security: protect local data at rest (issue #146)

T03 — keep secrets out of profanity.log:
- new redact_secrets() helper (common.c) masks the content of SASL
  auth/response/challenge/success and <password> elements; applied in
  the libstrophe logger (_xmpp_file_logger) and the stderr-to-log
  bridge (REQ-DAR-03, REQ-LOG-06)
- _add_to_db() no longer logs decrypted message bodies or the full
  INSERT statement (REQ-DAR-03)

T07 — owner-only permissions on key material and history (REQ-AUTH-01):
- chmod 0600 on chatlog.db after open (journal/WAL files inherit)
- chmod 0600 on OTR keys.txt and fingerprints.txt after every write
- parent dirs are already 0700 (create_dir); this is defense in depth

T08 — integrity before trust:
- PRAGMA quick_check(1) gates every chatlog.db open; on failure the
  DB stays closed, the user is warned once in the console and the
  session continues without history (REQ-RES-02)
- OMEMO aesgcm downloads decrypt into a 0600 tempfile next to the
  target and rename it into place only after the GCM tag verifies;
  the open-command hook no longer runs on failed decryption
  (REQ-CRY-06)

Tests: redact_secrets unit tests; AES-256-GCM roundtrip and
tampered-tag/ciphertext unit tests (crypto.c now linked into
unittests under BUILD_OMEMO); functional test planting a corrupt
chatlog.db and asserting graceful degradation.

Closes #146

.github/workflows/docker-publish.yml

@@ -0,0 +1,44 @@
+name: Publish Docker image
+
+on:
+  push:
+    branches: [master]
+  release:
+    types: [published]
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v7
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
+        with:
+          images: cproofdev/cproof
+          tags: |
+            type=raw,value=dev,enable={{is_default_branch}}
+            type=sha,prefix=nightly-,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@2bd26e71295ee32cbf6a73510d165bf7232460f3
+        with:
+          context: .
+          file: ./ci/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

Makefile.am

@@ -236,7 +236,10 @@ omemo_sources = \
 	src/tools/aesgcm_download.h src/tools/aesgcm_download.c
 
 omemo_unittest_sources = \
-	tests/unittests/omemo/stub_omemo.c
+	tests/unittests/omemo/stub_omemo.c \
+	tests/unittests/omemo/test_omemo_crypto.c \
+	tests/unittests/omemo/test_omemo_crypto.h \
+	src/omemo/crypto.c
 
 if BUILD_PYTHON_API
 core_sources += $(python_sources)
@@ -335,7 +338,7 @@ tests_functionaltests_functionaltests_LDADD = -lcmocka -lstabber @FORKPTY_LIB@
 # Parallel functional tests target (~3x faster than sequential)
 # Usage: make check-functional-parallel
 # To add more groups: increase FUNC_TEST_GROUPS and add group in functionaltests.c
-FUNC_TEST_GROUPS = 1 2 3 4 5
+FUNC_TEST_GROUPS = 1 2 3 4
 
 check-functional-parallel: tests/functionaltests/functionaltests
 	@echo "Running functional tests in parallel ($(words $(FUNC_TEST_GROUPS)) groups)..."

ci/Dockerfile

@@ -0,0 +1,106 @@
+# =============================================================================
+# Stage 1: Build
+# =============================================================================
+FROM ubuntu:26.04 AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    autoconf \
+    automake \
+    autoconf-archive \
+    ca-certificates \
+    libtool \
+    pkg-config \
+    git \
+    wget \
+    libglib2.0-dev \
+    libcurl4-openssl-dev \
+    libsqlite3-dev \
+    libncurses-dev \
+    libreadline-dev \
+    libnotify-dev \
+    python3-dev \
+    python3 \
+    libgpgme-dev \
+    libotr5-dev \
+    libgtk-3-dev \
+    libgdk-pixbuf-2.0-dev \
+    libsignal-protocol-c-dev \
+    libgcrypt20-dev \
+    libqrencode-dev \
+    libxss-dev \
+    libcmocka-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Build libstrophe from source (not available as Ubuntu package)
+RUN git clone --depth 1 https://git.jabber.space/devs/libstrophe-gh-mirror.git /tmp/libstrophe \
+    && cd /tmp/libstrophe \
+    && autoreconf -i \
+    && ./configure --prefix=/usr \
+    && make -j$(nproc) \
+    && make install \
+    && rm -rf /tmp/libstrophe
+
+WORKDIR /src
+
+COPY . .
+
+RUN ./bootstrap.sh \
+    && ./configure \
+        --enable-notifications \
+        --enable-icons-and-clipboard \
+        --enable-otr \
+        --enable-pgp \
+        --enable-omemo \
+        --enable-plugins \
+        --enable-c-plugins \
+        --enable-python-plugins \
+        --with-xscreensaver \
+        --enable-omemo-qrcode \
+        --enable-gdk-pixbuf \
+    && make -j$(nproc) \
+    && make install
+
+# =============================================================================
+# Stage 2: Runtime (minimal)
+# =============================================================================
+FROM ubuntu:26.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    libglib2.0-0t64 \
+    libcurl4t64 \
+    libsqlite3-0 \
+    libncursesw6 \
+    libreadline8t64 \
+    libnotify4 \
+    python3 \
+    libpython3.14 \
+    libgpgme45 \
+    libotr5t64 \
+    libgtk-3-0t64 \
+    libgdk-pixbuf-2.0-0 \
+    libsignal-protocol-c2.3.2 \
+    libgcrypt20 \
+    libqrencode4 \
+    libxss1 \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+COPY --from=builder /usr/local/bin/profanity /usr/local/bin/profanity
+COPY --from=builder /usr/local/lib/libprofanity* /usr/local/lib/
+COPY --from=builder /usr/local/include/profapi.h /usr/local/include/
+COPY --from=builder /usr/local/share/profanity /usr/local/share/profanity
+COPY --from=builder /usr/lib/libstrophe.so* /usr/lib/
+
+RUN ldconfig
+
+RUN ldd /usr/local/bin/profanity | grep 'not found' && exit 1 || true
+
+RUN mkdir -p /root/.config/profanity
+
+ENTRYPOINT ["profanity"]

src/ai/ai_client.h

@@ -12,21 +12,6 @@ typedef struct ai_message_t
     gchar* content; /* Message content */
 } AIMessage;
 
-/**
- * @brief API flavour used to talk to a provider.
- *
- * AUTO tries /v1/responses first and falls back to /v1/chat/completions when
- * the endpoint is missing (404/405/501) or rejects the payload shape
- * (400/422). The working flavour is cached for the rest of the run as a
- * first-attempt hint (the other flavour stays available as a fallback). The
- * other two values pin the flavour explicitly.
- */
-typedef enum {
-    AI_API_TYPE_AUTO = 0,
-    AI_API_TYPE_RESPONSES,
-    AI_API_TYPE_CHAT_COMPLETIONS,
-} AIApiType;
-
 /**
  * @brief AI provider configuration.
  */
@@ -36,10 +21,7 @@ typedef struct ai_provider_t
     gchar* api_url;                /* API endpoint URL */
     gchar* project_id;             /* Optional project ID (for some providers) */
     gchar* default_model;          /* Default model for this provider */
-    gint api_type;                 /* Configured AIApiType (atomic access; persisted) */
-    gint resolved_api_type;        /* AIApiType detected via 404 fallback (atomic access; runtime cache) */
-    gint api_epoch;                /* Bumped on URL change (atomic); a stale epoch discards resolved_api_type stamps */
-    pthread_mutex_t settings_lock; /* Protects settings and api_url (read by request threads) */
+    pthread_mutex_t settings_lock; /* Protects settings (iterated by the request thread) */
     GHashTable* settings;          /* Extensible per-provider settings (e.g., temperature=0.7) */
     GList* models;                 /* Cached models (gchar*) */
     gboolean models_fresh;         /* Whether models cache is current */
@@ -85,7 +67,7 @@ AIProvider* ai_get_provider(const gchar* name);
  * Add or update a provider configuration.
  * @param name The provider name
  * @param api_url The API endpoint URL
- * @return Borrowed AIProvider* owned by the provider table (do not unref)
+ * @return New AIProvider* (caller must unref when done)
  */
 AIProvider* ai_add_provider(const gchar* name, const gchar* api_url);
 
@@ -159,39 +141,9 @@ void ai_set_provider_default_model(const gchar* provider_name, const gchar* mode
  */
 const gchar* ai_get_provider_default_model(const gchar* provider_name);
 
-/**
- * Set the API type for a provider.
- * @param provider_name The provider name
- * @param api_type "responses", "chat-completions", or "auto" (detect by probing)
- * @return TRUE on success, FALSE on unknown provider or invalid type string
- */
-gboolean ai_set_provider_api_type(const gchar* provider_name, const gchar* api_type);
-
-/**
- * Get the configured API type for a provider.
- * @param provider_name The provider name
- * @return The configured AIApiType (AI_API_TYPE_AUTO for unknown providers)
- */
-AIApiType ai_get_provider_api_type(const gchar* provider_name);
-
-/**
- * Parse an API type string ("auto", "responses", "chat-completions").
- * @param str The string to parse
- * @param type Output for the parsed value (untouched on failure)
- * @return TRUE if str is a valid API type
- */
-gboolean ai_api_type_from_string(const gchar* str, AIApiType* type);
-
-/**
- * String form of an AIApiType, e.g. for display.
- * @param type The API type
- * @return Static string, never NULL
- */
-const gchar* ai_api_type_to_string(AIApiType type);
-
 /**
  * Set a custom setting for a provider.
- * Reserved payload keys (model, messages, input, stream) are rejected.
+ * Reserved payload keys (model, messages, stream) are rejected.
  * @param provider_name The provider name
  * @param setting The setting key (e.g., "temperature")
  * @param value The setting value, or NULL to remove
@@ -207,14 +159,6 @@ gboolean ai_set_provider_setting(const gchar* provider_name, const gchar* settin
  */
 gchar* ai_get_provider_setting(const gchar* provider_name, const gchar* setting);
 
-/**
- * List the custom setting keys currently set on a provider.
- * @param provider_name The provider name
- * @return GList of gchar* (free with g_list_free_full(keys, g_free)),
- *         or NULL if the provider is unknown or has no settings
- */
-GList* ai_get_provider_setting_keys(const gchar* provider_name);
-
 /**
  * Fetch available models from a provider's API.
  * @param provider_name The provider name
@@ -243,25 +187,14 @@ gboolean ai_models_are_fresh(const gchar* provider_name);
 void ai_parse_models_from_json(AIProvider* provider, const gchar* json);
 
 /**
- * Extract assistant content from a provider response body. Detects the
- * flavour from the envelope: chat completions
- * ({"choices":[{"message":{"content":"..."}}]}) or responses
- * ({"output":[{"content":[{"type":"output_text","text":"..."}]}]}).
+ * Extract assistant content from an OpenAI chat-completions response body
+ * ({"choices":[{"message":{"content":"..."}}]}). Decodes the \" and \n
+ * escape sequences only.
  * @param response_json The JSON body from the provider
  * @return Newly allocated content string, or NULL if not found (caller frees)
  */
 gchar* ai_parse_response(const gchar* response_json);
 
