoitechatprefs
 	unsigned int hex_net_auto_reconnect;
 	unsigned int hex_net_auto_reconnectonfail;
 	unsigned int hex_net_proxy_auth;
+	unsigned int hex_net_remote_media;
 	unsigned int hex_net_throttle;
 	unsigned int hex_notify_whois_online;
 	unsigned int hex_perl_warnings;
@@ -305,6 +306,7 @@ struct zoitechatprefs
 	int hex_net_reconnect_delay;
 	int hex_notify_timeout;
 	int hex_text_max_indent;
+	int hex_text_wrap_align;
 	int hex_text_max_lines;
 	int hex_url_grabber_limit;
 
@@ -314,6 +316,7 @@ struct zoitechatprefs
 	char hex_dcc_completed_dir[PATHLEN + 1];
 	char hex_dcc_dir[PATHLEN + 1];
 	char hex_dcc_ip[DOMAINLEN + 1];
+	char hex_gui_tab_font[FONTNAMELEN + 1];
 	char hex_gui_ulist_doubleclick[256];
 	char hex_input_command_char[4];
 	char hex_irc_extra_hilight[300];
@@ -448,6 +451,7 @@ typedef struct session
 	int mode_timeout_tag;
 	int typing_timeout_tag;
 	int typing_status;
+	gint64 typing_last_sent;
 	int typing_animation_tag;
 	int typing_animation_frame;
 

src/common/zoitechatc.h

@@ -25,6 +25,7 @@ extern struct zoitechatprefs prefs;
 extern int zoitechat_is_quitting;
 extern gint arg_skip_plugins;	/* command-line args */
 extern gint arg_dont_autoconnect;
+extern gint arg_run_as_root;
 extern char *arg_url;
 extern char **arg_urls;
 extern char *arg_command;

src/fe-gtk/ascii.c

@@ -138,7 +138,7 @@ ascii_open (void)
 		{
 			table_pos++;
 			hbox = gtk_box_new (GTK_ORIENTATION_HORIZONTAL, 0);
-			gtk_container_add (GTK_CONTAINER (vbox), hbox);
+			gtk_box_pack_start (GTK_BOX (vbox), hbox, TRUE, TRUE, 0);
 			gtk_widget_show (hbox);
 			i++;
 			continue;
@@ -155,14 +155,14 @@ ascii_open (void)
 								G_CALLBACK (ascii_click), NULL);
 		g_signal_connect (G_OBJECT (but), "enter-notify-event",
 								G_CALLBACK (ascii_enter), label);
-		gtk_box_pack_start (GTK_BOX (hbox), but, 0, 0, 0);
+		gtk_box_pack_start (GTK_BOX (hbox), but, TRUE, TRUE, 0);
 		gtk_widget_show (but);
 
 		table_pos += len;
 	}
 
 	frame = gtk_frame_new ("");
-	gtk_container_add (GTK_CONTAINER (hbox), frame);
+	gtk_box_pack_start (GTK_BOX (hbox), frame, TRUE, TRUE, 0);
 	gtk_container_add (GTK_CONTAINER (frame), label);
 	gtk_widget_show (label);
 	gtk_widget_show (frame);

src/fe-gtk/chanview-tabs.c

@@ -19,6 +19,8 @@
 
 /* file included in chanview.c */
 
+#include "theme/theme-css.h"
+
 typedef struct
 {
 	GtkWidget *outer;	/* outer box */
@@ -690,6 +692,7 @@ cv_tabs_add (chanview *cv, chan *ch, char *name, GtkTreeIter *parent)
 	GtkWidget *label;
 	GtkWidget *close_button;
 	GtkWidget *close_icon;
+	GtkCssProvider *close_css;
 
 	but = gtk_toggle_button_new ();
 	gtk_widget_set_name (but, "zoitechat-tab");
@@ -698,9 +701,27 @@ cv_tabs_add (chanview *cv, chan *ch, char *name, GtkTreeIter *parent)
 	cv_add_scroll_events (but);
 	hbox = gtk_box_new (GTK_ORIENTATION_HORIZONTAL, 2);
 	label = gtk_label_new (name);
+	if (prefs.hex_gui_tab_font[0])
+	{
+		PangoFontDescription *font_desc;
+
+		/* Keep activity colours and the Smaller text scale in the label attributes. */
+		font_desc = pango_font_description_from_string (prefs.hex_gui_tab_font);
+		gtkutil_apply_palette (label, NULL, NULL, font_desc);
+		pango_font_description_free (font_desc);
+	}
 	close_button = gtk_button_new ();
 	cv_add_scroll_events (close_button);
 	gtk_style_context_add_class (gtk_widget_get_style_context (close_button), "flat");
+	gtk_style_context_add_class (gtk_widget_get_style_context (close_button), "zoitechat-tab-close");
+	/* Theme button minimums and padding must not determine the tab height. */
+	close_css = gtk_css_provider_new ();
+	gtk_css_provider_load_from_data (close_css,
+		".zoitechat-tab-close { min-width: 0; min-height: 0; padding: 1px; margin: 0; }",
+		-1, NULL);
+	theme_css_apply_widget_provider (close_button, GTK_STYLE_PROVIDER (close_css));
+	g_object_unref (close_css);
+	gtk_widget_set_valign (close_button, GTK_ALIGN_CENTER);
 	close_icon = gtk_image_new_from_icon_name ("window-close-symbolic", GTK_ICON_SIZE_MENU);
 	gtk_image_set_pixel_size (GTK_IMAGE (close_icon), 8);
 	gtk_button_set_always_show_image (GTK_BUTTON (close_button), TRUE);

src/fe-gtk/chanview-tree.c

@@ -300,6 +300,14 @@ cv_tree_focus (chan *ch)
 
 	path = gtk_tree_model_get_path (model, &ch->iter);
 	if (path)
+	{
+		if (!gtk_widget_get_realized (GTK_WIDGET (tree)))
+		{
+			/* Layout changes can restore focus before the new tree is realized.
+			 * Let GTK track the row and scroll once its geometry is available. */
+			gtk_tree_view_scroll_to_cell (tree, path, NULL, TRUE, 0.5, 0.5);
+		}
+		else
 		{
 			/* This full section does what
 			 * gtk_tree_view_scroll_to_cell (tree, path, NULL, TRUE, 0.5, 0.5);
@@ -322,6 +330,7 @@ cv_tree_focus (chan *ch)
 					dest_y = 0;
 				gtk_tree_view_scroll_to_point (tree, -1, dest_y);
 			}
+		}
 		/* theft done, now make it focused like */
 		gtk_tree_view_set_cursor (tree, path, NULL, FALSE);
 		gtk_tree_path_free (path);

src/fe-gtk/emoji-font.c

@@ -78,7 +78,9 @@ emoji_font_get_map (void)
 		"<edit name='family' mode='assign'><string>" ZOITECHAT_EMOJI_FAMILY
 		"</string></edit></match>"
 		"<match target='pattern'><test name='family'><string>emoji</string></test>"
-		"<edit name='family' mode='prepend' binding='strong'><string>"
+		/* System rules may already have prepended older emoji families.
+		 * Put our bundled family before those, not just before 'emoji'. */
+		"<edit name='family' mode='prepend_first' binding='strong'><string>"
 		ZOITECHAT_EMOJI_FAMILY "</string></edit></match>"
 		"</fontconfig>", escaped);
 	registered = FcConfigParseAndLoadFromMemory (config, (const FcChar8 *) rules, FcTrue) &&

src/fe-gtk/fe-gtk.c

@@ -21,6 +21,9 @@
 #include <stdlib.h>
 
 #include "fe-gtk.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 #ifdef GDK_WINDOWING_WIN32
 #include <gdk/gdkwin32.h>
@@ -49,6 +52,7 @@
 #include "chanlist.h"
 #include "joind.h"
 #include "xtext.h"
+#include "inline-image.h"
 #include "theme/theme-gtk.h"
 #include "menu.h"
 #include "notifygui.h"
@@ -89,6 +93,9 @@ static const GOptionEntry gopt_entries[] =
  {"no-auto",	'a', 0, G_OPTION_ARG_NONE,	&arg_dont_autoconnect, N_("Don't auto connect to servers"), NULL},
  {"cfgdir",	'd', 0, G_OPTION_ARG_STRING,	&arg_cfgdir, N_("Use a different config directory"), "PATH"},
  {"no-plugins",	'n', 0, G_OPTION_ARG_NONE,	&arg_skip_plugins, N_("Don't auto load any plugins"), NULL},
+#ifdef __linux__
+ {"run-as-root", 0, 0, G_OPTION_ARG_NONE, &arg_run_as_root, N_("Allow ZoiteChat to run as root (unsafe)"), NULL},
+#endif
  {"plugindir",	'p', 0, G_OPTION_ARG_NONE,	&arg_show_autoload, N_("Show plugin/script auto-load directory"), NULL},
  {"configdir",	'u', 0, G_OPTION_ARG_NONE,	&arg_show_config, N_("Show user config directory"), NULL},
  {"url",	 0,  G_OPTION_FLAG_HIDDEN, G_OPTION_ARG_STRING, &arg_url, N_("Open an irc://server:port/channel?key URL"), "URL"},
@@ -102,6 +109,33 @@ static const GOptionEntry gopt_entries[] =
  {NULL}
 };
 
+#ifdef __linux__
+void
+fe_root_warning (void)
+{
+	const char *message =
+		"ZoiteChat refuses to run as root on Linux.\n\n"
+		"Run it as a normal user, or pass --run-as-root to override this protection.";
+	GtkWidget *dialog;
+
+	g_printerr ("%s\n", message);
+
+	/* A graphical session may not be accessible to root, particularly under
+	 * Wayland. Keep stderr as the fallback if GTK cannot open the display. */
+	if (!gtk_init_check (NULL, NULL))
+		return;
+
+	dialog = gtk_message_dialog_new (NULL,
+	                                 GTK_DIALOG_MODAL,
+	                                 GTK_MESSAGE_ERROR,
+	                                 GTK_BUTTONS_CLOSE,
+	                                 "%s", message);
+	gtk_window_set_title (GTK_WINDOW (dialog), "ZoiteChat");
+	gtk_dialog_run (GTK_DIALOG (dialog));
+	gtk_widget_destroy (dialog);
+}
+#endif
+
 #ifdef WIN32
 static void
 create_msg_dialog (gchar *title, gchar *message)
@@ -341,7 +375,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);
@@ -462,6 +502,15 @@ fe_args (int argc, char *argv[])
 #endif
 	gtk_init (&argc, &argv);
 
+#ifdef __APPLE__
+	if (g_getenv ("ZOITECHAT_MACOS_SHARE"))
+	{
+		char *icons = g_build_filename (g_getenv ("ZOITECHAT_MACOS_SHARE"), "icons", NULL);
+		gtk_icon_theme_prepend_search_path (gtk_icon_theme_get_default (), icons);
+		g_free (icons);
+	}
+#endif
+
 #ifdef WIN32
 	win32_configure_icon_theme ();
 #endif
@@ -943,7 +992,13 @@ void
 fe_print_text (struct session *sess, char *text, time_t stamp,
 			   gboolean no_activity)
 {
-	PrintTextRaw (sess->res->buffer, (unsigned char *)text, prefs.hex_text_indent, stamp);
+	/* image links become a "[view image]" placeholder with a hidden URL */
+	char *filtered = inline_image_filter_text (text);
+
+	PrintTextRaw (sess->res->buffer,
+					  (unsigned char *)(filtered ? filtered : text),
+					  prefs.hex_text_indent, stamp);
+	g_free (filtered);
 
 	if (no_activity || !sess->gui->is_tab)
 		return;

src/fe-gtk/fe-gtk.vcxproj

@@ -59,6 +59,7 @@ powershell "Get-Content -Encoding UTF8 '$(ZoiteChatLib)zoitechat.rc.utf8' | Out-
     <ClInclude Include="fkeys.h" />
     <ClInclude Include="gtkutil.h" />
     <ClInclude Include="icon-resolver.h" />
+    <ClInclude Include="inline-image.h" />
     <ClInclude Include="joind.h" />
     <ClInclude Include="maingui.h" />
     <ClInclude Include="preferences-persistence.h" />
@@ -104,6 +105,7 @@ powershell "Get-Content -Encoding UTF8 '$(ZoiteChatLib)zoitechat.rc.utf8' | Out-
     <ClCompile Include="gtkutil.c" />
     <ClCompile Include="icon-resolver.c" />
     <ClCompile Include="ignoregui.c" />
+    <ClCompile Include="inline-image.c" />
     <ClCompile Include="joind.c" />
     <ClCompile Include="maingui.c" />
     <ClCompile Include="menu.c" />

src/fe-gtk/fe-gtk.vcxproj.filters

@@ -45,6 +45,9 @@
     <ClInclude Include="icon-resolver.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="inline-image.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="joind.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -170,6 +173,9 @@
     <ClCompile Include="ignoregui.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="inline-image.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="joind.c">
       <Filter>Source Files</Filter>
     </ClCompile>

src/fe-gtk/fkeys.c

@@ -426,7 +426,7 @@ key_binding_is_builtin (struct key_binding *kb)
 }
 
 void
-key_init ()
+key_init (void)
 {
 	if (key_load_kbs () == 1)
 	{
@@ -1219,9 +1219,9 @@ key_dialog_load (GtkListStore *store)
 }
 
 void
-key_dialog_show ()
+key_dialog_show (void)
 {
-	GtkWidget *vbox, *box;
+	GtkWidget *vbox, *box, *pane, *scroll;
 	GtkWidget *view, *xtext, *delete_button;
 	GtkListStore *store;
 	XTextColor xtext_palette[XTEXT_COLS];
@@ -1237,10 +1237,20 @@ key_dialog_show ()
 	key_dialog = mg_create_generic_tab ("editkeys", buf, TRUE, FALSE, key_dialog_close,
 									NULL, 600, 360, &vbox, 0);
 
-	view = key_dialog_treeview_new (vbox);
+	pane = gtk_paned_new (GTK_ORIENTATION_VERTICAL);
+	gtk_box_pack_start (GTK_BOX (vbox), pane, TRUE, TRUE, 0);
+	box = gtkutil_box_new (GTK_ORIENTATION_VERTICAL, FALSE, 0);
+	gtk_paned_pack1 (GTK_PANED (pane), box, TRUE, FALSE);
+	view = key_dialog_treeview_new (box);
+	scroll = gtk_scrolled_window_new (NULL, NULL);
+	gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (scroll),
+	                                GTK_POLICY_NEVER, GTK_POLICY_AUTOMATIC);
+	gtk_scrolled_window_set_min_content_height (GTK_SCROLLED_WINDOW (scroll), 80);
+	gtk_paned_pack2 (GTK_PANED (pane), scroll, TRUE, FALSE);
+	gtk_paned_set_position (GTK_PANED (pane), 220);
 	theme_get_xtext_colors (xtext_palette, XTEXT_COLS);
 	xtext = gtk_xtext_new (xtext_palette, 0);
-	gtk_box_pack_start (GTK_BOX (vbox), xtext, FALSE, TRUE, 2);
+	gtk_container_add (GTK_CONTAINER (scroll), xtext);
 	gtk_xtext_set_font (GTK_XTEXT (xtext), prefs.hex_text_font);
 
 	g_object_set_data (G_OBJECT (key_dialog), "view", view);

src/fe-gtk/gtkutil.c

@@ -641,9 +641,8 @@ gtkutil_get_str (char *msg, char *def, void *callback, void *userdata, gboolean
 	if (parent_window && GTK_IS_WINDOW (parent_window))
 		gtk_window_set_transient_for (GTK_WINDOW (dialog), GTK_WINDOW (parent_window));
 	gtkutil_place_dialog (dialog);
-	gtk_box_set_homogeneous (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), TRUE);
 
-	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, TRUE, 0);
+	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 6);
 
 	g_object_set_data (G_OBJECT (dialog), "cb", callback);
 	g_object_set_data (G_OBJECT (dialog), "ud", userdata);
@@ -653,7 +652,8 @@ gtkutil_get_str (char *msg, char *def, void *callback, void *userdata, gboolean
 						 	G_CALLBACK (gtkutil_str_enter), dialog);
 	gtk_entry_set_text (GTK_ENTRY (entry), def ? def : "");
 	gtk_entry_set_visibility (GTK_ENTRY (entry), visible);
-	gtk_box_pack_end (GTK_BOX (hbox), entry, 0, 0, 0);
+	gtk_widget_set_valign (entry, GTK_ALIGN_CENTER);
+	gtk_box_pack_end (GTK_BOX (hbox), entry, TRUE, TRUE, 0);
 
 	label = gtk_label_new (msg);
 	gtk_box_pack_end (GTK_BOX (hbox), label, 0, 0, 0);
@@ -661,7 +661,8 @@ gtkutil_get_str (char *msg, char *def, void *callback, void *userdata, gboolean
 	g_signal_connect (G_OBJECT (dialog), "response",
 						   G_CALLBACK (gtkutil_get_str_response), entry);
 
-	gtk_container_add (GTK_CONTAINER (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), hbox);
+	gtk_box_pack_start (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))),
+	                    hbox, TRUE, TRUE, 0);
 
 	gtk_widget_show_all (dialog);
 }
@@ -742,9 +743,8 @@ fe_get_int (char *msg, int def, void *callback, void *userdata)
 	if (parent_window && GTK_IS_WINDOW (parent_window))
 		gtk_window_set_transient_for (GTK_WINDOW (dialog), GTK_WINDOW (parent_window));
 	gtkutil_place_dialog (dialog);
-	gtk_box_set_homogeneous (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), TRUE);
 
-	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, TRUE, 0);
+	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 6);
 
 	g_object_set_data (G_OBJECT (dialog), "cb", callback);
 	g_object_set_data (G_OBJECT (dialog), "ud", userdata);
@@ -755,7 +755,8 @@ fe_get_int (char *msg, int def, void *callback, void *userdata)
 	gtk_adjustment_set_upper (adj, 1024);
 	gtk_adjustment_set_step_increment (adj, 1);
 	gtk_spin_button_set_value ((GtkSpinButton*)spin, def);
-	gtk_box_pack_end (GTK_BOX (hbox), spin, 0, 0, 0);
+	gtk_widget_set_valign (spin, GTK_ALIGN_CENTER);
+	gtk_box_pack_end (GTK_BOX (hbox), spin, TRUE, TRUE, 0);
 
 	label = gtk_label_new (msg);
 	gtk_box_pack_end (GTK_BOX (hbox), label, 0, 0, 0);
@@ -763,7 +764,8 @@ fe_get_int (char *msg, int def, void *callback, void *userdata)
 	g_signal_connect (G_OBJECT (dialog), "response",
 						   G_CALLBACK (gtkutil_get_number_response), spin);
 
-	gtk_container_add (GTK_CONTAINER (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), hbox);
+	gtk_box_pack_start (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))),
+	                    hbox, TRUE, TRUE, 0);
 
 	gtk_widget_show_all (dialog);
 }
@@ -783,17 +785,18 @@ fe_get_bool (char *title, char *prompt, void *callback, void *userdata)
 	if (parent_window && GTK_IS_WINDOW (parent_window))
 		gtk_window_set_transient_for (GTK_WINDOW (dialog), GTK_WINDOW (parent_window));
 	gtkutil_place_dialog (dialog);
-	gtk_box_set_homogeneous (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), TRUE);
 
 	g_object_set_data (G_OBJECT (dialog), "cb", callback);
 	g_object_set_data (G_OBJECT (dialog), "ud", userdata);
 
 	prompt_label = gtk_label_new (prompt);
+	gtk_label_set_line_wrap (GTK_LABEL (prompt_label), TRUE);
 
 	g_signal_connect (G_OBJECT (dialog), "response",
 		G_CALLBACK (gtkutil_get_bool_response), NULL);
 
