KOKOTO WebChat

5.2.0

5.2.0 adds message reactions, personal conversation archives/PDF export, public/DM/group typing indicators, custom-emoji picker enhancements, and Relay Protocol 2.1 capability negotiation. It also includes security and account-linking corrections carried forward from the 5.1.0 release baseline.

Added

Public, DM, and group message reactions

• Added persistent reactions for logged-in users on public-chat, DM, and normal group-chat messages using Unicode emoji and KWC custom emoji (:pack/name:). Group membership join/leave events are excluded.
• Added multi-server reaction support. Public reactions use the message origin server as the authority, cross-server DM reactions are exchanged only between the two participant servers, and group-room reactions remain local to that server.
• Added Admin > Emojis > Reaction icons management with a master reaction switch, a separate KWC custom-emoji allowance, Unicode reaction ordering/catalog control, and administrator-managed search aliases.
• Added a per-account Reactions notification preference shared by live browser notifications and background/mobile Web Push. Each browser/device uses only the delivery path it supports. The server-side allow/default key is notifications.notify-reactions.
• Suppress duplicate DM/group attention account-wide when that exact conversation is actively being viewed in any signed-in KWC browser for the account: the page must be visible and focused, the chat window must not be minimized, the DM/group modal must be open, and the current thread/room ID must match. This short-lived view heartbeat is independent of whether the viewing browser itself subscribes to Web Push. While one active client is reading the exact private conversation, all browser notification/in-chat notification-inbox paths and all Web Push subscriptions for that account are suppressed for that conversation; when no active client is viewing it, normal notification delivery resumes.

Custom-emoji picker

• Added a browser-local Recent pseudo-folder for recently inserted custom emoji.
• Added an optional Favorites pseudo-folder with hover ☆/★ controls. Administrators can disable Favorites, store favorite IDs with the signed-in KWC account by default, or select browser storage; emoji.favorites.max-per-account uses 0 for unlimited or a positive retained-item limit. Account storage uses KWC user-preferences and is independent of public/DM history storage backends. Favorites keep the original catalog IDs and message insertion continues to use the original :pack/name: token.
• Added floating custom-emoji search across ID, name, display label, pack name, and every public alias with NFKC/case normalization. Recent and Favorites are shared by public chat, DM, and group-chat pickers.

Relay Protocol 2.1

• Added independent relay protocol revision/capability negotiation instead of using the KWC product version as the compatibility key.
• Relay Protocol 2.1 advertises public, dm, read, reaction, reaction-authority, and typing capabilities. KWC 5.1.0 peers remain compatible with 5.2.0 for the common Relay v2 public-chat/DM/read feature set; reactions and typing require participating 5.2.0 / Relay 2.1 peers.
• Retained verification compatibility with the legacy Relay 2.0 handshake canonical used before revision negotiation.

Saved conversations and PDF export

• Added per-account Saved conversations for public chat, DMs, and group rooms. Users select a message range, and the server re-reads and validates that range before creating the private snapshot.
• Added static archive/PDF views that preserve KWC chat presentation, reply/reaction/server context, display name and real account name. Attachments remain references to their original KWC sources rather than being duplicated into the archive.
• Added PDF export using the user's currently applied KWC appearance.
• Added chat.conversation-archive.enabled (default true). When disabled, archive API routes are not registered, conversation-archives.db is not opened/created, and saved-conversation controls are not created in the web DOM. Existing archive data is preserved for later re-enable.
• Added configurable archive quotas: max-archives-per-user (default 100), max-messages-per-archive (default 1000), and max-messages-per-user (default 10000). Lowering a quota does not delete existing snapshots; it blocks new saves that would exceed the active limit.

Public/DM/group typing and private-chat controls

• Added event-driven public/DM/group typing indicators without polling or persistent typing state. Server administrators control Open chat, DM, and Group chat independently in Web Admin Settings or chat.typing-indicator.* in config.yml; defaults are Open chat OFF, DM ON, and Group chat ON. chat.typing-indicator.user-display-control defaults OFF; when an administrator enables it, signed-in users can use one account-stored Typing indicators preference that hides incoming hints on their own screen without suppressing their outgoing typing activity. The rounded high-opacity indicator floats above the active composer, follows each viewer's existing display-name/original-name toggle, strips formatting tags from shown names, and scales to about 80% of the user chat font without dropping below the configured base UI font. Public and remote-DM typing can use Relay 2.1; group typing remains scoped to room participants.
• Consolidated private-room invite, saved-conversation, hide, and room-management actions under the room Settings menu according to the existing permissions.

Fixed from 5.1.0

• Corrected mention notification matching inherited from 5.1.0. Ordinary occurrences of a user's name no longer count as mentions: a mention must start with @, matches registered real/display names using the longest name at each @, and notifies all accounts that share the same exact display name.
• Corrected existing bundled/account-linking language values that still showed the obsolete /kwc auth command. KWC now migrates those built-in login hint/waiting texts to the supported /kchat auth <code> command without overwriting unrelated customized translations.
• Enforced the guest-disabled public-chat visibility policy on server-side history, search, around-history, and SSE endpoints instead of relying on frontend hiding alone.
• Hardened trusted-proxy / X-Forwarded-For client-IP resolution against leftmost-header spoofing.
• Enforced exact paths for leaf HTTP API contexts while retaining prefix routing only for intentional file/subtree endpoints.
• Reduced the unauthenticated client-config response to fields actually consumed by the frontend.