-/**
- * Extract assistant content trying the known request flavour's extractor
- * first, then the other flavour, then a bare top-level "content" string.
- * ai_parse_response is equivalent to passing AI_API_TYPE_AUTO.
- * @param api_type The API flavour the response was requested with
- * @param response_json The JSON body from the provider
- * @return Newly allocated content string, or NULL if not found (caller frees)
- */
-gchar* ai_parse_response_typed(AIApiType api_type, const gchar* response_json);
-
 /**
  * Extract human-readable error message from an API error envelope.
  * Expected format: {"error":{"message":"...","type":"...","code":...}}

src/command/cmd_ac.c

@@ -42,6 +42,7 @@
 
 #include "ai/ai_client.h"
 
+static char* _caps_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _sub_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _notify_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _theme_autocomplete(ProfWin* window, const char* const input, gboolean previous);
@@ -151,6 +152,7 @@ static Autocomplete account_clear_ac;
 static Autocomplete account_default_ac;
 static Autocomplete account_status_ac;
 static Autocomplete disco_ac;
+static Autocomplete caps_subcommands_ac;
 static Autocomplete wins_ac;
 static Autocomplete roster_ac;
 static Autocomplete roster_show_ac;
@@ -264,7 +266,6 @@ static Autocomplete avatar_ac;
 static Autocomplete ai_subcommands_ac;
 static Autocomplete ai_set_subcommands_ac;
 static Autocomplete ai_set_custom_subcommands_ac;
-static Autocomplete ai_api_types_ac;
 static Autocomplete ai_remove_subcommands_ac;
 static Autocomplete url_ac;
 static Autocomplete executable_ac;
@@ -322,6 +323,7 @@ static Autocomplete* all_acs[] = {
     &account_default_ac,
     &account_status_ac,
     &disco_ac,
+    &caps_subcommands_ac,
     &wins_ac,
     &roster_ac,
     &roster_show_ac,
@@ -454,7 +456,6 @@ static Autocomplete* all_acs[] = {
     &ai_subcommands_ac,
     &ai_set_subcommands_ac,
     &ai_set_custom_subcommands_ac,
-    &ai_api_types_ac,
     &ai_remove_subcommands_ac,
     &ai_models_ac
 };
@@ -599,6 +600,8 @@ cmd_ac_init(void)
     autocomplete_add(disco_ac, "info");
     autocomplete_add(disco_ac, "items");
 
+    autocomplete_add(caps_subcommands_ac, "clear");
+
     autocomplete_add(account_ac, "list");
     autocomplete_add(account_ac, "show");
     autocomplete_add(account_ac, "add");
@@ -1185,12 +1188,12 @@ cmd_ac_init(void)
     autocomplete_add_unsorted(ai_set_subcommands_ac, "provider", FALSE);
     autocomplete_add_unsorted(ai_set_subcommands_ac, "token", FALSE);
     autocomplete_add_unsorted(ai_set_subcommands_ac, "default-model", FALSE);
-    autocomplete_add_unsorted(ai_set_subcommands_ac, "api-type", FALSE);
     autocomplete_add_unsorted(ai_set_subcommands_ac, "custom", FALSE);
 
-    autocomplete_add_unsorted(ai_api_types_ac, "chat-completions", FALSE);
-    autocomplete_add_unsorted(ai_api_types_ac, "responses", FALSE);
-    autocomplete_add_unsorted(ai_api_types_ac, "auto", FALSE);
+    autocomplete_add_unsorted(ai_set_custom_subcommands_ac, "tools", FALSE);
+    autocomplete_add_unsorted(ai_set_custom_subcommands_ac, "search", FALSE);
+    autocomplete_add_unsorted(ai_set_custom_subcommands_ac, "memory", FALSE);
+    autocomplete_add_unsorted(ai_set_custom_subcommands_ac, "plugins", FALSE);
 
     autocomplete_add_unsorted(ai_remove_subcommands_ac, "provider", FALSE);
 
@@ -1416,6 +1419,7 @@ cmd_ac_init(void)
     g_hash_table_insert(ac_funcs, "/ban", _ban_autocomplete);
     g_hash_table_insert(ac_funcs, "/blocked", _blocked_autocomplete);
     g_hash_table_insert(ac_funcs, "/bookmark", _bookmark_autocomplete);
+    g_hash_table_insert(ac_funcs, "/caps", _caps_autocomplete);
     g_hash_table_insert(ac_funcs, "/clear", _clear_autocomplete);
     g_hash_table_insert(ac_funcs, "/close", _close_autocomplete);
     g_hash_table_insert(ac_funcs, "/cmd", _adhoc_cmd_autocomplete);
@@ -1987,6 +1991,35 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
     return NULL;
 }
 
+static char*
+_caps_autocomplete(ProfWin* window, const char* const input, gboolean previous)
+{
+    char* result = NULL;
+    result = autocomplete_param_with_ac(input, "/caps", caps_subcommands_ac, TRUE, previous);
+    if (result) {
+        return result;
+    }
+    if (window->type == WIN_MUC) {
+        ProfMucWin* mucwin = (ProfMucWin*)window;
+        assert(mucwin->memcheck == PROFMUCWIN_MEMCHECK);
+        Autocomplete nick_ac = muc_roster_ac(mucwin->roomjid);
+        if (nick_ac) {
+            result = autocomplete_param_with_ac(input, "/caps", nick_ac, TRUE, previous);
+        }
+    } else if (connection_get_status() == JABBER_CONNECTED) {
+        result = autocomplete_param_with_func(input, "/caps", roster_contact_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_barejid_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_fulljid_autocomplete, previous, NULL);
+    }
+    return result;
+}
+
 static char*
 _sub_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {
@@ -4534,67 +4567,17 @@ _force_encryption_autocomplete(ProfWin* window, const char* const input, gboolea
 static char* _ai_provider_and_model_autocomplete(ProfWin* window, const char* const input,
                                                  gboolean previous, const char* cmd);
 
-static char*
-_ai_api_type_find(const char* const search_str, gboolean previous, void* context)
-{
-    return autocomplete_complete(ai_api_types_ac, search_str, FALSE, previous);
-}
-
-static char*
-_ai_custom_setting_find(const char* const search_str, gboolean previous, void* context)
-{
-    return autocomplete_complete(ai_set_custom_subcommands_ac, search_str, FALSE, previous);
-}
-
-/**
- * Autocomplete the setting name for /ai set custom <provider> <setting>.
- * Offers a few common payload parameters merged with the keys already set
- * on the provider, so existing settings can be retyped or overridden.
- */
-static char*
-_ai_custom_setting_autocomplete(const char* const input, gboolean previous)
-{
-    if (!g_str_has_prefix(input, "/ai set custom ")) {
-        return NULL;
-    }
-
-    /* Quote-aware parse: args[2] is the provider, args[3] the setting being
-     * typed; skip the rebuild when the caret is not at the setting position */
-    gboolean parse_result = FALSE;
-    auto_gcharv gchar** args = parse_args(input, 1, 5, &parse_result);
-    if (!parse_result) {
-        return NULL;
-    }
-    guint num_args = g_strv_length(args);
-    if (num_args < 3 || num_args > 4 || !ai_get_provider(args[2])) {
-        return NULL;
-    }
-
-    /* Rebuild the completion list: common parameters + the provider's keys */
-    gchar* suggestions[] = { "temperature", "max_tokens", "top_p" };
-    GList* keys = ai_get_provider_setting_keys(args[2]);
-    char** items = g_new0(char*, ARRAY_SIZE(suggestions) + g_list_length(keys) + 1);
-    guint i = 0;
-    for (; i < ARRAY_SIZE(suggestions); i++) {
-        items[i] = suggestions[i];
-    }
-    for (GList* curr = keys; curr; curr = g_list_next(curr)) {
-        items[i++] = curr->data;
-    }
-    autocomplete_update(ai_set_custom_subcommands_ac, items);
-    g_free(items);
-    g_list_free_full(keys, g_free);
-
-    /* /ai(1) set(2) custom(3) <provider>(4) <setting>(5) */
-    return autocomplete_param_no_with_func(input, "/ai set custom", 5, _ai_custom_setting_find, previous, NULL);
-}
-
 static char*
 _ai_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {
     char* result = NULL;
 
-    // /ai set provider <name> <url> - autocomplete provider names (for updating)
+    /* Parse once for reuse - /ai <subcommand> [<arg1>] [<arg2>] */
+    gboolean parse_result = FALSE;
+    auto_gcharv gchar** args = parse_args(input, 1, 4, &parse_result);
+    int num_args = g_strv_length(args);
+
+    /* Top-level /ai <subcommand> autocomplete (e.g., /ai s<tab> -> /ai set) */
     result = autocomplete_param_with_func(input, "/ai set provider", ai_providers_find, previous, NULL);
     if (result) {
         return result;
@@ -4612,30 +4595,24 @@ _ai_autocomplete(ProfWin* window, const char* const input, gboolean previous)
         return result;
     }
 
-    // /ai set api-type <provider> <type> - autocomplete the type value
-    result = autocomplete_param_no_with_func(input, "/ai set api-type", 5, _ai_api_type_find, previous, NULL);
-    if (result) {
-        return result;
-    }
-
-    // /ai set api-type <provider> - autocomplete provider names
-    result = autocomplete_param_with_func(input, "/ai set api-type", ai_providers_find, previous, NULL);
-    if (result) {
-        return result;
-    }
-
     // /ai set custom <provider> <setting> <value> - autocomplete provider names
     result = autocomplete_param_with_func(input, "/ai set custom", ai_providers_find, previous, NULL);
     if (result) {
         return result;
     }
 
-    // /ai set custom <provider> <setting> - autocomplete setting names
-    result = _ai_custom_setting_autocomplete(input, previous);
-    if (result) {
-        return result;
+    // /ai set custom <provider> <setting> - autocomplete settings
+    /* args[0]="set", args[1]="custom", args[2]=provider (if typed), args[3]=setting (if typed) */
+    if (num_args == 3 && g_strcmp0(args[1], "custom") == 0) {
+        /* /ai set custom <provider> - check if provider is valid */
+        if (ai_get_provider(args[2])) {
+            /* Valid provider, try settings autocomplete */
+            result = autocomplete_param_with_ac(input, "/ai set custom ", ai_set_custom_subcommands_ac, TRUE, previous);
+            if (result) {
+                return result;
+            }
+        }
     }
-
     // /ai set <subcommand> - autocomplete subcommands
     result = autocomplete_param_with_ac(input, "/ai set", ai_set_subcommands_ac, TRUE, previous);
     if (result) {

src/command/cmd_defs.c

@@ -427,17 +427,21 @@ static const struct cmd_t command_defs[] = {
               CMD_TAG_GROUPCHAT)
       CMD_SYN(
               "/caps",
-              "/caps <fulljid>|<nick>")
+              "/caps <fulljid>|<nick>",
+              "/caps clear")
       CMD_DESC(
               "Find out a contacts, or room members client software capabilities. "
-              "If in private chat initiated from a chat room, no parameter is required.")
+              "If in private chat initiated from a chat room, no parameter is required. "
+              "Use clear to remove all cached capabilities.")
       CMD_ARGS(
               { "<fulljid>", "If in the console or a chat window, the full JID for which you wish to see capabilities." },
-              { "<nick>", "If in a chat room, nickname for which you wish to see capabilities." })
+              { "<nick>", "If in a chat room, nickname for which you wish to see capabilities." },
+              { "clear", "Clear all cached capabilities." })
       CMD_EXAMPLES(
               "/caps ran@cold.sea.org/laptop",
               "/caps ran@cold.sea.org/phone",
-              "/caps aegir")
+              "/caps aegir",
+              "/caps clear")
     },
 