-	gtk_container_add (GTK_CONTAINER (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), prompt_label);
+	gtk_box_pack_start (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))),
+	                    prompt_label, TRUE, TRUE, 0);
 
 	gtk_widget_show_all (dialog);
 }
@@ -885,7 +888,10 @@ gtkutil_window_new (char *title, char *role, int width, int height, int flags)
 	gtk_window_set_wmclass (GTK_WINDOW (win), "ZoiteChat", "zoitechat");
 #endif
 	gtk_window_set_title (GTK_WINDOW (win), title);
-	gtk_window_set_default_size (GTK_WINDOW (win), width, height);
+	/* Zero means content-sized to callers; GTK requires -1 for that. */
+	gtk_window_set_default_size (GTK_WINDOW (win),
+	                             width > 0 ? width : -1,
+	                             height > 0 ? height : -1);
 	gtk_window_set_role (GTK_WINDOW (win), role);
 	if (flags & 1)
 		gtk_window_set_position (GTK_WINDOW (win), GTK_WIN_POS_MOUSE);

src/fe-gtk/ignoregui.c

@@ -336,7 +336,7 @@ ignore_stats_entry (GtkWidget * box, char *label, int value)
 }
 
 void
-ignore_gui_open ()
+ignore_gui_open (void)
 {
 	GtkWidget *vbox, *box, *stat_box, *frame;
 	GtkWidget *view;

src/fe-gtk/inline-image.h

@@ -0,0 +1,45 @@
+/* ZoiteChat
+ * Copyright (C) 2026 ZoiteChat contributors.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef ZOITECHAT_INLINE_IMAGE_H
+#define ZOITECHAT_INLINE_IMAGE_H
+
+#include "xtext.h"
+
+/* does this look like a direct http(s) link to an image file? */
+gboolean inline_image_is_image_url (const char *url);
+
+/* show the image behind 'url' inline below 'ent', or hide it again if it is
+ * already shown.  Errors are reported to 'sess'. */
+void inline_image_toggle (session *sess, GtkXText *xtext, textentry *ent,
+								  const char *url);
+
+/* replace image links in a message with a clickable placeholder label that
+ * hides the URL.  Returns a newly allocated string, or NULL if the text has
+ * no image links (or the feature is off). */
+char *inline_image_filter_text (const char *text);
+
+/* pop up a window with a larger version of the entry's inline image */
+void inline_image_show_viewer (GtkXText *xtext, textentry *ent);
+
+/* can downloads go through the proxy configured for ZoiteChat (or is no
+ * proxy configured)?  FALSE means loading media would have to bypass the
+ * user's proxy, which is never done. */
+gboolean inline_image_proxy_usable (void);
+
+#endif

src/fe-gtk/joind.c

@@ -137,7 +137,6 @@ joind_show_dialog (server *serv)
 	gtk_window_set_position (GTK_WINDOW (dialog1), GTK_WIN_POS_CENTER_ON_PARENT);
 	gtk_window_set_transient_for (GTK_WINDOW(dialog1), GTK_WINDOW(serv->front_session->gui->window));
 	gtk_window_set_modal (GTK_WINDOW (dialog1), TRUE);
-	gtk_window_set_resizable (GTK_WINDOW (dialog1), FALSE);
 
 	dialog_vbox1 = gtk_dialog_get_content_area (GTK_DIALOG (dialog1));
 	gtk_widget_show (dialog_vbox1);

src/fe-gtk/maingui.c

@@ -61,6 +61,7 @@
 #include "pixmaps.h"
 #include "plugin-tray.h"
 #include "xtext.h"
+#include "inline-image.h"
 #include "sexy-spell-entry.h"
 #include "gtkutil.h"
 
@@ -296,40 +297,6 @@ mg_color_component_to_pango (double value)
 	return (guint16)(value * 65535.0 + 0.5);
 }
 
-static void
-mg_apply_font_css (GtkWidget *widget, const PangoFontDescription *desc,
-				   const char *class_name, const char *provider_key)
-{
-	GtkStyleContext *context;
-	GtkCssProvider *provider;
-	GString *css;
-
-	if (!widget || !desc)
-		return;
-
-	context = gtk_widget_get_style_context (widget);
-	if (!context)
-		return;
-
-	provider = g_object_get_data (G_OBJECT (widget), provider_key);
-	if (!provider)
-	{
-		provider = gtk_css_provider_new ();
-		g_object_set_data_full (G_OBJECT (widget), provider_key, provider, g_object_unref);
-	}
-
-	css = g_string_new (".");
-	g_string_append (css, class_name);
-	g_string_append (css, " {");
-	gtkutil_append_font_css (css, desc);
-	g_string_append (css, " }");
-	gtk_css_provider_load_from_data (provider, css->str, -1, NULL);
-	g_string_free (css, TRUE);
-
-	gtk_style_context_add_class (context, class_name);
-	theme_css_apply_widget_provider (widget, GTK_STYLE_PROVIDER (provider));
-}
-
 static void
 mg_set_label_alignment_start (GtkWidget *widget)
 {
@@ -777,10 +744,13 @@ mg_inputbox_focus (GtkWidget *widget, GdkEventFocus *event, session_gui *gui)
 }
 
 
+#define TYPING_THROTTLE_USEC (3 * G_USEC_PER_SEC)
+
 static gboolean
 mg_client_tag_allowed (server *serv, const char *tag)
 {
         char **deny;
+        gboolean blocked = FALSE;
         int i;
 
         if (!serv->have_message_tags)
@@ -792,30 +762,42 @@ mg_client_tag_allowed (server *serv, const char *tag)
         deny = g_strsplit (serv->clienttagdeny, ",", 0);
         for (i = 0; deny[i]; i++)
         {
-                if (!strcmp (deny[i], "*") || !strcmp (deny[i], tag) || (deny[i][0] == '+' && !strcmp (deny[i] + 1, tag)))
+                if (!strcmp (deny[i], "*"))
+                        blocked = TRUE;
+                else if (deny[i][0] == '-' && !strcmp (deny[i] + 1, tag))
+                        blocked = FALSE;
+                else if (!strcmp (deny[i], tag) || (deny[i][0] == '+' && !strcmp (deny[i] + 1, tag)))
+                        blocked = TRUE;
+        }
+
+        g_strfreev (deny);
+        return !blocked;
+}
+
+static gboolean
+mg_typing_can_send (session *sess)
 {
-                        g_strfreev (deny);
+        gint64 now = g_get_monotonic_time ();
-                        return FALSE;
+
-                }
+        return sess->typing_last_sent == 0 ||
+               now - sess->typing_last_sent >= TYPING_THROTTLE_USEC;
 }
 
-        g_strfreev (deny);
+static gboolean
-        return TRUE;
-}
-
-static void
 mg_send_typing (session *sess, const char *state)
 {
         char tags[32];
 
         if (!sess || !sess->server->connected || !mg_client_tag_allowed (sess->server, "typing") || !sess->channel[0])
-                return;
+                return FALSE;
 
         if (sess->type != SESS_CHANNEL && sess->type != SESS_DIALOG)
-                return;
+                return FALSE;
 
         g_snprintf (tags, sizeof (tags), "+typing=%s", state);
         sess->server->p_tagmsg (sess->server, tags, sess->channel);
+        sess->typing_last_sent = g_get_monotonic_time ();
+        return TRUE;
 }
 
 static int
@@ -844,17 +826,15 @@ mg_typing_update (session *sess, const char *text)
 
         if (!text || !*text || text[0] == prefs.hex_input_command_char[0])
         {
-                if (sess->typing_status)
+                if (sess->typing_status && mg_typing_can_send (sess))
                         mg_send_typing (sess, "done");
                 sess->typing_status = 0;
                 return;
         }
 
-        if (sess->typing_status != 1)
+        if (mg_typing_can_send (sess))
-        {
                 mg_send_typing (sess, "active");
         sess->typing_status = 1;
-        }
         sess->typing_timeout_tag = fe_timeout_add_seconds (6, mg_typing_pause_cb, sess);
 }
 
@@ -926,10 +906,236 @@ mg_send_reply_or_text (session *sess, char *cmd)
 	mg_reply_update (sess);
 }
 
+typedef struct
+{
+	gboolean bold;
+	gboolean italic;
+	gboolean underline;
+	gboolean strikethrough;
+	gboolean reverse;
+	gint foreground;
+	gint background;
+	gboolean pending_foreground;
+	gboolean pending_background;
+} MgInputFormatState;
+
+static void
+mg_input_format_state_at_cursor (GtkEntry *entry, MgInputFormatState *state)
+{
+	const char *text;
+	const char *cursor;
+	gsize limit;
+	gsize i;
+	gint cursor_pos;
+
+	memset (state, 0, sizeof (*state));
+	state->foreground = -1;
+	state->background = -1;
+
+	text = gtk_entry_get_text (entry);
+	cursor_pos = gtk_editable_get_position (GTK_EDITABLE (entry));
+	if (!text || cursor_pos < 0)
+		return;
+
+	cursor = g_utf8_offset_to_pointer (text, cursor_pos);
+	limit = (gsize) (cursor - text);
+
+	for (i = 0; i < limit;)
+	{
+		guchar ch = (guchar) text[i++];
+
+		switch (ch)
+		{
+		case ATTR_BOLD:
+			state->bold = !state->bold;
+			break;
+		case ATTR_ITALICS:
+			state->italic = !state->italic;
+			break;
+		case ATTR_UNDERLINE:
+			state->underline = !state->underline;
+			break;
+		case ATTR_STRIKETHROUGH:
+			state->strikethrough = !state->strikethrough;
+			break;
+		case ATTR_REVERSE:
+			state->reverse = !state->reverse;
+			break;
+		case ATTR_RESET:
+		case '\n':
+			state->bold = FALSE;
+			state->italic = FALSE;
+			state->underline = FALSE;
+			state->strikethrough = FALSE;
+			state->reverse = FALSE;
+			state->foreground = -1;
+			state->background = -1;
+			state->pending_foreground = FALSE;
+			state->pending_background = FALSE;
+			break;
+		case ATTR_COLOR:
+			{
+				gint value = 0;
+				gint digits = 0;
+
+				state->pending_foreground = FALSE;
+				state->pending_background = FALSE;
+
+				if (i >= limit)
+				{
+					state->pending_foreground = TRUE;
+					break;
+				}
+
+				if (!g_ascii_isdigit (text[i]))
+				{
+					state->foreground = -1;
+					state->background = -1;
+					break;
+				}
+
+				while (i < limit && digits < 2 && g_ascii_isdigit (text[i]))
+				{
+					value = (value * 10) + (text[i] - '0');
+					i++;
+					digits++;
+				}
+				state->foreground = value;
+				state->background = -1;
+
+				if (i < limit && text[i] == ',')
+				{
+					i++;
+					if (i >= limit)
+					{
+						state->pending_background = TRUE;
+						break;
+					}
+
+					value = 0;
+					digits = 0;
+					while (i < limit && digits < 2 && g_ascii_isdigit (text[i]))
+					{
+						value = (value * 10) + (text[i] - '0');
+						i++;
+						digits++;
+					}
+					if (digits > 0)
+						state->background = value;
+				}
+			}
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+static void
+mg_input_format_append (GString *summary, const char *text)
+{
+	if (summary->len > 0)
+		g_string_append (summary, " · ");
+	g_string_append (summary, text);
+}
+
+static void
+mg_input_format_color_value (char *buffer, gsize buffer_len, const char *label, gint color_index)
+{
+	guint16 red;
+	guint16 green;
+	guint16 blue;
+
+	if (theme_get_mirc_color_rgb16 ((unsigned int) color_index, &red, &green, &blue))
+	{
+		g_snprintf (buffer, buffer_len,
+					"%s <b>%02d</b> <span foreground=\"#%02x%02x%02x\">■</span>",
+					label, color_index, (guint) (red >> 8), (guint) (green >> 8),
+					(guint) (blue >> 8));
+		return;
+	}
+
+	g_snprintf (buffer, buffer_len, "%s <b>%02d</b>", label, color_index);
+}
+
+static void
+mg_input_format_update (GtkEntry *entry)
+{
+	GtkWidget *format_box;
+	GtkWidget *format_label;
+	MgInputFormatState state;
+	GString *summary;
+	char color[96];
+	char *markup;
+
+	format_box = g_object_get_data (G_OBJECT (entry), "zoitechat-format-box");
+	format_label = g_object_get_data (G_OBJECT (entry), "zoitechat-format-label");
+	if (!format_box || !format_label)
+		return;
+
+	if (!prefs.hex_gui_input_attr)
+	{
+		gtk_widget_hide (format_box);
+		return;
+	}
+
+	mg_input_format_state_at_cursor (entry, &state);
+	summary = g_string_new (NULL);
+
+	if (state.bold)
+		mg_input_format_append (summary, "<b>Bold</b>");
+	if (state.italic)
+		mg_input_format_append (summary, "<i>Italic</i>");
+	if (state.underline)
+		mg_input_format_append (summary, "<u>Underline</u>");
+	if (state.strikethrough)
+		mg_input_format_append (summary, "<s>Strikethrough</s>");
+	if (state.reverse)
+		mg_input_format_append (summary, "Reverse");
+
+	if (state.foreground >= 0)
+	{
+		mg_input_format_color_value (color, sizeof (color), "Text color", state.foreground);
+		mg_input_format_append (summary, color);
+	}
+	if (state.background >= 0)
+	{
+		mg_input_format_color_value (color, sizeof (color), "Background", state.background);
+		mg_input_format_append (summary, color);
+	}
+	if (state.pending_foreground)
+		mg_input_format_append (summary, "Color: type foreground[,background]");
+	else if (state.pending_background)
+		mg_input_format_append (summary, "Background: type color");
+
+	if (summary->len == 0)
+	{
+		gtk_widget_hide (format_box);
+		g_string_free (summary, TRUE);
+		return;
+	}
+
+	markup = g_strdup_printf ("<span foreground='#7d8790'>Formatting · %s</span>", summary->str);
+	gtk_label_set_markup (GTK_LABEL (format_label), markup);
+	gtk_widget_show (format_label);
+	gtk_widget_show (format_box);
+	g_free (markup);
+	g_string_free (summary, TRUE);
+}
+
+static void
+mg_inputbox_cursor_changed (GObject *object, GParamSpec *pspec, gpointer userdata)
+{
+	(void) pspec;
+	(void) userdata;
+	mg_input_format_update (GTK_ENTRY (object));
+}
+
 static void
 mg_inputbox_changed (GtkEditable *editable, session_gui *gui)
 {
         key_check_replace_on_change (editable, NULL);
+        mg_input_format_update (GTK_ENTRY (editable));
         if (current_sess && current_sess->gui == gui)
                 mg_typing_update (current_sess, gtk_entry_get_text (GTK_ENTRY (editable)));
 }
@@ -2090,7 +2296,6 @@ mg_open_quit_dialog (gboolean minimize_button)
         gtk_container_set_border_width (GTK_CONTAINER (dialog), 6);
         gtk_window_set_title (GTK_WINDOW (dialog), _("Quit ZoiteChat?"));
         gtk_window_set_transient_for (GTK_WINDOW (dialog), GTK_WINDOW (parent_window));
-        gtk_window_set_resizable (GTK_WINDOW (dialog), FALSE);
 
         dialog_vbox1 = gtk_dialog_get_content_area (GTK_DIALOG (dialog));
         gtk_widget_show (dialog_vbox1);
@@ -3692,6 +3897,12 @@ mg_word_clicked (GtkWidget *xtext, char *word, GdkEventButton *even)
         {
                 if (word == NULL)
                 {
+                        /* a click on a shown inline image opens the viewer */
+                        textentry *img_ent = gtk_xtext_get_clicked_image_entry (GTK_XTEXT (xtext));
+
+                        if (img_ent)
+                                inline_image_show_viewer (GTK_XTEXT (xtext), img_ent);
+                        else
                                 mg_focus (sess);
                         return;
                 }
@@ -3704,6 +3915,20 @@ mg_word_clicked (GtkWidget *xtext, char *word, GdkEventButton *even)
                         case WORD_HOST6:
                         case WORD_HOST:
                                 word[end] = 0;
+                                /* image links toggle an inline preview instead
+                                   of opening the browser */
+                                if (word_type == WORD_URL &&
+                                    prefs.hex_net_remote_media &&
+                                    inline_image_is_image_url (word + start))
+                                {
+                                        textentry *ent = gtk_xtext_get_clicked_entry (GTK_XTEXT (xtext));
+
+                                        if (ent)
+                                        {
+                                                inline_image_toggle (sess, GTK_XTEXT (xtext), ent, word + start);
+                                                break;
+                                        }
+                                }
                                 fe_open_url (word + start);
                         }
                 }
@@ -3732,7 +3957,8 @@ mg_word_clicked (GtkWidget *xtext, char *word, GdkEventButton *even)
         case WORD_HOST:
                 word[end] = 0;
                 word += start;
-                menu_urlmenu (even, word);
+                menu_urlmenu_entry (even, word, xtext,
+                                    gtk_xtext_get_clicked_entry (GTK_XTEXT (xtext)));
                 break;
         case WORD_NICK:
                 word[end] = 0;
@@ -4679,9 +4905,19 @@ mg_create_search(session *sess, GtkWidget *box)
 static void
 mg_create_entry (session *sess, GtkWidget *box)
 {
-        GtkWidget *hbox, *but, *entry;
+        GtkWidget *hbox, *but, *entry, *format_box, *format_label;
         session_gui *gui = sess->gui;
 
+        format_box = mg_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 6);
+        gtk_widget_set_name (format_box, "zoitechat-formatbar");
+        gtk_widget_set_no_show_all (format_box, TRUE);
+        gtk_box_pack_start (GTK_BOX (box), format_box, 0, 0, 0);
+        format_label = gtk_label_new ("");
+        gtk_label_set_ellipsize (GTK_LABEL (format_label), PANGO_ELLIPSIZE_END);
+        gtk_box_pack_start (GTK_BOX (format_box), format_label, TRUE, TRUE, 8);
+        gtk_widget_show (format_label);
+        gtk_widget_hide (format_box);
+
         gui->reply_box = mg_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 6);
         gtk_widget_set_name (gui->reply_box, "zoitechat-replybar");
         gtk_widget_set_no_show_all (gui->reply_box, TRUE);
@@ -4712,12 +4948,16 @@ mg_create_entry (session *sess, GtkWidget *box)
         gui->input_box = entry = sexy_spell_entry_new ();
         sexy_spell_entry_set_checked ((SexySpellEntry *)entry, prefs.hex_gui_input_spell);
         sexy_spell_entry_set_parse_attributes ((SexySpellEntry *)entry, prefs.hex_gui_input_attr);
+        g_object_set_data (G_OBJECT (entry), "zoitechat-format-box", format_box);
+        g_object_set_data (G_OBJECT (entry), "zoitechat-format-label", format_label);
 
         gtk_entry_set_max_length (GTK_ENTRY (gui->input_box), 0);
         g_signal_connect (G_OBJECT (entry), "activate",
                                                         G_CALLBACK (mg_inputbox_cb), gui);
         g_signal_connect (G_OBJECT (entry), "changed",
                                                         G_CALLBACK (mg_inputbox_changed), gui);
+        g_signal_connect (G_OBJECT (entry), "notify::cursor-position",
+                                                        G_CALLBACK (mg_inputbox_cursor_changed), gui);
         gtk_box_pack_start (GTK_BOX (hbox), entry, TRUE, TRUE, 0);
 
         gtk_widget_set_name (entry, "zoitechat-inputbox");

src/fe-gtk/menu.c

@@ -45,6 +45,7 @@
 #include "../common/util.h"
 #include "../common/text.h"
 #include "xtext.h"
+#include "inline-image.h"
 #include "ascii.h"
 #include "banlist.h"
 #include "chanlist.h"
@@ -1056,8 +1057,40 @@ open_url_cb (GtkWidget *item, char *url)
 	handle_command (current_sess, buf, FALSE);
 }
 
