feat: session persistence, logout button, TURN HMAC fix; update docs

- Browser mode auto-rejoins saved network on reload (waste_last_network)
- Logout button (⏻) in sidebar clears session; optionally clears identity keypair
- TURN credentials now use HMAC-SHA1 of username (coturn use-auth-secret compatible)
- README: deploy scripts documented, session persistence section, serve-web.sh noted
- FUTURE.md: mark shipped items, add remaining work for daemon TURN + TUI rooms

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/settings.json

@@ -1,7 +1,9 @@
 {
   "permissions": {
     "allow": [
-      "Bash(go build *)"
+      "Bash(go build *)",
+      "Bash(npx tsc *)",
+      "Bash(npm run *)"
     ]
   }
 }

FUTURE.md

@@ -38,19 +38,12 @@ React + Vite frontend. Two modes:
 ### NAT Traversal ✅ (WebRTC ICE/STUN)
 Solved by using WebRTC DataChannels via pion. ICE gathers host + server-reflexive (STUN) candidates and performs UDP hole punching automatically. The anchor (`cmd/anchor`) doubles as a STUN server on UDP/3478.
 
-### TURN relay (symmetric NAT pairs)
+### TURN relay ✅ (shipped, browser mode)
-The one remaining gap: two peers both behind symmetric NAT (common on mobile/CGNAT) will fail to hole-punch. TURN recovers this.
+Browser mode now supports TURN relay. `iceServers()` in `browser.ts` reads `WASTE_CONFIG.turnURL` and `WASTE_CONFIG.turnSecret`, generates time-limited HMAC-SHA1 credentials (compatible with coturn `use-auth-secret`), and adds the TURN server to the ICE candidate list. Mobile/CGNAT peers that fail STUN hole-punching automatically fall back to TURN relay.
 
-**How to add it:** `internal/anchor/client.go` already has the `ICEServers` slice. Adding a TURN entry is a one-liner:
+The peer dot in the sidebar turns yellow for relayed connections (`candidate_type: relay`).
 
-```go
+**Daemon mode:** not yet wired. Add `-turn-url` / `-turn-secret` flags to `cmd/daemon/main.go` and pass them into the `ICEServers` slice in `internal/anchor/client.go`.
-ICEServers: []webrtc.ICEServer{
-    {URLs: []string{"stun:stun.l.google.com:19302"}},
-    {URLs: []string{"turn:your-vps:3478"}, Username: "waste", Credential: "secret"},
-},
-```
-
-Expose as daemon flags (`-turn-url`, `-turn-user`, `-turn-credential`) and wire into the anchor client config. Run `coturn` in relay-only mode on the same VPS as the anchor. The relay sees only opaque DTLS-encrypted blobs. Opt-in, off by default.
 
 ### Signaling ✅ YAW/2.1 (shipped)
 Forward-secret signaling via per-session ephemeral X25519 keys. Falls back transparently to 2.0 static-key sealing for peers that don't speak 2.1.
@@ -71,24 +64,27 @@ When a new peer connects, the mesh immediately gossips the full peer list to the
 
 ## Remaining Work
 
-### Per-Network Share Directories (next)
+### Session Persistence ✅ (shipped)
-The IPC plumbing is done (`set_share_dir`, `ShareDir` on `NetworkInfo`, per-network mesh), but the web UI's folder picker is a single global share applied to all peers on all networks. The fix: track share state per `network_id` in the store and pass the active network's share when browsing or accepting get requests.
+Browser mode now auto-rejoins on reload. The last-used network name, alias, and anchor URL are saved to `localStorage` on join and restored on load. A ⏻ logout button in the sidebar clears session state (optionally including the identity keypair) and reloads the page.
 