     { CMD_PREAMBLE("/software",
@@ -2815,7 +2819,6 @@ static const struct cmd_t command_defs[] = {
               "/ai set provider <name> <url>",
               "/ai set token <provider> <token>",
               "/ai set default-model <provider> <model>",
-              "/ai set api-type <provider> chat-completions|responses|auto",
               "/ai set custom <provider> <setting> <value>",
               "/ai remove provider <name>",
               "/ai providers",
@@ -2831,10 +2834,9 @@ static const struct cmd_t command_defs[] = {
               "Chat history is maintained per session and not persisted locally.")
       CMD_ARGS(
               { "", "Display current AI settings and configured providers" },
-              { "set provider <name> <url>", "Add or update a provider with a custom API base URL (endpoint paths are appended automatically)" },
+              { "set provider <name> <url>", "Add or update a provider with custom API endpoint" },
               { "set token <provider> <token>", "Set API token for a provider (e.g., openai, perplexity)" },
               { "set default-model <provider> <model>", "Set default model for a provider" },
-              { "set api-type <provider> chat-completions|responses|auto", "Pin the provider API flavour; auto tries responses and falls back to chat completions when the endpoint is missing" },
               { "set custom <provider> <setting> <value>", "Set provider-level setting (e.g., temperature, max_tokens)" },
               { "remove provider <name>", "Remove a custom provider" },
               { "providers", "List configured providers with full details" },
@@ -2846,9 +2848,8 @@ static const struct cmd_t command_defs[] = {
               "/ai",
               "/ai set token openai sk-xxx",
               "/ai set token perplexity pplx-xxx",
-              "/ai set provider custom https://my-api.com/",
+              "/ai set provider custom https://my-api.com/v1/chat/completions",
               "/ai set default-model perplexity sonar",
-              "/ai set api-type perplexity responses",
               "/ai set custom perplexity temperature 0.7",
               "/ai remove provider custom",
               "/ai start",

src/command/cmd_funcs.c

@@ -70,6 +70,7 @@
 #include "xmpp/stanza.h"
 #include "xmpp/vcard_funcs.h"
 #include "xmpp/xmpp.h"
+#include "xmpp/capabilities.h"
 
 #ifdef HAVE_LIBOTR
 #include "otr/otr.h"
@@ -3387,6 +3388,12 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
         return TRUE;
     }
 
+    if (g_strcmp0(args[0], "clear") == 0) {
+        caps_cache_clear();
+        cons_show("Capabilities cache cleared.");
+        return TRUE;
+    }
+
     switch (window->type) {
     case WIN_MUC:
         if (args[0]) {
@@ -3405,6 +3412,7 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
         break;
     case WIN_CHAT:
     case WIN_CONSOLE:
+    case WIN_XML:
         if (args[0]) {
             auto_jid Jid* jid = jid_create(args[0]);
 
@@ -10703,19 +10711,6 @@ cmd_vcard_save(ProfWin* window, const char* const command, gchar** args)
     return TRUE;
 }
 
-/* Show the provider's API flavour: pinned, or auto with the detected one */
-static void
-_cons_show_ai_api_type(AIProvider* provider)
-{
-    AIApiType api_type = g_atomic_int_get(&provider->api_type);
-    AIApiType resolved = g_atomic_int_get(&provider->resolved_api_type);
-    if (api_type != AI_API_TYPE_AUTO) {
-        cons_show("    API type: %s", ai_api_type_to_string(api_type));
-    } else if (resolved != AI_API_TYPE_AUTO) {
-        cons_show("    API type: auto (detected: %s)", ai_api_type_to_string(resolved));
-    }
-}
-
 gboolean
 cmd_ai(ProfWin* window, const char* const command, gchar** args)
 {
@@ -10737,7 +10732,6 @@ cmd_ai(ProfWin* window, const char* const command, gchar** args)
             if (default_model) {
                 cons_show("    Default model: %s", default_model);
             }
-            _cons_show_ai_api_type(provider);
             if (provider->models && g_list_length(provider->models) > 0) {
                 cons_show("    Cached models: %d", g_list_length(provider->models));
             }
@@ -10795,19 +10789,6 @@ cmd_ai_set(ProfWin* window, const char* const command, gchar** args)
         cons_show("Default model for provider '%s' set to: %s", args[2], args[3]);
         cons_show("");
         return TRUE;
-    } else if (g_strcmp0(args[1], "api-type") == 0) {
-        // /ai set api-type <provider> chat-completions|responses|auto
-        if (g_strv_length(args) < 4) {
-            cons_bad_cmd_usage(command);
-            return TRUE;
-        }
-        if (ai_set_provider_api_type(args[2], args[3])) {
-            cons_show("API type for provider '%s' set to: %s", args[2], args[3]);
-        } else {
-            cons_show_error("Cannot set API type for provider '%s': unknown provider or invalid type (use chat-completions, responses, or auto).", args[2]);
-        }
-        cons_show("");
-        return TRUE;
     } else if (g_strcmp0(args[1], "custom") == 0) {
         // /ai set custom <provider> <setting> <value>
         if (g_strv_length(args) < 5) {
@@ -10817,7 +10798,7 @@ cmd_ai_set(ProfWin* window, const char* const command, gchar** args)
         if (ai_set_provider_setting(args[2], args[3], args[4])) {
             cons_show("Setting '%s' for provider '%s' set to: %s", args[3], args[2], args[4]);
         } else {
-            cons_show_error("Cannot set '%s' for provider '%s': unknown provider or reserved key (model, messages, input, stream).", args[3], args[2]);
+            cons_show_error("Cannot set '%s' for provider '%s': unknown provider or reserved key (model, messages, stream).", args[3], args[2]);
         }
         cons_show("");
         return TRUE;
@@ -11132,7 +11113,6 @@ cmd_ai_providers(ProfWin* window, const char* const command, gchar** args)
         cons_show("  %s", provider->name);
         cons_show("    URL: %s", provider->api_url);
         cons_show("    Key: %s", key ? "configured" : "NOT configured");
-        _cons_show_ai_api_type(provider);
         cons_show("");
     }
     g_list_free(providers);

src/common.c

@@ -455,6 +455,32 @@ str_xml_sanitize(const char* const str)
     return g_string_free(sanitized, FALSE);
 }
 
+gchar*
+redact_secrets(const char* const str)
+{
+    if (str == NULL) {
+        return NULL;
+    }
+
+    // SASL exchanges and <password> elements carry credentials — strip their content before logging
+    static gsize init = 0;
+    static GRegex* secret_regex = NULL;
+    if (g_once_init_enter(&init)) {
+        secret_regex = g_regex_new(
+            "(<(?:auth|response|challenge|success|password|digest)\\b[^>]*>)[^<]+(</(?:auth|response|challenge|success|password|digest)>)",
+            0, 0, NULL);
+        g_once_init_leave(&init, 1);
+    }
+
+    if (secret_regex == NULL) {
+        return g_strdup(str);
+    }
+
+    auto_gchar gchar* valid = g_utf8_make_valid(str, -1); // invalid UTF-8 would make the regex fail open
+    gchar* redacted = g_regex_replace(secret_regex, valid, -1, 0, "\\1[REDACTED]\\2", 0, NULL);
+    return redacted ? redacted : g_steal_pointer(&valid);
+}
+
 char*
 release_get_latest(void)
 {
@@ -921,7 +947,7 @@ prof_date_time_format_iso8601(GDateTime* dt)
     return ret;
 }
 
-/* build profanity version string.
+/* build CProof version string.
  * example: 0.13.1dev.master.69d8c1f9
  */
 gchar*

src/common.h

@@ -161,6 +161,7 @@ gboolean strtoi_range(const char* str, int* saveptr, int min, int max, char** er
 gsize g_diff_to_gsize(const void* end, const void* start);
 int utf8_display_len(const char* const str);
 gchar* str_xml_sanitize(const char* const str);
+gchar* redact_secrets(const char* const str);
 
 gboolean string_matches_one_of(const char* what, const char* is, gboolean is_can_be_null, const char* first, ...) __attribute__((sentinel));
 gboolean valid_tls_policy_option(const char* is);

src/config/accounts.c

@@ -522,7 +522,7 @@ accounts_set_script_start(const char* const account_name, const char* const valu
 void
 accounts_set_client(const char* const account_name, const char* const value)
 {
-    _accounts_set_string_option(account_name, "client.name", value);
+    _accounts_set_string_option(account_name, "client.account_name", value);
 }
 
 void
@@ -576,7 +576,7 @@ accounts_clear_script_start(const char* const account_name)
 void
 accounts_clear_client(const char* const account_name)
 {
-    _accounts_clear_string_option(account_name, "client.name");
+    _accounts_clear_string_option(account_name, "client.account_name");
 }
 
 void

src/config/preferences.c

@@ -2002,30 +2002,6 @@ prefs_ai_get_default_model(const char* const provider)
     return _ai_get_string(provider, "default_model");
 }
 
-/* --- API type --- */
-
-gboolean
-prefs_ai_set_api_type(const char* const provider, const char* const api_type)
-{
-    if (!provider || !api_type || !prefs)
-        return FALSE;
-    if (api_type[0] == '\0')
-        return prefs_ai_remove_api_type(provider);
-    return _ai_set_string(provider, "api_type", api_type);
-}
-
-gboolean
-prefs_ai_remove_api_type(const char* const provider)
-{
-    return _ai_remove_string(provider, "api_type");
-}
-
-char*
-prefs_ai_get_api_type(const char* const provider)
-{
-    return _ai_get_string(provider, "api_type");
-}
-
 /* --- Provider URL --- */
 
 gboolean
@@ -2713,7 +2689,6 @@ _get_default_boolean(preference_t pref)
     case PREF_STATUSBAR_SHOW_NUMBER:
     case PREF_STATUSBAR_SHOW_READ:
     case PREF_STATUSBAR_SHOW_DBBACKEND:
-    case PREF_REVEAL_OS:
     case PREF_CORRECTION_ALLOW:
     case PREF_RECEIPTS_SEND:
     case PREF_CARBONS:
@@ -2728,6 +2703,7 @@ _get_default_boolean(preference_t pref)
     case PREF_STROPHE_SM_RESEND:
     case PREF_AUTOPING_WARNING:
         return TRUE;
+    case PREF_REVEAL_OS:
     case PREF_SPELLCHECK_ENABLE:
     case PREF_PGP_PUBKEY_AUTOIMPORT:
     case PREF_FORCE_ENCRYPTION:

src/config/preferences.h

@@ -368,11 +368,6 @@ gboolean prefs_ai_set_default_model(const char* const provider, const char* cons
 gboolean prefs_ai_remove_default_model(const char* const provider);
 char* prefs_ai_get_default_model(const char* const provider);
 