+/* the text entry the open URL menu was created for; the widget pointer is
+   nulled automatically if the widget dies while the menu is up */
+static GtkXText *urlmenu_xtext = NULL;
+static textentry *urlmenu_ent = NULL;
+
+static void
+menu_urlmenu_set_entry (GtkWidget *xtext, textentry *ent)
+{
+	if (urlmenu_xtext)
+		g_object_remove_weak_pointer (G_OBJECT (urlmenu_xtext),
+												(gpointer *) &urlmenu_xtext);
+	urlmenu_xtext = xtext ? GTK_XTEXT (xtext) : NULL;
+	urlmenu_ent = ent;
+	if (urlmenu_xtext)
+		g_object_add_weak_pointer (G_OBJECT (urlmenu_xtext),
+											(gpointer *) &urlmenu_xtext);
+}
+
+static void
+inline_image_menu_cb (GtkWidget *item, char *url)
+{
+	if (urlmenu_xtext == NULL || urlmenu_ent == NULL)
+		return;
+
+	/* the line may have scrolled out of the buffer since the menu opened */
+	if (!gtk_xtext_buffer_contains (urlmenu_xtext, urlmenu_ent))
+		return;
+
+	inline_image_toggle (current_sess, urlmenu_xtext, urlmenu_ent, url);
+}
+
 void
-menu_urlmenu (GdkEventButton *event, char *url)
+menu_urlmenu_entry (GdkEventButton *event, char *url, GtkWidget *xtext,
+						  textentry *ent)
 {
 	GtkWidget *menu;
 	char *tmp, *chop;
@@ -1065,6 +1098,14 @@ menu_urlmenu (GdkEventButton *event, char *url)
 	g_free (str_copy);
 	str_copy = g_strdup (url);
 
+	if (xtext == NULL || ent == NULL || !prefs.hex_net_remote_media ||
+		 !inline_image_is_image_url (str_copy))
+	{
+		xtext = NULL;
+		ent = NULL;
+	}
+	menu_urlmenu_set_entry (xtext, ent);
+
 	menu = menu_new ();
 	/* more than 51 chars? Chop it */
 	if (g_utf8_strlen (str_copy, -1) >= 52)
@@ -1087,6 +1128,15 @@ menu_urlmenu (GdkEventButton *event, char *url)
 		menu_quick_item_with_callback (open_url_cb, _("Connect"), menu, str_copy);
 	else
 		menu_quick_item_with_callback (open_url_cb, _("Open Link in Browser"), menu, str_copy);
+	if (ent)
+	{
+		const char *shown = gtk_xtext_entry_get_image_url (GTK_XTEXT (xtext), ent);
+
+		menu_quick_item_with_callback (inline_image_menu_cb,
+			shown && strcmp (shown, str_copy) == 0 ?
+				_("Hide Inline Image") : _("Show Image Inline"),
+			menu, str_copy);
+	}
 	menu_quick_item_with_callback (copy_to_clipboard_cb, _("Copy Selected Link"), menu, str_copy);
 	/* custom ones from urlhandlers.conf */
 	menu_create (menu, urlhandler_list, str_copy, TRUE);
@@ -1094,6 +1144,12 @@ menu_urlmenu (GdkEventButton *event, char *url)
 	menu_popup (menu, event, NULL);
 }
 
+void
+menu_urlmenu (GdkEventButton *event, char *url)
+{
+	menu_urlmenu_entry (event, url, NULL, NULL);
+}
+
 static void
 menu_chan_cycle (GtkWidget * menu, char *chan)
 {
@@ -1539,16 +1595,16 @@ menu_join (GtkWidget * wid, gpointer none)
 									NULL);
 	theme_manager_attach_window (dialog);
 	content_area = gtk_dialog_get_content_area (GTK_DIALOG (dialog));
-	gtk_box_set_homogeneous (GTK_BOX (content_area), TRUE);
 	gtk_window_set_position (GTK_WINDOW (dialog), GTK_WIN_POS_MOUSE);
-	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, TRUE, 0);
+	hbox = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 6);
 
 	entry = gtk_entry_new ();
 	gtk_editable_set_editable (GTK_EDITABLE (entry), FALSE);	/* avoid auto-selection */
 	gtk_entry_set_text (GTK_ENTRY (entry), "#");
 	g_signal_connect (G_OBJECT (entry), "activate",
 						 	G_CALLBACK (menu_join_entry_cb), dialog);
-	gtk_box_pack_end (GTK_BOX (hbox), entry, 0, 0, 0);
+	gtk_widget_set_valign (entry, GTK_ALIGN_CENTER);
+	gtk_box_pack_end (GTK_BOX (hbox), entry, TRUE, TRUE, 0);
 
 	label = gtk_label_new (_("Enter Channel to Join:"));
 	gtk_box_pack_end (GTK_BOX (hbox), label, 0, 0, 0);
@@ -1556,7 +1612,7 @@ menu_join (GtkWidget * wid, gpointer none)
 	g_signal_connect (G_OBJECT (dialog), "response",
 						   G_CALLBACK (menu_join_cb), entry);
 
-	gtk_container_add (GTK_CONTAINER (content_area), hbox);
+	gtk_box_pack_start (GTK_BOX (content_area), hbox, TRUE, TRUE, 0);
 
 	gtk_widget_show_all (dialog);
 
@@ -1906,7 +1962,10 @@ menu_about (GtkWidget *wid, gpointer sess)
 	gtk_about_dialog_set_logo (dialog, pix_zoitechat);
 	gtk_about_dialog_set_copyright (dialog, "\302\251 1998-2010 Peter \305\275elezn\303\275\n\302\251 2009-2014 Berke Viktor\n\302\251 2015-2025 Patrick Griffis\n\302\251 2026 deepend");
 	gtk_about_dialog_set_comments (dialog, comment);
+	/* Preserve the About dialog's existing action-area button layout. */
+	G_GNUC_BEGIN_IGNORE_DEPRECATIONS
 	actions = gtk_dialog_get_action_area (GTK_DIALOG (dialog));
+	G_GNUC_END_IGNORE_DEPRECATIONS
 	children = gtk_container_get_children (GTK_CONTAINER (actions));
 	for (child = children; child; child = child->next)
 		gtk_widget_destroy (GTK_WIDGET (child->data));

src/fe-gtk/menu.h

@@ -20,8 +20,11 @@
 #ifndef ZOITECHAT_MENU_H
 #define ZOITECHAT_MENU_H
 
+#include "xtext.h"
+
 GtkWidget *menu_create_main (void *accel_group, int bar, int away, int toplevel, GtkWidget **menu_widgets);
 void menu_urlmenu (GdkEventButton * event, char *url);
+void menu_urlmenu_entry (GdkEventButton *event, char *url, GtkWidget *xtext, textentry *ent);
 void menu_chanmenu (session *sess, GdkEventButton * event, char *chan);
 void menu_addfavoritemenu (server *serv, GtkWidget *menu, char *channel, gboolean istree);
 void menu_addconnectmenu (server *serv, GtkWidget *menu);

src/fe-gtk/meson.build

@@ -25,6 +25,7 @@ zoitechat_gtk_sources = [
   'gtkutil.c',
   'icon-resolver.c',
   'ignoregui.c',
+  'inline-image.c',
   'joind.c',
   'menu.c',
   'maingui.c',
@@ -52,6 +53,15 @@ zoitechat_gtk_deps = [
 
 gtk_dep = dependency('gtk+-3.0', version: '>= 3.22')
 
+# Standalone GTK tests also include the common application's headers.
+gtk_dep = declare_dependency(dependencies: [gtk_dep] + zoitechat_common_header_deps)
+
+# fe-gtk.h exposes GtkosxApplication to every GTK consumer when enabled.
+# Theme libraries and standalone UI tests need the same headers as the app.
+if host_machine.system() == 'darwin' and gtk_mac_dep.found()
+  gtk_dep = declare_dependency(dependencies: [gtk_dep, gtk_mac_dep])
+endif
+
 zoitechat_theme_deps = [gtk_dep, zoitechat_common_dep]
 
 if host_machine.system() != 'windows'
@@ -90,12 +100,18 @@ if host_machine.system() != 'windows'
 endif
 
 zoitechat_gtk_ldflags = []
+zoitechat_gtk_objcflags = []
 
 if host_machine.system() == 'windows'
   zoitechat_gtk_sources += 'notifications/notification-windows.c'
   zoitechat_gtk_deps += cc.find_library('dwmapi', required: true)
   zoitechat_theme_deps += cc.find_library('dwmapi', required: true)
 
+elif host_machine.system() == 'darwin'
+  add_languages('objc', required: true)
+  zoitechat_gtk_sources += 'notifications/notification-osx.m'
+  zoitechat_gtk_deps += dependency('appleframeworks', modules: ['Cocoa', 'UserNotifications'])
+  zoitechat_gtk_objcflags += '-fobjc-arc'
 else
   zoitechat_gtk_sources += 'notifications/notification-freedesktop.c'
 endif
@@ -110,7 +126,7 @@ zoitechat_theme_lib = static_library('zoitechat_theme',
 iso_codes = dependency('iso-codes', required: false)
 if iso_codes.found()
   zoitechat_gtk_sources += 'sexy-iso-codes.c'
-  iso_codes_prefix = iso_codes.get_pkgconfig_variable('prefix')
+  iso_codes_prefix = iso_codes.get_variable(pkgconfig : 'prefix')
   zoitechat_gtk_cflags += '-DISO_CODES_PREFIX="@0@"'.format(iso_codes_prefix)
   zoitechat_gtk_cflags += '-DISO_CODES_LOCALEDIR="@0@"'.format(
                         join_paths(iso_codes_prefix, 'share/locale'))
@@ -136,10 +152,11 @@ executable('zoitechat',
   dependencies: zoitechat_gtk_deps,
   link_with: zoitechat_theme_lib,
   c_args: zoitechat_gtk_cflags,
+  objc_args: zoitechat_gtk_objcflags,
   link_args: zoitechat_gtk_ldflags,
   pie: true,
   install: true,
-  gui_app: true,
+  win_subsystem: 'windows',
 )
 
 emoji_ui_tests = executable('emoji_ui_tests',
@@ -277,3 +294,10 @@ test('Emoji Font Tests', emoji_font_tests,
   protocol: 'tap',
   timeout: 120,
 )
+
+xtext_tests = executable('xtext_tests',
+  ['tests/test-xtext.c', '../common/hexcolor.c'],
+  include_directories: [config_h_include],
+  dependencies: [gtk_dep],
+)
+test('XText Tests', xtext_tests, protocol: 'tap', timeout: 120)

src/fe-gtk/notifications/notification-osx.m

@@ -1,54 +1,67 @@
-/* ZoiteChat
+/* Native macOS notifications; GPL-2.0-or-later, see COPYING. */
- * Copyright (C) 2015 Patrick Griffis.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- */
-
 #import <Cocoa/Cocoa.h>
-#include <gtkosxapplication.h>
+#import <UserNotifications/UserNotifications.h>
 
-void
+@interface ZoiteChatNotificationDelegate : NSObject <UNUserNotificationCenterDelegate>
-notification_backend_show (const char *title, const char *text)
+@end
+@implementation ZoiteChatNotificationDelegate
+- (void)userNotificationCenter:(UNUserNotificationCenter *)center
+      willPresentNotification:(UNNotification *)notification
+        withCompletionHandler:(void (^)(UNNotificationPresentationOptions))completionHandler
 {
-	NSString *str_title = [[NSString alloc] initWithUTF8String:title];
+    completionHandler(UNNotificationPresentationOptionBanner | UNNotificationPresentationOptionSound);
-	NSString *str_text = [[NSString alloc] initWithUTF8String:text];
+}
+@end
 
-	NSUserNotification *userNotification = [NSUserNotification new];
+static ZoiteChatNotificationDelegate *notification_delegate;
-	userNotification.title = str_title;
-	userNotification.informativeText = str_text;
 
-	NSUserNotificationCenter *center = [NSUserNotificationCenter defaultUserNotificationCenter];
+int
-	[center scheduleNotification:userNotification];
+notification_backend_supported (void)
-
+{
-	[str_title release];
+    return [[NSBundle mainBundle] bundleIdentifier] != nil;
-	[str_text release];
 }
 
 int
 notification_backend_init (const char **error)
 {
+    if (!notification_backend_supported ())
+    {
+        *error = "macOS notifications require an application bundle";
+        return 0;
+    }
+    notification_delegate = [ZoiteChatNotificationDelegate new];
+    [UNUserNotificationCenter currentNotificationCenter].delegate = notification_delegate;
     return 1;
 }
 
+void
+notification_backend_show (const char *title, const char *text)
+{
+    UNMutableNotificationContent *content = [UNMutableNotificationContent new];
+    content.title = [NSString stringWithUTF8String:title] ?: @"ZoiteChat";
+    content.body = [NSString stringWithUTF8String:text] ?: @"";
+    UNUserNotificationCenter *center = [UNUserNotificationCenter currentNotificationCenter];
+    /* Ask only when the user first needs a notification, without blocking GTK. */
+    [center requestAuthorizationWithOptions:UNAuthorizationOptionAlert | UNAuthorizationOptionSound
+        completionHandler:^(BOOL granted, NSError *error) {
+            if (granted)
+            {
+                UNNotificationRequest *request = [UNNotificationRequest
+                    requestWithIdentifier:[[NSUUID UUID] UUIDString] content:content trigger:nil];
+                [center addNotificationRequest:request withCompletionHandler:^(NSError *deliveryError) {
+                    if (deliveryError)
+                        NSLog(@"ZoiteChat notification failed: %@", deliveryError);
+                }];
+            }
+            else if (error)
+                NSLog(@"ZoiteChat notification authorization failed: %@", error);
+        }];
+}
+
 void
 notification_backend_deinit (void)
 {
-}
+    if (notification_delegate)
-
+        [UNUserNotificationCenter currentNotificationCenter].delegate = nil;
-int
+    notification_delegate = nil;
-notification_backend_supported (void)
-{
-	return gtkosx_application_get_bundle_id () != NULL;
 }

src/fe-gtk/notifygui.c

@@ -391,34 +391,39 @@ fe_notify_ask (char *nick, char *networks)
 	gtk_container_set_border_width (GTK_CONTAINER (table), 12);
 	gtk_grid_set_row_spacing (GTK_GRID (table), 3);
 	gtk_grid_set_column_spacing (GTK_GRID (table), 8);
-	gtk_container_add (GTK_CONTAINER (gtk_dialog_get_content_area (GTK_DIALOG (dialog))), table);
+	gtk_box_pack_start (GTK_BOX (gtk_dialog_get_content_area (GTK_DIALOG (dialog))),
+	                    table, TRUE, TRUE, 0);
 
 	label = gtk_label_new (msg);
-	gtkutil_grid_attach_defaults (table, label, 0, 1, 0, 1);
+	gtk_label_set_xalign (GTK_LABEL (label), 0.0f);
+	gtkutil_grid_attach (table, label, 0, 1, 0, 1, GTKUTIL_ATTACH_FILL, 0, 0, 0);
 
 	entry = gtk_entry_new ();
 	gtk_entry_set_text (GTK_ENTRY (entry), nick);
 	g_signal_connect (G_OBJECT (entry), "activate",
 						 	G_CALLBACK (notifygui_add_enter), dialog);
-	gtkutil_grid_attach_defaults (table, entry, 1, 2, 0, 1);
+	gtkutil_grid_attach (table, entry, 1, 2, 0, 1,
+	                     GTKUTIL_ATTACH_EXPAND | GTKUTIL_ATTACH_FILL, 0, 0, 0);
 
 	g_signal_connect (G_OBJECT (dialog), "response",
 						   G_CALLBACK (notifygui_add_cb), entry);
 
 	label = gtk_label_new (_("Notify on these networks:"));
-	gtkutil_grid_attach_defaults (table, label, 0, 1, 2, 3);
+	gtk_label_set_xalign (GTK_LABEL (label), 0.0f);
+	gtkutil_grid_attach (table, label, 0, 1, 2, 3, GTKUTIL_ATTACH_FILL, 0, 0, 0);
 
 	wid = gtk_entry_new ();
 	g_object_set_data (G_OBJECT (entry), "net", wid);
 	g_signal_connect (G_OBJECT (wid), "activate",
 						 	G_CALLBACK (notifygui_add_enter), dialog);
 	gtk_entry_set_text (GTK_ENTRY (wid), networks ? networks : "ALL");
-	gtkutil_grid_attach_defaults (table, wid, 1, 2, 2, 3);
+	gtkutil_grid_attach (table, wid, 1, 2, 2, 3,
+	                     GTKUTIL_ATTACH_EXPAND | GTKUTIL_ATTACH_FILL, 0, 0, 0);
 
 	label = gtk_label_new (NULL);
 	g_snprintf (buf, sizeof (buf), "<i><span size=\"smaller\">%s</span></i>", _("Comma separated list of networks is accepted."));
 	gtk_label_set_markup (GTK_LABEL (label), buf);
-	gtkutil_grid_attach_defaults (table, label, 1, 2, 3, 4);
+	gtkutil_grid_attach (table, label, 1, 2, 3, 4, GTKUTIL_ATTACH_FILL, 0, 0, 0);
 
 	gtk_widget_show_all (dialog);
 }

src/fe-gtk/servlistgui.c

@@ -2423,6 +2423,8 @@ servlist_open_edit (GtkWidget *parent, ircnet *net)
 	GtkWidget *comboboxentry_charset;
 	GtkWidget *combobox_logintypes;
 	GtkWidget *hbox1;
+	GtkWidget *content_scroll;
+	GtkWidget *content_box;
 	GtkWidget *scrolledwindow2;
 	GtkWidget *scrolledwindow4;
 	GtkWidget *scrolledwindow5;
@@ -2449,7 +2451,9 @@ servlist_open_edit (GtkWidget *parent, ircnet *net)
 	gtk_container_set_border_width (GTK_CONTAINER (editwindow), 4);
 	g_snprintf (buf, sizeof (buf), _("Edit %s - %s"), net->name, _(DISPLAY_NAME));
 	gtk_window_set_title (GTK_WINDOW (editwindow), buf);
-	gtk_window_set_default_size (GTK_WINDOW (editwindow), netedit_win_width, netedit_win_height);
+	gtk_window_set_default_size (GTK_WINDOW (editwindow),
+	                             netedit_win_width > 0 ? netedit_win_width : -1,
+	                             netedit_win_height > 0 ? netedit_win_height : -1);
 	gtk_window_set_transient_for (GTK_WINDOW (editwindow), GTK_WINDOW (parent));
 	gtk_window_set_modal (GTK_WINDOW (editwindow), TRUE);
 	gtk_window_set_type_hint (GTK_WINDOW (editwindow), GDK_WINDOW_TYPE_HINT_DIALOG);
@@ -2458,10 +2462,20 @@ servlist_open_edit (GtkWidget *parent, ircnet *net)
 	vbox5 = gtkutil_box_new (GTK_ORIENTATION_VERTICAL, FALSE, 0);
 	gtk_container_add (GTK_CONTAINER (editwindow), vbox5);
 
+	/* Keep Close accessible on small screens, while the lists still receive
+	   all spare space when the complete form fits in the window. */
+	content_scroll = gtk_scrolled_window_new (NULL, NULL);
+	gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (content_scroll),
+	                                GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
+	gtk_scrolled_window_set_propagate_natural_width (GTK_SCROLLED_WINDOW (content_scroll), TRUE);
+	gtk_scrolled_window_set_propagate_natural_height (GTK_SCROLLED_WINDOW (content_scroll), TRUE);
+	gtk_box_pack_start (GTK_BOX (vbox5), content_scroll, TRUE, TRUE, 0);
+	content_box = gtkutil_box_new (GTK_ORIENTATION_VERTICAL, FALSE, 0);
+	gtk_container_add (GTK_CONTAINER (content_scroll), content_box);
 
