fix: challenge nonce must be 32 bytes per YAW/2 §5.1

The anchor was sending a 16-byte nonce. The spec (yaw2.0-protocol.md §5.1
and yaw2-implementation.md §7.1) requires 32 bytes. Any spec-conformant
peer would fail join signature verification against this anchor, breaking
interop. Signature verification was already using the raw nonce bytes
(not hex), so only the allocation size needed changing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -68,7 +68,8 @@ jobs:
       - name: Build desktop app
         run: |
           cd cmd/app
-          wails build -trimpath -ldflags="-s -w" -tags webkit2_41 -o ../../dist/waste-linux-amd64
+          wails build -trimpath -ldflags="-s -w" -tags webkit2_41
+          cp build/bin/waste ../../dist/waste-linux-amd64
 
       # ── Publish release (tags only) ─────────────────────────────────────────
 

.gitignore

@@ -21,6 +21,7 @@ build-daemon.sh
 deploy-web.sh
 deploy-daemon.sh
 serve-web.sh
+push.sh
 web/public/config.js
 cmd/app/frontend/dist/*
 !cmd/app/frontend/dist/.gitkeep

EXTENSIONS.md

@@ -151,9 +151,13 @@ entries from all applicable share roots, with relative `path` fields
 **Status:** implemented (browser mode + daemon mode)  
 **Affects:** ICE server configuration only, no wire changes
 
-The browser adapter reads `WASTE_CONFIG.turnURL` and `WASTE_CONFIG.turnSecret`
-and adds a TURN server to the WebRTC `ICEServers` list. Credentials are
-generated using HMAC-SHA1 of the username (coturn `use-auth-secret` scheme).
+The browser adapter reads `WASTE_CONFIG.turnURL` and fetches short-lived
+credentials from the anchor's `GET /turn-credentials` endpoint (derived from
+`WASTE_CONFIG.signalURL`, or overridden via `WASTE_CONFIG.turnCredentialsURL`).
+The anchor computes the credential using HMAC-SHA1 of the username (coturn
+`use-auth-secret` scheme) — the shared secret itself is never sent to the
+browser. Daemon mode does the equivalent computation locally, since the
+daemon already holds `-turn-secret` server-side.
 
 YAW/2 §0 explicitly declines TURN ("No relay (TURN)"). This extension is
 opt-in via server configuration and does not affect peers that omit it.
@@ -304,3 +308,74 @@ without a `mid` are assigned one at receive time and are not gossipped.
 
 Emitted once per room after a `history_chunk` is fully processed. The UI
 should render these messages with a visual separator from live messages.
+
+---
+
+## EXT-008 — Message Reactions
+
+### Wire message (`PeerMessage`)
+
+```json
+{
+  "type": "reaction",
+  "reaction_mid": "<32-hex mid of the target message>",
+  "reaction_emoji": "👍"
+}
+```
+
+Sent on the normal mesh DataChannel (same as `chat`). No signing beyond
+the existing channel-level encryption.
+
+### Semantics
+
+- A reaction is idempotent: the same `(mid, emoji, from_peer)` triple is
+  stored with `INSERT OR IGNORE` — receiving a duplicate is a no-op.
+- There is no "un-react" wire message. Toggling off a reaction in the UI
+  is a local-only operation in the current implementation.
+- `reaction_mid` must reference a message that exists in the local store;
+  unknown mids are silently ignored.
+
+### Storage
+
+SQLite table added as a migration:
+
+```sql
+CREATE TABLE IF NOT EXISTS reactions (
+  mid        TEXT NOT NULL,
+  emoji      TEXT NOT NULL,
+  from_peer  TEXT NOT NULL,
+  reacted_at DATETIME NOT NULL,
+  PRIMARY KEY (mid, emoji, from_peer)
+)
+```
+
+### IPC
+
+**Command** — send a reaction (daemon and browser mode):
+```json
+{ "type": "send_reaction", "network_id": "...", "reaction_mid": "<hex>", "reaction_emoji": "👍" }
+```
+
+**Event** — reaction received or replayed from history:
+```json
+{ "type": "reaction", "network_id": "...", "peer_id": "<64-hex>", "reaction_mid": "<hex>", "reaction_emoji": "👍" }
+```
+
+Stored reactions are replayed as `reaction` IPC events when history is
+loaded (`sendStoredHistory`), so the UI always sees reactions alongside
+their messages.
+
+### History replay
+
+When `sendStoredHistory` sends a `history_chunk`, it also queries
+`ReactionsForRoom` and emits one `reaction` event per stored reaction so
+clients receive the full reaction state on reconnect.
+
+### Browser mode
+
+`browser.ts` mirrors the daemon behaviour independently:
+
+- `PeerConn.sendReaction(mid, emoji)` broadcasts `{ type: "reaction", reaction_mid, reaction_emoji }` over the DataChannel.
+- Incoming `reaction` wire frames are dispatched as `reaction` IPC events.
+- `BrowserAdapter.send()` handles `send_reaction` commands and both broadcasts to all peers and emits a local `reaction` event.
+- `sendChat` includes the `mid` in the wire frame so reactions can reference it correctly across peers.

FUTURE.md

@@ -41,7 +41,9 @@ Solved by using WebRTC DataChannels via pion. ICE gathers host + server-reflexiv
 ### TURN relay ✅ (shipped)
 Both browser and daemon modes support TURN relay.
 
-**Browser mode:** `iceServers()` in `browser.ts` reads `WASTE_CONFIG.turnURL` and `WASTE_CONFIG.turnSecret`, generates time-limited HMAC-SHA1 credentials (compatible with coturn `use-auth-secret`), and adds the TURN server to the ICE candidate list. The peer dot turns yellow for relayed connections (`candidate_type: relay`).
+**Browser mode:** `iceServers()` in `browser.ts` reads `WASTE_CONFIG.turnURL` and fetches a time-limited credential from the anchor's `GET /turn-credentials` endpoint (HMAC-SHA1, compatible with coturn `use-auth-secret`) rather than holding the shared secret client-side. The peer dot turns yellow for relayed connections (`candidate_type: relay`).
+
+> **Security fix:** earlier this previously embedded `turnSecret` directly in `WASTE_CONFIG`, which let anyone reading the PWA's JS mint unlimited long-lived TURN credentials. The secret now lives only on the anchor (`-turn-secret` flag); the anchor mints short-lived credentials per-request instead.
 
 **Daemon mode:** `-turn-url` and `-turn-secret` flags on `cmd/daemon`. `turnICEServers()` in `internal/netmgr/manager.go` generates HMAC-SHA1 credentials and injects them into the ICE server list for every new peer connection.
 
@@ -137,6 +139,35 @@ Web frontend (React, already built) + [Wails v2](https://wails.io) shell for nat
 | ✅ shipped | P2P message history gossip (EXT-007) — new peers receive recent history from first connected peer |
 | ✅ shipped | Date-aware timestamps in TUI and web UI |
 | ✅ shipped | Historical peer alias resolution in web UI |
+| ✅ shipped | Message reactions (emoji picker, full-stack: wire protocol, SQLite, IPC, web UI, TUI) |
+| ✅ shipped | Link rendering + image preview in web UI messages |
+| ✅ shipped | Responsive mobile layout (slide-over sidebar, hamburger button) |
+| ✅ shipped | TUI multi-network (join/switch networks at runtime, `ctrl+n`, `/join`, `/net`) |
+| ✅ shipped | TUI message reactions (`/react <emoji>` or `/react <n> <emoji>`) |
+| 🔜 planned | Push notifications (PWA Web Push + service worker) |
+
+### Message Reactions ✅ (shipped)
+Full-stack emoji reactions. The web UI shows a `+` button on hover that opens a six-emoji picker (👍 ❤️ 😂 😮 😢 🙏). Reactions render as chips below each message; clicking an existing chip toggles your own reaction. Reactions are stored in SQLite (`reactions` table), gossiped over the mesh as `reaction` wire messages (EXT-008), and replayed via IPC on reconnect.
+
+Browser mode: `browser.ts` independently mirrors the daemon — reactions flow over the DataChannel and are broadcast to all connected peers.
+
+TUI: messages show `[n]` line numbers. Use `/react <emoji>` (reacts to last message) or `/react <n> <emoji>` (reacts to message `n`). Reactions render inline below the target message.
+
+### Link Rendering + Image Preview ✅ (shipped)
+URLs in messages are auto-linked. URLs ending in a recognized image extension (`.jpg`, `.png`, `.gif`, `.webp`, `.svg`) render an inline `<img>` preview (max 320×200px). `blob:` and `data:image` URLs are also treated as images.
+
+### Responsive Mobile Layout ✅ (shipped)
+At viewport width ≤ 600px the sidebar becomes a fixed-position slide-over drawer, hidden off-screen by default (`transform: translateX(-100%)`). A `☰` hamburger button in the message pane header toggles it open. Clicking any room or network in the sidebar closes it automatically. The layout is dimmed while the sidebar is open via a `::before` overlay.
+
+### Push Notifications (planned)
+The web UI is already a PWA (installable, has manifest). The missing half is a service worker + Web Push subscription:
+
+1. **Service worker** — intercepts `push` events and shows OS notifications via `showNotification()`.
+2. **VAPID key pair** — generated once by the daemon (`-vapid-key` flag); the public key is served to the browser so it can subscribe.
+3. **Subscription persistence** — the browser's `PushSubscription` JSON is sent to the daemon over IPC (`register_push` command). The daemon stores it per-network-per-peer.
+4. **Daemon relay** — when a `message_received` event fires with no active IPC WebSocket connection, the daemon POSTs a Web Push notification to the stored subscription endpoint.
+
+This keeps the architecture clean: the daemon already runs in the background; it becomes the notification relay. No third-party push server is required for self-hosted setups (coturn already in use for TURN; a lightweight Web Push POST is similar).
 
 ---
 

QUICKSTART.md

@@ -41,13 +41,33 @@ On Linux and Windows a tray icon appears — closing the window hides to tray ra
 
 ---
 
-## Option 3 — Run the daemon manually (headless / power users)
+## Option 3 — Run the daemon + TUI or web UI locally (power users / dev)
+
+Example scripts are provided for the common local workflows. Copy them and fill in your anchor URL:
+
+```bash
+# TUI (terminal UI):
+cp launch-tui.sh.example launch-tui.sh
+$EDITOR launch-tui.sh          # set ANCHOR=wss://your-anchor/ws
+./launch-tui.sh
+
+# Web UI in daemon mode (Vite dev server + daemon):
+cp launch-web.sh.example launch-web.sh
+$EDITOR launch-web.sh          # set ANCHOR=wss://your-anchor/ws
+./launch-web.sh
+```
+
+The real script files are gitignored so your local edits (anchor URL, alias, network) are never accidentally committed.
+
+---
+
+## Option 4 — Run the daemon manually (headless)
 
 If you want the daemon running in the background without the desktop UI — on a server, over SSH, or with the web UI in a browser pointed at your local machine:
 
 ```bash
 # Download waste-daemon from the releases page, then:
-./waste-daemon -alias yourname -anchor wss://your-anchor-server/ws
+./waste-daemon -alias yourname -anchor wss://YOUR_ANCHOR_DOMAIN/ws
 ```
 
 Then open the web UI in a browser at the anchor URL, or point the web UI's daemon mode at `ws://127.0.0.1:17338`.
@@ -83,7 +103,7 @@ The anchor is a tiny signaling server that helps peers find each other — it ne
 
 ```bash
 # On your VPS:
-./waste-anchor -bind 127.0.0.1:8080
+./waste-anchor -bind 127.0.0.1:8080 -turn-secret YOUR_COTURN_SECRET
 ```
 
-Put it behind nginx with a `/ws` WebSocket proxy and serve the web UI static files at `/`. See [README.md](README.md#hosting-on-a-vps) for the full nginx setup.
+Put it behind nginx with `/ws` and `/turn-credentials` proxied to the anchor, and the web UI static files at `/`. See [README.md](README.md#hosting-on-a-vps) for the full nginx setup.