-/* AI API type per provider ("responses" or "chat-completions") */
-gboolean prefs_ai_set_api_type(const char* const provider, const char* const api_type);
-gboolean prefs_ai_remove_api_type(const char* const provider);
-char* prefs_ai_get_api_type(const char* const provider);
-
 /* AI per-provider custom settings (e.g. tools, search) — persisted as
  * setting.<name>=<value> inside [ai/<provider>]. Pass NULL value to remove. */
 gboolean prefs_ai_set_setting(const char* const provider, const char* const setting, const char* const value);

src/database_sqlite.c

@@ -39,6 +39,7 @@
 #include <sys/statvfs.h>
 #include <sqlite3.h>
 #include <glib.h>
+#include <glib/gstdio.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -124,6 +125,15 @@ _get_db_filename(ProfAccount* account)
     return files_file_in_account_data_path(DIR_DATABASE, account->jid, "chatlog.db");
 }
 
+static int
+_quick_check_cb(void* intact, int argc, char** argv, char** column_names)
+{
+    if (argc > 0 && argv[0] && strcmp(argv[0], "ok") == 0) {
+        *(gboolean*)intact = TRUE;
+    }
+    return 0;
+}
+
 static gboolean
 _sqlite_init(ProfAccount* account)
 {
@@ -149,6 +159,20 @@ _sqlite_init(ProfAccount* account)
         return FALSE;
     }
 
+    g_chmod(filename, S_IRUSR | S_IWUSR); // history holds plaintext; journal/WAL files inherit these perms
+
+    // catch corruption before running queries or migrations against the file
+    char* check_err = NULL;
+    gboolean intact = FALSE;
+    ret = sqlite3_exec(g_chatlog_database, "PRAGMA quick_check(1);", _quick_check_cb, &intact, &check_err);
+    if (ret != SQLITE_OK || !intact) {
+        log_error("Chat history database failed integrity check (%s): %s", filename,
+                  check_err ? check_err : "quick_check did not return 'ok'");
+        sqlite3_free(check_err);
+        _db_teardown("_sqlite_init(quick_check)");
+        return FALSE;
+    }
+
     char* err_msg = NULL;
 
     int db_version = _get_db_version();
@@ -691,7 +715,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
             original_message_id = tmp ? tmp : original_message_id;
 
             if (g_strcmp0(from_jid_orig, from_jid->barejid) != 0) {
-                log_error("Mismatch in sender JIDs when trying to do LMC. Corrected message sender: %s. Original message sender: %s. Replace-ID: %s. Message: %s", from_jid->barejid, from_jid_orig, message->replace_id, message->plain);
+                log_error("Mismatch in sender JIDs when trying to do LMC. Corrected message sender: %s. Original message sender: %s. Replace-ID: %s.", from_jid->barejid, from_jid_orig, message->replace_id);
                 cons_show_error("%s sent a message correction with mismatched sender. See log for details.", from_jid->barejid);
                 sqlite3_finalize(lmc_stmt);
                 return;
@@ -714,7 +738,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
         sqlite3_stmt* stmt;
         if (_db_prepare_ctx(duplicate_check_query, &stmt, "_add_to_db(duplicate_check)")) {
             if (sqlite3_step(stmt) == SQLITE_ROW) {
-                log_error("Duplicate stanza-id found for the message. stanza_id: %s; archive_id: %s; sender: %s; content: %s", message->id, message->stanzaid, from_jid->barejid, message->plain);
+                log_error("Duplicate stanza-id found for the message. stanza_id: %s; archive_id: %s; sender: %s", message->id, message->stanzaid, from_jid->barejid);
                 cons_show_error("Got a message with duplicate (server-generated) stanza-id from %s.", from_jid->fulljid);
             }
             sqlite3_finalize(stmt);
@@ -745,7 +769,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
         return;
     }
 
-    log_debug("Writing to DB. Query: %s", query);
+    log_debug("Writing message to DB (id: %s, stanza_id: %s, type: %s)", message->id, message->stanzaid, type); // no query text: it embeds the plaintext body
 
     if (SQLITE_OK != sqlite3_exec(g_chatlog_database, query, NULL, 0, &err_msg)) {
         if (err_msg) {
@@ -757,7 +781,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
     } else {
         int inserted_rows_count = sqlite3_changes(g_chatlog_database);
         if (inserted_rows_count < 1) {
-            log_error("SQLite did not insert message (rows: %d, id: %s, content: %s)", inserted_rows_count, message->id, message->plain);
+            log_error("SQLite did not insert message (rows: %d, id: %s)", inserted_rows_count, message->id);
         }
     }
 }

src/event/server_events.c

@@ -83,6 +83,7 @@ sv_ev_login_account_success(char* account_name, gboolean secured)
 
     if (!log_database_init(account)) {
         log_error("Failed to initialize database for account: %s", account->jid);
+        cons_show_error("Chat history storage is unavailable for this session, messages will not be saved. See the log for details.");
     }
     vcard_user_refresh();
     avatar_pep_subscribe();

src/log.c

@@ -286,7 +286,8 @@ log_stderr_handler(void)
 
         for (int i = 0; i < size; ++i) {
             if (buf[i] == '\n') {
-                log_msg(stderr_level, "stderr", s->str);
+                auto_gchar gchar* redacted = redact_secrets(s->str); // third-party libs may echo credentials
+                log_msg(stderr_level, "stderr", redacted);
                 g_string_assign(s, "");
             } else
                 g_string_append_c(s, buf[i]);
@@ -294,7 +295,8 @@ log_stderr_handler(void)
     } while (1);
 
     if (s->len > 0 && s->str[0] != '\0') {
-        log_msg(stderr_level, "stderr", s->str);
+        auto_gchar gchar* redacted = redact_secrets(s->str);
+        log_msg(stderr_level, "stderr", redacted);
         g_string_assign(s, "");
     }
 }

src/main.c

@@ -77,7 +77,7 @@ main(int argc, char** argv)
 
     if (version == TRUE) {
         auto_gchar gchar* prof_version = prof_get_version();
-        g_print("Profanity, version %s\n", prof_version);
+        g_print("CProof, version %s\n", prof_version);
 
         // lets use fixed email instead of PACKAGE_BUGREPORT
         g_print("Copyright (C) 2012 - 2019 James Booth <boothj5web@gmail.com>.\n");

src/otr/otr.c

@@ -14,6 +14,8 @@
 #include <libotr/message.h>
 #include <libotr/sm.h>
 #include <glib.h>
+#include <glib/gstdio.h>
+#include <sys/stat.h>
 
 #include "log.h"
 #include "chatlog.h"
@@ -114,6 +116,8 @@ cb_write_fingerprints(void* opdata)
     if (err != GPG_ERR_NO_ERROR) {
         log_error("Failed to write fingerprints file");
         cons_show_error("Failed to write fingerprints file");
+    } else {
+        g_chmod(fpsfilename, S_IRUSR | S_IWUSR);
     }
 }
 
@@ -376,6 +380,7 @@ otr_keygen(ProfAccount* account)
         cons_show_error("Failed to generate private key");
         return;
     }
+    g_chmod(keysfilename->str, S_IRUSR | S_IWUSR);
     log_info("Private key generated");
     cons_show("");
     cons_show("Private key generation complete.");
@@ -390,6 +395,7 @@ otr_keygen(ProfAccount* account)
         cons_show_error("Failed to create fingerprints file");
         return;
     }
+    g_chmod(fpsfilename->str, S_IRUSR | S_IWUSR);
     log_info("Fingerprints file created");
 
     err = otrl_privkey_read(user_state, keysfilename->str);

src/profanity.c

@@ -253,7 +253,7 @@ _init(char* log_level, char* config_file, char* log_file, char* theme_name)
     log_stderr_init(PROF_LEVEL_ERROR);
 
     auto_gchar gchar* prof_version = prof_get_version();
-    log_info("Starting Profanity (%s)…", prof_version);
+    log_info("Starting CProof (%s)…", prof_version);
 
     chatlog_init();
     accounts_load();

src/tools/aesgcm_download.c

@@ -13,10 +13,12 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
+#include <unistd.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <curl/curl.h>
 #include <gio/gio.h>
+#include <glib/gstdio.h>
 #include <pthread.h>
 #include <assert.h>
 #include <errno.h>
@@ -62,14 +64,28 @@ aesgcm_file_get(void* userdata)
         return NULL;
     }
 
-    // Open the target file for storing the cleartext.
-    auto_FILE FILE* outfh = fopen(aesgcm_dl->filename, "wb");
+    // Decrypt into a temporary file next to the target and rename it into
+    // place only after the GCM tag verified, so tampered or truncated
+    // content never appears at the destination path.
+    auto_gchar gchar* partname = g_strdup_printf("%s.part.XXXXXX", aesgcm_dl->filename);
+    gint outfd = g_mkstemp(partname);
+    if (outfd == -1) {
+        http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
+                                   "Downloading '%s' failed: Unable to open "
+                                   "output file at '%s' for writing (%s).",
+                                   https_url, aesgcm_dl->filename,
+                                   g_strerror(errno));
+        return NULL;
+    }
+    FILE* outfh = fdopen(outfd, "wb");
     if (outfh == NULL) {
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
                                    "Downloading '%s' failed: Unable to open "
                                    "output file at '%s' for writing (%s).",
                                    https_url, aesgcm_dl->filename,
                                    g_strerror(errno));
+        close(outfd);
+        remove(partname);
         return NULL;
     }
 
@@ -90,6 +106,8 @@ aesgcm_file_get(void* userdata)
 
     ssize_t* p_bytes_received = http_file_get(http_dl);
     if (!p_bytes_received) {
+        fclose(outfh);
+        remove(partname);
         return NULL;
     }
     ssize_t bytes_received = *p_bytes_received;
@@ -102,6 +120,8 @@ aesgcm_file_get(void* userdata)
                                    "temporary file at '%s' for reading (%s).",
                                    aesgcm_dl->url, tmpname,
                                    g_strerror(errno));
+        fclose(outfh);
+        remove(partname);
         return NULL;
     }
 
@@ -110,20 +130,32 @@ aesgcm_file_get(void* userdata)
                                    bytes_received, fragment);
     fclose(tmpfh);
     remove(tmpname);
+    fclose(outfh);
 
+    gboolean saved = FALSE;
     if (crypt_res != GPG_ERR_NO_ERROR) {
+        remove(partname);
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
                                    "Downloading '%s' failed: Failed to decrypt "
                                    "file (%s).",
                                    https_url, gcry_strerror(crypt_res));
+    } else if (g_rename(partname, aesgcm_dl->filename) != 0) {
+        remove(partname);
+        http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
+                                   "Downloading '%s' failed: Unable to move "
+                                   "decrypted file to '%s' (%s).",
+                                   https_url, aesgcm_dl->filename,
+                                   g_strerror(errno));
     } else {
+        saved = TRUE;
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ONLINE, ENTRY_COMPLETED,
                                    "Downloading '%s': done\nSaved to '%s'",
                                    aesgcm_dl->url, aesgcm_dl->filename);
         win_mark_received(aesgcm_dl->window, aesgcm_dl->id);
     }
 