-### Additional Channels / Rooms (next)
+### Per-Network Share Directories ✅ (shipped)
-Currently each network has a hardcoded `#general` room. The protocol supports arbitrary room names already (messages carry a `room` field). What's missing:
+Share state is tracked per `network_id` in the store (`sharedFilesByNetwork`). The folder picker shows per-network file count. Switching networks switches the active share.
-- IPC command `create_room {network_id, name}` / `list_rooms {network_id}`
-- Daemon stores room list per network in SQLite
-- TUI: room creation input
-- Web UI: `+` button in the Rooms sidebar section → prompt for name → `create_room`
 
-Room names are just strings — no server coordination needed. Any peer that sends to a room name causes it to appear on the recipient's side automatically. The only thing to add is persistence and a creation UI.
+### Additional Channels / Rooms ✅ (shipped)
+The `+` button in the Rooms sidebar section creates custom rooms, stored in `customRooms` keyed by `network_id`. Room names are slugified strings — any peer that sends to a room name causes it to appear on the recipient automatically. DM rooms (`dm:<peerId>`) appear automatically when messages arrive.
 
-### File Transfer UX
+**Not yet done:** TUI room creation, daemon-side SQLite persistence of room lists across restarts.
-- Manual accept/reject (currently auto-accept everywhere)
+
-- Transfer cancellation via `file-cancel`
+### File Transfer UX ✅ (shipped)
-- Progress indicator in TUI and web UI
+- Manual accept/reject via the Transfers panel in the sidebar
-- Resume after disconnection
+- Transfer cancellation (`file-cancel` message, closes DataChannel)
-- Daemon-side: write received files to `<data-dir>/downloads-<netid>/` (browser is limited to download prompt)
+- Live progress bar per active transfer
+- Push (📎) sends directly to a peer without them needing to share a folder
+
+**Not yet done:** resume after disconnection, daemon-side download directory.
+
+### TURN Relay for Daemon Mode
+The daemon doesn't yet support TURN. Add `-turn-url` and `-turn-secret` flags to `cmd/daemon/main.go` and wire them into the ICE server list in `internal/anchor/client.go`. The credential generation is the same HMAC-SHA1 scheme already implemented in browser mode.
 
 ### Native UI
 Web frontend (React, already built) + Tauri shell for native packaging. The IPC protocol is the full boundary — the UI is already a pure consumer. Main work: Tauri setup, system tray, OS notifications.
@@ -112,10 +108,14 @@ Web frontend (React, already built) + Tauri shell for native packaging. The IPC
 | ✅ shipped | Peer gossip (anchor-free mesh reconnection) |
 | ✅ shipped | Web UI — browser mode + daemon mode |
 | ✅ shipped | Per-peer NAT/ICE status, identity backup/restore |
-| next | Per-network share directories (web UI wiring) |
+| ✅ shipped | Per-network share directories |
-| next | Additional channels/rooms per network |
+| ✅ shipped | Additional channels/rooms per network |
-| next | TURN relay (3 flags + coturn on VPS) |
+| ✅ shipped | TURN relay (browser mode, coturn `use-auth-secret`) |
-| next | File transfer UX (progress, cancel, manual accept) |
+| ✅ shipped | File transfer UX (progress, cancel, manual accept) |
+| ✅ shipped | Session persistence + logout (browser mode) |
+| next | TURN relay for daemon mode |
+| next | TUI room creation + daemon-side room persistence |
+| next | File transfer resume after disconnection |
 | future | Native UI (React + Tauri) |
 
 ---

README.md

@@ -41,6 +41,21 @@ On the VPS, run the anchor and keep it alive (systemd, screen, whatever you use)
 ./waste-anchor -bind 127.0.0.1:8080
 ```
 
+Or use the helper script which handles background execution and logging:
+
+```bash
+./setup-anchor.sh --bg    # start in background, logs to waste-anchor.log
+./setup-anchor.sh --stop  # stop it
+```
+
+To cross-compile and redeploy the anchor binary from your local machine:
+
+```bash
+./deploy-daemon.sh
+```
+
+This kills the existing anchor, uploads the new binary, and restarts it.
+
 The anchor listens locally on port 8080 — Nginx Proxy Manager will expose it over TLS.
 
 ### 2. Build and upload the web UI
@@ -56,6 +71,12 @@ npm run build
 rsync -az web/dist/ user@your-vps:~/waste-www/
 ```
 