README.md

@@ -21,6 +21,51 @@ waste-go/
 
 ---
 
+## Prebuilt binaries
+
+Every tagged release publishes cross-compiled binaries — no Go toolchain required. Grab them from the repo's **Releases** page:
+
+```
+https://repo.explewd.com/explewd/waste-go/releases
+```
+
+| File | What it is | Run it on |
+|---|---|---|
+| `waste-daemon-<os>-<arch>` | The peer process — your identity, mesh connections, file shares | Each friend's own machine |
+| `waste-anchor-<os>-<arch>` | The signaling relay (no message content ever passes through it) | One server you control (VPS) |
+
+`<os>` is `linux`, `darwin` (macOS), or `windows`; `<arch>` is `amd64` or `arm64` (Windows builds are amd64 only). Windows binaries have a `.exe` suffix.
+
+**Linux / macOS:**
+
+```bash
+curl -LO https://repo.explewd.com/explewd/waste-go/releases/download/<tag>/waste-daemon-linux-amd64
+chmod +x waste-daemon-linux-amd64
+./waste-daemon-linux-amd64 -alias yourname -data-dir ~/.waste --join 'waste:eyJ...'
+```
+
+> **macOS Gatekeeper:** unsigned binaries downloaded from a browser get a quarantine flag and macOS will refuse to run them ("cannot be opened because the developer cannot be verified"). Clear it once after downloading: `xattr -d com.apple.quarantine waste-daemon-darwin-arm64` (or right-click → Open the first time, which prompts for an override).
+
+**Windows:** download the `.exe`, then run it from PowerShell or `cmd.exe`:
+
+```powershell
+.\waste-daemon-windows-amd64.exe -alias yourname -data-dir C:\waste --join "waste:eyJ..."
+```
+
+SmartScreen may warn about an unrecognized publisher on first run — these binaries aren't code-signed. Click "More info" → "Run anyway".
+
+Once the daemon is running, drive it with the [TUI](#terminal-ui) (`./cmd/tui` built locally, or the web UI in [daemon mode](#daemon-mode-for-users-running-the-daemon-locally)) — the daemon itself has no UI of its own, it just exposes the local IPC API on port 17337.
+
+The `waste-anchor` binary is for whoever is hosting a network — see [Hosting on a VPS](#hosting-on-a-vps) below for the full anchor + web UI setup. For a quick local anchor (e.g. testing on a LAN), just run:
+
+```bash
+./waste-anchor-linux-amd64 -bind 0.0.0.0:8080
+```
+
+> **No desktop app build in the current release.** A native Wails desktop app (`cmd/app/`) exists in the source tree, but the CI step that packages it for releases was broken (wrong output path) until this fix — earlier tagged releases only have daemon/anchor binaries. The next tag will include `waste-linux-amd64`. Until then, build it yourself with `./build-app.sh` (see [Desktop app (Wails)](#desktop-app-wails) below).
+
+---
+
 ## Hosting on a VPS
 
 You need two things on the server: the **anchor** (signaling process) and the **web UI** (static files). Both are served through the same domain via Nginx Proxy Manager.
@@ -89,7 +134,7 @@ This tells the browser where to connect for signaling. Without it the join form
 
 ### 3. Nginx Proxy Manager setup
 
-Create one **Proxy Host** for your domain (e.g. `waste.example.com`) with TLS enabled. You need two locations:
+Create one **Proxy Host** for your domain (e.g. `waste.example.com`) with TLS enabled. You need these locations:
 
 **Location 1 — WebSocket signaling (`/ws`)**
 - Location: `/ws`
@@ -97,6 +142,12 @@ Create one **Proxy Host** for your domain (e.g. `waste.example.com`) with TLS en
 - Forward port: `8080`
 - Enable: WebSockets Support
 
+**Location 1b — TURN credentials (`/turn-credentials`, only if using TURN — see [step 4](#4-turn-relay-optional-fixes-mobile--cgnat))**
+- Location: `/turn-credentials`
+- Forward hostname/IP: `127.0.0.1`
+- Forward port: `8080`
+- Plain HTTP, no WebSockets toggle needed
+
 **Location 2 — Web UI (catch-all)**
 - Location: `/`
 - Choose "Serve Static Files" (or point to a local HTTP server serving `/var/www/waste-web`)
@@ -117,6 +168,7 @@ Or use `serve-web.sh` which handles PID tracking and restart:
 The key requirements:
 
 - `/ws` → anchor process (WebSocket, keep-alive)
+- `/turn-credentials` → anchor process (plain HTTP; only needed if using TURN)
 - `/*` → static file server (SPA fallback: return `index.html` for unknown paths)
 
 ### 4. TURN relay (optional, fixes mobile / CGNAT)
@@ -155,21 +207,32 @@ systemctl enable coturn
 systemctl start coturn
 ```
 
-**Update `config.js`** to tell browsers about the TURN server:
+**Start the anchor with the same secret**, so it can mint short-lived credentials on your behalf:
+
+```bash
+./waste-anchor -bind 0.0.0.0:8080 -turn-secret YOUR_SECRET_HERE
+```
+
+This enables `GET /turn-credentials` on the anchor, which returns a fresh `{username, credential}` pair (1-hour TTL) computed from the shared secret — the secret itself never leaves the server.
+
+**Update `config.js`** to tell browsers about the TURN server (no secret here — only the public relay address):
 