-    if (aesgcm_dl->cmd_template != NULL) {
+    // never hand an unverified file to the external command
+    if (saved && aesgcm_dl->cmd_template != NULL) {
         gchar** argv = format_call_external_argv(aesgcm_dl->cmd_template,
                                                  aesgcm_dl->filename,
                                                  aesgcm_dl->filename);
@@ -140,8 +172,8 @@ aesgcm_file_get(void* userdata)
         }
 
         g_strfreev(argv);
-        free(aesgcm_dl->cmd_template);
     }
+    free(aesgcm_dl->cmd_template);
 
     free(aesgcm_dl->id);
     free(aesgcm_dl->filename);

src/ui/console.c

@@ -2830,8 +2830,7 @@ cons_privacy_setting(void)
         if (account->client) {
             cons_show("Client name (/account set <account> clientid)              : %s", account->client);
         } else {
-            auto_gchar gchar* prof_version = prof_get_version();
-            cons_show("Client name (/account set <account> clientid)              : Profanity %s", prof_version);
+            cons_show("Client name (/account set <account> clientid)              : Pidgin");
         }
         if (account->max_sessions > 0) {
             cons_show("Max sessions alarm (/account set <account> session_alarm)  : %d", account->max_sessions);

src/xmpp/capabilities.c

@@ -23,6 +23,7 @@
 #include "plugins/plugins.h"
 #include "config/files.h"
 #include "config/preferences.h"
+#include "xmpp/connection.h"
 #include "xmpp/xmpp.h"
 #include "xmpp/stanza.h"
 #include "xmpp/form.h"
@@ -271,6 +272,19 @@ caps_map_jid_to_ver(const char* const jid, const char* const ver)
     g_hash_table_insert(jid_to_ver, strdup(jid), strdup(ver));
 }
 
+void
+caps_cache_clear(void)
+{
+    g_hash_table_remove_all(jid_to_ver);
+    g_hash_table_remove_all(jid_to_caps);
+    if (caps_prof_keyfile.keyfile) {
+        g_key_file_free(caps_prof_keyfile.keyfile);
+    }
+    caps_prof_keyfile.keyfile = g_key_file_new();
+    cache = caps_prof_keyfile.keyfile;
+    save_keyfile(&caps_prof_keyfile);
+}
+
 gboolean
 caps_cache_contains(const char* const ver)
 {

src/xmpp/capabilities.h

@@ -28,5 +28,6 @@ void caps_map_jid_to_ver(const char* const jid, const char* const ver);
 gboolean caps_cache_contains(const char* const ver);
 GList* caps_get_features(void);
 char* caps_get_my_sha1(xmpp_ctx_t* const ctx);
+void caps_cache_clear(void);
 
 #endif

src/xmpp/connection.c

@@ -1104,7 +1104,8 @@ _xmpp_file_logger(void* const userdata, const xmpp_log_level_t xmpp_level, const
         break;
     }
 
-    log_msg(prof_level, area, msg);
+    auto_gchar gchar* redacted = redact_secrets(msg); // raw traffic contains SASL/register credentials
+    log_msg(prof_level, area, redacted);
 
     if ((g_strcmp0(area, "xmpp") == 0) || (g_strcmp0(area, "conn")) == 0) {
         sv_ev_xmpp_stanza(msg);

src/xmpp/iq.c

@@ -1681,7 +1681,7 @@ _version_get_handler(xmpp_stanza_t* const stanza)
     xmpp_stanza_t* name = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(name, "name");
     xmpp_stanza_t* name_txt = xmpp_stanza_new(ctx);
-    xmpp_stanza_set_text(name_txt, is_custom_client ? client : "Profanity");
+    xmpp_stanza_set_text(name_txt, is_custom_client ? client : "Pidgin");
     xmpp_stanza_add_child(name, name_txt);
     xmpp_stanza_add_child(query, name);
     bool include_os = prefs_get_boolean(PREF_REVEAL_OS) && !is_custom_client;
@@ -1690,7 +1690,7 @@ _version_get_handler(xmpp_stanza_t* const stanza)
     xmpp_stanza_t* version = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(version, "version");
     xmpp_stanza_t* version_txt = xmpp_stanza_new(ctx);
-    auto_gchar gchar* prof_version = prof_get_version();
+    auto_gchar gchar* prof_version = g_strdup("");
 
     if (!is_custom_client) {
         xmpp_stanza_set_text(version_txt, prof_version);

src/xmpp/jid.c

@@ -280,9 +280,13 @@ jid_fulljid_or_barejid(Jid* jid)
 gchar*
 jid_random_resource(void)
 {
-    auto_gchar gchar* rand = get_random_string(4);
+    gchar* rand = g_malloc0(29);
+    const gchar* digits = "0123456789";
 
-    gchar* result = g_strdup_printf("profanity.%s", rand);
+    for (int i = 0; i < 28; i++) {
+        rand[i] = digits[g_random_int_range(0, 10)];
+    }
+    rand[28] = '\0';
 
-    return result;
+    return rand;
 }

src/xmpp/session.c

@@ -178,7 +178,7 @@ session_connect_with_details(const char* const jid, const char* const passwd, co
         saved_details.auth_policy = NULL;
     }
 
-    // use 'profanity' when no resourcepart in provided jid
+    // use random string when no resourcepart in provided jid
     auto_jid Jid* jidp = jid_create(jid);
     if (jidp->resourcepart == NULL) {
         auto_gchar gchar* resource = jid_random_resource();

src/xmpp/stanza.c

@@ -32,6 +32,7 @@
 
 static void _stanza_add_unique_id(xmpp_stanza_t* stanza);
 static gchar* _stanza_create_sha1_hash(char* str);
+static const char* _stanza_get_caps_node(const char* const client);
 
 #if 0
 xmpp_stanza_t*
@@ -930,23 +931,22 @@ stanza_create_caps_query_element(xmpp_ctx_t* ctx)
 
     xmpp_stanza_t* identity = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(identity, "identity");
+    xmpp_stanza_set_type(identity, "pc");
     xmpp_stanza_set_attribute(identity, "category", "client");
 
     ProfAccount* account = accounts_get_account(session_get_account_name());
-    gchar* client = account->client;
-    bool is_custom_client = client != NULL;
 
-    GString* name_str = g_string_new(is_custom_client ? client : "Profanity ");
-    if (!is_custom_client) {
-        xmpp_stanza_set_type(identity, "console");
-        auto_gchar gchar* prof_version = prof_get_version();
-        g_string_append(name_str, prof_version);
+    auto_gchar gchar* name = g_strdup(account->client ? account->client : "Pidgin");
+
+    if (account->client) {
+        gchar* space = strchr(name, ' ');
+        if (space) {
+            *space = '\0';
+        }
     }
-
     account_free(account);
 
-    xmpp_stanza_set_attribute(identity, "name", name_str->str);
-    g_string_free(name_str, TRUE);
+    xmpp_stanza_set_attribute(identity, "name", name);
     xmpp_stanza_add_child(query, identity);
     xmpp_stanza_release(identity);
 
@@ -1994,6 +1994,42 @@ stanza_attach_last_activity(xmpp_ctx_t* const ctx,
     xmpp_stanza_release(query);
 }
 
+static const char*
+_stanza_get_caps_node(const char* const client)
+{
+    if (!client || g_strcmp0(client, "") == 0) {
+        return "http://pidgin.im";
+    }
+
+    auto_gchar gchar* lower = g_ascii_strdown(client, -1);
+
+    if (g_str_has_prefix(lower, "pidgin")) {
+        return "http://pidgin.im";
+    }
+
+    if (g_str_has_prefix(lower, "gajim")) {
+        return "https://gajim.org";
+    }
+
+    if (g_str_has_prefix(lower, "conversations")) {
+        return "https://conversations.im";
+    }
+
+    if (g_str_has_prefix(lower, "psi+")) {
+        return "http://psi-plus.com";
+    }
+
+    if (g_str_has_prefix(lower, "psi")) {
+        return "http://psi-im.org";
+    }
+
+    if (g_str_has_prefix(lower, "profanity")) {
+        return "http://profanity-im.github.io";
+    }
+
+    return "";
+}
+
 void
 stanza_attach_caps(xmpp_ctx_t* const ctx, xmpp_stanza_t* const presence)
 {
@@ -2002,9 +2038,13 @@ stanza_attach_caps(xmpp_ctx_t* const ctx, xmpp_stanza_t* const presence)
     xmpp_stanza_set_ns(caps, STANZA_NS_CAPS);
     xmpp_stanza_t* query = stanza_create_caps_query_element(ctx);
 
+    ProfAccount* account = accounts_get_account(session_get_account_name());
+    const char* node = _stanza_get_caps_node(account->client);
+    account_free(account);
+
     char* sha1 = caps_get_my_sha1(ctx);
     xmpp_stanza_set_attribute(caps, STANZA_ATTR_HASH, "sha-1");
-    xmpp_stanza_set_attribute(caps, STANZA_ATTR_NODE, "http://profanity-im.github.io");
+    xmpp_stanza_set_attribute(caps, STANZA_ATTR_NODE, node);
     xmpp_stanza_set_attribute(caps, STANZA_ATTR_VER, sha1);
     xmpp_stanza_add_child(presence, caps);
     xmpp_stanza_release(caps);

tests/functionaltests/functionaltests.c

@@ -255,6 +255,9 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(message_db_history_verify),
         PROF_FUNC_TEST(message_db_history_lmc),
         PROF_FUNC_TEST(message_db_history_multi_resource),
+#ifdef HAVE_SQLITE
+        PROF_FUNC_TEST(message_db_corrupt_database_degrades_gracefully),
+#endif
 