+Or use the deploy script (builds + rsyncs in one step):
+
+```bash
+./deploy-web.sh
+```
+
 Create a `/var/www/waste-web/config.js` on the VPS (not in git — this is host-specific):
 
 ```js
@@ -81,7 +102,19 @@ Create one **Proxy Host** for your domain (e.g. `waste.example.com`) with TLS en
 - Choose "Serve Static Files" (or point to a local HTTP server serving `/var/www/waste-web`)
 - Enable the SPA fallback so unknown paths return `index.html` — this is required for invite links to work
 
-If NPM doesn't support static file serving directly, run a small static server on a spare port (e.g. `npx serve -s /var/www/waste-web -l 3000`) and proxy `/` to `127.0.0.1:3000`. The key requirements:
+If NPM doesn't support static file serving directly, run a small static server on a spare port and proxy `/` to it:
+
+```bash
+nohup npx serve -s ~/waste-www -l 1337 &
+```
+
+Or use `serve-web.sh` which handles PID tracking and restart:
+
+```bash
+./serve-web.sh   # kills existing instance, starts fresh, logs to waste-www.log
+```
+
+The key requirements:
 
 - `/ws` → anchor process (WebSocket, keep-alive)
 - `/*` → static file server (SPA fallback: return `index.html` for unknown paths)
@@ -150,6 +183,8 @@ A user visits your domain, enters their name and a network name, and joins. Invi
 
 **Identity note:** browser mode uses the master identity directly (same keypair on all networks, compatible with yaw2). The daemon derives a separate keypair per network via HKDF. A browser user and a daemon user on the same network will see each other and can chat — they just appear as different peers even if they're the same person.
 
+**Session persistence:** the last-used network name, alias, and anchor URL are saved to `localStorage`. On reload, the browser automatically rejoins the saved network — no login screen. To leave a network or switch identity, click the **⏻** button in the top-left of the sidebar. You'll be asked whether to also clear the identity keypair (export a backup first if you want to keep it).
+
 ### Daemon mode (for users running the daemon locally)
 
 `launch-web.sh` starts the Go daemon and the Vite dev server. The web UI connects to the local daemon over WebSocket IPC (`ws://127.0.0.1:17338`). The daemon handles all crypto and connects to the anchor.

web/src/App.css

@@ -49,9 +49,11 @@ details summary { color: var(--muted); font-size: 12px; cursor: pointer; }
 
 /* ── sidebar ── */
 .sidebar { background: var(--surface); border-right: 1px solid var(--border); display: flex; flex-direction: column; overflow-y: auto; }
-.sidebar-identity { padding: 12px 12px 10px; border-bottom: 1px solid var(--border); }
+.sidebar-identity { padding: 12px 12px 10px; border-bottom: 1px solid var(--border); display: flex; align-items: center; gap: 6px; }
 .sidebar-identity .alias { display: block; font-weight: 600; font-size: 14px; }
 .sidebar-identity .peer-id { display: block; color: var(--muted); font-size: 10px; font-family: monospace; margin-top: 2px; }
+.sidebar-logout { background: none; color: var(--muted); font-size: 14px; padding: 2px 4px; flex-shrink: 0; margin-left: auto; }
+.sidebar-logout:hover { color: #e06060; background: none; }
 .sidebar-section { display: flex; flex-direction: column; padding: 8px 0; border-bottom: 1px solid var(--border); }
 .sidebar-section:last-child { border-bottom: none; flex: 1; }
 .sidebar-label { font-size: 10px; text-transform: uppercase; letter-spacing: 0.1em; color: var(--muted); padding: 4px 12px 2px; }

web/src/components/Sidebar.tsx

@@ -32,7 +32,7 @@ export function Sidebar() {
     networks, activeNetworkId, activeRoom,
     connectedPeers, peerStatus,
     setActiveRoom, setActiveNetwork, messages, browseFiles, sendFileTo, adapterMode,
-    customRooms, createRoom,