 	/* Tabs and buttons */
 	hbox1 = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 0);
-	gtk_box_pack_start (GTK_BOX (vbox5), hbox1, TRUE, TRUE, 4);
+	gtk_box_pack_start (GTK_BOX (content_box), hbox1, TRUE, TRUE, 4);
 
 	scrolledwindow2 = gtk_scrolled_window_new (NULL, NULL);
 	scrolledwindow4 = gtk_scrolled_window_new (NULL, NULL);
@@ -2599,7 +2613,7 @@ servlist_open_edit (GtkWidget *parent, ircnet *net)
 
 	/* Checkboxes and entries */
 	table3 = gtkutil_grid_new (19, 2, FALSE);
-	gtk_box_pack_start (GTK_BOX (vbox5), table3, FALSE, FALSE, 0);
+	gtk_box_pack_start (GTK_BOX (content_box), table3, FALSE, FALSE, 0);
 	gtk_grid_set_row_spacing (GTK_GRID (table3), 2);
 	gtk_grid_set_column_spacing (GTK_GRID (table3), 8);
 
@@ -2828,7 +2842,9 @@ servlist_open_networks (void)
 	gtk_container_set_border_width (GTK_CONTAINER (servlist), 4);
 	g_snprintf(buf, sizeof(buf), _("Network List - %s"), _(DISPLAY_NAME));
 	gtk_window_set_title (GTK_WINDOW (servlist), buf);
-	gtk_window_set_default_size (GTK_WINDOW (servlist), netlist_win_width, netlist_win_height);
+	gtk_window_set_default_size (GTK_WINDOW (servlist),
+	                             netlist_win_width > 0 ? netlist_win_width : -1,
+	                             netlist_win_height > 0 ? netlist_win_height : -1);
 	gtk_window_set_role (GTK_WINDOW (servlist), "servlist");
 	gtk_window_set_type_hint (GTK_WINDOW (servlist), GDK_WINDOW_TYPE_HINT_DIALOG);
 	if (current_sess)

src/fe-gtk/setup.c

@@ -59,6 +59,8 @@ static struct zoitechatprefs setup_prefs;
 static GtkWidget *cancel_button;
 static GtkWidget *font_dialog = NULL;
 static GtkWidget *setup_topicbar_multiline_toggle = NULL;
+static GtkWidget *setup_wrap_align_label = NULL;
+static GtkWidget *setup_wrap_align_combo = NULL;
 
 enum
 {
@@ -157,6 +159,14 @@ static const char *const langsmenu[] =
 };
 #endif
 
+static const char *const wrapalignmenu[] =
+{
+        N_("Start of line (default)"),
+        N_("Prefix (nick name)"),
+        N_("Message"),
+        NULL
+};
+
 static const setting appearance_settings[] =
 {
         {ST_HEADER,     N_("General"),0,0,0},
@@ -172,6 +182,7 @@ static const setting appearance_settings[] =
         {ST_TOGGLR, N_("Indent nick names"), P_OFFINTNL(hex_text_indent), N_("Make nick names right-justified"),0,0},
         {ST_TOGGLE, N_ ("Show marker line"), P_OFFINTNL (hex_text_show_marker), N_ ("Insert a red line after the last read text."), 0, 0},
         {ST_TOGGLE, N_("Keep search position when closing"), P_OFFINTNL(hex_text_search_keep_position), 0, 0, 0},
+        {ST_MENU,   N_("Align wrapped lines under:"), P_OFFINTNL(hex_text_wrap_align), N_("Where wrapped lines start when nick names are not indented"), wrapalignmenu, 0},
 
         {ST_HEADER,     N_("Timestamps"),0,0,0},
         {ST_TOGGLE, N_("Enable timestamps"), P_OFFINTNL(hex_stamp_text),0,0,1},
@@ -340,6 +351,9 @@ static const setting tabs_settings[] =
         {ST_TOGGLE, N_("Show close button on tabs"), P_OFFINTNL(hex_gui_tab_closebuttons), 0, 0, 0},
         {ST_TOGGLE, N_("Middle click to close tab"), P_OFFINTNL(hex_gui_tab_middleclose), 0, 0, 0},
         {ST_TOGGLE, N_("Smaller text"), P_OFFINTNL(hex_gui_tab_small), 0, 0, 0},
+        {ST_EFONT,  N_("Tab font:"), P_OFFSETNL(hex_gui_tab_font),
+                N_("Font for server and channel tabs in the Tabs layout. Leave blank to use the theme font. Smaller text still applies."),
+                0, sizeof prefs.hex_gui_tab_font},
         {ST_MENU,       N_("Focus new tabs:"), P_OFFINTNL(hex_gui_tab_newtofront), 0, focusnewtabsmenu, 0},
         {ST_MENU,       N_("Placement of notices:"), P_OFFINTNL(hex_irc_notice_pos), 0, noticeposmenu, 0},
         {ST_MENU,       N_("Show channel switcher at:"), P_OFFINTNL(hex_gui_tab_pos), 0, cspos, 1},
@@ -674,6 +688,11 @@ static const setting network_settings[] =
         {ST_ENTRY,      N_("Username:"), P_OFFSETNL(hex_net_proxy_user), 0, 0, sizeof prefs.hex_net_proxy_user},
         {ST_ENTRY,      N_("Password:"), P_OFFSETNL(hex_net_proxy_pass), 0, GINT_TO_POINTER(1), sizeof prefs.hex_net_proxy_pass},
 
+        {ST_HEADER,     N_("Remote Media"), 0, 0, 0, 0},
+        {ST_TOGGLE,     N_("Allow loading remote media (inline images) when clicked"),
+                                        P_OFFINTNL(hex_net_remote_media),
+                                        N_("Loading remote media contacts the site hosting it, which can reveal your IP address and that you viewed the message. You are asked for confirmation before each new domain is contacted."), 0, 0},
+
         {ST_END, 0, 0, 0, 0, 0}
 };
 
@@ -849,6 +868,20 @@ setup_topicbar_inline_toggled_cb (GtkToggleButton *but, gpointer userdata)
                         !gtk_toggle_button_get_active (but));
 }
 
+static void
+setup_text_indent_toggled_cb (GtkToggleButton *but, gpointer userdata)
+{
+        gboolean sens = !gtk_toggle_button_get_active (but);
+
+        (void) userdata;
+
+        /* wrapped line alignment only applies without nick indentation */
+        if (setup_wrap_align_label)
+                gtk_widget_set_sensitive (setup_wrap_align_label, sens);
+        if (setup_wrap_align_combo)
+                gtk_widget_set_sensitive (setup_wrap_align_combo, sens);
+}
+
 static void
 setup_create_toggleR (GtkWidget *tab, int row, const setting *set)
 {
@@ -859,6 +892,9 @@ setup_create_toggleR (GtkWidget *tab, int row, const setting *set)
                                                                                         setup_get_int (&setup_prefs, set));
         g_signal_connect (G_OBJECT (wid), "toggled",
                                                         G_CALLBACK (setup_toggle_cb), (gpointer)set);
+        if (set->offset == STRUCT_OFFSET_INT (struct zoitechatprefs, hex_text_indent))
+                g_signal_connect (G_OBJECT (wid), "toggled",
+                                                        G_CALLBACK (setup_text_indent_toggled_cb), NULL);
         if (set->tooltip)
                 gtk_widget_set_tooltip_text (wid, _(set->tooltip));
         setup_table_attach (tab, wid, 4, 5, row, row + 1, TRUE, FALSE,
@@ -1248,7 +1284,7 @@ setup_create_id_menu (GtkWidget *table, char *label, int row, char *dest)
 static void
 setup_create_menu (GtkWidget *table, int row, const setting *set)
 {
-        GtkWidget *wid, *cbox, *box;
+        GtkWidget *wid, *cbox;
         const char **text = (const char **)set->list;
         int i;
 
@@ -1269,10 +1305,18 @@ setup_create_menu (GtkWidget *table, int row, const setting *set)
         g_signal_connect (G_OBJECT (cbox), "changed",
                                                         G_CALLBACK (setup_menu_cb), (gpointer)set);
 
-        box = gtkutil_box_new (GTK_ORIENTATION_HORIZONTAL, FALSE, 0);
+        setup_table_attach (table, cbox, 3, 6, row, row + 1, TRUE, FALSE,
-        gtk_box_pack_start (GTK_BOX (box), cbox, 0, 0, 0);
-        setup_table_attach (table, box, 3, 4, row, row + 1, TRUE, FALSE,
                             SETUP_ALIGN_FILL, SETUP_ALIGN_FILL, 0, 0);
+
+        if (set->offset == STRUCT_OFFSET_INT (struct zoitechatprefs, hex_text_wrap_align))
+        {
+                setup_wrap_align_label = wid;
+                setup_wrap_align_combo = cbox;
+                g_object_add_weak_pointer (G_OBJECT (wid), (gpointer *)&setup_wrap_align_label);
+                g_object_add_weak_pointer (G_OBJECT (cbox), (gpointer *)&setup_wrap_align_combo);
+                gtk_widget_set_sensitive (wid, !setup_prefs.hex_text_indent);
+                gtk_widget_set_sensitive (cbox, !setup_prefs.hex_text_indent);
+        }
 }
 
 static void
@@ -1955,7 +1999,8 @@ setup_add_page (const char *title, GtkWidget *book, GtkWidget *tab)
 
         sw = GTK_SCROLLED_WINDOW(gtk_scrolled_window_new (NULL, NULL));
         gtk_scrolled_window_set_shadow_type (sw, GTK_SHADOW_IN);
-        gtk_scrolled_window_set_policy (sw, GTK_POLICY_NEVER, GTK_POLICY_AUTOMATIC);
+        gtk_scrolled_window_set_policy (sw, GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
+        gtk_scrolled_window_set_propagate_natural_width (sw, TRUE);
         gtk_container_add (GTK_CONTAINER (sw), vvbox);
 
         viewport = gtk_bin_get_child (GTK_BIN(sw));
@@ -1999,7 +2044,9 @@ setup_ensure_page_created (int page)
         }
 
         page_widget = setup_page_factories[page] (setup_page_settings[page]);
-        gtk_container_add (GTK_CONTAINER (container), page_widget);
+        /* Lazy pages must pass the notebook's spare space to their content,
+           particularly the independently scrolling Sounds list. */
+        gtk_box_pack_start (GTK_BOX (container), page_widget, TRUE, TRUE, 0);
         gtk_widget_show_all (container);
 }
 
@@ -2177,9 +2224,14 @@ setup_create_tree (GtkWidget *box, GtkWidget *book)
                                                             -1, _("Categories"), renderer, "text", 0, NULL);
         gtk_tree_view_expand_all (GTK_TREE_VIEW (tree));
 
-        frame = gtk_frame_new (NULL);
+        frame = gtk_scrolled_window_new (NULL, NULL);
+        gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (frame),
+                                       GTK_POLICY_NEVER, GTK_POLICY_AUTOMATIC);
+        gtk_scrolled_window_set_shadow_type (GTK_SCROLLED_WINDOW (frame), GTK_SHADOW_IN);
+        gtk_scrolled_window_set_propagate_natural_width (GTK_SCROLLED_WINDOW (frame), TRUE);
+        gtk_widget_set_vexpand (frame, TRUE);
         gtk_container_add (GTK_CONTAINER (frame), tree);
-        gtk_box_pack_start (GTK_BOX (box), frame, 0, 0, 0);
+        gtk_box_pack_start (GTK_BOX (box), frame, FALSE, TRUE, 0);
         gtk_box_reorder_child (GTK_BOX (box), frame, 0);
 
         if (sel_iter)
@@ -2330,6 +2382,9 @@ setup_apply (struct zoitechatprefs *pr)
         if (DIFF (hex_gui_tab_icons) || DIFF (hex_gui_tab_closebuttons) ||
                  DIFF (hex_gui_tab_small))
                 live_changes.chanview = TRUE;
+        if (pr->hex_gui_tab_layout == 0 &&
+                strcmp (pr->hex_gui_tab_font, prefs.hex_gui_tab_font) != 0)
+                live_changes.chanview = TRUE;
         if (DIFF (hex_gui_tab_sort))
                 live_changes.tab_resort = TRUE;
         if (DIFF (hex_gui_tab_trunc))

src/fe-gtk/sexy-spell-entry.c

@@ -215,7 +215,22 @@ initialize_enchant (void)
 #endif
     };
 
-    for (i = 0; i < G_N_ELEMENTS(libnames); ++i)
+#ifdef __APPLE__
+    const char *bundled_enchant = g_getenv ("ZOITECHAT_ENCHANT_LIBRARY");
+    if (bundled_enchant && *bundled_enchant)
+    {
+        enchant = g_module_open (bundled_enchant, 0);
+        if (enchant)
+        {
+            void (*set_prefix) (const char *) = NULL;
+            const char *prefix = g_getenv ("ZOITECHAT_ENCHANT_PREFIX");
+            if (prefix && g_module_symbol (enchant, "enchant_set_prefix_dir", (gpointer *) &set_prefix))
+                set_prefix (prefix);
+            have_enchant = TRUE;
+        }
+    }
+#endif
+    for (i = 0; !have_enchant && i < G_N_ELEMENTS(libnames); ++i)
     {
         enchant = g_module_open(libnames[i], 0);
         if (enchant)
@@ -1266,8 +1281,6 @@ attr_list_has_attrs (PangoAttrList *attrs)
 static void
 sexy_spell_entry_recheck_all(SexySpellEntry *entry)
 {
-	GdkRectangle rect;
-	GtkAllocation allocation;
 	GtkWidget *widget = GTK_WIDGET(entry);
 	int length, i, text_len;
 	const char *text;
@@ -1299,15 +1312,8 @@ sexy_spell_entry_recheck_all(SexySpellEntry *entry)
 
 	gtk_entry_set_attributes (GTK_ENTRY (entry), attr_list_has_attrs (entry->priv->attr_list) ? entry->priv->attr_list : NULL);
 
-	if (gtk_widget_get_realized (GTK_WIDGET(entry)))
+	/* GtkEntry shares its parent's GdkWindow in GTK3; redraw the widget area. */
-	{
+	gtk_widget_queue_draw (widget);
-		gtk_widget_get_allocation (GTK_WIDGET(entry), &allocation);
-		
-		rect.x = 0; rect.y = 0;
-		rect.width  = allocation.width;
-		rect.height = allocation.height;
-		gdk_window_invalidate_rect(gtk_widget_get_window (widget), &rect, TRUE);
-	}
 }
 
 static gboolean

src/fe-gtk/tests/test-emoji-font.c

@@ -3,6 +3,52 @@
 #include "../emoji-font.h"
 #include "../../common/emoji-data.h"
 #include <pango/pangofc-fontmap.h>
+#include <pango/pangofc-font.h>
+
+static GHashTable *font_checksums;
+static char *bundled_checksum;
+
+static const char *
+font_checksum (const char *path)
+{
+	const char *cached = g_hash_table_lookup (font_checksums, path);
+	char *contents, *checksum;
+	gsize length;
+
+	if (cached)
+		return cached;
+	g_assert_true (g_file_get_contents (path, &contents, &length, NULL));
+	checksum = g_compute_checksum_for_data (G_CHECKSUM_SHA256,
+		(const guchar *) contents, length);
+	g_free (contents);
+	g_hash_table_insert (font_checksums, g_strdup (path), checksum);
+	return checksum;
+}
+
+static void
+assert_bundled_font (PangoFont *font, gboolean expected)
+{
+	FcPattern *pattern;
+	FcChar8 *path;
+	const char *checksum;
+
+	/* Pango can describe a face by its embedded name rather than its
+	 * Fontconfig alias. Verify the resolved file's bytes, not that name.
+	 * Cache by filename so catalog coverage does not reread the font for
+	 * every glyph. An older system Noto must still fail this assertion. */
+	g_assert_true (PANGO_IS_FC_FONT (font));
+#if PANGO_VERSION_CHECK(1, 48, 0)
+	pattern = pango_fc_font_get_pattern (PANGO_FC_FONT (font));
+#else
+	pattern = PANGO_FC_FONT (font)->font_pattern;
+#endif
+	g_assert_cmpint (FcPatternGetString (pattern, FC_FILE, 0, &path), ==, FcResultMatch);
+	checksum = font_checksum ((const char *) path);
+	if (expected)
+		g_assert_cmpstr (checksum, ==, bundled_checksum);
+	else
+		g_assert_cmpstr (checksum, !=, bundled_checksum);
+}
 
 static void
 test_font_catalog (void)
@@ -34,9 +80,7 @@ test_font_catalog (void)
 				PangoLayoutRun *run = pango_layout_iter_get_run_readonly (iter);
 				if (run)
 				{
-					PangoFontDescription *actual = pango_font_describe (run->item->analysis.font);
+					assert_bundled_font (run->item->analysis.font, TRUE);
-					g_assert_cmpstr (pango_font_description_get_family (actual), ==, ZOITECHAT_EMOJI_FAMILY);
-					pango_font_description_free (actual);
 				}
 			} while (pango_layout_iter_next_run (iter));
 			pango_layout_iter_free (iter);
@@ -68,9 +112,7 @@ test_plain_text_font (void)
 		PangoLayoutRun *run = pango_layout_iter_get_run_readonly (iter);
 		if (run)
 		{
-			PangoFontDescription *actual = pango_font_describe (run->item->analysis.font);
+			assert_bundled_font (run->item->analysis.font, FALSE);
-			g_assert_cmpstr (pango_font_description_get_family (actual), !=, ZOITECHAT_EMOJI_FAMILY);
-			pango_font_description_free (actual);
 		}
 	} while (pango_layout_iter_next_run (iter));
 	pango_layout_iter_free (iter);
@@ -101,9 +143,7 @@ test_implicit_emoji_font (void)
 			PangoLayoutRun *run = pango_layout_iter_get_run_readonly (iter);
 			if (run)
 			{
-				PangoFontDescription *actual = pango_font_describe (run->item->analysis.font);
+				assert_bundled_font (run->item->analysis.font, TRUE);
-				g_assert_cmpstr (pango_font_description_get_family (actual), ==, ZOITECHAT_EMOJI_FAMILY);
-				pango_font_description_free (actual);
 			}
 		} while (pango_layout_iter_next_run (iter));
 		pango_layout_iter_free (iter);
@@ -116,9 +156,19 @@ test_implicit_emoji_font (void)
 int
 main (int argc, char **argv)
 {
+	const char *path;
+	int result;
+
 	g_test_init (&argc, &argv, NULL);
+	path = g_getenv ("ZOITECHAT_EMOJI_FONT");
+	g_assert_nonnull (path);
+	font_checksums = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
+	bundled_checksum = g_strdup (font_checksum (path));
 	g_test_add_func ("/emoji-font/catalog", test_font_catalog);
 	g_test_add_func ("/emoji-font/plain-text", test_plain_text_font);
 	g_test_add_func ("/emoji-font/implicit-emoji", test_implicit_emoji_font);
-	return g_test_run ();
+	result = g_test_run ();
+	g_free (bundled_checksum);
+	g_hash_table_destroy (font_checksums);
+	return result;
 }

src/fe-gtk/tests/test-emoji-ui.c

@@ -12,6 +12,22 @@
 struct zoitechatprefs prefs;
 static char *config_dir;
 