         /* Basic message send/receive */
         PROF_FUNC_TEST(message_send),

tests/functionaltests/proftest.c

@@ -601,11 +601,11 @@ prof_connect_with_roster(const char* roster)
     assert_true(prof_output_regex(".+online.+ \\(priority 0\\)\\."));
 
     expect_timeout = EXPECT_TIMEOUT_CONNECT;
-    // Wait for presence stanza to be sent (content-based, not ID-based)
+    // Wait for presence stanza to be sent
     // Match the actual attribute order from stanza_attach_caps
     assert_true(stbbr_received(
         "<presence id=\"*\">"
-        "<c xmlns=\"http://jabber.org/protocol/caps\" hash=\"sha-1\" node=\"http://profanity-im.github.io\" ver=\"*\"/>"
+        "<c xmlns=\"http://jabber.org/protocol/caps\" hash=\"sha-1\" node=\"*\" ver=\"*\"/>"
         "</presence>"));
 }
 

tests/functionaltests/test_ai.c

@@ -55,11 +55,11 @@ ai_no_args_shows_help(void** state)
 void
 ai_providers_lists_defaults(void** state)
 {
-    /* `/ai providers` (no "list") shows the configured list with URLs. */
+    /* `/ai providers` (no "list") shows the built-in list with URLs. */
     prof_input("/ai providers");
 
     prof_timeout(5);
-    assert_true(prof_output_exact("Configured providers:"));
+    assert_true(prof_output_exact("Available AI providers:"));
     /* At least one URL line is rendered — exact name agnostic. */
     assert_true(prof_output_regex("https?://"));
     prof_timeout_reset();

tests/functionaltests/test_connect.c

@@ -25,7 +25,7 @@ connect_jid_sends_presence_after_receiving_roster(void **state)
 
     assert_true(stbbr_received(
         "<presence id='*'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }

tests/functionaltests/test_export_import.c

@@ -1289,7 +1289,7 @@ _join_muc(const char* room)
     snprintf(presence, sizeof(presence),
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='%s/stabber'>"
             "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' "
-               "node='http://profanity-im.github.io' ver='*'/>"
+               "node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"

tests/functionaltests/test_history.c

@@ -536,3 +536,41 @@ message_db_history_multi_resource(void** state)
     assert_true(prof_output_regex("Buddy1/laptop"));
     assert_true(prof_output_regex("Buddy1/tablet"));
 }
+
+/*
+ * Test: corrupt chatlog.db degrades gracefully (issue #146, REQ-RES-02).
+ *
+ * A chatlog.db with a valid SQLite magic but garbage content is planted
+ * before connecting. Database init must fail cleanly: the user gets a
+ * console warning, the session stays up, and the client stays responsive.
+ */
+void
+message_db_corrupt_database_degrades_gracefully(void** state)
+{
+    const char* xdg_data = getenv("XDG_DATA_HOME");
+    assert_non_null(xdg_data);
+
+    GString* db_file = g_string_new(xdg_data);
+    g_string_append(db_file, "/profanity/database/stabber_at_localhost");
+    assert_int_equal(0, g_mkdir_with_parents(db_file->str, 0700));
+    g_string_append(db_file, "/chatlog.db");
+
+    /* valid 16-byte SQLite header magic followed by garbage: sqlite3_open
+     * succeeds (lazy open), the integrity gate must catch it */
+    FILE* db = fopen(db_file->str, "wb");
+    assert_non_null(db);
+    assert_int_equal(16, fwrite("SQLite format 3", 1, 16, db));
+    for (int i = 0; i < 4096; i++) {
+        fputc(0xA5, db);
+    }
+    fclose(db);
+    g_string_free(db_file, TRUE);
+
+    prof_connect();
+
+    assert_true(prof_output_exact("Chat history storage is unavailable for this session"));
+
+    /* client is still alive and responsive after the failed DB init */
+    prof_input("/autoping set 60");
+    assert_true(prof_output_exact("Autoping interval set to 60 seconds."));
+}

tests/functionaltests/test_history.h

@@ -11,3 +11,4 @@ void message_db_history_service_chars(void** state);
 void message_db_history_verify(void** state);
 void message_db_history_lmc(void** state);
 void message_db_history_multi_resource(void** state);
+void message_db_corrupt_database_degrades_gracefully(void** state);

tests/functionaltests/test_muc.c

@@ -26,7 +26,7 @@ sends_room_join(void **state)
     assert_true(stbbr_received(
         "<presence id='*' to='testroom@conference.localhost/stabber'>"
             "<x xmlns='http://jabber.org/protocol/muc'/>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -41,7 +41,7 @@ sends_room_join_with_nick(void **state)
     assert_true(stbbr_received(
         "<presence id='*' to='testroom@conference.localhost/testnick'>"
             "<x xmlns='http://jabber.org/protocol/muc'/>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -58,7 +58,7 @@ sends_room_join_with_password(void **state)
             "<x xmlns='http://jabber.org/protocol/muc'>"
                 "<password>testpassword</password>"
             "</x>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -75,7 +75,7 @@ sends_room_join_with_nick_and_password(void **state)
             "<x xmlns='http://jabber.org/protocol/muc'>"
                 "<password>testpassword</password>"
             "</x>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -87,7 +87,7 @@ shows_role_and_affiliation_on_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -107,7 +107,7 @@ shows_subject_on_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -135,7 +135,7 @@ shows_history_message(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -170,7 +170,7 @@ shows_occupant_join(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -200,7 +200,7 @@ shows_message(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -227,7 +227,7 @@ shows_me_message_from_occupant(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -254,7 +254,7 @@ shows_me_message_from_self(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -281,7 +281,7 @@ shows_all_messages_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -322,7 +322,7 @@ shows_first_message_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -369,7 +369,7 @@ shows_no_message_in_console_when_window_not_focussed(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='participant' jid='stabber@localhost/profanity' affiliation='none'/>"
             "</x>"
@@ -401,7 +401,7 @@ sends_affiliation_list_request(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='moderator' jid='stabber@localhost/profanity' affiliation='owner'/>"
             "</x>"
@@ -434,7 +434,7 @@ sends_kick_request(void **state)
 
     stbbr_for_presence_to("testroom@conference.localhost/stabber",
         "<presence id='*' lang='en' to='stabber@localhost/profanity' from='testroom@conference.localhost/stabber'>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='http://profanity-im.github.io' ver='*'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' node='*' ver='*'/>"
             "<x xmlns='http://jabber.org/protocol/muc#user'>"
                 "<item role='moderator' jid='stabber@localhost/profanity' affiliation='admin'/>"
             "</x>"

tests/functionaltests/test_presence.c

@@ -19,7 +19,7 @@ presence_online(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<status>online</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -36,7 +36,7 @@ presence_online_with_message(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<status>Hi there</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -54,7 +54,7 @@ presence_away(void **state)
         "<presence id='*'>"
             "<show>away</show>"
             "<status>away</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -72,7 +72,7 @@ presence_away_with_message(void **state)
         "<presence id='*'>"
             "<show>away</show>"
             "<status>I'm not here for a bit</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -90,7 +90,7 @@ presence_xa(void **state)
         "<presence id='*'>"
             "<show>xa</show>"
             "<status>xa</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -108,7 +108,7 @@ presence_xa_with_message(void **state)
         "<presence id='*'>"
             "<show>xa</show>"
             "<status>Gone to the shops</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -126,7 +126,7 @@ presence_dnd(void **state)
         "<presence id='*'>"
             "<show>dnd</show>"
             "<status>dnd</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -144,7 +144,7 @@ presence_dnd_with_message(void **state)
         "<presence id='*'>"
             "<show>dnd</show>"
             "<status>Working</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -162,7 +162,7 @@ presence_chat(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>chat</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -180,7 +180,7 @@ presence_chat_with_message(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -197,7 +197,7 @@ presence_set_priority(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -212,7 +212,7 @@ presence_includes_priority(void **state)
     assert_true(stbbr_received(
         "<presence id='*'>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 
@@ -223,7 +223,7 @@ presence_includes_priority(void **state)
             "<priority>25</priority>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }
@@ -239,7 +239,7 @@ presence_keeps_status(void **state)
         "<presence id='*'>"
             "<show>chat</show>"
             "<status>Free to talk</status>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 
@@ -250,7 +250,7 @@ presence_keeps_status(void **state)
             "<show>chat</show>"
             "<status>Free to talk</status>"
             "<priority>25</priority>"
-            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='http://profanity-im.github.io'/>"
+            "<c hash='sha-1' xmlns='http://jabber.org/protocol/caps' ver='*' node='*'/>"
         "</presence>"
     ));
 }

tests/unittests/omemo/test_omemo_crypto.c

@@ -0,0 +1,152 @@
+/*
+ * test_omemo_crypto.c
+ *
+ * Unit tests for the OMEMO AES-256-GCM file crypto (src/omemo/crypto.c).
+ * The decrypt direction streams plaintext before the tag is checked, so
+ * callers rely on the returned error code to discard unverified output —
+ * these tests pin that contract (issue #146, REQ-CRY-06).
+ */
+
+#include "config.h"
+
+#include <glib.h>
+#include <stdio.h>
+#include <string.h>
+#include "prof_cmocka.h"
+
+#ifdef HAVE_OMEMO
+
+#include "omemo/omemo.h"
+#include "omemo/crypto.h"
+
+#define TAG_LENGTH 16
+
+static const unsigned char PLAINTEXT[] = "at-rest integrity check payload: 0123456789abcdef";
+
+// gcrypt secure memory must be set up exactly once per process
+static int
+_crypto_init_once(void)
+{
+    static gboolean done = FALSE;
+    static int rc = 0;
+    if (!done) {
+        rc = omemo_crypto_init();
+        done = TRUE;
+    }
+    return rc;
+}
+
+static off_t
+_file_size(FILE* fh)
+{
+    fseeko(fh, 0, SEEK_END);
+    off_t size = ftello(fh);
+    rewind(fh);
+    return size;
+}
+
+// encrypt PLAINTEXT with a fixed key/nonce into a fresh tmpfile
+static FILE*
+_encrypted_tmpfile(unsigned char* key, unsigned char* nonce)
+{
+    memset(key, 0x42, OMEMO_AESGCM_KEY_LENGTH);
+    memset(nonce, 0x24, OMEMO_AESGCM_NONCE_LENGTH);
+
+    FILE* plain = tmpfile();
+    FILE* cipher = tmpfile();
+    assert_non_null(plain);
+    assert_non_null(cipher);
+
+    assert_int_equal(sizeof(PLAINTEXT), fwrite(PLAINTEXT, 1, sizeof(PLAINTEXT), plain));
+    rewind(plain);
+
+    assert_int_equal(GPG_ERR_NO_ERROR,
+                     aes256gcm_crypt_file(plain, cipher, (off_t)sizeof(PLAINTEXT), key, nonce, TRUE));
+    fclose(plain);
+    rewind(cipher);
+    return cipher;
+}
+
+// corrupt one byte at offset (negative counts from the end), return reopened stream
+static FILE*
+_flip_byte(FILE* cipher, long offset)
+{
+    off_t size = _file_size(cipher);
+    unsigned char* buf = g_malloc(size);
+    assert_int_equal(size, fread(buf, 1, size, cipher));
+    fclose(cipher);
+
+    long pos = offset >= 0 ? offset : (long)size + offset;
+    buf[pos] ^= 0xFF;
+
+    FILE* tampered = tmpfile();
+    assert_non_null(tampered);
+    assert_int_equal(size, fwrite(buf, 1, size, tampered));
+    rewind(tampered);
+    g_free(buf);
+    return tampered;
+}
+
+void
+aes256gcm_crypt_file__roundtrip_succeeds(void** state)
+{
+    assert_int_equal(0, _crypto_init_once());
+
+    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
+    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
+    FILE* cipher = _encrypted_tmpfile(key, nonce);
+
+    off_t cipher_size = _file_size(cipher);
+    assert_int_equal((off_t)sizeof(PLAINTEXT) + TAG_LENGTH, cipher_size);
+
+    FILE* decrypted = tmpfile();
+    assert_non_null(decrypted);
+    assert_int_equal(GPG_ERR_NO_ERROR,
+                     aes256gcm_crypt_file(cipher, decrypted, cipher_size, key, nonce, FALSE));
+
+    unsigned char readback[sizeof(PLAINTEXT)];
+    rewind(decrypted);
+    assert_int_equal(sizeof(PLAINTEXT), fread(readback, 1, sizeof(readback), decrypted));
+    assert_memory_equal(PLAINTEXT, readback, sizeof(PLAINTEXT));
+
+    fclose(cipher);
+    fclose(decrypted);
+}
+
+void
+aes256gcm_crypt_file__rejects_tampered_tag(void** state)
+{
+    assert_int_equal(0, _crypto_init_once());
+
+    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
+    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
+    FILE* cipher = _flip_byte(_encrypted_tmpfile(key, nonce), -1); // last tag byte
+
+    FILE* decrypted = tmpfile();
+    assert_non_null(decrypted);
+    gcry_error_t res = aes256gcm_crypt_file(cipher, decrypted, _file_size(cipher), key, nonce, FALSE);
+    assert_int_not_equal(GPG_ERR_NO_ERROR, res);
+
+    fclose(cipher);
+    fclose(decrypted);
+}
+
+void
+aes256gcm_crypt_file__rejects_tampered_ciphertext(void** state)
+{
+    assert_int_equal(0, _crypto_init_once());
+
+    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
+    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
+    FILE* cipher = _flip_byte(_encrypted_tmpfile(key, nonce), 0); // first payload byte
+
+    FILE* decrypted = tmpfile();
+    assert_non_null(decrypted);
+    gcry_error_t res = aes256gcm_crypt_file(cipher, decrypted, _file_size(cipher), key, nonce, FALSE);
+    assert_int_not_equal(GPG_ERR_NO_ERROR, res);
+
+    fclose(cipher);
+    fclose(decrypted);
+}
+
+#endif