 ```js
 window.WASTE_CONFIG = {
   signalURL: 'wss://your-domain.com/ws',
   turnURL: 'turn:your-domain.com:3478',
-  turnSecret: 'YOUR_SECRET_HERE',
 }
 ```
 
-The `use-auth-secret` mode generates short-lived TURN credentials from the shared secret — no user database required. The relay only sees opaque DTLS-encrypted blobs.
+> **Security note:** earlier versions of this doc had you put `turnSecret` directly in `config.js`. Don't — anyone reading the PWA's JS bundle could read it and mint unlimited, long-lived TURN credentials, turning your relay into an open proxy for anyone. The browser now calls the anchor's `/turn-credentials` endpoint instead and only ever sees a credential that expires in an hour. If you have an old `config.js` with `turnSecret` set, remove it and rotate the coturn secret (`static-auth-secret` in `turnserver.conf` and the anchor's `-turn-secret` flag) since the old one was exposed.
 
-> The browser adapter reads `turnURL` and `turnSecret` from `WASTE_CONFIG` and adds the TURN server to the WebRTC `ICEServers` list automatically. If not configured, STUN-only is used (works for most desktop/home NAT situations).
+The browser adapter calls `signalURL` with `/ws` swapped for `/turn-credentials` to find the anchor's endpoint by default; set `turnCredentialsURL` explicitly in `WASTE_CONFIG` if the anchor is reachable at a different path. If `turnURL` is set but the credentials endpoint is unreachable, the browser falls back to STUN-only.
 
-**Daemon mode TURN:** pass `-turn-url turn:your-domain.com:3478 -turn-secret YOUR_SECRET_HERE` when starting the daemon. The same coturn `use-auth-secret` HMAC-SHA1 scheme is used — no extra config required beyond what you set up for browser mode.
+You'll also need nginx to route the new path to the anchor, alongside `/ws` (see [step 3](#3-nginx-proxy-manager-setup)):
+
+- `/turn-credentials` → anchor process (plain HTTP, no WebSocket upgrade needed)
+
+**Daemon mode TURN:** pass `-turn-url turn:your-domain.com:3478 -turn-secret YOUR_SECRET_HERE` when starting the daemon. This is unaffected by the above — the daemon computes credentials itself server-side and never exposes the secret, same as the anchor now does for browser mode.
 
 ---
 
@@ -392,9 +455,16 @@ go run ./cmd/tui -network friends
 | `-join` | — | `waste:` invite string |
 | `-ipc` | `17337` | Daemon IPC port |
 
-**Key bindings:** `Tab`/`Shift+Tab` — switch rooms · `PgUp`/`PgDn` — scroll · `Enter` — send · `Ctrl+I` — generate invite · `Esc` — close overlay · `Ctrl+C` — quit
+**Key bindings:** `Tab`/`Shift+Tab` — switch rooms · `Ctrl+N` — cycle networks · `PgUp`/`PgDn` — scroll · `Enter` — send · `Ctrl+I` — generate invite · `Esc` — close overlay · `Ctrl+C` — quit
 
-**Slash commands:** `/room <name>` — create a new room (persisted in SQLite, restored on reconnect). Rooms with unread messages show a `*` prefix in the sidebar.
+**Slash commands:**
+- `/room <name>` — create a new room (persisted in SQLite, restored on reconnect)
+- `/join <name>` — join a new network at runtime (the `-network` flag is optional; start idle and `/join` to connect)
+- `/net <n|name>` — switch active network by index or name
+- `/react <emoji>` — react to the last message (use actual emoji characters, e.g. `/react 👍`)
+- `/react <n> <emoji>` — react to message `[n]` (line numbers shown next to each message)
+
+Rooms with unread messages show a `*` prefix in the sidebar.
 
 ---
 
@@ -419,6 +489,7 @@ Newline-delimited JSON on TCP port 17337 (or WebSocket on 17338).
 {"type":"create_room","room":"dev"}
 {"type":"set_download_dir","path":"/home/alice/Downloads"}               // change download base for current network
 {"type":"set_download_dir","network_id":"<16-hex>","path":"/home/alice/Downloads/friends"}
+{"type":"send_reaction","network_id":"...","reaction_mid":"<32-hex>","reaction_emoji":"👍"}
 {"type":"export_identity","passphrase":"..."}
 {"type":"import_identity","passphrase":"...","backup":"..."}
 ```
@@ -435,6 +506,7 @@ Newline-delimited JSON on TCP port 17337 (or WebSocket on 17338).
 {"type":"incoming_file","peer_id":"<64-hex>","offer":{"xid":"...","name":"notes.txt","size":1024,"sha256":"..."}}
 {"type":"file_complete","transfer_id":"...","path":"/downloads/notes.txt"}
 {"type":"room_created","network_id":"...","room":"dev"}
+{"type":"reaction","network_id":"...","peer_id":"<64-hex>","reaction_mid":"<32-hex>","reaction_emoji":"👍"}
 {"type":"identity_exported","backup":"..."}
 {"type":"error","error_message":"..."}
 ```

cmd/anchor/main.go

@@ -6,12 +6,17 @@ package main
 import (
 	"context"
 	"crypto/ed25519"
+	"crypto/hmac"
 	"crypto/rand"
+	"crypto/sha1"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
+	"encoding/json"
 	"flag"
 	"log"
 	"net/http"
+	"strconv"
 	"sync"
 	"time"
 
@@ -23,16 +28,40 @@ import (
 
 func main() {
 	bind := flag.String("bind", "0.0.0.0:17339", "address to listen on")
+	turnSecret := flag.String("turn-secret", "", "coturn use-auth-secret shared secret; enables GET /turn-credentials")
 	flag.Parse()
 
 	a := newAnchor()
 	http.HandleFunc("/ws", a.handleWS)
+	if *turnSecret != "" {
+		http.HandleFunc("/turn-credentials", turnCredentialsHandler(*turnSecret))
+		log.Printf("anchor: /turn-credentials enabled")
+	}
 	log.Printf("anchor: listening on %s", *bind)
 	if err := http.ListenAndServe(*bind, nil); err != nil {
 		log.Fatalf("anchor: %v", err)
 	}
 }
 
+// turnCredentialsHandler mints short-lived coturn use-auth-secret credentials
+// server-side, so the shared secret never reaches the browser. Mirrors the
+// scheme in internal/netmgr.Manager.turnICEServers (daemon mode).
+func turnCredentialsHandler(secret string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Content-Type", "application/json")
+		expiry := strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)
+		mac := hmac.New(sha1.New, []byte(secret))
+		mac.Write([]byte(expiry))
+		credential := base64.StdEncoding.EncodeToString(mac.Sum(nil))
+		json.NewEncoder(w).Encode(struct {
+			Username   string `json:"username"`
+			Credential string `json:"credential"`
+			TTL        int    `json:"ttl"`
+		}{Username: expiry, Credential: credential, TTL: 3600})
+	}
+}
+
 // ── Anchor ────────────────────────────────────────────────────────────────────
 
 type client struct {
@@ -126,8 +155,8 @@ func (a *anchor) handleWS(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithCancel(r.Context())
 	defer cancel()
 
-	// Send a challenge nonce immediately.
-	nonce := make([]byte, 16)
+	// Send a challenge nonce immediately. §5.1 requires 32 bytes.
+	nonce := make([]byte, 32)
 	rand.Read(nonce)
 	nonceHex := hex.EncodeToString(nonce)
 	if err := wsjson.Write(ctx, conn, proto.AnchorMessage{

cmd/tui/main.go

@@ -1,6 +1,7 @@
 // Package main is the waste-go terminal UI.
-// It connects to a running daemon's IPC port, joins a named network, and
-// renders a three-pane layout: rooms (left), messages (centre), peers (right).
+// It connects to a running daemon's IPC port and renders a three-pane layout:
+// rooms/networks (left), messages with line numbers (centre), peers (right).
+// Multiple networks are supported at runtime via /join; switch with ctrl+n.
 package main
 
 import (
@@ -10,6 +11,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -25,21 +27,25 @@ import (
 // ── styles ────────────────────────────────────────────────────────────────────
 
 var (
-	styleHeader  = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
-	styleActive  = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("86"))
-	styleRoom    = lipgloss.NewStyle().Foreground(lipgloss.Color("250"))
-	stylePeer    = lipgloss.NewStyle().Foreground(lipgloss.Color("72"))
-	styleSelf    = lipgloss.NewStyle().Foreground(lipgloss.Color("86"))
-	styleMsgFrom = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
-	styleMsgMe   = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("86"))
-	styleMsgTime = lipgloss.NewStyle().Foreground(lipgloss.Color("238"))
-	styleTitle   = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
-	styleBorder  = lipgloss.Color("238")
-	styleStatus  = lipgloss.NewStyle().Foreground(lipgloss.Color("238"))
-	styleErr     = lipgloss.NewStyle().Foreground(lipgloss.Color("196")).Bold(true)
+	styleHeader   = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
+	styleActive   = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("86"))
+	styleRoom     = lipgloss.NewStyle().Foreground(lipgloss.Color("250"))
+	styleNet      = lipgloss.NewStyle().Foreground(lipgloss.Color("39"))
+	styleNetActive = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("51"))
+	stylePeer     = lipgloss.NewStyle().Foreground(lipgloss.Color("72"))
+	styleSelf     = lipgloss.NewStyle().Foreground(lipgloss.Color("86"))
+	styleMsgFrom  = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
+	styleMsgMe    = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("86"))
+	styleMsgTime  = lipgloss.NewStyle().Foreground(lipgloss.Color("238"))
+	styleLineNum  = lipgloss.NewStyle().Foreground(lipgloss.Color("238"))
+	styleReaction = lipgloss.NewStyle().Foreground(lipgloss.Color("246"))
+	styleTitle    = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("33"))
+	styleBorder   = lipgloss.Color("238")
+	styleStatus   = lipgloss.NewStyle().Foreground(lipgloss.Color("238"))
+	styleErr      = lipgloss.NewStyle().Foreground(lipgloss.Color("196")).Bold(true)
 )
 
-const sideW = 22 // total width of each sidebar box (inner = sideW-2)
+const sideW = 22
 
 // ── tea messages ──────────────────────────────────────────────────────────────
 
@@ -51,9 +57,6 @@ type ipcLineMsg struct{ line []byte }
 type connectErrMsg struct{ err error }
 type readErrMsg struct{ err error }
 
-// lineReader pumps a TCP connection through a channel so a single bufio.Scanner
-// is alive for the lifetime of the connection (avoids read-ahead data loss when
-// a new scanner is created on each call).
 type lineReader struct {
 	ch chan []byte
 }
@@ -84,7 +87,42 @@ func (lr *lineReader) next() tea.Cmd {
 
 // ── model ─────────────────────────────────────────────────────────────────────
 
+// netData holds per-network state.
+type netData struct {
+	id         string
+	name       string
+	localID    proto.PeerID
+	localAlias string
+	rooms      []string
+	activeRoom int
+	peers      map[proto.PeerID]string
+	peerOrder  []proto.PeerID
+	knownPeers map[proto.PeerID]string // historical peers (from store)
+}
+
+func newNetData(id, name string) *netData {
+	return &netData{
+		id:         id,
+		name:       name,
+		rooms:      []string{"general"},
+		peers:      make(map[proto.PeerID]string),
+		knownPeers: make(map[proto.PeerID]string),
+	}
+}
+
+func (n *netData) addRoom(room string) bool {
+	for _, r := range n.rooms {
+		if r == room {
+			return false
+		}
+	}
+	n.rooms = append(n.rooms, room)
+	return true
+}
+
+// entry is a single chat message in the viewport.
 type entry struct {
+	mid    string
 	from   string
 	body   string
 	at     time.Time
@@ -92,8 +130,8 @@ type entry struct {
 }
 
 type model struct {
-	ipcPort     int
-	networkName string
+	ipcPort        int
+	initialNetwork string // from -network flag; joined on first connect
 
 	width, height int
 
@@ -101,16 +139,15 @@ type model struct {
 	enc    *json.Encoder
 	reader *lineReader
 
-	localID    proto.PeerID
-	localAlias string
+	nets      []*netData
+	activeNet int
 
-	rooms      []string // "general" always first; DM rooms appended
-	activeRoom int
-	messages   map[string][]entry
-	unread     map[string]bool // rooms with messages since last viewed
+	// keyed by "netId:room"
+	messages map[string][]entry
+	unread   map[string]bool
 
-	peers     map[proto.PeerID]string // connected peers: id → alias
-	peerOrder []proto.PeerID
+	// mid → emoji → []alias
+	reactions map[string]map[string][]string
 
 	input    textinput.Model
 	viewport viewport.Model
@@ -118,27 +155,89 @@ type model struct {
 
 	status      string
 	errMsg      string
-	invitePopup string // non-empty = show invite overlay
+	invitePopup string
 }
 
 func newModel(ipcPort int, network string) model {
 	ti := textinput.New()
-	ti.Placeholder = "Type a message…"
+	ti.Placeholder = "Type a message, or /join /net /room /react…"
 	ti.Focus()
 	ti.CharLimit = 2000
 
 	return model{
-		ipcPort:     ipcPort,
-		networkName: network,
-		rooms:       []string{"general"},
-		messages:    make(map[string][]entry),