+static void
+test_theme_svg_loader (void)
+{
+	GError *error = NULL;
+	GdkPixbuf *pixbuf;
+
+	/* Exercise the theme asset that failed in the packaged Windows runtime. */
+	pixbuf = gdk_pixbuf_new_from_resource (
+		"/org/gtk/libgtk/theme/Adwaita/assets/bullet-symbolic.svg", &error);
+	g_assert_no_error (error);
+	g_assert_nonnull (pixbuf);
+	g_assert_cmpint (gdk_pixbuf_get_width (pixbuf), >, 0);
+	g_assert_cmpint (gdk_pixbuf_get_height (pixbuf), >, 0);
+	g_object_unref (pixbuf);
+}
+
 char *get_xdir (void) { return config_dir; }
 PreferencesPersistenceResult preferences_persistence_save_all (void)
 {
@@ -125,6 +141,7 @@ main (int argc, char **argv)
 	g_object_set (gtk_settings_get_default (), "gtk-enable-animations", FALSE, NULL);
 	config_dir = g_dir_make_tmp ("zoitechat-emoji-tests-XXXXXX", NULL);
 	g_assert_nonnull (config_dir);
+	g_test_add_func ("/emoji-ui/theme-svg-loader", test_theme_svg_loader);
 	g_test_add ("/emoji-ui/search-insertion", PickerFixture, NULL, fixture_setup, test_search_insertion, fixture_teardown);
 	g_test_add ("/emoji-ui/read-only", PickerFixture, NULL, fixture_setup, test_read_only, fixture_teardown);
 	g_test_add ("/emoji-ui/sequence-limit", PickerFixture, NULL, fixture_setup, test_sequence_limit, fixture_teardown);

src/fe-gtk/tests/test-xtext.c

@@ -0,0 +1,597 @@
+/* XText regression tests. Distributed under GPL-2.0-or-later; see COPYING.
+ * Include the implementation to check layout/selection invariants without
+ * adding test-only symbols to the widget's public API. Application services
+ * are stubbed; GTK, Pango, Cairo and the widget itself are exercised normally. */
+#include "../xtext.c"
+#include <glib/gstdio.h>
+
+struct zoitechatprefs prefs;
+
+void emoji_font_apply (GtkWidget *widget) { }
+int url_last (int *start, int *end) { return 0; }
+gsize strftime_utf8 (char *dest, gsize size, const char *format, time_t stamp)
+{
+	return strftime (dest, size, format, localtime (&stamp));
+}
+int xtext_get_stamp_str (time_t stamp, char **out)
+{
+	*out = g_strdup ("[12:34] ");
+	return strlen (*out);
+}
+void theme_get_xtext_colors_for_widget (GtkWidget *widget, XTextColor *colors, size_t len)
+{
+	size_t i;
+	for (i = 0; i < len; i++)
+	{
+		colors[i].red = colors[i].green = colors[i].blue = 0.0;
+		colors[i].alpha = 1.0;
+	}
+	colors[XTEXT_FG].red = colors[XTEXT_FG].green = colors[XTEXT_FG].blue = 1.0;
+	colors[XTEXT_MARK_BG].blue = 1.0;
+	colors[XTEXT_MARK_FG] = colors[XTEXT_FG];
+	colors[XTEXT_MARKER].red = 1.0;
+}
+
+typedef struct { GtkWidget *window; GtkXText *xtext; } Fixture;
+
+static void drain_events (void)
+{
+	while (g_main_context_iteration (NULL, FALSE)) { }
+}
+
+static void fixture_setup (Fixture *f, gconstpointer data)
+{
+	XTextColor colors[XTEXT_COLS];
+	GtkWidget *scrolled = gtk_scrolled_window_new (NULL, NULL);
+	theme_get_xtext_colors_for_widget (NULL, colors, G_N_ELEMENTS (colors));
+	f->window = gtk_window_new (GTK_WINDOW_TOPLEVEL);
+	gtk_window_set_default_size (GTK_WINDOW (f->window), 640, 360);
+	f->xtext = GTK_XTEXT (gtk_xtext_new (colors, TRUE));
+	g_object_ref (f->xtext);
+	gtk_container_add (GTK_CONTAINER (scrolled), GTK_WIDGET (f->xtext));
+	gtk_container_add (GTK_CONTAINER (f->window), scrolled);
+	g_assert_true (gtk_xtext_set_font (f->xtext, "monospace 12"));
+	gtk_widget_show_all (f->window);
+	drain_events ();
+}
+
+static void fixture_teardown (Fixture *f, gconstpointer data)
+{
+	gtk_widget_destroy (f->window);
+	g_object_unref (f->xtext);
+	drain_events ();
+	g_assert_null (image_pending_list);
+}
+
+static void append (Fixture *f, const char *text)
+{
+	gtk_xtext_append (f->xtext->buffer, (guchar *)text, -1, 1234);
+}
+
+static cairo_surface_t *snapshot (Fixture *f, gboolean partial)
+{
+	GtkWidget *widget = GTK_WIDGET (f->xtext);
+	int width = gtk_widget_get_allocated_width (widget);
+	int height = gtk_widget_get_allocated_height (widget);
+	cairo_surface_t *surface = cairo_image_surface_create (CAIRO_FORMAT_ARGB32, width, height);
+	cairo_t *cr = cairo_create (surface);
+	if (partial)
+	{
+		cairo_rectangle (cr, 0, f->xtext->fontsize, width, height - f->xtext->fontsize);
+		cairo_clip (cr);
+	}
+	gtk_widget_draw (widget, cr);
+	g_assert_cmpint (cairo_status (cr), ==, CAIRO_STATUS_SUCCESS);
+	cairo_destroy (cr);
+	cairo_surface_flush (surface);
+	return surface;
+}
+
+static void test_empty_and_bounded_append (Fixture *f, gconstpointer data)
+{
+	const guchar bytes[] = {'a', 'b', 'c'}; /* deliberately no terminating NUL */
+	append (f, "");
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==, "");
+	g_assert_cmpint (f->xtext->buffer->text_last->subline_count, ==, 1);
+	append (f, "\n");
+	g_assert_cmpint (f->xtext->buffer->text_last->str_len, ==, 0);
+	gtk_xtext_append (f->xtext->buffer, (guchar *)bytes, sizeof (bytes), 1234);
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==, "abc");
+	gtk_xtext_append_indent (f->xtext->buffer, (guchar *)"", 0, (guchar *)"", 0, 1234);
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==, " ");
+}
+
+static void test_utf8_limits (Fixture *f, gconstpointer data)
+{
+	GString *text = g_string_new (NULL);
+	int i;
+	for (i = 0; i < 1500; i++) g_string_append (text, "猫");
+	gtk_xtext_append (f->xtext->buffer, (guchar *)text->str, text->len, 1234);
+	g_assert_cmpint (f->xtext->buffer->text_last->str_len, ==, 4095);
+	g_assert_true (g_utf8_validate ((char *)f->xtext->buffer->text_last->str, -1, NULL));
+	gtk_xtext_append_indent (f->xtext->buffer, (guchar *)text->str, text->len,
+		(guchar *)"猫", -1, 1234);
+	g_assert_cmpint (f->xtext->buffer->text_last->str_len, <=, 4095);
+	g_assert_true (g_utf8_validate ((char *)f->xtext->buffer->text_last->str, -1, NULL));
+	gtk_xtext_append (f->xtext->buffer, (guchar *)"hello 猫", 8, 1234);
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==, "hello ");
+	gtk_xtext_append (f->xtext->buffer, (guchar *)"ok\xff" "bad", 6, 1234);
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==, "ok");
+	g_string_free (text, TRUE);
+}
+
+static void test_null_empty_prefix (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *buf = f->xtext->buffer;
+	/* PrintTextLine passes NULL/0 for indented server text without a tab. */
+	gtk_xtext_append_indent (buf, NULL, 0, (guchar *)"server notice", -1, 1234);
+	g_assert_cmpstr ((char *)buf->text_last->str, ==, " server notice");
+	g_assert_cmpint (buf->text_last->left_len, ==, 0);
+	g_assert_cmpint (buf->text_last->stamp, ==, 1234);
+	gtk_xtext_append_indent (buf, (guchar *)"nick", -1, NULL, 0, 1234);
+	g_assert_cmpstr ((char *)buf->text_last->str, ==, "nick ");
+	gtk_xtext_append_indent (buf, NULL, 0, NULL, 0, 1234);
+	g_assert_cmpstr ((char *)buf->text_last->str, ==, " ");
+	g_assert_cmpint (buf->num_lines, ==, 3);
+	cairo_surface_destroy (snapshot (f, FALSE));
+}
+
+static void test_wrapping (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *buf = f->xtext->buffer;
+	textentry *ent;
+	int start = 0, i;
+	append (f, "猫猫猫猫猫猫猫猫猫猫");
+	ent = buf->text_last;
+	/* A character wider than the row must still be kept whole. */
+	buf->window_width = 3;
+	gtk_xtext_lines_taken (buf, ent);
+	g_assert_cmpint (ent->subline_count, ==, 10);
+	for (i = 0; i < ent->subline_count; i++)
+	{
+		int end = gtk_xtext_subline_end (ent, i);
+		g_assert_cmpint (end, >, start);
+		g_assert_true (g_utf8_validate ((char *)ent->str + start, end - start, NULL));
+		start = end;
+	}
+	buf->window_width = 120;
+	gtk_xtext_lines_taken (buf, ent);
+	g_assert_cmpint (ent->subline_count, >, 1);
+	buf->window_width = 640;
+	gtk_xtext_lines_taken (buf, ent);
+	g_assert_cmpint (ent->subline_count, ==, 1);
+}
+
+static void test_font_isolation (Fixture *f, gconstpointer data)
+{
+	Fixture second;
+	int original = gtk_xtext_text_width (f->xtext, (guchar *)"WWii hello", 10);
+	fixture_setup (&second, NULL);
+	g_assert_true (gtk_xtext_set_font (second.xtext, "sans 30"));
+	g_assert_cmpint (gtk_xtext_text_width (second.xtext, (guchar *)"WWii hello", 10), >, original);
+	g_assert_cmpint (gtk_xtext_text_width (f->xtext, (guchar *)"WWii hello", 10), ==, original);
+	fixture_teardown (&second, NULL);
+	g_assert_cmpint (gtk_xtext_text_width (f->xtext, (guchar *)"WWii hello", 10), ==, original);
+}
+
+static void test_wide_metrics (Fixture *f, gconstpointer data)
+{
+	char *text = g_strnfill (4000, 'W');
+	g_assert_true (gtk_xtext_set_font (f->xtext, "sans 40"));
+	append (f, text);
+	g_assert_cmpint (f->xtext->buffer->text_last->str_width, >, 65535);
+	g_assert_cmpint (f->xtext->buffer->text_last->subline_count, >, 1);
+	g_free (text);
+}
+
+static void test_formatting (Fixture *f, gconstpointer data)
+{
+	const char *formatted = "a\002bold\002 \035italic\035 \00304,02red\017 \037u\037 \036s\036 \026r\026";
+	char *plain;
+	GSList *runs = NULL;
+	int len;
+	plain = (char *)gtk_xtext_strip_color ((guchar *)formatted, strlen (formatted), NULL, &len, &runs, FALSE);
+	g_assert_cmpstr (plain, ==, "abold italic red u s r");
+	g_assert_cmpint (len, ==, strlen (plain));
+	g_assert_cmpint (((offlen_t *)runs->data)->off, ==, 0);
+	g_slist_free_full (runs, g_free);
+	g_free (plain);
+	plain = (char *)gtk_xtext_strip_color ((guchar *)"a\010secret\010b", 10, NULL, &len, NULL, TRUE);
+	g_assert_cmpstr (plain, ==, "ab");
+	g_free (plain);
+	append (f, formatted);
+	gtk_xtext_append_indent (f->xtext->buffer, (guchar *)"nick", -1, (guchar *)formatted, -1, 1234);
+	f->xtext->auto_indent = TRUE;
+	f->xtext->buffer->time_stamp = TRUE;
+	f->xtext->buffer->indent = 130;
+	gtk_xtext_recalc_widths (f->xtext->buffer, FALSE);
+	cairo_surface_destroy (snapshot (f, FALSE));
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_last->str, ==,
+		"nick a\002bold\002 \035italic\035 \00304,02red\017 \037u\037 \036s\036 \026r\026");
+}
+
+static void select_entries (Fixture *f, textentry *start, textentry *end)
+{
+	textentry *ent;
+	for (ent = start; ent; ent = ent->next)
+	{
+		ent->mark_start = 0;
+		ent->mark_end = ent->str_len;
+		if (ent == end) break;
+	}
+	gtk_xtext_selection_render (f->xtext, start, end);
+	f->xtext->selection_buffer = f->xtext->buffer;
+}
+
+static void test_selection_and_clipboard (Fixture *f, gconstpointer data)
+{
+	char *selected;
+	int len;
+	append (f, "");
+	append (f, "\002bold\002 猫");
+	append (f, "last");
+	select_entries (f, f->xtext->buffer->text_first, f->xtext->buffer->text_last);
+	selected = gtk_xtext_selection_get_text (f->xtext, &len);
+	g_assert_cmpstr (selected, ==, "\nbold 猫\nlast");
+	g_assert_cmpint (len, ==, strlen (selected));
+	g_free (selected);
+	f->xtext->color_paste = TRUE;
+	f->xtext->mark_stamp = TRUE;
+	selected = gtk_xtext_selection_get_text (f->xtext, &len);
+	g_assert_cmpstr (selected, ==, "\n[12:34] \002bold\002 猫\n[12:34] last");
+	g_free (selected);
+	f->xtext->color_paste = f->xtext->mark_stamp = FALSE;
+	gtk_xtext_copy_selection (f->xtext);
+	selected = gtk_clipboard_wait_for_text (gtk_widget_get_clipboard (GTK_WIDGET (f->xtext), GDK_SELECTION_CLIPBOARD));
+	g_assert_cmpstr (selected, ==, "\nbold 猫\nlast");
+	g_free (selected);
+	selected = gtk_clipboard_wait_for_text (gtk_widget_get_clipboard (GTK_WIDGET (f->xtext), GDK_SELECTION_PRIMARY));
+	g_assert_cmpstr (selected, ==, "\nbold 猫\nlast");
+	g_free (selected);
+	gtk_xtext_unselect (f->xtext);
+	g_assert_false (gtk_xtext_is_selecting (f->xtext));
+}
+
+static void test_search (Fixture *f, gconstpointer data)
+{
+	GError *error = NULL;
+	textentry *first;
+	xtext_buffer *buf = f->xtext->buffer;
+	append (f, "one \002needle\002 then NEEDLE");
+	first = buf->text_last;
+	append (f, "second needle");
+	g_assert_true (gtk_xtext_search (f->xtext, "needle", highlight, &error) == first);
+	g_assert_no_error (error);
+	g_assert_cmpint (g_list_length (first->marks), ==, 2);
+	g_assert_true (gtk_xtext_search (f->xtext, "needle", highlight, &error) == first);
+	g_assert_true (gtk_xtext_search (f->xtext, "needle", highlight, &error) == buf->text_last);
+	gtk_xtext_search (f->xtext, "", 0, &error);
+	g_assert_null (buf->search_found);
+	g_assert_true (gtk_xtext_search (f->xtext, "needle", backward | case_match, &error) == buf->text_last);
+	gtk_xtext_search (f->xtext, "n[a-z]+", regexp | case_match, &error);
+	g_assert_no_error (error);
+	g_assert_nonnull (buf->search_re);
+	gtk_xtext_search (f->xtext, "[", regexp, &error);
+	g_assert_error (error, G_REGEX_ERROR, G_REGEX_ERROR_UNTERMINATED_CHARACTER_CLASS);
+	g_clear_error (&error);
+	/* A no-match search must also release its regex/text on clear. */
+	gtk_xtext_search (f->xtext, "nomatch", regexp, &error);
+	g_assert_null (buf->search_found);
+	gtk_xtext_clear (buf, 0);
+	g_assert_null (buf->search_re);
+	g_assert_null (buf->search_text);
+}
+
+static void test_follow_search (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *buf = f->xtext->buffer;
+	append (f, "match first");
+	gtk_xtext_search (f->xtext, "match", 0, NULL);
+	append (f, "match second");
+	gtk_xtext_search (f->xtext, NULL, follow, NULL);
+	g_assert_cmpint (g_list_length (buf->search_found), ==, 2);
+	GList *current = buf->curmark;
+	gtk_xtext_search (f->xtext, NULL, 0, NULL);
+	gtk_xtext_search (f->xtext, NULL, follow, NULL);
+	g_assert_cmpint (g_list_length (buf->search_found), ==, 2);
+	g_assert_true (buf->curmark == current);
+	append (f, "match third");
+	g_assert_cmpint (g_list_length (buf->search_found), ==, 3);
+}
+
+static void test_search_unicode_offsets (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *buf = f->xtext->buffer;
+	offsets_t mark;
+	append (f, "İ \002NEEDLE\002 Straße");
+	gtk_xtext_search (f->xtext, "needle", 0, NULL);
+	mark.u = GPOINTER_TO_UINT (buf->text_first->marks->data);
+	g_assert_cmpint (mark.o.start, ==, 4);
+	/* The established color-offset mapping includes the closing control. */
+	g_assert_cmpint (mark.o.end, ==, 11);
+	gtk_xtext_search (f->xtext, "ss", 0, NULL);
+	mark.u = GPOINTER_TO_UINT (buf->text_first->marks->data);
+	g_assert_cmpint (mark.o.start, ==, 16);
+	g_assert_cmpint (mark.o.end, ==, 18);
+	gtk_xtext_clear (buf, 0);
+	append (f, "ſ needle");
+	gtk_xtext_search (f->xtext, "needle", 0, NULL);
+	mark.u = GPOINTER_TO_UINT (buf->text_first->marks->data);
+	g_assert_cmpint (mark.o.start, ==, 3);
+	g_assert_cmpint (mark.o.end, ==, 9);
+}
+
+static void test_rawlog_hidden_text (Fixture *f, gconstpointer data)
+{
+	int hidden, visible;
+	append (f, "a\010secret\010b");
+	hidden = f->xtext->buffer->text_last->str_width;
+	f->xtext->ignore_hidden = TRUE;
+	gtk_xtext_recalc_widths (f->xtext->buffer, TRUE);
+	visible = f->xtext->buffer->text_last->str_width;
+	g_assert_cmpint (visible, >, hidden);
+	g_assert_cmpint (visible, ==, gtk_xtext_text_width (f->xtext, (guchar *)"asecretb", 8));
+}
+
+static void test_save (Fixture *f, gconstpointer data)
+{
+	char *path, *saved;
+	GError *error = NULL;
+	int fd = g_file_open_tmp ("zoitechat-xtext-XXXXXX", &path, &error);
+	g_assert_no_error (error);
+	append (f, "\002bold\002 猫");
+	append (f, "");
+	append (f, "last");
+	gtk_xtext_save (f->xtext, fd);
+	close (fd);
+	g_assert_true (g_file_get_contents (path, &saved, NULL, &error));
+	g_assert_no_error (error);
+	g_assert_cmpstr (saved, ==, "bold 猫\n\nlast\n");
+	g_free (saved);
+	g_unlink (path);
+	g_free (path);
+}
+
+static void test_scrollable_ownership (Fixture *f, gconstpointer data)
+{
+	GtkAdjustment *horizontal = GTK_ADJUSTMENT (gtk_adjustment_new (0, 0, 1, 1, 1, 1));
+	GtkAdjustment *vertical = GTK_ADJUSTMENT (gtk_adjustment_new (0, 0, 100, 1, 10, 10));
+	GtkAdjustment *old = g_object_ref (f->xtext->adj);
+	g_object_set (f->xtext, "hadjustment", horizontal, "vadjustment", vertical, NULL);
+	g_assert_false (g_object_is_floating (horizontal));
+	g_assert_false (g_object_is_floating (vertical));
+	g_assert_true (f->xtext->hadj == horizontal);
+	g_assert_true (f->xtext->adj == vertical);
+	/* A replaced adjustment must no longer call into the widget. */
+	g_assert_cmpuint (g_signal_handler_find (old, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, f->xtext), ==, 0);
+	g_signal_emit_by_name (f->xtext, "set-scroll-adjustments", horizontal, vertical);
+	g_assert_true (f->xtext->adj == vertical);
+	g_object_set (f->xtext, "hadjustment", NULL, "vadjustment", NULL, NULL);
+	g_assert_true (GTK_IS_ADJUSTMENT (f->xtext->hadj));
+	g_assert_true (GTK_IS_ADJUSTMENT (f->xtext->adj));
+	g_object_unref (old);
+}
+
+static void test_clear_and_marker (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *buf = f->xtext->buffer;
+	append (f, "first"); append (f, "second"); append (f, "third");
+	buf->marker_pos = buf->text_first;
+	buf->marker_state = MARKER_IS_SET;
+	gtk_xtext_clear (buf, 1);
+	g_assert_cmpstr ((char *)buf->text_first->str, ==, "second");
+	g_assert_cmpint (buf->marker_state, ==, MARKER_RESET_BY_CLEAR);
+	gtk_xtext_clear (buf, -1);
+	g_assert_cmpstr ((char *)buf->text_last->str, ==, "second");
+	select_entries (f, buf->text_first, buf->text_last);
+	f->xtext->hilight_ent = buf->text_first;
+	gtk_xtext_clear (buf, 0);
+	g_assert_null (f->xtext->hilight_ent);
+	g_assert_null (buf->pagetop_ent);
+	g_assert_null (buf->last_ent_start);
+	g_assert_cmpint (buf->num_lines, ==, 0);
+	g_assert_true (gtk_xtext_is_empty (buf));
+	append (f, "after clear");
+	g_assert_cmpint (buf->num_lines, ==, 1);
+}
+
+static void test_scrollback_limit (Fixture *f, gconstpointer data)
+{
+	int i;
+	xtext_buffer *buf = f->xtext->buffer;
+	gtk_xtext_set_max_lines (f->xtext, 10);
+	for (i = 0; i < 100; i++) append (f, "line");
+	g_assert_cmpint (buf->num_lines, ==, 10);
+	g_assert_null (buf->text_first->prev);
+	g_assert_null (buf->text_last->next);
+	g_assert_cmpfloat (gtk_adjustment_get_value (f->xtext->adj), >=, 0);
+}
+
+static void test_follow_trim_oversized_entry (Fixture *f, gconstpointer data)
+{
+	char *long_text = g_strnfill (4000, 'W');
+	gtk_xtext_set_max_lines (f->xtext, 3);
+	append (f, "needle");
+	gtk_xtext_search (f->xtext, "W", follow, NULL);
+	gtk_xtext_clear (f->xtext->buffer, 1);
+	append (f, long_text);
+	g_assert_true (gtk_xtext_is_empty (f->xtext->buffer));
+	g_assert_null (f->xtext->buffer->search_found);
+	g_free (long_text);
+	append (f, "after oversized");
+	gtk_xtext_clear (f->xtext->buffer, G_MININT);
+	g_assert_true (gtk_xtext_is_empty (f->xtext->buffer));
+}
+
+static void test_stress (Fixture *f, gconstpointer data)
+{
+	static const char *tokens[] = {"text ", "猫", "😀", "\002bold\002", "\00304,02red\017", "\010hidden\010", "\037u\037", "\036s\036"};
+	GRand *random = g_rand_new_with_seed (0x78746578);
+	xtext_buffer *buf = f->xtext->buffer;
+	int i;
+	gtk_xtext_set_max_lines (f->xtext, 80);
+	for (i = 0; i < 2000; i++)
+	{
+		GString *text = g_string_new (NULL);
+		textentry *ent;
+		int j, lines = 0;
+		for (j = 0; j < 30; j++)
+			g_string_append (text, tokens[g_rand_int_range (random, 0, G_N_ELEMENTS (tokens))]);
+		if (i % 2)
+			gtk_xtext_append_indent (buf, (guchar *)"nick", -1, (guchar *)text->str, text->len, 1234);
+		else
+			gtk_xtext_append (buf, (guchar *)text->str, text->len, 1234);
+		g_string_free (text, TRUE);
+		if (i % 29 == 0) gtk_xtext_search (f->xtext, "text", follow | highlight, NULL);
+		if (i % 31 == 0) gtk_xtext_clear (buf, 1);
+		if (i % 37 == 0) gtk_xtext_clear (buf, -1);
+		if (i % 101 == 0) gtk_xtext_clear (buf, 0);
+		for (ent = buf->text_first; ent; ent = ent->next)
+		{
+			g_assert_true (g_utf8_validate ((char *)ent->str, ent->str_len, NULL));
+			g_assert_cmpint (ent->subline_count, >, 0);
+			lines += ent->subline_count;
+		}
+		g_assert_cmpint (buf->num_lines, ==, lines);
+		if (i % 43 == 0) cairo_surface_destroy (snapshot (f, FALSE));
+	}
+	g_rand_free (random);
+}
+
+static void test_buffers (Fixture *f, gconstpointer data)
+{
+	xtext_buffer *original = f->xtext->buffer;
+	xtext_buffer *second = gtk_xtext_buffer_new (f->xtext);
+	append (f, "original");
+	gtk_xtext_append (second, (guchar *)"alternate", -1, 1234);
+	gtk_xtext_buffer_show (f->xtext, second, TRUE);
+	g_assert_true (f->xtext->buffer == second);
+	cairo_surface_destroy (snapshot (f, FALSE));
+	gtk_xtext_buffer_show (f->xtext, original, TRUE);
+	g_assert_cmpstr ((char *)f->xtext->buffer->text_first->str, ==, "original");
+	gtk_xtext_buffer_free (second);
+}
+
+static void test_partial_draw_after_scroll (Fixture *f, gconstpointer data)
+{
+	cairo_surface_t *partial, *full;
+	int i, stride, height, y;
+	for (i = 0; i < 80; i++)
+	{
+		char *line = g_strdup_printf ("line %d — 猫 \002bold\002", i);
+		append (f, line);
+		g_free (line);
+	}
+	cairo_surface_destroy (snapshot (f, FALSE));
+	gtk_adjustment_set_value (f->xtext->adj, 12.5);
+	partial = snapshot (f, TRUE);
+	full = snapshot (f, FALSE);
+	stride = cairo_image_surface_get_stride (full);
+	height = cairo_image_surface_get_height (full);
+	for (y = f->xtext->fontsize; y < height; y++)
+		g_assert_cmpmem (cairo_image_surface_get_data (partial) + y * stride, stride,
+			cairo_image_surface_get_data (full) + y * stride, stride);
+	cairo_surface_destroy (partial);
+	cairo_surface_destroy (full);
+}
+
+static void test_image_lifecycle (Fixture *f, gconstpointer data)
+{
+	GdkPixbuf *image = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, 800, 600);
+	xtext_buffer *buf = f->xtext->buffer;
+	textentry *ent;
+	guint handle;
+	int before;
+	gdk_pixbuf_fill (image, 0xff0000ff);
+	append (f, "image");
+	ent = buf->text_last;
+	before = buf->num_lines;
+	handle = gtk_xtext_image_load_begin (f->xtext, ent, "https://example.invalid/image.png");
+	g_assert_cmpuint (handle, !=, 0);
+	g_assert_cmpuint (gtk_xtext_image_load_begin (f->xtext, ent, "duplicate"), ==, 0);
+	g_assert_true (gtk_xtext_image_load_finish (handle, image));
+	g_assert_cmpint (buf->num_lines, >, before);
+	g_assert_true (gtk_xtext_entry_has_image (f->xtext, ent));
+	g_assert_cmpint (gdk_pixbuf_get_width (ent->image), <=, XTEXT_IMAGE_MAX_WIDTH);
+	g_assert_true (gtk_xtext_entry_get_full_image (f->xtext, ent) == image);
+	cairo_surface_destroy (snapshot (f, FALSE));
+	g_assert_true (gtk_xtext_image_remove (f->xtext, ent));
+	g_assert_cmpint (buf->num_lines, ==, before);
+	handle = gtk_xtext_image_load_begin (f->xtext, ent, "late");
+	gtk_xtext_clear (buf, 0);
+	g_assert_false (gtk_xtext_image_load_finish (handle, image));
+	g_assert_false (gtk_xtext_entry_has_image (f->xtext, ent));
+	g_assert_null (gtk_xtext_entry_get_full_image (f->xtext, ent));
+	g_object_unref (image);
+}
+
+static void test_background (Fixture *f, gconstpointer data)
+{
+	cairo_surface_t *background = cairo_image_surface_create (CAIRO_FORMAT_ARGB32, 32, 32);
+	cairo_t *cr = cairo_create (background);
+	cairo_set_source_rgb (cr, 0.2, 0.3, 0.4);
+	cairo_paint (cr);
+	cairo_destroy (cr);
+	gtk_xtext_set_background (f->xtext, background);
+	cairo_surface_destroy (background);
+	gtk_xtext_set_background (f->xtext, f->xtext->background_surface);
+	append (f, "background text");
+	cairo_surface_destroy (snapshot (f, FALSE));
+	gtk_xtext_set_background (f->xtext, NULL);
+	cairo_surface_destroy (snapshot (f, FALSE));
+}
+
+static void test_destroy_pending_sources (Fixture *f, gconstpointer data)
+{
+	guint image;
+	append (f, "pending");
+	image = gtk_xtext_image_load_begin (f->xtext, f->xtext->buffer->text_last, "late");
+	f->xtext->io_tag = g_timeout_add (10000, gtk_xtext_adjustment_timeout, f->xtext);
+	f->xtext->add_io_tag = g_timeout_add (10000, gtk_xtext_render_page_timeout, f->xtext);
+	f->xtext->scroll_tag = g_timeout_add (10000, gtk_xtext_scrollup_timeout, f->xtext);
+	gtk_widget_destroy (f->window);
+	g_assert_cmpint (f->xtext->io_tag, ==, 0);
+	g_assert_cmpint (f->xtext->add_io_tag, ==, 0);
+	g_assert_cmpint (f->xtext->scroll_tag, ==, 0);
+	g_assert_false (gtk_xtext_image_load_finish (image, NULL));
+	/* GtkWidget destruction must be safe if GObject dispose runs again. */
+	g_object_run_dispose (G_OBJECT (f->xtext));
+	f->window = gtk_window_new (GTK_WINDOW_TOPLEVEL);
+}
+
+int main (int argc, char **argv)
+{
+	g_test_init (&argc, &argv, NULL);
+	if (!gtk_init_check (&argc, &argv))
+	{
+		g_test_message ("GTK display unavailable; run under Xvfb for widget coverage");
+		return 77;
+	}
+	prefs.hex_gui_mouse_scroll_speed = 10;
+#define ADD(name, function) g_test_add ("/xtext/" name, Fixture, NULL, fixture_setup, function, fixture_teardown)
+	ADD ("append/empty-bounded", test_empty_and_bounded_append);
+	ADD ("append/utf8-limits", test_utf8_limits);
+	ADD ("append/null-empty-prefix", test_null_empty_prefix);
+	ADD ("layout/wrapping", test_wrapping);
+	ADD ("layout/font-isolation", test_font_isolation);
+	ADD ("layout/wide-metrics", test_wide_metrics);
+	ADD ("render/formatting-timestamps", test_formatting);
+	ADD ("selection/clipboard", test_selection_and_clipboard);
+	ADD ("search/navigation-regex-clear", test_search);
+	ADD ("search/follow", test_follow_search);
+	ADD ("search/unicode-offsets", test_search_unicode_offsets);
+	ADD ("render/rawlog-hidden", test_rawlog_hidden_text);
+	ADD ("buffer/save", test_save);
+	ADD ("lifecycle/scrollable-ownership", test_scrollable_ownership);
+	ADD ("buffer/clear-marker", test_clear_and_marker);
+	ADD ("buffer/scrollback-limit", test_scrollback_limit);
+	ADD ("buffer/follow-trim-oversized", test_follow_trim_oversized_entry);
+	ADD ("buffer/stress", test_stress);
+	ADD ("buffer/switch", test_buffers);
+	ADD ("render/partial-scroll", test_partial_draw_after_scroll);
+	ADD ("images/lifecycle", test_image_lifecycle);
+	ADD ("render/background", test_background);
+	ADD ("lifecycle/pending-sources", test_destroy_pending_sources);
+#undef ADD
+	return g_test_run ();
+}