tests/unittests/omemo/test_omemo_crypto.h

@@ -0,0 +1,8 @@
+/* test_omemo_crypto.h
+ *
+ * Unit tests for OMEMO AES-256-GCM file crypto (issue #146, REQ-CRY-06)
+ */
+
+void aes256gcm_crypt_file__roundtrip_succeeds(void** state);
+void aes256gcm_crypt_file__rejects_tampered_tag(void** state);
+void aes256gcm_crypt_file__rejects_tampered_ciphertext(void** state);

tests/unittests/test_ai_client.c

@@ -62,10 +62,12 @@ test_ai_add_provider(void** state)
     assert_string_equal("custom", provider->name);
     assert_string_equal("https://custom.api.com/v1", provider->api_url);
 
-    /* Update existing provider (borrowed pointer, same as the create path) */
+    /* Update existing provider (returns ref; caller owns it) */
     AIProvider* updated = ai_add_provider("custom", "https://new.api.com/v1");
     assert_non_null(updated);
     assert_string_equal("https://new.api.com/v1", updated->api_url);
+
+    ai_provider_unref(updated);
 }
 
 void
@@ -327,10 +329,11 @@ test_ai_add_provider_update_existing(void** state)
     assert_non_null(provider);
     assert_string_equal("https://first.api.com/v1", provider->api_url);
 
-    /* Update the same provider (borrowed pointer) */
+    /* Update the same provider (returns ref) */
     provider = ai_add_provider("custom", "https://second.api.com/v1");
     assert_non_null(provider);
     assert_string_equal("https://second.api.com/v1", provider->api_url);
+    ai_provider_unref(provider);
 }
 
 void
@@ -619,17 +622,9 @@ test_ai_set_provider_setting_reserved_key(void** state)
     /* Reserved payload keys are rejected (would duplicate fixed fields) */
     assert_false(ai_set_provider_setting("p_reserved_keys", "model", "x"));
     assert_false(ai_set_provider_setting("p_reserved_keys", "messages", "[]"));
-    assert_false(ai_set_provider_setting("p_reserved_keys", "input", "[]"));
     assert_false(ai_set_provider_setting("p_reserved_keys", "stream", "true"));
     assert_null(ai_get_provider_setting("p_reserved_keys", "model"));
 
-    /* "store" is a legitimate chat-completions parameter and overrides the
-     * responses-flavour "store":false default, so it stays settable */
-    assert_true(ai_set_provider_setting("p_reserved_keys", "store", "true"));
-    auto_gchar gchar* store = ai_get_provider_setting("p_reserved_keys", "store");
-    assert_non_null(store);
-    assert_string_equal("true", store);
-
     /* Ordinary keys still work */
     assert_true(ai_set_provider_setting("p_reserved_keys", "temperature", "0.7"));
     auto_gchar gchar* temp = ai_get_provider_setting("p_reserved_keys", "temperature");
@@ -637,86 +632,6 @@ test_ai_set_provider_setting_reserved_key(void** state)
     assert_string_equal("0.7", temp);
 }
 
-void
-test_ai_get_provider_setting_keys(void** state)
-{
-    ai_add_provider("p_setting_keys", "https://example.test/skeys/");
-
-    /* No settings yet, unknown provider, NULL — all yield NULL */
-    assert_null(ai_get_provider_setting_keys("p_setting_keys"));
-    assert_null(ai_get_provider_setting_keys("nonexistent"));
-    assert_null(ai_get_provider_setting_keys(NULL));
-
-    ai_set_provider_setting("p_setting_keys", "temperature", "0.7");
-    ai_set_provider_setting("p_setting_keys", "reasoning_effort", "high");
-
-    /* Both keys listed (order is hash-defined, assert membership) */
-    GList* keys = ai_get_provider_setting_keys("p_setting_keys");
-    assert_int_equal(2, g_list_length(keys));
-    assert_non_null(g_list_find_custom(keys, "temperature", (GCompareFunc)g_strcmp0));
-    assert_non_null(g_list_find_custom(keys, "reasoning_effort", (GCompareFunc)g_strcmp0));
-    g_list_free_full(keys, g_free);
-
-    /* Removing a setting removes its key */
-    ai_set_provider_setting("p_setting_keys", "temperature", NULL);
-    keys = ai_get_provider_setting_keys("p_setting_keys");
-    assert_int_equal(1, g_list_length(keys));
-    assert_string_equal("reasoning_effort", keys->data);
-    g_list_free_full(keys, g_free);
-}
-
-void
-test_ai_set_provider_api_type(void** state)
-{
-    ai_add_provider("p_api_type", "https://example.test/at/");
-
-    /* Default is auto */
-    assert_int_equal(AI_API_TYPE_AUTO, ai_get_provider_api_type("p_api_type"));
-
-    /* Pin each flavour explicitly */
-    assert_true(ai_set_provider_api_type("p_api_type", "chat-completions"));
-    assert_int_equal(AI_API_TYPE_CHAT_COMPLETIONS, ai_get_provider_api_type("p_api_type"));
-
-    assert_true(ai_set_provider_api_type("p_api_type", "responses"));
-    assert_int_equal(AI_API_TYPE_RESPONSES, ai_get_provider_api_type("p_api_type"));
-
-    /* auto resets to detection */
-    assert_true(ai_set_provider_api_type("p_api_type", "auto"));
-    assert_int_equal(AI_API_TYPE_AUTO, ai_get_provider_api_type("p_api_type"));
-
-    /* Invalid values and unknown providers are rejected */
-    assert_false(ai_set_provider_api_type("p_api_type", "v2"));
-    assert_false(ai_set_provider_api_type("p_api_type", NULL));
-    assert_false(ai_set_provider_api_type("nonexistent", "responses"));
-    assert_false(ai_set_provider_api_type(NULL, "responses"));
-
-    /* Unknown provider reads as auto */
-    assert_int_equal(AI_API_TYPE_AUTO, ai_get_provider_api_type("nonexistent"));
-    assert_int_equal(AI_API_TYPE_AUTO, ai_get_provider_api_type(NULL));
-}
-
-void
-test_ai_api_type_string_round_trip(void** state)
-{
-    AIApiType type = AI_API_TYPE_AUTO;
-
-    assert_true(ai_api_type_from_string("responses", &type));
-    assert_int_equal(AI_API_TYPE_RESPONSES, type);
-    assert_string_equal("responses", ai_api_type_to_string(type));
-
-    assert_true(ai_api_type_from_string("chat-completions", &type));
-    assert_int_equal(AI_API_TYPE_CHAT_COMPLETIONS, type);
-    assert_string_equal("chat-completions", ai_api_type_to_string(type));
-
-    assert_true(ai_api_type_from_string("auto", &type));
-    assert_int_equal(AI_API_TYPE_AUTO, type);
-    assert_string_equal("auto", ai_api_type_to_string(type));
-
-    assert_false(ai_api_type_from_string("completions", &type));
-    assert_false(ai_api_type_from_string("", &type));
-    assert_false(ai_api_type_from_string(NULL, &type));
-}
-
 void
 test_ai_get_provider_setting(void** state)
 {
@@ -1022,133 +937,12 @@ test_ai_parse_response_openai_content(void** state)
 }
 
 void
-test_ai_parse_response_responses_output_text(void** state)
+test_ai_parse_response_legacy_text_format_unsupported(void** state)
 {
-    /* Responses API: "content" is an array of typed parts; the inner "text"
-     * of the output_text part is the assistant message. */
+    /* Legacy Perplexity /v1/agent format: "content" is an array, not a string.
+     * Dropped with the chat-completions alignment, so parsing yields NULL. */
     const gchar* json = "{\"output\":[{\"content\":[{\"text\":\"Search result\",\"type\":\"output_text\"}]}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("Search result", out);
-}
-
-void
-test_ai_parse_response_responses_full_envelope(void** state)
-{
-    /* Realistic responses body: a reasoning item precedes the message item;
-     * the parser must still land on the message's output_text. */
-    const gchar* json = "{\"id\":\"resp_1\",\"object\":\"response\",\"status\":\"completed\","
-                        "\"output\":["
-                        "{\"id\":\"rs_1\",\"type\":\"reasoning\",\"summary\":[]},"
-                        "{\"id\":\"msg_1\",\"type\":\"message\",\"status\":\"completed\",\"role\":\"assistant\","
-                        "\"content\":[{\"type\":\"output_text\",\"annotations\":[],\"text\":\"Hello!\"}]}"
-                        "]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("Hello!", out);
-}
-
-void
-test_ai_parse_response_choices_win_over_output(void** state)
-{
-    /* A chat-completions envelope is authoritative even if the content
-     * happens to mention "output". */
-    const gchar* json = "{\"choices\":[{\"message\":{\"content\":\"chat result\"}}],\"output\":[{\"content\":[{\"text\":\"wrong\"}]}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("chat result", out);
-}
-
-void
-test_ai_parse_response_responses_reasoning_summary_skipped(void** state)
-{
-    /* A reasoning item with a non-empty summary precedes the message item;
-     * the summary's "text" must not be mistaken for the assistant reply. */
-    const gchar* json = "{\"output\":["
-                        "{\"id\":\"rs_1\",\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"User asks X\"}]},"
-                        "{\"id\":\"msg_1\",\"type\":\"message\",\"status\":\"completed\",\"role\":\"assistant\","
-                        "\"content\":[{\"type\":\"output_text\",\"annotations\":[],\"text\":\"Actual answer\"}]}"
-                        "]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("Actual answer", out);
-}
-
-void
-test_ai_parse_response_responses_reasoning_only_returns_null(void** state)
-{
-    /* An incomplete/truncated body with only a reasoning item (no message
-     * "content" array at all) must yield a parse failure, not leak the
-     * reasoning summary's "text" as the assistant reply. */
-    const gchar* json = "{\"status\":\"incomplete\",\"output\":["
-                        "{\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"secret reasoning\"}]}"
-                        "]}";
-    gchar* out = ai_parse_response(json);
-    assert_null(out);
-}
-
-void
-test_ai_parse_response_responses_reasoning_after_message_skipped(void** state)
-{
-    /* A reasoning item ordered after the message, with the part's "text"
-     * preceding "type":"output_text": the forward scan must stay inside the
-     * part's object and the backscan must find the real answer. */
-    const gchar* json = "{\"output\":["
-                        "{\"type\":\"message\",\"content\":[{\"text\":\"answer\",\"type\":\"output_text\"}]},"
-                        "{\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"secret\"}]}"
-                        "]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("answer", out);
-}
-
-void
-test_ai_parse_response_responses_empty_content_not_leaked(void** state)
-{
-    /* An empty content array followed by a reasoning item must yield a parse
-     * failure; the scan must not escape the array and return the summary. */
-    const gchar* json = "{\"output\":["
-                        "{\"type\":\"message\",\"content\":[]},"
-                        "{\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"secret\"}]}"
-                        "]}";
-    gchar* out = ai_parse_response(json);
-    assert_null(out);
-}
-
-void
-test_ai_parse_response_responses_text_value_before_later_item(void** state)
-{
-    /* A reply that is exactly "text" plus a reasoning item after the message:
-     * the backscan's own extraction must also stay inside the part's object. */
-    const gchar* json = "{\"output\":["
-                        "{\"type\":\"message\",\"content\":[{\"text\":\"text\",\"type\":\"output_text\"}]},"
-                        "{\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"secret\"}]}"
-                        "]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("text", out);
-}
-
-void
-test_ai_parse_response_choices_in_string_value(void** state)
-{
-    /* "choices" occurring as a string value must not hijack a valid
-     * responses envelope. */
-    const gchar* json = "{\"kind\":\"choices\",\"output\":[{\"content\":[{\"type\":\"output_text\",\"text\":\"hi\"}]}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("hi", out);
-}
-
-void
-test_ai_parse_response_content_before_choices(void** state)
-{
-    /* Nonstandard body: a top-level content string precedes an empty
-     * choices array; the bare-content fallback must still find it. */
-    const gchar* json = "{\"content\":\"hi\",\"choices\":[]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("hi", out);
+    assert_null(ai_parse_response(json));
 }
 