-		unread:      make(map[string]bool),
-		peers:       make(map[proto.PeerID]string),
-		input:       ti,
-		status:      "connecting…",
+		ipcPort:        ipcPort,
+		initialNetwork: network,
+		messages:       make(map[string][]entry),
+		unread:         make(map[string]bool),
+		reactions:      make(map[string]map[string][]string),
+		input:          ti,
+		status:         "connecting…",
 	}
 }
 
+// ── accessors ─────────────────────────────────────────────────────────────────
+
+func (m model) activeNetData() *netData {
+	if m.activeNet < len(m.nets) {
+		return m.nets[m.activeNet]
+	}
+	return nil
+}
+
+func (m model) activeNetworkID() string {
+	if n := m.activeNetData(); n != nil {
+		return n.id
+	}
+	return ""
+}
+
+func (m model) activeRoomName() string {
+	n := m.activeNetData()
+	if n == nil {
+		return "general"
+	}
+	if n.activeRoom < len(n.rooms) {
+		return n.rooms[n.activeRoom]
+	}
+	return "general"
+}
+
+func (m model) msgKey() string {
+	n := m.activeNetData()
+	if n == nil {
+		return ":general"
+	}
+	return n.id + ":" + n.rooms[n.activeRoom]
+}
+
+func (m model) netByID(id string) *netData {
+	for _, n := range m.nets {
+		if n.id == id {
+			return n
+		}
+	}
+	return nil
+}
+
+func (m model) aliasOf(netID string, id proto.PeerID) string {
+	n := m.netByID(netID)
+	if n == nil {
+		return shortID(id)
+	}
+	if id == n.localID && n.localAlias != "" {
+		return n.localAlias
+	}
+	if a, ok := n.peers[id]; ok && a != "" {
+		return a
+	}
+	if a, ok := n.knownPeers[id]; ok && a != "" {
+		return a
+	}
+	return shortID(id)
+}
+
+// ── Init ──────────────────────────────────────────────────────────────────────
+
 func (m model) Init() tea.Cmd {
 	return tea.Batch(connectCmd(m.ipcPort), textinput.Blink)
 }
@@ -162,7 +261,7 @@ func sendIPC(enc *json.Encoder, msg proto.IpcMessage) tea.Cmd {
 	}
 }
 
-// ── update ────────────────────────────────────────────────────────────────────
+// ── Update ────────────────────────────────────────────────────────────────────
 
 func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmds []tea.Cmd
@@ -181,12 +280,13 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.conn = msg.conn
 		m.enc = json.NewEncoder(msg.conn)
 		m.reader = msg.reader
-		m.status = "joining " + m.networkName + "…"
-		cmds = append(cmds,
-			sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdJoinNetwork, NetworkName: m.networkName}),
-			sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdGetState}),
-			m.reader.next(),
-		)
+		cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdGetState}), m.reader.next())
+		if m.initialNetwork != "" {
+			m.status = "joining " + m.initialNetwork + "…"
+			cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdJoinNetwork, NetworkName: m.initialNetwork}))
+		} else {
+			m.status = "connected — /join <network> to start"
+		}
 
 	case ipcLineMsg:
 		var evt proto.IpcMessage
@@ -211,18 +311,30 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, tea.Quit
 		case msg.String() == "ctrl+i":
 			if m.enc != nil {
-				cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdGenerateInvite}))
+				cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{
+					Type:      proto.CmdGenerateInvite,
+					NetworkID: m.activeNetworkID(),
+				}))
+			}
+		case msg.String() == "ctrl+n":
+			if len(m.nets) > 1 {
+				m.activeNet = (m.activeNet + 1) % len(m.nets)
+				m = m.refreshViewport()
 			}
 		case msg.Type == tea.KeyEnter:
 			m, cmds = m.doSend(cmds)
 		case msg.Type == tea.KeyTab:
-			m.activeRoom = (m.activeRoom + 1) % len(m.rooms)
-			delete(m.unread, m.activeRoomName())
-			m = m.refreshViewport()
+			if n := m.activeNetData(); n != nil {
+				n.activeRoom = (n.activeRoom + 1) % len(n.rooms)
+				delete(m.unread, m.msgKey())
+				m = m.refreshViewport()
+			}
 		case msg.Type == tea.KeyShiftTab:
-			m.activeRoom = (m.activeRoom - 1 + len(m.rooms)) % len(m.rooms)
-			delete(m.unread, m.activeRoomName())
-			m = m.refreshViewport()
+			if n := m.activeNetData(); n != nil {
+				n.activeRoom = (n.activeRoom - 1 + len(n.rooms)) % len(n.rooms)
+				delete(m.unread, m.msgKey())
+				m = m.refreshViewport()
+			}
 		default:
 			var tiCmd tea.Cmd
 			m.input, tiCmd = m.input.Update(msg)
@@ -230,7 +342,6 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 
 	default:
-		// Let viewport handle scroll events.
 		if m.vpReady {
 			var vpCmd tea.Cmd
 			m.viewport, vpCmd = m.viewport.Update(msg)
@@ -241,56 +352,106 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	return m, tea.Batch(cmds...)
 }
 
+// ── applyEvent ────────────────────────────────────────────────────────────────
+
 func (m model) applyEvent(evt proto.IpcMessage) model {
 	switch evt.Type {
 
 	case proto.EvtStateSnapshot:
-		if evt.LocalPeer != nil {
-			m.localID = evt.LocalPeer.ID
-			m.localAlias = evt.LocalPeer.Alias
+		// Populate nets from snapshot.
+		for _, ni := range evt.Networks {
+			n := m.netByID(ni.NetworkID)
+			if n == nil {
+				n = newNetData(ni.NetworkID, ni.NetworkName)
+				m.nets = append(m.nets, n)
+			}
+			if ni.LocalPeer != nil {
+				n.localID = ni.LocalPeer.ID
+				n.localAlias = ni.LocalPeer.Alias
+			}
 		}
-		m.peers = make(map[proto.PeerID]string)
-		m.peerOrder = nil
-		for _, p := range evt.ConnectedPeers {
-			m.peers[p.ID] = p.Alias
-			m.peerOrder = append(m.peerOrder, p.ID)
+		// Backward-compat: connected_peers and rooms are from first network.
+		if len(evt.Networks) > 0 && len(m.nets) > 0 {
+			n := m.nets[0]
+			for _, p := range evt.ConnectedPeers {
+				if _, ok := n.peers[p.ID]; !ok {
+					n.peerOrder = append(n.peerOrder, p.ID)
+				}
+				n.peers[p.ID] = p.Alias
+			}
+			for _, r := range evt.Rooms {
+				n.addRoom(r)
+			}
+			for _, p := range evt.KnownPeers {
+				n.knownPeers[p.ID] = p.Alias
+			}
 		}
-		for _, r := range evt.Rooms {
-			m = m.addRoom(r)
-		}
-		m.status = fmt.Sprintf("● %s  ·  %s", m.localAlias, m.networkName)
-
-	case proto.EvtRoomCreated:
-		m = m.addRoom(evt.Room)
+		m = m.updateStatus()
 		m = m.refreshViewport()
 
+	case proto.EvtNetworkJoined:
+		n := m.netByID(evt.NetworkID)
+		if n == nil {
+			name := evt.NetworkName
+			if name == "" {
+				name = evt.NetworkID
+			}
+			n = newNetData(evt.NetworkID, name)
+			m.nets = append(m.nets, n)
+			m.activeNet = len(m.nets) - 1
+		}
+		if evt.LocalPeer != nil {
+			n.localID = evt.LocalPeer.ID
+			n.localAlias = evt.LocalPeer.Alias
+		}
+		m = m.updateStatus()
+		m = m.refreshViewport()
+
+	case proto.EvtRoomCreated:
+		if n := m.netByID(evt.NetworkID); n != nil {
+			n.addRoom(evt.Room)
+			m = m.refreshViewport()
+		}
+
 	case proto.EvtSessionReady:
-		if evt.PeerID != nil {
+		netID := evt.NetworkID
+		if netID == "" && len(m.nets) > 0 {
+			netID = m.nets[0].id
+		}
+		if n := m.netByID(netID); n != nil && evt.PeerID != nil {
 			pid := *evt.PeerID
-			if _, ok := m.peers[pid]; !ok {
-				m.peerOrder = append(m.peerOrder, pid)
+			if _, ok := n.peers[pid]; !ok {
+				n.peerOrder = append(n.peerOrder, pid)
 			}
 			alias := evt.Nick
 			if alias == "" {
 				alias = shortID(pid)
 			}
-			m.peers[pid] = alias
+			n.peers[pid] = alias
 		}
 
 	case proto.EvtPeerConnected:
-		if evt.Peer != nil {
+		netID := evt.NetworkID
+		if netID == "" && len(m.nets) > 0 {
+			netID = m.nets[0].id
+		}
+		if n := m.netByID(netID); n != nil && evt.Peer != nil {
 			pid := evt.Peer.ID
-			if _, ok := m.peers[pid]; !ok {
-				m.peerOrder = append(m.peerOrder, pid)
+			if _, ok := n.peers[pid]; !ok {
+				n.peerOrder = append(n.peerOrder, pid)
 			}
-			m.peers[pid] = evt.Peer.Alias
+			n.peers[pid] = evt.Peer.Alias
 		}
 
 	case proto.EvtPeerDisconnected:
-		if evt.PeerID != nil {
+		netID := evt.NetworkID
+		if netID == "" && len(m.nets) > 0 {
+			netID = m.nets[0].id
+		}
+		if n := m.netByID(netID); n != nil && evt.PeerID != nil {
 			pid := *evt.PeerID
-			delete(m.peers, pid)
-			m.peerOrder = filterIDs(m.peerOrder, pid)
+			delete(n.peers, pid)
+			n.peerOrder = filterIDs(n.peerOrder, pid)
 		}
 
 	case proto.EvtInviteGenerated:
@@ -299,23 +460,111 @@ func (m model) applyEvent(evt proto.IpcMessage) model {
 	case proto.EvtMessageReceived:
 		if evt.Message != nil {
 			msg := evt.Message
+			netID := evt.NetworkID
+			if netID == "" && len(m.nets) > 0 {
+				netID = m.nets[0].id
+			}
+			n := m.netByID(netID)
+			if n != nil {
+				n.addRoom(msg.Room)
+			}
 			e := entry{
-				from:   m.aliasOf(msg.From),
+				mid:    msg.Mid,
+				from:   m.aliasOf(netID, msg.From),
 				body:   msg.Text,
 				at:     time.UnixMilli(msg.Ts),
-				fromMe: msg.From == m.localID,
+				fromMe: n != nil && msg.From == n.localID,
 			}
-			m.messages[msg.Room] = append(m.messages[msg.Room], e)
-			m = m.addRoom(msg.Room)
-			if msg.Room != m.activeRoomName() {
-				m.unread[msg.Room] = true
+			key := netID + ":" + msg.Room
+			m.messages[key] = append(m.messages[key], e)
+			if key != m.msgKey() {
+				m.unread[key] = true
 			}
 			m = m.refreshViewport()
 		}
+
+	case proto.EvtHistoryLoaded:
+		netID := evt.NetworkID
+		if netID == "" && len(m.nets) > 0 {
+			netID = m.nets[0].id
+		}
+		n := m.netByID(netID)
+		key := netID + ":" + evt.Room
+		existing := m.messages[key]
+		existingMids := make(map[string]bool, len(existing))
+		for _, e := range existing {
+			if e.mid != "" {
+				existingMids[e.mid] = true
+			}
+		}
+		var fresh []entry
+		for _, msg := range evt.Messages {
+			if msg.Mid != "" && existingMids[msg.Mid] {
+				continue
+			}
+			fromMe := n != nil && msg.From == n.localID
+			fresh = append(fresh, entry{
+				mid:    msg.Mid,
+				from:   m.aliasOf(netID, msg.From),
+				body:   msg.Text,
+				at:     time.UnixMilli(msg.Ts),
+				fromMe: fromMe,
+			})
+		}
+		if len(fresh) > 0 {
+			// Prepend history, then existing live messages; sort by time.
+			merged := append(fresh, existing...)
+			// Simple insertion sort (lists are already mostly sorted).
+			for i := 1; i < len(merged); i++ {
+				for j := i; j > 0 && merged[j].at.Before(merged[j-1].at); j-- {
+					merged[j], merged[j-1] = merged[j-1], merged[j]
+				}
+			}
+			m.messages[key] = merged
+			if n != nil {
+				n.addRoom(evt.Room)
+			}
+			m = m.refreshViewport()
+		}
+
+	case proto.EvtReaction:
+		mid := evt.ReactionMID
+		emoji := evt.ReactionEmoji
+		if mid == "" || emoji == "" || evt.PeerID == nil {
+			break
+		}
+		netID := evt.NetworkID
+		if netID == "" && len(m.nets) > 0 {
+			netID = m.nets[0].id
+		}
+		alias := m.aliasOf(netID, *evt.PeerID)
+		if m.reactions[mid] == nil {
+			m.reactions[mid] = make(map[string][]string)
+		}
+		for _, a := range m.reactions[mid][emoji] {
+			if a == alias {
+				return m // already recorded
+			}
+		}
+		m.reactions[mid][emoji] = append(m.reactions[mid][emoji], alias)
+		m = m.refreshViewport()
 	}
+
 	return m
 }
 
+func (m model) updateStatus() model {
+	n := m.activeNetData()
+	if n == nil {
+		m.status = "connected — /join <network> to start"
+		return m
+	}
+	m.status = fmt.Sprintf("● %s  ·  %s", n.localAlias, n.name)
+	return m
+}
+
+// ── doSend ────────────────────────────────────────────────────────────────────
+
 func (m model) doSend(cmds []tea.Cmd) (model, []tea.Cmd) {
 	body := strings.TrimSpace(m.input.Value())
 	if body == "" || m.enc == nil {
@@ -323,16 +572,106 @@ func (m model) doSend(cmds []tea.Cmd) (model, []tea.Cmd) {
 	}
 	m.input.SetValue("")
 
-	if strings.HasPrefix(body, "/room ") {
-		name := strings.TrimSpace(strings.TrimPrefix(body, "/room "))
+	// /join <network-name>
+	if strings.HasPrefix(body, "/join ") {
+		name := strings.TrimSpace(strings.TrimPrefix(body, "/join "))
 		if name != "" {
-			cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdCreateRoom, Room: name}))
+			cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{Type: proto.CmdJoinNetwork, NetworkName: name}))
 		}
 		return m, cmds
 	}
 
-	room := m.rooms[m.activeRoom]
-	ipcMsg := proto.IpcMessage{Type: proto.CmdSendMessage, Room: room, Body: body}
+	// /net <number|name> — switch active network
+	if strings.HasPrefix(body, "/net ") {
+		arg := strings.TrimSpace(strings.TrimPrefix(body, "/net "))
+		if n, err := strconv.Atoi(arg); err == nil {
+			idx := n - 1
+			if idx >= 0 && idx < len(m.nets) {
+				m.activeNet = idx
+				m = m.updateStatus()
+				m = m.refreshViewport()
+			}
+		} else {
+			for i, net := range m.nets {
+				if strings.EqualFold(net.name, arg) {