+    customRooms, createRoom, logout,
   } = useWaste()
   const [addingRoom, setAddingRoom] = useState(false)
   const [newRoomName, setNewRoomName] = useState('')
@@ -54,6 +54,11 @@ export function Sidebar() {
   const displayId = localPeer?.id ?? masterId ?? ''
   const card = displayId ? makeYawCard(displayId, displayAlias) : null
 
+  function handleLogout() {
+    const clearId = window.confirm('Also clear your identity keypair? (Cannot be undone — export a backup first if you want to keep it.)')
+    logout(clearId)
+  }
+
   function openDM(peerId: string) {
     setActiveRoom(`dm:${peerId}`)
   }
@@ -64,15 +69,17 @@ export function Sidebar() {
 
   return (
     <nav className="sidebar">
+      <div className="sidebar-identity">
         <div
-        className="sidebar-identity"
+          style={{ flex: 1, cursor: card ? 'pointer' : undefined }}
           title={card ?? undefined}
           onClick={() => card && navigator.clipboard?.writeText(card)}
-        style={{ cursor: card ? 'pointer' : undefined }}
         >
           <span className="alias">{displayAlias || '…'}</span>
           <span className="peer-id">{displayId.slice(0, 16).replace(/(.{4})/g, '$1 ').trim()}</span>
         </div>
+        <button className="sidebar-logout" onClick={handleLogout} title="Leave network">⏻</button>
+      </div>
 
       <div className="sidebar-section">
         <span className="sidebar-label">Networks</span>

web/src/pages/Onboarding.tsx

@@ -61,16 +61,28 @@ export function Onboarding({ status }: Props) {
     if (inv) setInviteString(inv)
   }, [])
 
+  // Auto-rejoin when adapter is ready and we have saved session state
+  useEffect(() => {
+    if (adapterMode !== 'browser' || status !== 'connected') return
+    const { network: n, netHash: nh } = parseInviteParams()
+    if (n || nh) return // explicit invite — don't auto-join, show form
+    const savedNetwork = localStorage.getItem('waste_last_network')
+    if (savedNetwork) doJoin(savedNetwork, '')
+  }, [adapterMode, status]) // eslint-disable-line react-hooks/exhaustive-deps
+
   function joinNetwork(e: React.FormEvent) {
     e.preventDefault()
-    const name = network.trim()
+    doJoin(network.trim(), netHash.trim())
-    const hash = netHash.trim()
+  }
+
+  function doJoin(name: string, hash: string) {
     if (!name && !hash) return
 
-    // In browser mode: persist anchor URL choice and pass it via localStorage
     if (adapterMode === 'browser') {
       localStorage.setItem('waste_anchor_url', anchorUrl)
       if (nick.trim()) localStorage.setItem('waste_nick', nick.trim())
+      if (name) localStorage.setItem('waste_last_network', name)
+      else localStorage.removeItem('waste_last_network')
     }
 
     if (hash.length === 64 && !name) {

web/src/store/index.ts

@@ -69,6 +69,7 @@ interface WasteState {
   rejectOffer: (peerId: string, xid: string) => void
   cancelTransfer: (peerId: string, xid: string, direction: 'recv' | 'send') => void
   createRoom: (name: string) => void
+  logout: (clearIdentity: boolean) => void
   handleEvent: (msg: IpcMessage) => void
 }
 
@@ -169,6 +170,17 @@ export const useWaste = create<WasteState>((set, get) => ({
     if (a instanceof BrowserAdapter) a.cancelTransfer(peerId, xid, direction)
   },
 
+  logout(clearIdentity) {
+    const a = get().adapter
+    if (a instanceof DaemonAdapter) a.disconnect()
+    else if (a instanceof BrowserAdapter) a.disconnect()
+    localStorage.removeItem('waste_last_network')
+    localStorage.removeItem('waste_nick')
+    localStorage.removeItem('waste_anchor_url')
+    if (clearIdentity) localStorage.removeItem('waste_seed')
+    window.location.reload()
+  },
+
   createRoom(name) {
     const netId = get().activeNetworkId
     if (!netId || !name.trim()) return