src/fe-gtk/textgui.c

@@ -92,7 +92,7 @@ PrintTextLine (xtext_buffer *xtbuf, unsigned char *text, int len, int indent, ti
 			memcpy (new_text, stamp, stamp_size);
 			g_free (stamp);
 			memcpy (new_text + stamp_size, text, len);
-			gtk_xtext_append (xtbuf, new_text, len + stamp_size, timet);
+			gtk_xtext_append_wrap (xtbuf, new_text, len + stamp_size, timet, stamp_size);
 			g_free (new_text);
 		} else
 			gtk_xtext_append (xtbuf, text, len, timet);
@@ -400,7 +400,6 @@ pevent_treeview_new (GtkWidget *box)
 	scroll = gtk_scrolled_window_new (NULL, NULL);
 	gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (scroll), GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
 	gtk_scrolled_window_set_shadow_type (GTK_SCROLLED_WINDOW (scroll), GTK_SHADOW_IN);
-	gtk_widget_set_size_request (GTK_WIDGET (scroll), -1, 250);
 
 	store = gtk_list_store_new (N_COLUMNS, G_TYPE_STRING, G_TYPE_STRING, G_TYPE_INT);
 	g_return_val_if_fail (store != NULL, NULL);
@@ -437,7 +436,7 @@ pevent_treeview_new (GtkWidget *box)
 	gtk_tree_view_column_set_min_width (col, 100);
 
 	gtk_container_add (GTK_CONTAINER (scroll), view);
-	gtk_container_add (GTK_CONTAINER (box), scroll);
+	gtk_paned_pack1 (GTK_PANED (box), scroll, TRUE, FALSE);
 
 	return view;
 }
@@ -481,15 +480,15 @@ pevent_hlist_treeview_new (GtkWidget *box)
 	gtk_tree_view_column_set_sizing (col, GTK_TREE_VIEW_COLUMN_AUTOSIZE);
 
 	gtk_container_add (GTK_CONTAINER (scroll), view);
-	gtk_container_add (GTK_CONTAINER (box), scroll);
+	gtk_paned_pack2 (GTK_PANED (box), scroll, TRUE, FALSE);
 
 	return view;
 }
 
 void
-pevent_dialog_show ()
+pevent_dialog_show (void)
 {
-	GtkWidget *vbox, *hbox, *wid, *pane;
+	GtkWidget *vbox, *hbox, *wid, *pane, *preview_pane;
 	XTextColor xtext_palette[XTEXT_COLS];
 
 	if (pevent_dialog)
@@ -503,8 +502,12 @@ pevent_dialog_show ()
 											 TRUE, FALSE, pevent_dialog_close, NULL,
 											 600, 455, &vbox, 0);
 
+	preview_pane = gtk_paned_new (GTK_ORIENTATION_VERTICAL);
+	gtk_box_pack_start (GTK_BOX (vbox), preview_pane, TRUE, TRUE, 0);
 	pane = gtk_paned_new (GTK_ORIENTATION_VERTICAL);
-	gtk_box_pack_start (GTK_BOX (vbox), pane, TRUE, TRUE, 0);
+	gtk_paned_pack1 (GTK_PANED (preview_pane), pane, TRUE, FALSE);
+	gtk_paned_set_position (GTK_PANED (pane), 220);
+	gtk_paned_set_position (GTK_PANED (preview_pane), 330);
 	
 	pevent_dialog_list = pevent_treeview_new (pane);
 	pevent_dialog_fill (pevent_dialog_list);
@@ -513,12 +516,12 @@ pevent_dialog_show ()
 
 	wid = gtk_scrolled_window_new (NULL, NULL);
 	gtk_scrolled_window_set_policy (GTK_SCROLLED_WINDOW (wid), GTK_POLICY_NEVER, GTK_POLICY_ALWAYS);
-	gtk_box_pack_start (GTK_BOX (vbox), wid, FALSE, TRUE, 0);
+	gtk_scrolled_window_set_min_content_height (GTK_SCROLLED_WINDOW (wid), 75);
+	gtk_paned_pack2 (GTK_PANED (preview_pane), wid, TRUE, FALSE);
 
 	theme_get_xtext_colors_for_widget (wid, xtext_palette, XTEXT_COLS);
 	pevent_dialog_twid = gtk_xtext_new (xtext_palette, 0);
 	gtk_widget_set_sensitive (pevent_dialog_twid, FALSE);
-	gtk_widget_set_size_request (pevent_dialog_twid, -1, 75);
 	gtk_container_add (GTK_CONTAINER (wid), pevent_dialog_twid);
 	gtk_xtext_set_font (GTK_XTEXT (pevent_dialog_twid), prefs.hex_text_font);
 	g_object_set_data (G_OBJECT (pevent_dialog), "xtext", pevent_dialog_twid);

src/fe-gtk/theme/tests/test-theme-application-input-style.c

@@ -21,6 +21,7 @@
 #include "../../fe-gtk.h"
 
 #include "../theme-application.h"
+#include "../theme-css.h"
 #include "../theme-policy.h"
 #include "../../maingui.h"
 #include "../../../common/zoitechat.h"
@@ -45,6 +46,13 @@ fe_message (char *msg, int flags)
 	message_calls++;
 }
 
+/* This test isolates input styling from the application's toplevel CSS. */
+char *
+theme_css_build_toplevel_classes (void)
+{
+	return g_strdup ("");
+}
+
 void
 theme_css_reload_input_style (gboolean enabled, const PangoFontDescription *font_desc)
 {

src/fe-gtk/theme/theme-manager.c

@@ -683,7 +683,7 @@ theme_manager_get_userlist_palette_behavior (const PangoFontDescription *font_de
 
 	behavior.font_desc = font_desc;
 	behavior.apply_background = TRUE;
-	behavior.apply_foreground = (prefs.hex_gui_ulist_color || prefs.hex_text_color_nicks) ? FALSE : TRUE;
+	behavior.apply_foreground = prefs.hex_gui_ulist_color ? FALSE : TRUE;
 
 	return behavior;
 }

src/fe-gtk/theme/theme-preferences.c

@@ -1911,6 +1911,7 @@ theme_preferences_create_page (GtkWindow *parent,
                                          G_TYPE_STRING,
                                          G_TYPE_INT);
         ui->gtk3_combo = gtk_combo_box_new_with_model (GTK_TREE_MODEL (gtk3_store));
+        gtk_widget_set_hexpand (ui->gtk3_combo, TRUE);
         g_object_unref (gtk3_store);
         renderer = gtk_cell_renderer_text_new ();
         gtk_cell_layout_pack_start (GTK_CELL_LAYOUT (ui->gtk3_combo), renderer, TRUE);

src/fe-gtk/urlgrab.c

@@ -187,7 +187,7 @@ populate_cb (char *urltext, gpointer userdata)
 }
 
 void
-url_opengui ()
+url_opengui (void)
 {
 	GtkWidget *vbox, *hbox, *view;
 	char buf[128];

src/fe-gtk/userlistgui.c

@@ -594,7 +594,7 @@ fe_userlist_rehash (session *sess, struct User *user)
 		nick_token = THEME_TOKEN_TAB_AWAY;
 		have_nick_token = TRUE;
 	}
-	else if (prefs.hex_gui_ulist_color || prefs.hex_text_color_nicks)
+	else if (prefs.hex_gui_ulist_color)
 	{
 		int mirc_index = text_color_of (user->nick);
 
@@ -635,7 +635,7 @@ fe_userlist_insert (session *sess, struct User *newuser, gboolean sel)
 		nick_token = THEME_TOKEN_TAB_AWAY;
 		have_nick_token = TRUE;
 	}
-	else if (prefs.hex_gui_ulist_color || prefs.hex_text_color_nicks)
+	else if (prefs.hex_gui_ulist_color)
 	{
 		int mirc_index = text_color_of (newuser->nick);
 

src/fe-gtk/xtext.h

@@ -38,6 +38,7 @@ GType gtk_xtext_get_type (void);
 