+					m.activeNet = i
+					m = m.updateStatus()
+					m = m.refreshViewport()
+					break
+				}
+			}
+		}
+		return m, cmds
+	}
+
+	// /room <name>
+	if strings.HasPrefix(body, "/room ") {
+		name := strings.TrimSpace(strings.TrimPrefix(body, "/room "))
+		if name != "" {
+			cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{
+				Type:      proto.CmdCreateRoom,
+				NetworkID: m.activeNetworkID(),
+				Room:      name,
+			}))
+		}
+		return m, cmds
+	}
+
+	// /react [<n>] <emoji>
+	if strings.HasPrefix(body, "/react ") {
+		rest := strings.TrimSpace(strings.TrimPrefix(body, "/react "))
+		parts := strings.Fields(rest)
+		var targetIdx int = -1 // -1 = last message
+		var emoji string
+		switch len(parts) {
+		case 1:
+			emoji = parts[0]
+		case 2:
+			if n, err := strconv.Atoi(parts[0]); err == nil {
+				targetIdx = n - 1
+			} else {
+				emoji = parts[0] // fallback: treat first token as emoji
+			}
+			if emoji == "" {
+				emoji = parts[1]
+			}
+		}
+		if emoji == "" {
+			m.errMsg = "usage: /react <emoji>  or  /react <n> <emoji>   (e.g. /react 👍  or  /react 3 ❤️)"
+			return m, cmds
+		}
+		msgs := m.messages[m.msgKey()]
+		var targetMid string
+		if targetIdx == -1 && len(msgs) > 0 {
+			targetMid = msgs[len(msgs)-1].mid
+		} else if targetIdx >= 0 && targetIdx < len(msgs) {
+			targetMid = msgs[targetIdx].mid
+		}
+		if targetMid == "" {
+			m.errMsg = "usage: /react <emoji>  or  /react <n> <emoji>   (e.g. /react 👍  or  /react 3 ❤️)"
+			return m, cmds
+		}
+		cmds = append(cmds, sendIPC(m.enc, proto.IpcMessage{
+			Type:          proto.CmdSendReaction,
+			NetworkID:     m.activeNetworkID(),
+			ReactionMID:   targetMid,
+			ReactionEmoji: emoji,
+		}))
+		return m, cmds
+	}
+
+	// Regular message
+	n := m.activeNetData()
+	if n == nil {
+		return m, cmds
+	}
+	room := n.rooms[n.activeRoom]
+	ipcMsg := proto.IpcMessage{
+		Type:      proto.CmdSendMessage,
+		NetworkID: n.id,
+		Room:      room,
+		Body:      body,
+	}
 	if strings.HasPrefix(room, "dm:") {
 		recipID := proto.PeerID(strings.TrimPrefix(room, "dm:"))
 		ipcMsg.To = &recipID
@@ -343,9 +682,7 @@ func (m model) doSend(cmds []tea.Cmd) (model, []tea.Cmd) {
 
 // ── layout helpers ────────────────────────────────────────────────────────────
 
-// vpContentWidth returns the inner width of the centre pane (available to the viewport).
 func (m model) vpContentWidth() int {
-	// Two sidebar boxes (sideW total each) + centre box (borders 2 = -2 from inner).
 	w := m.width - sideW*2 - 2
 	if w < 10 {
 		w = 10
@@ -353,10 +690,7 @@ func (m model) vpContentWidth() int {
 	return w
 }
 
-// vpHeight returns the viewport height (lines of messages shown).
 func (m model) vpHeight() int {
-	// Full height minus: top border(1) + title(1) + divider(1) + bottom border(1) +
-	// input box (3 lines incl borders) + status bar(1) = 8 total overhead.
 	h := m.height - 8
 	if h < 1 {
 		h = 1
@@ -379,10 +713,10 @@ func (m model) refreshViewport() model {
 	if !m.vpReady {
 		return m
 	}
-	room := m.activeRoomName()
-	w := m.vpContentWidth()
+	key := m.msgKey()
 	var sb strings.Builder
-	for _, e := range m.messages[room] {
+	for i, e := range m.messages[key] {
+		lineNum := styleLineNum.Render(fmt.Sprintf("[%d]", i+1))
 		ts := styleMsgTime.Render(formatMsgTime(e.at))
 		var from string
 		if e.fromMe {
@@ -390,31 +724,28 @@ func (m model) refreshViewport() model {
 		} else {
 			from = styleMsgFrom.Render(e.from)
 		}
-		line := fmt.Sprintf("%s %s  %s", ts, from, e.body)
-		// Crude wrap: if line > w, just truncate (viewport handles horizontal scroll).
-		_ = w
-		sb.WriteString(line + "\n")
+		sb.WriteString(fmt.Sprintf("%s %s %s  %s\n", lineNum, ts, from, e.body))
+		if e.mid != "" {
+			if rxn := m.renderReactions(e.mid); rxn != "" {
+				sb.WriteString(rxn + "\n")
+			}
+		}
 	}
 	m.viewport.SetContent(sb.String())
 	m.viewport.GotoBottom()
 	return m
 }
 
-func (m model) activeRoomName() string {
-	if m.activeRoom < len(m.rooms) {
-		return m.rooms[m.activeRoom]
+func (m model) renderReactions(mid string) string {
+	byEmoji := m.reactions[mid]
+	if len(byEmoji) == 0 {
+		return ""
 	}
-	return ""
-}
-
-func (m model) addRoom(room string) model {
-	for _, r := range m.rooms {
-		if r == room {
-			return m
-		}
+	var parts []string
+	for emoji, froms := range byEmoji {
+		parts = append(parts, fmt.Sprintf("%s %d", emoji, len(froms)))
 	}
-	m.rooms = append(m.rooms, room)
-	return m
+	return styleReaction.Render("         " + strings.Join(parts, "  "))
 }
 
 // ── view ──────────────────────────────────────────────────────────────────────
@@ -424,41 +755,33 @@ func (m model) View() string {
 		return "loading…\n"
 	}
 
-	innerH := m.height - 3 - 1 // 3 = input box, 1 = status bar
+	innerH := m.height - 3 - 1
 	if innerH < 4 {
 		innerH = 4
 	}
 
-	// ── left: rooms ───────────────────────────────────────────────────────────
-	leftBox := m.renderRooms(innerH)
-
-	// ── right: peers ──────────────────────────────────────────────────────────
+	leftBox := m.renderLeft(innerH)
 	rightBox := m.renderPeers(innerH)
-
-	// ── centre: title + messages ──────────────────────────────────────────────
 	centreBox := m.renderCentre(innerH)
 
 	mainRow := lipgloss.JoinHorizontal(lipgloss.Top, leftBox, centreBox, rightBox)
 
-	// ── input ─────────────────────────────────────────────────────────────────
 	inputBox := lipgloss.NewStyle().
 		Width(m.width - 2).
 		Border(lipgloss.RoundedBorder()).
 		BorderForeground(styleBorder).
 		Render(m.input.View())
 
-	// ── status bar ────────────────────────────────────────────────────────────
 	var statusLine string
 	if m.errMsg != "" {
 		statusLine = styleErr.Render(" ✗ " + m.errMsg)
 	} else {
-		hint := "  tab: rooms · /room <name>: new room · ctrl+i: invite · ctrl+c: quit"
+		hint := "  tab: rooms · ctrl+n: nets · /join /net /room /react · ctrl+i: invite · ctrl+c: quit"
 		statusLine = styleStatus.Width(m.width).Render(" " + m.status + hint)
 	}
 
 	view := lipgloss.JoinVertical(lipgloss.Left, mainRow, inputBox, statusLine)
 
-	// ── invite popup (full-screen overlay) ───────────────────────────────────
 	if m.invitePopup != "" {
 		label := styleActive.Render("Invite — share this with anyone you want to add:")
 		code := lipgloss.NewStyle().
@@ -479,24 +802,51 @@ func (m model) View() string {
 	return view
 }
 
-func (m model) renderRooms(boxH int) string {
+func (m model) renderLeft(boxH int) string {
 	innerW := sideW - 2
-	contentH := boxH - 2 // subtract top+bottom border
+	contentH := boxH - 2
+	sep := lipgloss.NewStyle().Foreground(styleBorder).Render(strings.Repeat("─", innerW))
 	var lines []string
-	lines = append(lines, styleHeader.Width(innerW).Render("Rooms"))
-	lines = append(lines, lipgloss.NewStyle().Foreground(styleBorder).Render(strings.Repeat("─", innerW)))
-	for i, room := range m.rooms {
-		label := roomLabel(room, m.peers)
-		if i == m.activeRoom {
-			lines = append(lines, styleActive.Width(innerW).Render("▶ "+label))
+
+	// Networks section
+	lines = append(lines, styleHeader.Width(innerW).Render("Networks"))
+	lines = append(lines, sep)
+	if len(m.nets) == 0 {
+		lines = append(lines, styleRoom.Width(innerW).Render("  (none)"))
+	}
+	for i, n := range m.nets {
+		label := n.name
+		if i == m.activeNet {
+			lines = append(lines, styleNetActive.Width(innerW).Render("▶ "+label))
 		} else {
-			prefix := "  "
-			if m.unread[room] {
-				prefix = "* "
-			}
-			lines = append(lines, styleRoom.Width(innerW).Render(prefix+label))
+			lines = append(lines, styleNet.Width(innerW).Render(fmt.Sprintf("  [%d] %s", i+1, label)))
 		}
 	}
+
+	lines = append(lines, sep)
+
+	// Rooms section
+	lines = append(lines, styleHeader.Width(innerW).Render("Rooms"))
+	lines = append(lines, sep)
+	n := m.activeNetData()
+	if n == nil {
+		lines = append(lines, styleRoom.Width(innerW).Render("  (no network)"))
+	} else {
+		for i, room := range n.rooms {
+			label := roomLabel(room, n.peers)
+			key := n.id + ":" + room
+			if i == n.activeRoom {
+				lines = append(lines, styleActive.Width(innerW).Render("▶ "+label))
+			} else {
+				prefix := "  "
+				if m.unread[key] {
+					prefix = "* "
+				}
+				lines = append(lines, styleRoom.Width(innerW).Render(prefix+label))
+			}
+		}
+	}
+
 	for len(lines) < contentH {
 		lines = append(lines, strings.Repeat(" ", innerW))
 	}
@@ -513,16 +863,18 @@ func (m model) renderPeers(boxH int) string {
 	var lines []string
 	lines = append(lines, styleHeader.Width(innerW).Render("Peers"))
 	lines = append(lines, lipgloss.NewStyle().Foreground(styleBorder).Render(strings.Repeat("─", innerW)))
-	// Local peer first
-	if m.localAlias != "" {
-		lines = append(lines, styleSelf.Width(innerW).Render("◉ "+m.localAlias+" (me)"))
-	}
-	for _, pid := range m.peerOrder {
-		alias := m.peers[pid]
-		if alias == "" {
-			alias = shortID(pid)
+	n := m.activeNetData()
+	if n != nil {
+		if n.localAlias != "" {
+			lines = append(lines, styleSelf.Width(innerW).Render("◉ "+n.localAlias+" (me)"))
+		}
+		for _, pid := range n.peerOrder {
+			alias := n.peers[pid]
+			if alias == "" {
+				alias = shortID(pid)
+			}
+			lines = append(lines, stylePeer.Width(innerW).Render("● "+alias))
 		}
-		lines = append(lines, stylePeer.Width(innerW).Render("● "+alias))
 	}
 	for len(lines) < contentH {
 		lines = append(lines, strings.Repeat(" ", innerW))
@@ -536,8 +888,18 @@ func (m model) renderPeers(boxH int) string {
 
 func (m model) renderCentre(boxH int) string {
 	innerW := m.vpContentWidth()
-	room := m.activeRoomName()
-	title := styleTitle.Width(innerW).Render(" " + roomTitle(room, m.peers))
+	n := m.activeNetData()
+	var roomName string
+	if n != nil {
+		roomName = n.rooms[n.activeRoom]
+	} else {
+		roomName = "general"
+	}
+	var peerMap map[proto.PeerID]string
+	if n != nil {
+		peerMap = n.peers
+	}
+	title := styleTitle.Width(innerW).Render(" " + roomTitle(roomName, peerMap))
 	divider := lipgloss.NewStyle().Foreground(styleBorder).Render(strings.Repeat("─", innerW))
 
 	vpView := ""
@@ -546,7 +908,6 @@ func (m model) renderCentre(boxH int) string {
 	}
 
 	content := lipgloss.JoinVertical(lipgloss.Left, title, divider, vpView)
-
 	return lipgloss.NewStyle().
 		Width(innerW).Height(boxH - 2).
 		Border(lipgloss.RoundedBorder()).BorderForeground(styleBorder).
@@ -555,19 +916,6 @@ func (m model) renderCentre(boxH int) string {
 
 // ── helpers ───────────────────────────────────────────────────────────────────
 
-func (m model) aliasOf(id proto.PeerID) string {
-	if id == m.localID {
-		if m.localAlias != "" {
-			return m.localAlias
-		}
-		return "me"
-	}
-	if a, ok := m.peers[id]; ok && a != "" {
-		return a
-	}
-	return shortID(id)
-}
-
 func shortID(id proto.PeerID) string {
 	s := string(id)
 	if len(s) > 8 {
@@ -582,8 +930,10 @@ func roomLabel(room string, peers map[proto.PeerID]string) string {
 	}
 	if strings.HasPrefix(room, "dm:") {
 		pid := proto.PeerID(strings.TrimPrefix(room, "dm:"))
-		if a, ok := peers[pid]; ok && a != "" {
-			return "@ " + a
+		if peers != nil {
+			if a, ok := peers[pid]; ok && a != "" {
+				return "@ " + a
+			}
 		}
 		return "@ " + shortID(pid)
 	}
@@ -591,17 +941,7 @@ func roomLabel(room string, peers map[proto.PeerID]string) string {
 }
 
 func roomTitle(room string, peers map[proto.PeerID]string) string {
-	if room == "general" {
-		return "#general"
-	}
-	if strings.HasPrefix(room, "dm:") {
-		pid := proto.PeerID(strings.TrimPrefix(room, "dm:"))
-		if a, ok := peers[pid]; ok && a != "" {
-			return "@ " + a
-		}
-		return "@ " + shortID(pid)
-	}
-	return "#" + room
+	return roomLabel(room, peers)
 }
 
 func filterIDs(ids []proto.PeerID, remove proto.PeerID) []proto.PeerID {
@@ -619,9 +959,6 @@ func formatMsgTime(t time.Time) string {
 	if t.Year() == now.Year() && t.YearDay() == now.YearDay() {
 		return t.Format("15:04")
 	}
-	if t.Year() == now.Year() && t.YearDay() == now.YearDay()-1 {
-		return "Yesterday " + t.Format("15:04")
-	}
 	return t.Format("Jan 2 15:04")
 }
 
@@ -635,12 +972,11 @@ func min(a, b int) int {
 // ── main ──────────────────────────────────────────────────────────────────────
 
 func main() {
-	ipcPort     := flag.Int("ipc", 17337, "daemon IPC port")
-	network     := flag.String("network", "", "network name to join on startup")
-	joinInvite  := flag.String("join", "", "waste: invite string — auto-sets the network name")