 #define ATTR_BOLD				'\002'
 #define ATTR_COLOR			'\003'
+#define ATTR_HEXCOLOR		'\004'
 #define ATTR_BLINK			'\006'
 #define ATTR_BEEP				'\007'
 #define ATTR_HIDDEN			'\010'
@@ -57,6 +58,8 @@ GType gtk_xtext_get_type (void);
 #define XTEXT_BG 102
 #define XTEXT_MARKER 103	/* for marker line */
 #define XTEXT_MAX_COLOR 98
+#define XTEXT_HEX_FG 200	/* not palette slots: colors from \004RRGGBB */
+#define XTEXT_HEX_BG 201
 typedef struct textentry textentry;
 
 /*
@@ -181,6 +184,8 @@ struct _GtkXText
 
 	int col_fore;
 	int col_back;
+	XTextColor hex_fg;
+	XTextColor hex_bg;
 
 	int depth;						  /* gdk window depth */
 
@@ -192,6 +197,7 @@ struct _GtkXText
 	int hilight_end;
 	time_t tooltip_stamp;
 	unsigned int tooltip_stamp_set:1;
+	char *tooltip_url;			  /* URL shown while hovering a placeholder */
 
 	guint16 fontwidth[128];	  /* each char's width, only the ASCII ones */
 
@@ -254,6 +260,9 @@ struct _GtkXText
 	unsigned int force_render:1;
 	unsigned int color_paste:1; /* CTRL was pressed when selection finished */
 
+	textentry *clicked_ent;		  /* entry under the last word_click, or NULL */
+	textentry *clicked_image_ent; /* entry whose inline image was clicked */
+
 	/* settings/prefs */
 	unsigned int auto_indent:1;
 	unsigned int thinline:1;
@@ -272,6 +281,7 @@ struct _GtkXTextClass
 
 GtkWidget *gtk_xtext_new (const XTextColor *palette, int separator);
 void gtk_xtext_append (xtext_buffer *buf, unsigned char *text, int len, time_t stamp);
+void gtk_xtext_append_wrap (xtext_buffer *buf, unsigned char *text, int len, time_t stamp, int stamp_len);
 void gtk_xtext_append_indent (xtext_buffer *buf,
 										unsigned char *left_text, int left_len,
 										unsigned char *right_text, int right_len,
@@ -309,4 +319,19 @@ void gtk_xtext_buffer_free (xtext_buffer *buf);
 void gtk_xtext_buffer_show (GtkXText *xtext, xtext_buffer *buf, int render);
 void gtk_xtext_copy_selection (GtkXText *xtext);
 
+/* inline image support.  A textentry can have one image attached, which is
+ * rendered below its text.  Loading is asynchronous: begin() registers the
+ * target entry and returns a handle, finish() attaches the downloaded pixbuf
+ * if the entry still exists.  The handle stays valid even if the entry, its
+ * buffer or the widget are destroyed in the meantime. */
+textentry *gtk_xtext_get_clicked_entry (GtkXText *xtext);
+textentry *gtk_xtext_get_clicked_image_entry (GtkXText *xtext);
+gboolean gtk_xtext_buffer_contains (GtkXText *xtext, textentry *ent);
+gboolean gtk_xtext_entry_has_image (GtkXText *xtext, textentry *ent);
+const char *gtk_xtext_entry_get_image_url (GtkXText *xtext, textentry *ent);
+GdkPixbuf *gtk_xtext_entry_get_full_image (GtkXText *xtext, textentry *ent);
+guint gtk_xtext_image_load_begin (GtkXText *xtext, textentry *ent, const char *url);
+gboolean gtk_xtext_image_load_finish (guint handle, GdkPixbuf *pixbuf);
+gboolean gtk_xtext_image_remove (GtkXText *xtext, textentry *ent);
+
 #endif

src/fe-text/fe-text.c

@@ -43,6 +43,9 @@
 #include "../common/util.h"
 #include "../common/fe.h"
 #include "fe-text.h"
+#ifdef __APPLE__
+#include "../common/macos.h"
+#endif
 
 
 static int done = FALSE;
@@ -467,6 +470,9 @@ static const GOptionEntry gopt_entries[] =
  {"no-auto",	'a', 0, G_OPTION_ARG_NONE,	&arg_dont_autoconnect, N_("Don't auto connect to servers"), NULL},
  {"cfgdir",	'd', 0, G_OPTION_ARG_STRING,	&arg_cfgdir, N_("Use a different config directory"), "PATH"},
  {"no-plugins",	'n', 0, G_OPTION_ARG_NONE,	&arg_skip_plugins, N_("Don't auto load any plugins"), NULL},
+#ifdef __linux__
+ {"run-as-root", 0, 0, G_OPTION_ARG_NONE, &arg_run_as_root, N_("Allow ZoiteChat to run as root (unsafe)"), NULL},
+#endif
  {"plugindir",	'p', 0, G_OPTION_ARG_NONE,	&arg_show_autoload, N_("Show plugin/script auto-load directory"), NULL},
  {"configdir",	'u', 0, G_OPTION_ARG_NONE,	&arg_show_config, N_("Show user config directory"), NULL},
  {"url",	 0,  G_OPTION_FLAG_HIDDEN, G_OPTION_ARG_STRING,	&arg_url, N_("Open an irc://server:port/channel URL"), "URL"},
@@ -475,6 +481,16 @@ static const GOptionEntry gopt_entries[] =
  {NULL}
 };
 
+#ifdef __linux__
+void
+fe_root_warning (void)
+{
+	fputs ("ZoiteChat refuses to run as root on Linux.\n"
+	       "Run it as a normal user, or pass --run-as-root to override this protection.\n",
+	       stderr);
+}
+#endif
+
 int
 fe_args (int argc, char *argv[])
 {
@@ -500,7 +516,13 @@ fe_args (int argc, char *argv[])
 	g_free (locale_path);
 	g_free (base_path);
 #else
-	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
+	bindtextdomain (GETTEXT_PACKAGE,
+#ifdef __APPLE__
+		zoitechat_macos_locale_dir ()
+#else
+		LOCALEDIR
+#endif
+	);
 #endif
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");
 	textdomain (GETTEXT_PACKAGE);

win32/copy/copy.vcxproj

@@ -37,6 +37,7 @@
       <None Include="$(DepsRoot)\bin\*fribidi*.dll" />
       <None Include="$(DepsRoot)\bin\*fontconfig*.dll" />
       <None Include="$(DepsRoot)\bin\*gdk_pixbuf*.dll" />
+      <None Include="$(DepsRoot)\bin\rsvg-2-2.dll" />
       <None Include="$(DepsRoot)\bin\*gdk-3*.dll" />
       <None Include="$(DepsRoot)\bin\*epoxy*.dll" />
       <None Include="$(DepsRoot)\bin\*gio-2*.dll" />
@@ -78,8 +79,8 @@
       <Gtk3Immodules Include="$(DepsRoot)\lib\gtk-3.0\3.0.0\immodules\**\*" />
       <Gtk3PrintBackends Include="$(DepsRoot)\lib\gtk-3.0\3.0.0\printbackends\**\*" />
       <GSettingsSchemas Include="$(DepsRoot)\share\glib-2.0\schemas\*" />
-      <GdkPixbufLoaders Include="$(DepsRoot)\lib\gdk-pixbuf-2.0\**\loaders\**\*" />
+      <!-- Preserve the version/loaders directories used by the relative cache. -->
-      <GdkPixbufLoaderCache Include="$(DepsRoot)\lib\gdk-pixbuf-2.0\**\loaders.cache" />
+      <GdkPixbufRuntime Include="$(DepsRoot)\lib\gdk-pixbuf-2.0\**\*" />
 
       <FontConfig Include="$(DepsRoot)\etc\fonts\**\*" />
       <EmojiFont Include="..\..\data\fonts\NotoColorEmoji.ttf" />
@@ -97,8 +98,8 @@
     <Copy SourceFiles="@(EmojiFontLicense)" DestinationFolder="$(ZoiteChatRel)\share\doc\zoitechat\fonts" />
     <Copy SourceFiles="@(Gtk3Immodules)" DestinationFiles="@(Gtk3Immodules->'$(ZoiteChatRel)\lib\gtk-3.0\3.0.0\immodules\%(RecursiveDir)%(Filename)%(Extension)')" />
     <Copy SourceFiles="@(Gtk3PrintBackends)" DestinationFiles="@(Gtk3PrintBackends->'$(ZoiteChatRel)\lib\gtk-3.0\3.0.0\printbackends\%(RecursiveDir)%(Filename)%(Extension)')" />
-    <Copy SourceFiles="@(GdkPixbufLoaders)" DestinationFiles="@(GdkPixbufLoaders->'$(ZoiteChatRel)\lib\gdk-pixbuf-2.0\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Copy SourceFiles="@(GdkPixbufRuntime)" DestinationFiles="@(GdkPixbufRuntime->'$(ZoiteChatRel)\lib\gdk-pixbuf-2.0\%(RecursiveDir)%(Filename)%(Extension)')" />
-    <Copy SourceFiles="@(GdkPixbufLoaderCache)" DestinationFiles="@(GdkPixbufLoaderCache->'$(ZoiteChatRel)\lib\gdk-pixbuf-2.0\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Copy SourceFiles="$(DepsRoot)\share\doc\librsvg\COPYING.LIB" DestinationFolder="$(ZoiteChatRel)\share\doc\librsvg" />
     <Copy SourceFiles="@(GSettingsSchemas)" DestinationFiles="@(GSettingsSchemas->'$(ZoiteChatRel)\share\glib-2.0\schemas\%(Filename)%(Extension)')" />
     <Copy SourceFiles="@(Share)" DestinationFiles="@(Share->'$(ZoiteChatRel)\share\%(RecursiveDir)%(Filename)%(Extension)')" />
     <Copy SourceFiles="..\..\COPYING" DestinationFolder="$(ZoiteChatRel)\share\doc\zoitechat" />

win32/installer/zoitechat.iss.tt

@@ -106,6 +106,8 @@ Source: "share\xml\*"; DestDir: "{app}\share\xml"; Flags: ignoreversion createal
 Source: "share\doc\zoitechat\*"; DestDir: "{app}\share\doc\zoitechat"; Flags: ignoreversion createallsubdirs recursesubdirs; Components: libs
 Source: "share\fonts\zoitechat\*"; DestDir: "{app}\share\fonts\zoitechat"; Flags: ignoreversion createallsubdirs recursesubdirs; Components: libs
 Source: "share\doc\WinSparkle\*"; DestDir: "{app}\share\doc\WinSparkle"; Flags: ignoreversion createallsubdirs recursesubdirs; Components: libs
+Source: "share\doc\librsvg\*"; DestDir: "{app}\share\doc\librsvg"; Flags: ignoreversion createallsubdirs recursesubdirs; Components: libs
+Source: "lib\gdk-pixbuf-2.0\*"; DestDir: "{app}\lib\gdk-pixbuf-2.0"; Flags: ignoreversion createallsubdirs recursesubdirs; Components: libs
 Source: "share\themes\MS-Windows\*"; DestDir: "{app}\share\themes\MS-Windows"; Flags: ignoreversion createallsubdirs recursesubdirs skipifsourcedoesntexist; Components: libs
 Source: "share\glib-2.0\schemas\*"; DestDir: "{app}\share\glib-2.0\schemas"; Flags: ignoreversion createallsubdirs recursesubdirs skipifsourcedoesntexist; Components: libs
 Source: "share\icons\hicolor\*"; DestDir: "{app}\share\icons\hicolor"; Flags: ignoreversion createallsubdirs recursesubdirs skipifsourcedoesntexist; Components: libs
@@ -118,6 +120,7 @@ Source: "freetype-6.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: li
 Source: "fribidi-0.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
 Source: "fontconfig-1.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
 Source: "gdk_pixbuf-2.0-0.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
+Source: "rsvg-2-2.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
 Source: "gdk-3-vs17.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
 Source: "epoxy-0.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs
 Source: "gio-2.0-0.dll"; DestDir: "{app}"; Flags: ignoreversion; Components: libs

win32/msix/AppxManifest.xml.in

@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package
+  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+  xmlns:uap3="http://schemas.microsoft.com/appx/manifest/uap/windows10/3"
+  xmlns:uap10="http://schemas.microsoft.com/appx/manifest/uap/windows10/10"
+  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+  IgnorableNamespaces="uap uap3 uap10 rescap">
+
+  <!--
+    Identity values are filled by build-msix.ps1. For Microsoft Store
+    submissions they must exactly match Product management > Product identity
+    in Partner Center.
+  -->
+  <Identity
+    Name="@IDENTITY_NAME@"
+    Publisher="@PUBLISHER@"
+    Version="@PACKAGE_VERSION@"
+    ProcessorArchitecture="x64" />
+
+  <Properties>
+    <DisplayName>ZoiteChat</DisplayName>
+    <PublisherDisplayName>@PUBLISHER_DISPLAY_NAME@</PublisherDisplayName>
+    <Description>ZoiteChat IRC client</Description>
+    <Logo>Assets\StoreLogo.png</Logo>
+  </Properties>
+
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+
+  <Dependencies>
+    <TargetDeviceFamily
+      Name="Windows.Desktop"
+      MinVersion="10.0.19041.0"
+      MaxVersionTested="10.0.26100.0" />
+    <PackageDependency
+      Name="Microsoft.VCLibs.140.00.UWPDesktop"
+      Publisher="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
+      MinVersion="14.0.30704.0" />
+  </Dependencies>
+
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />
+  </Capabilities>
+
+  <Applications>
+    <Application
+      Id="ZoiteChat"
+      Executable="ZoiteChat\zoitechat.exe"
+      uap10:RuntimeBehavior="packagedClassicApp"
+      uap10:TrustLevel="mediumIL">
+
+      <uap:VisualElements
+        DisplayName="ZoiteChat"
+        Description="ZoiteChat IRC client"
+        BackgroundColor="transparent"
+        Square150x150Logo="Assets\Square150x150Logo.png"
+        Square44x44Logo="Assets\Square44x44Logo.png" />
+
+      <Extensions>
+        <uap3:Extension Category="windows.protocol">
+          <uap3:Protocol
+            Name="irc"
+            Parameters="--url=&quot;%1&quot;" />
+        </uap3:Extension>
+
+        <uap3:Extension Category="windows.fileTypeAssociation">
+          <uap3:FileTypeAssociation
+            Name="zoitechattheme"
+            Parameters="&quot;%1&quot;">
+            <uap:DisplayName>ZoiteChat Theme</uap:DisplayName>
+            <uap:SupportedFileTypes>
+              <uap:FileType>.zct</uap:FileType>
+              <uap:FileType>.hct</uap:FileType>
+            </uap:SupportedFileTypes>
+          </uap3:FileTypeAssociation>
+        </uap3:Extension>
+      </Extensions>
+    </Application>
+  </Applications>
+</Package>

win32/msix/build-msix.ps1

@@ -0,0 +1,392 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string] $SourceDir,
+
+    [Parameter(Mandatory = $true)]
+    [string] $OutputPath,
+
+    [Parameter(Mandatory = $true)]
+    [ValidatePattern('^\d+\.\d+\.\d+\.0$')]
+    [string] $PackageVersion,
+
+    [Parameter(Mandatory = $true)]
+    [string] $IdentityName,
+
+    [Parameter(Mandatory = $true)]
+    [string] $Publisher,
+
+    [Parameter(Mandatory = $true)]
+    [string] $PublisherDisplayName,
+
+    [switch] $SelfSign
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+Add-Type -AssemblyName System.Drawing
+
+function Find-WindowsSdkTool {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $ToolName
+    )
+
+    $command = Get-Command $ToolName -ErrorAction SilentlyContinue
+    if ($command) {
+        return $command.Source
+    }
+
+    $kitsRoot = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\bin'
+    if (-not (Test-Path $kitsRoot)) {
+        throw "Windows SDK bin directory was not found: $kitsRoot"
+    }
+
+    $tool = Get-ChildItem -Path $kitsRoot -Filter $ToolName -File -Recurse |
+        Where-Object { $_.FullName -match '\\x64\\' } |
+        Sort-Object {
+            $versionDirectory = Split-Path (Split-Path $_.DirectoryName -Parent) -Leaf
+            try {
+                [version] $versionDirectory
+            }
+            catch {
+                [version] '0.0'
+            }
+        } -Descending |
+        Select-Object -First 1
+
+    if (-not $tool) {
+        throw "$ToolName was not found in the installed Windows SDK."
+    }
+
+    return $tool.FullName
+}
+
+function Escape-Xml {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Value
+    )
+
+    return [System.Security.SecurityElement]::Escape($Value)
+}
+
+function New-MsixAsset {
+    param(
+        [Parameter(Mandatory = $true)]
+        [System.Drawing.Image] $SourceImage,
+
+        [Parameter(Mandatory = $true)]
+        [int] $Width,
+
+        [Parameter(Mandatory = $true)]
+        [int] $Height,
+
+        [Parameter(Mandatory = $true)]
+        [string] $Path
+    )
+
+    $bitmap = [System.Drawing.Bitmap]::new($Width, $Height)
+    try {
+        $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
+        try {
+            $graphics.Clear([System.Drawing.Color]::Transparent)
+            $graphics.InterpolationMode = [System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic
+            $graphics.PixelOffsetMode = [System.Drawing.Drawing2D.PixelOffsetMode]::HighQuality
+            $graphics.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::HighQuality
+
+            $scale = [Math]::Min($Width / $SourceImage.Width, $Height / $SourceImage.Height)
+            $drawWidth = [Math]::Max(1, [int][Math]::Round($SourceImage.Width * $scale))
+            $drawHeight = [Math]::Max(1, [int][Math]::Round($SourceImage.Height * $scale))
+            $x = [int](($Width - $drawWidth) / 2)
+            $y = [int](($Height - $drawHeight) / 2)
+
+            $graphics.DrawImage($SourceImage, $x, $y, $drawWidth, $drawHeight)
+        }
+        finally {
+            $graphics.Dispose()
+        }
+
+        $bitmap.Save($Path, [System.Drawing.Imaging.ImageFormat]::Png)
+    }
+    finally {
+        $bitmap.Dispose()
+    }
+}
+
+$source = (Resolve-Path $SourceDir).Path
+if (-not (Test-Path (Join-Path $source 'zoitechat.exe'))) {
+    throw "Staged ZoiteChat executable is missing from $source"
+}
+
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$templatePath = Join-Path $PSScriptRoot 'AppxManifest.xml.in'
+$iconPath = Join-Path $repoRoot 'data\icons\zoitechat.png'
+
+if (-not (Test-Path $templatePath)) {
+    throw "MSIX manifest template is missing: $templatePath"
+}
+if (-not (Test-Path $iconPath)) {
+    throw "ZoiteChat PNG icon is missing: $iconPath"
+}
+
+if ([System.IO.Path]::IsPathRooted($OutputPath)) {
+    $output = [System.IO.Path]::GetFullPath($OutputPath)
+}
+else {
+    $output = [System.IO.Path]::GetFullPath((Join-Path $PWD $OutputPath))
+}
+$outputDirectory = Split-Path $output -Parent
+New-Item -ItemType Directory -Path $outputDirectory -Force | Out-Null
+
+$stagingRoot = Join-Path $env:RUNNER_TEMP 'zoitechat-msix'
+$verifyRoot = Join-Path $env:RUNNER_TEMP 'zoitechat-msix-verify'
+$pfxPath = Join-Path $env:RUNNER_TEMP 'zoitechat-msix-dev.pfx'
+
+foreach ($path in @($stagingRoot, $verifyRoot)) {
+    if (Test-Path $path) {
+        Remove-Item -Path $path -Recurse -Force
+    }
+}
+if (Test-Path $pfxPath) {
+    Remove-Item -Path $pfxPath -Force
+}
+
+New-Item -ItemType Directory -Path $stagingRoot -Force | Out-Null
+$appRoot = Join-Path $stagingRoot 'ZoiteChat'
+New-Item -ItemType Directory -Path $appRoot -Force | Out-Null
+Copy-Item -Path (Join-Path $source '*') -Destination $appRoot -Recurse -Force
+
+# copy.vcxproj stages everything needed by every Inno component. The Store
+# package keeps the useful bundled plugins and scripting bridges while letting
+# the Microsoft Store own application updates. The WinSparkle updater is the
+# only bundled plugin deliberately removed from the Store package.
+$excludeFiles = @(
+    'portable-mode',
+    'zoitechat-text.exe',
+    'plugins\hcupd.dll',
+    'WinSparkle.dll',
+    'share\download.png'
+)
+
+foreach ($relativePath in $excludeFiles) {
+    $path = Join-Path $appRoot $relativePath
+    if (Test-Path $path) {
+        Remove-Item -Path $path -Force
+    }
+}
+
+foreach ($relativePath in @('share\doc\WinSparkle')) {
+    $path = Join-Path $appRoot $relativePath
+    if (Test-Path $path) {
+        Remove-Item -Path $path -Recurse -Force
+    }
+}
+
+foreach ($requiredPath in @(
+    'zoitechat.exe',
+    'plugins\hcnotifications-winrt.dll',
+    'plugins\hcchecksum.dll',
+    'plugins\hcexec.dll',
+    'plugins\hcfishlim.dll',
+    'plugins\hcsysinfo.dll',
+    'share\system.png',
+    'share\fonts\zoitechat\NotoColorEmoji.ttf',
+    'share\doc\zoitechat\fonts\OFL.txt',
+    'plugins\hclua.dll',
+    'plugins\hcperl.dll',
+    'plugins\hcpython3.dll',
+    'plugins\hcpython38.dll'
+)) {
+    if (-not (Test-Path (Join-Path $appRoot $requiredPath))) {
+        throw "MSIX staging is missing required file: $requiredPath"
+    }
+}
+
+foreach ($requiredPattern in @('_cffi_backend.cp314*.pyd', '_cffi_backend.cp38*.pyd')) {
+    $match = Get-ChildItem -Path $appRoot -Filter $requiredPattern -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1
+    if ($null -eq $match) {
+        throw "MSIX staging is missing required Python support file: $requiredPattern"
+    }
+}
+
+foreach ($requiredPythonFile in @('zoitechat.py', '_zoitechat.py', 'hexchat.py', 'xchat.py')) {
+    $path = Join-Path (Join-Path $appRoot 'python') $requiredPythonFile
+    if (-not (Test-Path $path)) {
+        throw "MSIX staging is missing required Python bridge file: $requiredPythonFile"
+    }
+}
+
+$assets = Join-Path $stagingRoot 'Assets'
+New-Item -ItemType Directory -Path $assets -Force | Out-Null
+
+$image = [System.Drawing.Image]::FromFile($iconPath)
+try {
+    New-MsixAsset -SourceImage $image -Width 50 -Height 50 `
+        -Path (Join-Path $assets 'StoreLogo.png')
+    New-MsixAsset -SourceImage $image -Width 44 -Height 44 `
+        -Path (Join-Path $assets 'Square44x44Logo.png')
+    New-MsixAsset -SourceImage $image -Width 150 -Height 150 `
+        -Path (Join-Path $assets 'Square150x150Logo.png')
+}
+finally {
+    $image.Dispose()
+}
+
+$manifest = Get-Content $templatePath -Raw -Encoding UTF8
+$manifest = $manifest.Replace('@IDENTITY_NAME@', (Escape-Xml $IdentityName))
+$manifest = $manifest.Replace('@PUBLISHER@', (Escape-Xml $Publisher))
+$manifest = $manifest.Replace('@PUBLISHER_DISPLAY_NAME@', (Escape-Xml $PublisherDisplayName))
+$manifest = $manifest.Replace('@PACKAGE_VERSION@', (Escape-Xml $PackageVersion))
+
+if ($manifest -match '@[A-Z0-9_]+@') {
+    throw "Unexpanded MSIX manifest placeholder: $($Matches[0])"
+}
+
+$manifestPath = Join-Path $stagingRoot 'AppxManifest.xml'
+[System.IO.File]::WriteAllText(
+    $manifestPath,
+    $manifest,
+    [System.Text.UTF8Encoding]::new($false)
+)
+
+# Catch malformed XML before MakeAppx so CI reports a useful error.
+[xml](Get-Content $manifestPath -Raw -Encoding UTF8) | Out-Null
+
+$makeAppx = Find-WindowsSdkTool -ToolName 'MakeAppx.exe'
+$signtool = Find-WindowsSdkTool -ToolName 'SignTool.exe'
+
+if (Test-Path $output) {
+    Remove-Item -Path $output -Force
+}
+
+& $makeAppx pack /d $stagingRoot /p $output /o
+if ($LASTEXITCODE -ne 0) {
+    throw "MakeAppx failed with exit code $LASTEXITCODE"
+}
+
+$certificate = $null
+try {
+    if ($SelfSign) {
+        # Partner Center replaces this development signature with Microsoft's
+        # trusted Store signature. The certificate subject must exactly match
+        # the manifest Publisher for SignTool to accept the package.
+        $certificate = New-SelfSignedCertificate `
+            -Type Custom `
+            -KeyUsage DigitalSignature `
+            -Subject $Publisher `
+            -CertStoreLocation 'Cert:\CurrentUser\My' `
+            -HashAlgorithm SHA256 `
+            -TextExtension @(
+                '2.5.29.37={text}1.3.6.1.5.5.7.3.3',
+                '2.5.29.19={text}'
+            ) `
+            -FriendlyName 'ZoiteChat MSIX CI signing certificate'
+
+        if ($certificate.Subject -cne $Publisher) {
+            throw "Generated certificate subject '$($certificate.Subject)' does not exactly match manifest Publisher '$Publisher'."
+        }
+
+        $passwordText = [Guid]::NewGuid().ToString('N')
+        $password = ConvertTo-SecureString -String $passwordText -AsPlainText -Force
+        Export-PfxCertificate -Cert $certificate -FilePath $pfxPath -Password $password | Out-Null
+
+        & $signtool sign /fd SHA256 /f $pfxPath /p $passwordText $output
+        if ($LASTEXITCODE -ne 0) {
+            throw "SignTool failed with exit code $LASTEXITCODE"
+        }
+
+        $signature = Get-AuthenticodeSignature -FilePath $output
+        if (-not $signature.SignerCertificate -or
+            $signature.SignerCertificate.Subject -cne $Publisher) {
+            throw 'MSIX signature does not match the manifest Publisher.'
+        }
+    }
+
+    New-Item -ItemType Directory -Path $verifyRoot -Force | Out-Null
+    & $makeAppx unpack /p $output /d $verifyRoot /o
+    if ($LASTEXITCODE -ne 0) {
+        throw "MakeAppx validation unpack failed with exit code $LASTEXITCODE"
+    }
+
+    [xml] $verifiedManifest = Get-Content (Join-Path $verifyRoot 'AppxManifest.xml') -Raw -Encoding UTF8
+    $ns = New-Object System.Xml.XmlNamespaceManager($verifiedManifest.NameTable)
+    $ns.AddNamespace('f', 'http://schemas.microsoft.com/appx/manifest/foundation/windows10')
+    $identity = $verifiedManifest.SelectSingleNode('/f:Package/f:Identity', $ns)
+    if (-not $identity) {
+        throw 'Validated MSIX does not contain a package Identity.'
+    }
+    if ($identity.Name -cne $IdentityName -or
+        $identity.Publisher -cne $Publisher -or
+        $identity.Version -cne $PackageVersion) {
+        throw 'Validated MSIX identity does not match the requested Store identity.'
+    }
+
+    foreach ($requiredPath in @(
+        'ZoiteChat\zoitechat.exe',
+        'ZoiteChat\plugins\hcnotifications-winrt.dll',
+        'ZoiteChat\plugins\hcchecksum.dll',
+        'ZoiteChat\plugins\hcexec.dll',
+        'ZoiteChat\plugins\hcfishlim.dll',
+        'ZoiteChat\plugins\hcsysinfo.dll',
+        'ZoiteChat\share\system.png',
+        'ZoiteChat\share\fonts\zoitechat\NotoColorEmoji.ttf',
+        'ZoiteChat\share\doc\zoitechat\fonts\OFL.txt',
+        'ZoiteChat\plugins\hclua.dll',
+        'ZoiteChat\plugins\hcperl.dll',
+        'ZoiteChat\plugins\hcpython3.dll',
+        'ZoiteChat\plugins\hcpython38.dll'
+    )) {
+        if (-not (Test-Path (Join-Path $verifyRoot $requiredPath))) {
+            throw "Validated MSIX is missing required file: $requiredPath"
+        }
+    }
+
+    foreach ($requiredPattern in @('_cffi_backend.cp314*.pyd', '_cffi_backend.cp38*.pyd')) {
+        $match = Get-ChildItem -Path (Join-Path $verifyRoot 'ZoiteChat') -Filter $requiredPattern -File -ErrorAction SilentlyContinue |
+            Select-Object -First 1
+        if ($null -eq $match) {
+            throw "Validated MSIX is missing required Python support file: $requiredPattern"
+        }
+    }
+
+    foreach ($requiredPythonFile in @('zoitechat.py', '_zoitechat.py', 'hexchat.py', 'xchat.py')) {
+        $path = Join-Path (Join-Path $verifyRoot 'ZoiteChat\python') $requiredPythonFile
+        if (-not (Test-Path $path)) {
+            throw "Validated MSIX is missing required Python bridge file: $requiredPythonFile"
+        }
+    }
+
+    foreach ($excludedPath in @(
+        'ZoiteChat\portable-mode',
+        'ZoiteChat\zoitechat-text.exe',
+        'ZoiteChat\plugins\hcupd.dll',
+        'ZoiteChat\WinSparkle.dll',
+        'ZoiteChat\share\download.png'
+    )) {
+        if (Test-Path (Join-Path $verifyRoot $excludedPath)) {
+            throw "MSIX incorrectly contains excluded file/directory: $excludedPath"
+        }
+    }
+}
+finally {
+    if ($certificate) {
+        Remove-Item -Path "Cert:\CurrentUser\My\$($certificate.Thumbprint)" -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path $pfxPath) {
+        Remove-Item -Path $pfxPath -Force -ErrorAction SilentlyContinue
+    }
+    foreach ($path in @($stagingRoot, $verifyRoot)) {
+        if (Test-Path $path) {
+            Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+}
+
+if (-not (Test-Path $output)) {
+    throw "Expected MSIX was not created: $output"
+}
+
+Write-Host "Created MSIX: $output"

win32/wix/zoitechat.wxs

@@ -0,0 +1,162 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <!--
+    This MSI intentionally mirrors the staged portion of the normal Inno Setup
+    payload. Optional/custom-only files are excluded below. In particular,
+    portable-mode must never be harvested because copy.vcxproj always stages
+    that marker. Inno-only download-at-install components remain outside the MSI.
+  -->
+  <Package
+    Name="ZoiteChat"
+    Manufacturer="ZoiteChat"
+    Version="$(ProductVersion)"
+    UpgradeCode="{E9F09DF3-12FA-4BDF-A8AA-A6D62A327ED5}"
+    Scope="perMachine"
+    InstallerVersion="500"
+    Compressed="yes">
+
+    <MajorUpgrade
+      AllowSameVersionUpgrades="yes"
+      DowngradeErrorMessage="A newer version of ZoiteChat is already installed." />
+
+    <MediaTemplate EmbedCab="yes" CompressionLevel="high" />
+
+    <Icon Id="ZoiteChat.ico" SourceFile="$(sys.SOURCEFILEDIR)..\..\data\icons\zoitechat.ico" />
+    <Property Id="ARPPRODUCTICON" Value="ZoiteChat.ico" />
+    <Property Id="ARPHELPLINK" Value="https://github.com/ZoiteChat/zoitechat/issues" />
+    <Property Id="ARPURLINFOABOUT" Value="https://zoitechat.org/" />
+    <Property Id="ARPURLUPDATEINFO" Value="https://zoitechat.org/downloads.html" />
+    <Property Id="ARPNOMODIFY" Value="1" />
+
+    <!--
+      The Inno installer can bootstrap the VC++ runtime. A plain MSI should not
+      run an EXE prerequisite as an MSI custom action, so require the runtime.
+      Administrative extraction is allowed regardless of prerequisite state.
+    -->
+    <Property Id="VCREDIST_X64_INSTALLED">
+      <RegistrySearch
+        Id="FindVCRedistX64"
+        Root="HKLM"
+        Key="SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64"
+        Name="Installed"
+        Type="raw"
+        Bitness="always64" />
+    </Property>
+    <Launch
+      Condition="Installed OR ACTION = &quot;ADMIN&quot; OR VCREDIST_X64_INSTALLED = &quot;#1&quot;"
+      Message="Microsoft Visual C++ 2015-2022 x64 Redistributable is required before installing ZoiteChat." />
+    <Launch
+      Condition="Installed OR ACTION = &quot;ADMIN&quot; OR VersionNT64 &gt; 601 OR (VersionNT64 = 601 AND ServicePackLevel &gt;= 1)"
+      Message="ZoiteChat requires 64-bit Windows 7 SP1 or later." />
+
+    <StandardDirectory Id="ProgramFiles6432Folder">
+      <Directory Id="INSTALLFOLDER" Name="ZoiteChat" />
+    </StandardDirectory>
+
+    <StandardDirectory Id="ProgramMenuFolder">
+      <Directory Id="ApplicationProgramsFolder" Name="ZoiteChat" />
+    </StandardDirectory>
+
+    <Feature Id="MainFeature" Title="ZoiteChat" Level="1">
+      <ComponentGroupRef Id="ApplicationFiles" />
+      <ComponentRef Id="StartMenuShortcuts" />
+      <ComponentRef Id="ProtocolAndThemeAssociations" />
+    </Feature>
+  </Package>
+
+  <Fragment>
+    <ComponentGroup Id="ApplicationFiles">
+      <Files Directory="INSTALLFOLDER" Include="$(SourceDir)\**">
+        <!-- Created by copy.vcxproj for Inno's optional portable task only. -->
+        <Exclude Files="$(SourceDir)\portable-mode" />
+        <!-- Inno custom-only application component. -->
+        <Exclude Files="$(SourceDir)\zoitechat-text.exe" />
+        <!--
+          Keep the bundled utility and scripting plugins, including Python
+          3.14 and 3.8 support, available to non-Inno installations.
+        -->
+      </Files>
+    </ComponentGroup>
+  </Fragment>
+
+  <Fragment>
+    <Component Id="StartMenuShortcuts" Directory="ApplicationProgramsFolder" Guid="*">
+      <Shortcut
+        Id="ZoiteChatShortcut"
+        Name="ZoiteChat"
+        Description="ZoiteChat IRC client"
+        Target="[INSTALLFOLDER]zoitechat.exe"
+        WorkingDirectory="INSTALLFOLDER"
+        Icon="ZoiteChat.ico">
+        <ShortcutProperty Key="System.AppUserModel.ID" Value="ZoiteChat.Desktop.Notify" />
+      </Shortcut>
+
+      <Shortcut
+        Id="ZoiteChatSafeModeShortcut"
+        Name="ZoiteChat Safe Mode"
+        Description="Start ZoiteChat without auto-connect or plugins"
+        Target="[INSTALLFOLDER]zoitechat.exe"
+        Arguments="--no-auto --no-plugins"
+        WorkingDirectory="INSTALLFOLDER"
+        Icon="ZoiteChat.ico" />
+
+      <Shortcut
+        Id="ZoiteChatChangelogShortcut"
+        Name="ZoiteChat ChangeLog"
+        Target="[INSTALLFOLDER]changelog.url" />
+
+      <Shortcut
+        Id="ZoiteChatReadmeShortcut"
+        Name="ZoiteChat ReadMe"
+        Target="[INSTALLFOLDER]readme.url" />
+
+      <Shortcut
+        Id="ZoiteChatUninstallShortcut"
+        Name="Uninstall ZoiteChat"
+        Target="[System64Folder]msiexec.exe"
+        Arguments="/x [ProductCode]" />
+
+      <RemoveFolder Id="RemoveApplicationProgramsFolder" On="uninstall" />
+      <RegistryValue
+        Root="HKLM"
+        Key="Software\ZoiteChat\Installer"
+        Name="StartMenuShortcuts"
+        Type="integer"
+        Value="1"
+        KeyPath="yes" />
+    </Component>
+  </Fragment>
+
+  <Fragment>
+    <Component Id="ProtocolAndThemeAssociations" Directory="INSTALLFOLDER" Guid="*">
+      <RegistryValue
+        Root="HKCR"
+        Key="irc"
+        Type="string"
+        Value="URL:IRC Protocol"
+        KeyPath="yes" />
+      <RegistryValue Root="HKCR" Key="irc" Name="URL Protocol" Type="string" Value="" />
+      <RegistryValue Root="HKCR" Key="irc\DefaultIcon" Type="string" Value="[INSTALLFOLDER]zoitechat.exe,0" />
+      <RegistryValue Root="HKCR" Key="irc\shell" Type="string" Value="open" />
+      <RegistryValue
+        Root="HKCR"
+        Key="irc\shell\open\command"
+        Type="string"
+        Value="&quot;[INSTALLFOLDER]zoitechat.exe&quot; --url=&quot;%1&quot;" />
+
+      <RegistryValue Root="HKCR" Key=".zct" Type="string" Value="ZoiteChat.Theme" />
+      <RegistryValue Root="HKCR" Key=".hct" Type="string" Value="ZoiteChat.Theme" />
+      <RegistryValue Root="HKCR" Key="ZoiteChat.Theme" Type="string" Value="ZoiteChat Theme" />
+      <RegistryValue
+        Root="HKCR"
+        Key="ZoiteChat.Theme\DefaultIcon"
+        Type="string"
+        Value="[INSTALLFOLDER]zoitechat.exe,0" />
+      <RegistryValue
+        Root="HKCR"
+        Key="ZoiteChat.Theme\shell\open\command"
+        Type="string"
+        Value="&quot;[INSTALLFOLDER]zoitechat.exe&quot; &quot;%1&quot;" />
+    </Component>
+  </Fragment>
+</Wix>

win32/zoitechat.props

@@ -75,7 +75,7 @@
 
 		<UsingGtk3 Condition="Exists('$(DepsRoot)\\include\\gtk-3.0\\gtk\\gtk.h')">true</UsingGtk3>
 		<Gtk3>$(DepsRoot)\include\gtk-3.0;$(DepsRoot)\lib\gtk-3.0\include</Gtk3>
-		<GtkCommon>$(DepsRoot)\include\atk-1.0;$(DepsRoot)\include\cairo;$(DepsRoot)\include\pango-1.0;$(DepsRoot)\include\gdk-pixbuf-2.0;$(DepsRoot)\include\harfbuzz</GtkCommon>
+		<GtkCommon>$(DepsRoot)\include\atk-1.0;$(DepsRoot)\include\cairo;$(DepsRoot)\include\pango-1.0;$(DepsRoot)\include\gdk-pixbuf-2.0;$(DepsRoot)\include\harfbuzz;$(DepsRoot)\include\freetype2</GtkCommon>
 		<Gtk>$(Gtk3);$(GtkCommon)</Gtk>
 
 		<SslLegacyLib Condition="Exists('$(DepsRoot)\\lib\\ssleay32.lib')">ssleay32.lib</SslLegacyLib>