+	ipcPort    := flag.Int("ipc", 17337, "daemon IPC port")
+	network    := flag.String("network", "", "network name to join on startup (optional)")
+	joinInvite := flag.String("join", "", "waste: invite string — auto-sets the network name")
 	flag.Parse()
 
-	// --join overrides --network.
 	if *joinInvite != "" {
 		inv, err := invite.Decode(*joinInvite)
 		if err != nil {
@@ -650,12 +986,6 @@ func main() {
 		*network = inv.Network
 	}
 
-	if *network == "" {
-		fmt.Fprintln(os.Stderr, "error: -network or -join is required")
-		flag.Usage()
-		os.Exit(1)
-	}
-
 	p := tea.NewProgram(
 		newModel(*ipcPort, *network),
 		tea.WithAltScreen(),

deploy-web.sh.example

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# deploy-web.sh — build and push the web UI to the VPS.
+# Assumes SSH agent forwarding is set up.
+#
+# SETUP: copy this file to deploy-web.sh (gitignored) and set HOST below.
+#
+# Usage:
+#   ./deploy-web.sh
+#
+# Optional env vars:
+#   HOST        SSH target (user@host)  (required — edit below)
+#   REMOTE_DIR  path on VPS            (default: ~/waste-www)
+
+set -euo pipefail
+
+HOST="${HOST:-user@YOUR_VPS_IP}"           # ← edit this
+REMOTE_DIR="${REMOTE_DIR:-~/waste-www}"
+
+if [[ "$HOST" == *YOUR_VPS_IP* ]]; then
+    echo "error: edit HOST in this script (or export HOST=user@your-vps before running)" >&2
+    exit 1
+fi
+
+echo "→ building web UI…"
+"$(dirname "$0")/build-web.sh"
+
+echo "→ syncing to $HOST:$REMOTE_DIR"
+rsync -azv --delete \
+    --exclude='config.js' \
+    web/dist/ "$HOST:$REMOTE_DIR/"
+
+echo "✓ done"

internal/ipc/ipc.go

@@ -244,6 +244,34 @@ func handleClient(conn net.Conn, mgr *netmgr.Manager) {
 				})
 			}
 
+		case proto.CmdSendReaction:
+			n := mgr.Resolve(cmd.NetworkID)
+			if n == nil {
+				send(errMsg("send_reaction: not joined to any network"))
+				continue
+			}
+			if cmd.ReactionMID == "" || cmd.ReactionEmoji == "" {
+				send(errMsg("send_reaction: reaction_mid and reaction_emoji are required"))
+				continue
+			}
+			wire, err := json.Marshal(proto.PeerMessage{
+				Type:          proto.MsgReaction,
+				ReactionMID:   cmd.ReactionMID,
+				ReactionEmoji: cmd.ReactionEmoji,
+			})
+			if err != nil {
+				continue
+			}
+			n.Mesh.Broadcast(wire)
+			n.Mesh.SaveReaction(cmd.ReactionMID, cmd.ReactionEmoji, string(n.Identity.PeerID()))
+			n.Mesh.Emit(proto.IpcMessage{
+				Type:          proto.EvtReaction,
+				NetworkID:     n.ID,
+				PeerID:        ptr(n.Identity.PeerID()),
+				ReactionMID:   cmd.ReactionMID,
+				ReactionEmoji: cmd.ReactionEmoji,
+			})
+
 		case proto.CmdCreateRoom:
 			n := mgr.Resolve(cmd.NetworkID)
 			if n == nil {
@@ -505,6 +533,25 @@ func sendStoredHistory(mgr *netmgr.Manager, send func(proto.IpcMessage)) {
 			Room:      room,
 			Messages:  msgs,
 		})
+		// Send stored reactions for this room's messages.
+		rxns, err := n.Store.ReactionsForRoom(room)
+		if err != nil {
+			continue
+		}
+		for mid, byEmoji := range rxns {
+			for emoji, fromPeers := range byEmoji {
+				for _, fromPeer := range fromPeers {
+					pid := proto.PeerID(fromPeer)
+					send(proto.IpcMessage{
+						Type:          proto.EvtReaction,
+						NetworkID:     n.ID,
+						PeerID:        &pid,
+						ReactionMID:   mid,
+						ReactionEmoji: emoji,
+					})
+				}
+			}
+		}
 	}
 }
 

internal/mesh/mesh.go

@@ -146,6 +146,17 @@ func (m *Mesh) AddPeer(conn *PeerConn) {
 	})
 }
 
+// SaveReaction persists a reaction if a store is configured.
+// Duplicate (mid, emoji, fromPeer) triples are silently dropped.
+func (m *Mesh) SaveReaction(mid, emoji, fromPeer string) {
+	if m.Store == nil {
+		return
+	}
+	if err := m.Store.SaveReaction(mid, emoji, fromPeer); err != nil {
+		log.Printf("mesh: store reaction %s/%s: %v", mid, emoji, err)
+	}
+}
+
 // SaveMessage persists a chat message if a store is configured.
 // Duplicate mids are silently dropped.
 func (m *Mesh) SaveMessage(msg *proto.ChatMessage) {

internal/mesh/peer.go

@@ -307,6 +307,18 @@ func dispatchPeerMessage(msg proto.PeerMessage, from proto.PeerID, m *Mesh) {
 	case proto.MsgHistoryChunk:
 		go m.HandleHistoryChunk(msg.Room, msg.History)
 
+	case proto.MsgReaction:
+		if msg.ReactionMID == "" || msg.ReactionEmoji == "" {
+			return
+		}
+		m.SaveReaction(msg.ReactionMID, msg.ReactionEmoji, string(from))
+		m.emit(proto.IpcMessage{
+			Type:          proto.EvtReaction,
+			PeerID:        peerIDPtr(from),
+			ReactionMID:   msg.ReactionMID,
+			ReactionEmoji: msg.ReactionEmoji,
+		})
+
 	case proto.MsgPing:
 		log.Printf("mesh: ping from %s", from.Short())
 	case proto.MsgPong:

internal/proto/proto.go

@@ -51,6 +51,7 @@ const (
 	MsgPong            MsgType = "pong"
 	MsgHistoryRequest  MsgType = "history_request"
 	MsgHistoryChunk    MsgType = "history_chunk"
+	MsgReaction        MsgType = "reaction"
 )
 
 // PmMessage is a private message sent directly over a single peer link (§8 "pm").
@@ -97,6 +98,10 @@ type PeerMessage struct {
 	// history_chunk fields
 	History     []HistoryEntry `json:"history,omitempty"`
 	HistoryDone bool           `json:"history_done,omitempty"`
+
+	// reaction fields
+	ReactionMID   string `json:"reaction_mid,omitempty"`
+	ReactionEmoji string `json:"reaction_emoji,omitempty"`
 }
 
 // ResumableFile describes a partially-downloaded file found on daemon startup.
@@ -280,6 +285,7 @@ const (
 	CmdListShares     IpcMsgType = "list_shares"       // returns shares_list event
 	CmdCreateRoom       IpcMsgType = "create_room"        // field: room (name)
 	CmdSetDownloadDir   IpcMsgType = "set_download_dir"   // set per-network download directory at runtime; fields: network_id, path
+	CmdSendReaction     IpcMsgType = "send_reaction"      // fields: network_id, reaction_mid, reaction_emoji
 
 	// Events (daemon → UI)
 	EvtMessageReceived  IpcMsgType = "message_received"
@@ -302,6 +308,7 @@ const (
 	EvtRoomCreated      IpcMsgType = "room_created"    // field: room (name)
 	EvtHistoryLoaded      IpcMsgType = "history_loaded"       // fields: room, messages
 	EvtResumableTransfers IpcMsgType = "resumable_transfers"  // field: resumable_files
+	EvtReaction           IpcMsgType = "reaction"             // fields: reaction_mid, reaction_emoji, peer_id
 )
 
 // NetworkInfo summarises one joined network for state_snapshot and network_joined events.
@@ -359,6 +366,8 @@ type IpcMessage struct {
 	Files          []FileEntry    `json:"files,omitempty"`
 	Messages        []ChatMessage   `json:"messages,omitempty"`          // history_loaded
 	ResumableFiles  []ResumableFile `json:"resumable_files,omitempty"`   // resumable_transfers
+	ReactionMID     string          `json:"reaction_mid,omitempty"`      // reaction
+	ReactionEmoji   string          `json:"reaction_emoji,omitempty"`    // reaction
 	Shares         []ShareEntry `json:"shares,omitempty"`
 	ShareNetworks  []string     `json:"network_ids,omitempty"` // for add_share command: scope to specific network IDs, or ["*"] for global
 	// export_identity / import_identity

internal/store/store.go

@@ -38,10 +38,19 @@ CREATE TABLE IF NOT EXISTS rooms (
 
 // migrations run after the base schema. ALTER TABLE ADD COLUMN fails with
 // "duplicate column name" on subsequent opens — we swallow that error.
+// CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS are idempotent.
 var migrations = []string{
 	// EXT-007: canonical message ID for history dedup (NULL for pre-feature messages).
 	`ALTER TABLE messages ADD COLUMN msg_id TEXT`,
 	`CREATE UNIQUE INDEX IF NOT EXISTS idx_messages_msg_id ON messages (msg_id) WHERE msg_id IS NOT NULL`,
+	// Reactions: (mid, emoji, from_peer) triple is the unique dedup key.
+	`CREATE TABLE IF NOT EXISTS reactions (
+		mid        TEXT NOT NULL,
+		emoji      TEXT NOT NULL,
+		from_peer  TEXT NOT NULL,
+		reacted_at DATETIME NOT NULL,
+		PRIMARY KEY (mid, emoji, from_peer)
+	)`,
 }
 
 // Store is a local SQLite-backed message and peer store.
@@ -208,6 +217,43 @@ func (s *Store) KnownPeers() (map[proto.PeerID]string, error) {
 	return out, rows.Err()
 }
 
+// SaveReaction persists a reaction. Duplicate (mid, emoji, from_peer) triples are silently ignored.
+func (s *Store) SaveReaction(mid, emoji, fromPeer string) error {
+	_, err := s.db.Exec(
+		`INSERT OR IGNORE INTO reactions (mid, emoji, from_peer, reacted_at) VALUES (?, ?, ?, ?)`,
+		mid, emoji, fromPeer, time.Now().UTC(),
+	)
+	return err
+}
+
+// ReactionsForRoom returns all reactions for messages in a given room.
+// Result: mid → emoji → []fromPeer (ordered by reaction time).
+func (s *Store) ReactionsForRoom(room string) (map[string]map[string][]string, error) {
+	rows, err := s.db.Query(`
+		SELECT r.mid, r.emoji, r.from_peer
+		FROM reactions r
+		JOIN messages m ON m.mid = r.mid
+		WHERE m.room = ?
+		ORDER BY r.reacted_at
+	`, room)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make(map[string]map[string][]string)
+	for rows.Next() {
+		var mid, emoji, from string
+		if err := rows.Scan(&mid, &emoji, &from); err != nil {
+			return nil, err
+		}
+		if out[mid] == nil {
+			out[mid] = make(map[string][]string)
+		}
+		out[mid][emoji] = append(out[mid][emoji], from)
+	}
+	return out, rows.Err()
+}
+
 func nullableString(s string) any {
 	if s == "" {
 		return nil

launch-tui.sh.example

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# launch-tui.sh — build and launch the TUI against a remote anchor.
+# Starts a local daemon then opens the Bubble Tea terminal UI.
+#
+# SETUP: copy this file to launch-tui.sh (gitignored) and set ANCHOR below.
+#
+# Usage:
+#   ./launch-tui.sh
+#   ALIAS=alice NETWORK=friends ./launch-tui.sh
+#
+# Optional env vars (all have defaults):
+#   ANCHOR      anchor WebSocket URL          (required — edit below)
+#   NETWORK     network name to join          (default: "friends")
+#   ALIAS       display name                  (default: $USER)
+#   DATA_DIR    identity + message store dir  (default: ~/.waste-$ALIAS)
+#   IPC_PORT    local daemon IPC port         (default: 17337)
+#   SHARE_DIR   directory to share with peers (optional)
+
+set -euo pipefail
+
+ANCHOR="${ANCHOR:-wss://YOUR_ANCHOR_DOMAIN/ws}"   # ← edit this
+
+NETWORK="${NETWORK:-friends}"
+ALIAS="${ALIAS:-${USER:-anon}}"
+DATA_DIR="${DATA_DIR:-${HOME}/.waste-${ALIAS}}"
+
+_DEFAULT_ALIAS="${USER:-anon}"
+if [ "${ALIAS}" = "${_DEFAULT_ALIAS}" ]; then
+    IPC_PORT="${IPC_PORT:-17337}"
+else
+    _HASH=$(printf '%d' "0x$(printf '%s' "$ALIAS" | md5sum | cut -c1-4)")
+    IPC_PORT="${IPC_PORT:-$(( 17400 + _HASH % 1000 ))}"
+fi
+
+SHARE_DIR="${SHARE_DIR:-}"
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; DIM='\033[2m'; BOLD='\033[1m'; RESET='\033[0m'
+
+if [[ "$ANCHOR" == *YOUR_ANCHOR_DOMAIN* ]]; then
+    echo -e "${RED}error: edit ANCHOR in this script (or export ANCHOR=wss://... before running)${RESET}" >&2
+    exit 1
+fi
+
+mkdir -p "$DATA_DIR"
+
+echo ""
+echo -e "${BOLD}waste TUI${RESET}"
+echo -e "${DIM}anchor  : ${BOLD}${ANCHOR}${RESET}"
+echo -e "${DIM}network : ${BOLD}${NETWORK}${RESET}"
+echo -e "${DIM}alias   : ${BOLD}${ALIAS}${RESET}"
+echo -e "${DIM}data    : ${DATA_DIR}${RESET}"
+[ -n "$SHARE_DIR" ] && echo -e "${DIM}share   : ${SHARE_DIR}${RESET}"
+echo ""
+
+echo -e "${DIM}building binaries…${RESET}"
+go build -o /tmp/waste-daemon-run ./cmd/daemon
+go build -o /tmp/waste-tui-run    ./cmd/tui
+echo -e "${GREEN}✓ built${RESET}"
+echo ""
+
+existing=$(lsof -ti tcp:"$IPC_PORT" 2>/dev/null || true)
+[ -n "$existing" ] && kill "$existing" 2>/dev/null && sleep 0.3 || true
+
+echo -e "${DIM}starting daemon on :${IPC_PORT}…${RESET}"
+WS_PORT=$(( IPC_PORT + 1 ))
+/tmp/waste-daemon-run \
+    -alias "$ALIAS" -data-dir "$DATA_DIR" \
+    -ipc-port "$IPC_PORT" -ws-port "$WS_PORT" \
+    -anchor "$ANCHOR" \
+    2>/tmp/waste-daemon.log &
+DAEMON_PID=$!
+
+n=0
+while ! nc -z 127.0.0.1 "$IPC_PORT" 2>/dev/null; do
+    sleep 0.1; n=$(( n + 1 ))
+    [ "$n" -gt 80 ] && echo -e "${RED}daemon failed — check /tmp/waste-daemon.log${RESET}" >&2 && exit 1
+done
+echo -e "${GREEN}✓ daemon started (pid ${DAEMON_PID})${RESET}"
+
+sleep 0.3
+if [ -n "$SHARE_DIR" ]; then
+    JOIN=$(jq -cn --arg net "$NETWORK" --arg dir "$SHARE_DIR" \
+        '{"type":"join_network","network_name":$net,"share_dir":$dir}')
+else
+    JOIN=$(jq -cn --arg net "$NETWORK" '{"type":"join_network","network_name":$net}')
+fi
+echo "$JOIN" | nc -q 0 127.0.0.1 "$IPC_PORT" >/dev/null 2>&1 || true
+echo -e "${DIM}joined network: ${BOLD}${NETWORK}${RESET}"
+
+cleanup() { kill "$DAEMON_PID" 2>/dev/null || true; }
+trap cleanup EXIT INT TERM
+
+echo ""
+echo -e "${BOLD}launching TUI${RESET} — ${DIM}ctrl+c to quit${RESET}"
+echo ""
+exec /tmp/waste-tui-run -ipc "$IPC_PORT" -network "$NETWORK"

launch-web.sh.example

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# launch-web.sh — start the daemon and open the web UI Vite dev server.
+# For local development / daemon-mode browsing.
+#
+# SETUP: copy this file to launch-web.sh (gitignored) and set ANCHOR below.
+#
+# Usage:
+#   ./launch-web.sh
+#   ALIAS=alice NETWORK=friends ./launch-web.sh
+
+set -euo pipefail
+
+ANCHOR="${ANCHOR:-wss://YOUR_ANCHOR_DOMAIN/ws}"   # ← edit this
+
+NETWORK="${NETWORK:-friends}"
+ALIAS="${ALIAS:-${USER:-anon}}"
+DATA_DIR="${DATA_DIR:-${HOME}/.waste-${ALIAS}}"
+IPC_PORT="${IPC_PORT:-17337}"
+WS_PORT=$(( IPC_PORT + 1 ))
+
+if [[ "$ANCHOR" == *YOUR_ANCHOR_DOMAIN* ]]; then
+    echo "error: edit ANCHOR in this script (or export ANCHOR=wss://... before running)" >&2
+    exit 1
+fi
+
+PIDS=()
+cleanup() {
+    for pid in "${PIDS[@]:-}"; do kill "$pid" 2>/dev/null || true; done
+    wait 2>/dev/null || true
+}
+trap cleanup EXIT INT TERM
+
+for port in "$IPC_PORT" "$WS_PORT"; do
+    existing=$(lsof -ti tcp:"$port" 2>/dev/null || true)
+    [ -n "$existing" ] && kill "$existing" 2>/dev/null || true
+done
+for port in "$IPC_PORT" "$WS_PORT"; do
+    n=0
+    while lsof -ti tcp:"$port" >/dev/null 2>&1; do
+        sleep 0.1; n=$(( n + 1 )); [ "$n" -gt 30 ] && break
+    done
+done
+
+mkdir -p "$DATA_DIR"
+
+echo "alias   : $ALIAS"
+echo "network : $NETWORK"
+echo "anchor  : $ANCHOR"
+echo "ws-port : $WS_PORT"
+echo ""
+
+echo "building daemon…"
+go build -o /tmp/waste-daemon-web ./cmd/daemon
+
+/tmp/waste-daemon-web \
+    -alias "$ALIAS" -data-dir "$DATA_DIR" \
+    -ipc-port "$IPC_PORT" -ws-port "$WS_PORT" \
+    -anchor "$ANCHOR" \
+    2>/tmp/waste-daemon-web.log &
+PIDS+=($!)
+
+n=0
+while ! nc -z 127.0.0.1 "$IPC_PORT" 2>/dev/null; do
+    sleep 0.1; n=$(( n + 1 ))
+    [ "$n" -gt 80 ] && echo "daemon failed to start — check /tmp/waste-daemon-web.log" >&2 && exit 1
+done
+
+sleep 0.2
+jq -cn --arg net "$NETWORK" '{"type":"join_network","network_name":$net}' \
+    | nc -q0 127.0.0.1 "$IPC_PORT" >/dev/null 2>&1 || true
+echo "daemon ready — joined $NETWORK"
+echo ""
+
+npm run dev --prefix "$(dirname "$0")/web"

serve-web.sh.example

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# serve-web.sh — start (or restart) the static file server on the VPS.
+# Runs `npx serve` in the background, logs to ~/waste-www.log.
+#
+# SETUP: copy this file to serve-web.sh (gitignored) and set HOST below.
+#
+# Usage:
+#   ./serve-web.sh
+#
+# Optional env vars:
+#   HOST        SSH target (user@host)  (required — edit below)
+#   REMOTE_DIR  path on VPS            (default: ~/waste-www)
+#   PORT        local port on VPS      (default: 1337)
+
+set -euo pipefail
+
+HOST="${HOST:-user@YOUR_VPS_IP}"           # ← edit this
+REMOTE_DIR="${REMOTE_DIR:-~/waste-www}"
+REMOTE_LOG="~/waste-www.log"
+REMOTE_PID="~/waste-www.pid"
+PORT="${PORT:-1337}"
+
+if [[ "$HOST" == *YOUR_VPS_IP* ]]; then
+    echo "error: edit HOST in this script (or export HOST=user@your-vps before running)" >&2
+    exit 1
+fi
+
+ssh "$HOST" bash <<EOF
+  if [ -f $REMOTE_PID ]; then
+    kill \$(cat $REMOTE_PID) 2>/dev/null || true
+    rm -f $REMOTE_PID
+  fi
+
+  echo "[\$(date)] starting npx serve on port $PORT" >> $REMOTE_LOG
+  nohup npx serve -s $REMOTE_DIR -l $PORT >> $REMOTE_LOG 2>&1 &
+  echo \$! > $REMOTE_PID
+  echo "→ started (pid \$(cat $REMOTE_PID)), logging to $REMOTE_LOG"
+EOF

web/src/App.css

@@ -164,3 +164,84 @@ details summary { color: var(--muted); font-size: 12px; cursor: pointer; }
 .file-entry-icon { font-size: 12px; flex-shrink: 0; }
 .history-divider { display: flex; align-items: center; gap: 8px; margin: 10px 0 6px; color: var(--muted); font-size: 11px; }
 .history-divider::before, .history-divider::after { content: ''; flex: 1; height: 1px; background: var(--border); }
+
+/* ── message links + image preview ── */
+.msg-link { color: var(--accent); text-decoration: underline; word-break: break-all; }
+.msg-link:hover { opacity: 0.8; }
+.message-text { display: flex; flex-direction: column; gap: 4px; }
+.msg-image-preview { max-width: 320px; max-height: 200px; border-radius: 6px; border: 1px solid var(--border); margin-top: 4px; object-fit: contain; display: block; }
+
+/* ── reactions ── */
+.message-wrapper { display: flex; flex-direction: column; padding: 0; }
+.message-wrapper .message { padding: 2px 16px; }
+.reaction-add { background: none; color: var(--muted); font-size: 13px; padding: 0 4px; line-height: 1; opacity: 0; transition: opacity 0.1s; margin-left: 4px; flex-shrink: 0; }
+.message-wrapper:hover .reaction-add { opacity: 1; }
+.reaction-add:hover { color: var(--accent); background: none; }
+.reaction-picker { display: flex; gap: 4px; padding: 4px 16px 2px; }
+.reaction-picker-btn { background: var(--surface); border: 1px solid var(--border); border-radius: 6px; font-size: 18px; padding: 2px 6px; line-height: 1.4; cursor: pointer; }
+.reaction-picker-btn:hover { border-color: var(--accent); background: rgba(124,106,247,0.12); }
+.reaction-bar { display: flex; flex-wrap: wrap; gap: 4px; padding: 2px 16px 4px; }
+.reaction-chip { background: var(--surface); border: 1px solid var(--border); border-radius: 12px; font-size: 13px; padding: 1px 8px; cursor: pointer; color: var(--text); }
+.reaction-chip:hover { border-color: var(--accent); background: rgba(124,106,247,0.1); }
+.reaction-chip.mine { border-color: var(--accent); background: rgba(124,106,247,0.18); }
+
+/* ── mobile hamburger / close buttons ── */
+.menu-btn-mobile { display: none; background: none; color: var(--muted); font-size: 18px; padding: 0 8px 0 0; line-height: 1; }
+.menu-btn-mobile:hover { color: var(--text); background: none; }
+.sidebar-close-mobile { display: none; background: none; color: var(--muted); font-size: 14px; padding: 2px 4px; }
+.sidebar-close-mobile:hover { color: var(--text); background: none; }
+
+/* ── responsive layout ── */
+@media (max-width: 600px) {
+  :root { --sidebar-w: 80vw; }
+
+  .chat-layout {
+    grid-template-columns: 1fr;
+    position: relative;
+  }
+
+  /* sidebar slides in over the top */
+  .sidebar {
+    position: fixed;
+    top: 0; left: 0;
+    width: var(--sidebar-w);
+    height: 100%;
+    z-index: 100;
+    transform: translateX(-100%);
+    transition: transform 0.22s ease;
+    box-shadow: 4px 0 24px rgba(0,0,0,0.5);
+  }
+  .chat-layout.sidebar-open .sidebar {
+    transform: translateX(0);
+  }
+
+  /* dim overlay behind open sidebar */
+  .chat-layout.sidebar-open::before {
+    content: '';
+    position: fixed;
+    inset: 0;
+    background: rgba(0,0,0,0.45);
+    z-index: 99;
+  }
+
+  .menu-btn-mobile { display: inline-block; }
+  .sidebar-close-mobile { display: inline-block; }
+
+  /* message pane fills full width */
+  .chat-layout > .message-pane { grid-column: 1; }
+
+  /* file browser stacks below on mobile */
+  .chat-layout.has-file-browser { grid-template-columns: 1fr; }
+  .chat-layout.has-file-browser > .file-browser { border-left: none; border-top: 1px solid var(--border); max-height: 40vh; overflow-y: auto; }
+
+  /* slightly larger tap targets */
+  .sidebar-item { padding: 8px 12px; font-size: 14px; }
+  .peer-row { padding: 6px 12px; }
+  .peer-row-actions { opacity: 1; }
+  .peer-action { font-size: 18px; padding: 2px 6px; }
+
+  /* message layout: stack alias above text on very narrow screens */
+  .message { flex-wrap: wrap; }
+  .message-ts { width: auto; min-width: 56px; }
+  .message-alias { width: auto; }
+}

web/src/adapter/browser.ts

@@ -16,23 +16,31 @@ const EKEY_PREFIX = 'yaw/2.1 ekey'
 const FS_TIMEOUT = 2000
 const STUN = 'stun:stun.l.google.com:19302'
 
-async function turnCredential(secret: string, username: string): Promise<string> {
-  const key = await crypto.subtle.importKey(
-    'raw', new TextEncoder().encode(secret),
-    { name: 'HMAC', hash: 'SHA-1' },
-    false, ['sign']
-  )
-  const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(username))
-  return btoa(String.fromCharCode(...new Uint8Array(sig)))
+// TURN credentials are short-lived and minted server-side by the anchor's
+// GET /turn-credentials endpoint (see cmd/anchor). The shared coturn secret
+// never reaches the browser — only a time-limited username/credential pair.
+async function fetchTurnCredentials(credentialsURL: string): Promise<{ username: string; credential: string } | null> {
+  try {
+    const res = await fetch(credentialsURL)
+    if (!res.ok) return null
+    const data = await res.json()
+    if (!data.username || !data.credential) return null
+    return { username: data.username, credential: data.credential }
+  } catch {
+    return null
+  }
 }
 
 async function iceServers(): Promise<RTCIceServer[]> {
-  const cfg = (window as unknown as { WASTE_CONFIG?: { turnURL?: string; turnSecret?: string } }).WASTE_CONFIG
+  const cfg = (window as unknown as { WASTE_CONFIG?: { turnURL?: string; turnCredentialsURL?: string; signalURL?: string } }).WASTE_CONFIG
   const servers: RTCIceServer[] = [{ urls: STUN }]
-  if (cfg?.turnURL && cfg?.turnSecret) {
-    const user = Math.floor(Date.now() / 1000) + 3600 + ':waste'
-    const credential = await turnCredential(cfg.turnSecret, user)
-    servers.push({ urls: cfg.turnURL, username: user, credential })
+  if (cfg?.turnURL) {
+    const credentialsURL = cfg.turnCredentialsURL
+      ?? cfg.signalURL?.replace(/^ws/, 'http').replace(/\/ws\/?$/, '/turn-credentials')
+    if (credentialsURL) {
+      const creds = await fetchTurnCredentials(credentialsURL)
+      if (creds) servers.push({ urls: cfg.turnURL, username: creds.username, credential: creds.credential })
+    }
   }
   return servers
 }
@@ -433,9 +441,17 @@ class PeerConn {
         nick: m['nick'] as string || '', caps: m['caps'] || []
       })
     } else if (m['type'] === 'chat') {
+      const ts = (m['ts'] as number) || Date.now()
       this.on('chat', {
         peer: this.peerId, room: m['room'] as string || 'general',
-        text: m['text'] as string, ts: m['ts'] as number || Date.now()
+        text: m['text'] as string, ts,
+        mid: (m['mid'] as string) || `${this.peerId}-${ts}`,
+      })
+    } else if (m['type'] === 'reaction') {
+      this.on('reaction', {
+        peer: this.peerId,
+        mid: m['reaction_mid'] as string,
+        emoji: m['reaction_emoji'] as string,
       })
     } else if (m['type'] === 'pm') {
       this.on('pm', { peer: this.peerId, text: m['text'] as string, ts: m['ts'] as number || Date.now() })
@@ -556,14 +572,18 @@ class PeerConn {
     } catch { /* ignore */ }
   }
 
-  sendChat(room: string, text: string) {
-    this._dc({ type: 'chat', room, text, ts: Date.now() })
+  sendChat(room: string, text: string, mid: string) {
+    this._dc({ type: 'chat', room, text, ts: Date.now(), mid })
   }
 
   sendPm(text: string) {
     this._dc({ type: 'pm', text, ts: Date.now() })
   }
 
+  sendReaction(mid: string, emoji: string) {
+    this._dc({ type: 'reaction', reaction_mid: mid, reaction_emoji: emoji })
+  }
+
   private _dc(obj: object) {
     if (this.dc?.readyState === 'open') this.dc.send(JSON.stringify(obj))
   }
@@ -755,9 +775,17 @@ export class BrowserAdapter {
           public_key: data['peer'] as string, created_at: new Date().toISOString()
         },
       })
+    } else if (event === 'reaction') {
+      this.emit({
+        type: 'reaction',
+        network_id: this.networkId,
+        peer_id: data['peer'] as unknown as import('../types').PeerID,
+        reaction_mid: data['mid'] as string,
+        reaction_emoji: data['emoji'] as string,
+      })
     } else if (event === 'chat') {
       const ts = (data['ts'] as number) || Date.now()
-      const mid = `${data['peer']}-${ts}`
+      const mid = (data['mid'] as string) || `${data['peer']}-${ts}`
       this.emit({
         type: 'message_received',
         network_id: this.networkId,
@@ -910,8 +938,8 @@ export class BrowserAdapter {
           },
         })
       } else {
-        // Broadcast
-        this.peers.forEach(p => p.sendChat(room, text))
+        // Broadcast — include mid on the wire so recipients can reference it in reactions
+        this.peers.forEach(p => p.sendChat(room, text, mid))
         this.emit({
           type: 'message_received',
           network_id: this.networkId,
@@ -924,6 +952,22 @@ export class BrowserAdapter {
       return
     }
 
+    if (msg.type === 'send_reaction') {
+      const mid = msg.reaction_mid
+      const emoji = msg.reaction_emoji
+      if (!mid || !emoji) return
+      this.peers.forEach(p => p.sendReaction(mid, emoji))
+      // Emit locally so the sender sees their own reaction immediately
+      this.emit({
+        type: 'reaction',
+        network_id: this.networkId,
+        peer_id: this.identity.id as unknown as import('../types').PeerID,
+        reaction_mid: mid,
+        reaction_emoji: emoji,
+      })
+      return
+    }
+
     if (msg.type === 'export_identity') {
       if (!msg.passphrase) return
       try {

web/src/components/MessagePane.tsx

@@ -12,20 +12,48 @@ function formatTs(ts: number): string {
   return d.toLocaleDateString([], { month: 'short', day: 'numeric' }) + ' ' + time
 }
 
-export function MessagePane() {
-  const { messages, historyCutoff, activeRoom, activeNetworkId, localPeer, connectedPeers, knownPeers, send } = useWaste()
+const URL_RE = /https?:\/\/[^\s<>"']+/g
+const IMAGE_EXT_RE = /\.(jpe?g|png|gif|webp|svg)(\?[^\s]*)?$/i
+
+function renderText(text: string): React.ReactNode {
+  const parts: React.ReactNode[] = []
+  let last = 0
+  let m: RegExpExecArray | null
+  URL_RE.lastIndex = 0
+  while ((m = URL_RE.exec(text)) !== null) {
+    if (m.index > last) parts.push(text.slice(last, m.index))
+    const url = m[0]
+    const isImage = IMAGE_EXT_RE.test(url) || url.startsWith('blob:') || url.startsWith('data:image')
+    parts.push(
+      <a key={m.index} href={url} target="_blank" rel="noopener noreferrer" className="msg-link">
+        {url}
+      </a>
+    )
+    if (isImage) {
+      parts.push(
+        <img key={`img-${m.index}`} src={url} alt="" className="msg-image-preview" loading="lazy" />
+      )
+    }
+    last = m.index + url.length
+  }
+  if (last < text.length) parts.push(text.slice(last))
+  return parts.length > 1 ? <>{parts}</> : text
+}
+
+const EMOJI_SET = ['👍', '❤️', '😂', '😮', '😢', '🙏']
+
+export function MessagePane({ onMenuClick }: { onMenuClick: () => void }) {
+  const { messages, historyCutoff, activeRoom, activeNetworkId, localPeer, connectedPeers, knownPeers, reactions, sendReaction, send } = useWaste()
   const [draft, setDraft] = useState('')
+  const [pickerMid, setPickerMid] = useState<string | null>(null)
   const bottomRef = useRef<HTMLDivElement>(null)
   const msgKey = activeNetworkId ? `${activeNetworkId}:${activeRoom}` : activeRoom
   const roomMessages = messages[msgKey] ?? []
   const cutoff = historyCutoff[msgKey] ?? 0
 
-  // Find the index of the first live message (ts > cutoff).
-  // The divider appears just before this index, or at the top if all are history.
   const firstLiveIdx = cutoff > 0
     ? roomMessages.findIndex(m => m.ts > cutoff)
     : -1
-  // If all messages are history (no live yet), put divider at the start.
   const dividerIdx = cutoff > 0
     ? (firstLiveIdx === -1 ? 0 : firstLiveIdx)
     : -1
@@ -34,6 +62,14 @@ export function MessagePane() {
     bottomRef.current?.scrollIntoView({ behavior: 'smooth' })
   }, [roomMessages.length])
 
+  // Close picker when clicking outside
+  useEffect(() => {
+    if (!pickerMid) return
+    const handler = () => setPickerMid(null)
+    document.addEventListener('click', handler)
+    return () => document.removeEventListener('click', handler)
+  }, [pickerMid])
+
   function submit(e: React.FormEvent) {
     e.preventDefault()
     const text = draft.trim()
@@ -58,13 +94,28 @@ export function MessagePane() {
       ?? fromId.slice(0, 8)
   }
 
+  function toggleReaction(mid: string, emoji: string, e: React.MouseEvent) {
+    e.stopPropagation()
+    if (!activeNetworkId || !mid) return
+    sendReaction(activeNetworkId, mid, emoji)
+    setPickerMid(null)
+  }
+
+  function openPicker(mid: string, e: React.MouseEvent) {
+    e.stopPropagation()
+    setPickerMid(prev => prev === mid ? null : mid)
+  }
+
   const roomLabel = activeRoom.startsWith('dm:')
     ? `@ ${activeRoom.slice(3, 11)}…`
     : `# ${activeRoom}`
 
   return (
     <main className="message-pane">
-      <div className="message-pane-header">{roomLabel}</div>
+      <div className="message-pane-header">
+        <button className="menu-btn-mobile" onClick={onMenuClick} aria-label="Menu">☰</button>
+        {roomLabel}
+      </div>
 
       <div className="messages">
         {dividerIdx === 0 && (
@@ -74,16 +125,54 @@ export function MessagePane() {
           const mine = msg.from === localPeer?.id
           const alias = aliasFor(String(msg.from))
           const ts = formatTs(msg.ts)
+          const mid = msg.mid ?? ''
+          const msgReactions = mid ? reactions[mid] : undefined
+          const hasReactions = msgReactions && Object.keys(msgReactions).length > 0
           return (
-            <div key={msg.mid ?? i}>
+            <div key={mid || i} className="message-wrapper">
               {i === dividerIdx && dividerIdx > 0 && (
                 <div className="history-divider"><span>earlier messages</span></div>
               )}
               <div className={`message ${mine ? 'mine' : ''}`}>
                 <span className="message-ts">{ts}</span>
                 <span className="message-alias">{alias}</span>
-                <span className="message-text">{msg.text}</span>
+                <span className="message-text">
+                  {renderText(msg.text)}
+                </span>
+                {mid && (
+                  <button
+                    className="reaction-add"
+                    onClick={e => openPicker(mid, e)}
+                    title="React"
+                  >+</button>
+                )}
               </div>
+              {pickerMid === mid && (
+                <div className="reaction-picker" onClick={e => e.stopPropagation()}>
+                  {EMOJI_SET.map(emoji => (
+                    <button key={emoji} className="reaction-picker-btn" onClick={e => toggleReaction(mid, emoji, e)}>
+                      {emoji}
+                    </button>
+                  ))}
+                </div>
+              )}
+              {hasReactions && (
+                <div className="reaction-bar">
+                  {Object.entries(msgReactions!).map(([emoji, fromIds]) => {
+                    const iMine = fromIds.includes(localPeer?.id ?? '')
+                    return (
+                      <button
+                        key={emoji}
+                        className={`reaction-chip ${iMine ? 'mine' : ''}`}
+                        onClick={e => toggleReaction(mid, emoji, e)}
+                        title={fromIds.map(aliasFor).join(', ')}
+                      >
+                        {emoji} {fromIds.length}
+                      </button>
+                    )
+                  })}
+                </div>
+              )}
             </div>
           )
         })}

web/src/components/Sidebar.tsx

@@ -26,7 +26,7 @@ function formatTs(ts: number | undefined): string {
   return new Date(ts).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', second: '2-digit' })
 }
 
-export function Sidebar() {
+export function Sidebar({ onClose }: { onClose: () => void }) {
   const {
     localPeer, masterId, masterAlias,
     networks, activeNetworkId, activeRoom,
@@ -118,6 +118,7 @@ export function Sidebar() {
           <span className="peer-id">{displayId.slice(0, 16).replace(/(.{4})/g, '$1 ').trim()}</span>
         </div>
         <button className="sidebar-logout" onClick={handleLogout} title="Leave network">⏻</button>
+        <button className="sidebar-close-mobile" onClick={onClose} title="Close">✕</button>
       </div>
 
       <div className="sidebar-section">
@@ -134,7 +135,7 @@ export function Sidebar() {
           <button
             key={n.network_id}
             className={`sidebar-item ${n.network_id === activeNetworkId ? 'active' : ''}`}
-            onClick={() => setActiveNetwork(n.network_id)}
+            onClick={() => { setActiveNetwork(n.network_id); onClose() }}
           >
             {n.network_name}
           </button>
@@ -173,7 +174,7 @@ export function Sidebar() {
           <button
             key={r}
             className={`sidebar-item ${r === activeRoom ? 'active' : ''}`}
-            onClick={() => setActiveRoom(r)}
+            onClick={() => { setActiveRoom(r); onClose() }}
           >
             {r.startsWith('dm:') ? `@ ${r.slice(3, 11)}…` : `# ${r}`}
           </button>

web/src/pages/Chat.tsx

@@ -1,3 +1,4 @@
+import { useState } from 'react'
 import { Sidebar } from '../components/Sidebar'
 import { MessagePane } from '../components/MessagePane'
 import { FileBrowser } from '../components/FileBrowser'
@@ -5,10 +6,11 @@ import { useWaste } from '../store'
 
 export function Chat() {
   const { activeFilePeer } = useWaste()
+  const [sidebarOpen, setSidebarOpen] = useState(false)
   return (
-    <div className={`chat-layout${activeFilePeer ? ' has-file-browser' : ''}`}>
-      <Sidebar />
-      <MessagePane />
+    <div className={`chat-layout${activeFilePeer ? ' has-file-browser' : ''}${sidebarOpen ? ' sidebar-open' : ''}`}>
+      <Sidebar onClose={() => setSidebarOpen(false)} />
+      <MessagePane onMenuClick={() => setSidebarOpen(v => !v)} />
       {activeFilePeer && <FileBrowser />}
     </div>
   )

web/src/store/index.ts

@@ -58,6 +58,8 @@ interface WasteState {
   fileProgress: Record<string, { peerId: string; name: string; received: number; total: number }>
   // partial downloads found on daemon startup: sha256 → info
   resumableFiles: Record<string, { name: string; from: string; size: number; offset: number }>
+  // reactions: mid → emoji → [fromId, ...]
+  reactions: Record<string, Record<string, string[]>>
 
   // actions
   connect: (url: string) => void
@@ -74,6 +76,7 @@ interface WasteState {
   rejectOffer: (peerId: string, xid: string) => void
   cancelTransfer: (peerId: string, xid: string, direction: 'recv' | 'send') => void
   createRoom: (name: string) => void
+  sendReaction: (networkId: string, mid: string, emoji: string) => void
   logout: (clearIdentity: boolean) => void
   handleEvent: (msg: IpcMessage) => void
 }
@@ -101,6 +104,7 @@ export const useWaste = create<WasteState>((set, get) => ({
   pendingOffers: {},
   fileProgress: {},
   resumableFiles: {},
+  reactions: {},
 
   connect(url: string) {
     const adapter = new DaemonAdapter(url)
@@ -189,6 +193,10 @@ export const useWaste = create<WasteState>((set, get) => ({
     window.location.reload()
   },
 
+  sendReaction(networkId, mid, emoji) {
+    get().send({ type: 'send_reaction', network_id: networkId, reaction_mid: mid, reaction_emoji: emoji })
+  },
+
   createRoom(name) {
     const netId = get().activeNetworkId
     if (!netId || !name.trim()) return
@@ -374,6 +382,19 @@ export const useWaste = create<WasteState>((set, get) => ({
         set(s => ({ resumableFiles: { ...s.resumableFiles, ...byHash } }))
         break
       }
+      case 'reaction': {
+        const mid = msg.reaction_mid
+        const emoji = msg.reaction_emoji
+        const from = msg.peer_id
+        if (!mid || !emoji || !from) break
+        set(s => {
+          const byEmoji = { ...(s.reactions[mid] ?? {}) }
+          const existing = byEmoji[emoji] ?? []
+          if (existing.includes(from)) return s
+          return { reactions: { ...s.reactions, [mid]: { ...byEmoji, [emoji]: [...existing, from] } } }
+        })
+        break
+      }
       case 'history_loaded': {
         const room = msg.room
         const incoming = (msg.messages ?? []) as ChatMessage[]

web/src/types.ts

@@ -86,6 +86,8 @@ export type IpcMsgType =
   | 'room_created'
   | 'create_room'
   | 'resumable_transfers'
+  | 'send_reaction'
+  | 'reaction'
 
 export interface IpcMessage {
   type: IpcMsgType
@@ -133,4 +135,7 @@ export interface IpcMessage {
   messages?: ChatMessage[]
   // resumable_transfers
   resumable_files?: Array<{ name: string; sha256: string; from: string; size: number; offset: number }>
+  // reaction
+  reaction_mid?: string
+  reaction_emoji?: string
 }