 void
@@ -1161,54 +955,6 @@ test_ai_parse_response_content_preferred_over_text(void** state)
     assert_string_equal("from content field", out);
 }
 
-void
-test_ai_parse_response_responses_brace_in_text(void** state)
-{
-    /* Responses part with "text" before "type":"output_text" and a '{' inside
-     * the answer: the nearest preceding "text" key must be extracted, not a
-     * brace inside the string value. */
-    const gchar* json = "{\"output\":[{\"content\":[{\"text\":\"use { here\",\"type\":\"output_text\"}]}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("use { here", out);
-}
-
-void
-test_ai_parse_response_choices_logprobs_before_content(void** state)
-{
-    /* A non-string "content" (logprobs array) ordered before message.content
-     * must not defeat extraction; anchoring on "message" finds the reply. */
-    const gchar* json = "{\"choices\":[{\"logprobs\":{\"content\":[{\"token\":\"hi\"}]},"
-                        "\"message\":{\"role\":\"assistant\",\"content\":\"real answer\"}}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("real answer", out);
-}
-
-void
-test_ai_parse_response_reasoning_not_leaked_without_text(void** state)
-{
-    /* An output_text part with no "text" at all (truncated body) must yield a
-     * parse failure, not leak the preceding reasoning summary's text. */
-    const gchar* json = "{\"output\":["
-                        "{\"type\":\"reasoning\",\"summary\":[{\"type\":\"summary_text\",\"text\":\"secret\"}]},"
-                        "{\"type\":\"message\",\"content\":[{\"type\":\"output_text\",\"annotations\":[]}]}"
-                        "]}";
-    gchar* out = ai_parse_response(json);
-    assert_null(out);
-}
-
-void
-test_ai_parse_response_responses_text_value_text(void** state)
-{
-    /* A reply that is exactly the string "text" must not confuse the
-     * backscan (the value's own quoted bytes match the key needle). */
-    const gchar* json = "{\"output\":[{\"content\":[{\"text\":\"text\",\"type\":\"output_text\"}]}]}";
-    auto_gchar gchar* out = ai_parse_response(json);
-    assert_non_null(out);
-    assert_string_equal("text", out);
-}
-
 void
 test_ai_parse_response_escaped_quote(void** state)
 {
@@ -1746,26 +1492,6 @@ test_ai_prefs_round_trip_remove_key(void** state)
     assert_null(after);
 }
 
-void
-test_ai_prefs_round_trip_api_type(void** state)
-{
-    ai_add_provider("p_persist_api_type", "https://example.test/pat/");
-    assert_true(ai_set_provider_api_type("p_persist_api_type", "chat-completions"));
-
-    ai_client_shutdown();
-    ai_client_init();
-
-    assert_int_equal(AI_API_TYPE_CHAT_COMPLETIONS, ai_get_provider_api_type("p_persist_api_type"));
-
-    /* Setting auto removes the persisted value */
-    assert_true(ai_set_provider_api_type("p_persist_api_type", "auto"));
-
-    ai_client_shutdown();
-    ai_client_init();
-
-    assert_int_equal(AI_API_TYPE_AUTO, ai_get_provider_api_type("p_persist_api_type"));
-}
-
 void
 test_ai_prefs_multiple_providers_persist(void** state)
 {

tests/unittests/test_ai_client.h

@@ -44,9 +44,6 @@ void test_ai_set_provider_default_model(void** state);
 void test_ai_get_provider_default_model(void** state);
 void test_ai_set_provider_setting(void** state);
 void test_ai_set_provider_setting_reserved_key(void** state);
-void test_ai_get_provider_setting_keys(void** state);
-void test_ai_set_provider_api_type(void** state);
-void test_ai_api_type_string_round_trip(void** state);
 void test_ai_get_provider_setting(void** state);
 /* Model caching tests */
 void test_ai_models_are_fresh_initial(void** state);
@@ -68,21 +65,8 @@ int ai_client_teardown_with_prefs(void** state);
 
 /* Chat response parser tests (ai_parse_response) */
 void test_ai_parse_response_openai_content(void** state);
-void test_ai_parse_response_responses_output_text(void** state);
-void test_ai_parse_response_responses_full_envelope(void** state);
-void test_ai_parse_response_responses_reasoning_summary_skipped(void** state);
-void test_ai_parse_response_choices_win_over_output(void** state);
-void test_ai_parse_response_choices_in_string_value(void** state);
-void test_ai_parse_response_content_before_choices(void** state);
+void test_ai_parse_response_legacy_text_format_unsupported(void** state);
 void test_ai_parse_response_content_preferred_over_text(void** state);
-void test_ai_parse_response_responses_brace_in_text(void** state);
-void test_ai_parse_response_choices_logprobs_before_content(void** state);
-void test_ai_parse_response_reasoning_not_leaked_without_text(void** state);
-void test_ai_parse_response_responses_reasoning_only_returns_null(void** state);
-void test_ai_parse_response_responses_reasoning_after_message_skipped(void** state);
-void test_ai_parse_response_responses_empty_content_not_leaked(void** state);
-void test_ai_parse_response_responses_text_value_before_later_item(void** state);
-void test_ai_parse_response_responses_text_value_text(void** state);
 void test_ai_parse_response_escaped_quote(void** state);
 void test_ai_parse_response_newline_escape(void** state);
 void test_ai_parse_response_empty_content(void** state);
@@ -145,7 +129,6 @@ void test_ai_parse_models_multiple_models(void** state);
 /* Prefs round-trip tests */
 void test_ai_prefs_round_trip_api_key(void** state);
 void test_ai_prefs_round_trip_remove_key(void** state);
-void test_ai_prefs_round_trip_api_type(void** state);
 void test_ai_prefs_multiple_providers_persist(void** state);
 
 /* Autocomplete deeper coverage */

tests/unittests/test_common.c

@@ -1384,3 +1384,55 @@ str_xml_sanitize__strips_illegal_characters(void** state)
     assert_string_equal("UTF-8: üñîçøðé  and more", res5);
     g_free(res5);
 }
+
+void
+redact_secrets__masks_credentials(void** state)
+{
+    // NULL input
+    assert_null(redact_secrets(NULL));
+
+    // Plain text and non-secret XML pass through unchanged
+    gchar* res1 = redact_secrets("hello world");
+    assert_string_equal("hello world", res1);
+    g_free(res1);
+
+    gchar* res2 = redact_secrets("<message><body>secret-looking text</body></message>");
+    assert_string_equal("<message><body>secret-looking text</body></message>", res2);
+    g_free(res2);
+
+    // SASL auth payload is redacted, envelope kept
+    gchar* res3 = redact_secrets("SENT: <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>AGFsaWNlAHBhc3N3b3Jk</auth>");
+    assert_string_equal("SENT: <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>[REDACTED]</auth>", res3);
+    g_free(res3);
+
+    // SASL challenge/response round-trip
+    gchar* res4 = redact_secrets("<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>cj1abc</challenge>");
+    assert_string_equal("<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>[REDACTED]</challenge>", res4);
+    g_free(res4);
+
+    gchar* res5 = redact_secrets("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>Yz1iaXdz</response>");
+    assert_string_equal("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>[REDACTED]</response>", res5);
+    g_free(res5);
+
+    // Empty SASL response element has no content to redact
+    gchar* res6 = redact_secrets("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>");
+    assert_string_equal("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>", res6);
+    g_free(res6);
+
+    // XEP-0077 registration: password redacted, username kept
+    gchar* res7 = redact_secrets("<query xmlns='jabber:iq:register'><username>alice</username><password>hunter2</password></query>");
+    assert_string_equal("<query xmlns='jabber:iq:register'><username>alice</username><password>[REDACTED]</password></query>", res7);
+    g_free(res7);
+
+    // XEP-0078 legacy auth: password-derived digest redacted
+    gchar* res8 = redact_secrets("<query xmlns='jabber:iq:auth'><username>alice</username><digest>48fc78be9ec8f86d8ce1c39ebd7a5b4c9d0e2f13</digest><resource>tui</resource></query>");
+    assert_string_equal("<query xmlns='jabber:iq:auth'><username>alice</username><digest>[REDACTED]</digest><resource>tui</resource></query>", res8);
+    g_free(res8);
+
+    // invalid UTF-8 must not make redaction fail open
+    gchar* res9 = redact_secrets("\xFF garbage <password>hunter2</password>");
+    assert_non_null(res9);
+    assert_null(strstr(res9, "hunter2"));
+    assert_non_null(strstr(res9, "[REDACTED]"));
+    g_free(res9);
+}

tests/unittests/test_common.h

@@ -64,5 +64,6 @@ void valid_tls_policy_option__is__correct_for_various_inputs(void** state);
 void get_mentions__tests__various(void** state);
 void release_is_new__tests__various(void** state);
 void str_xml_sanitize__strips_illegal_characters(void** state);
+void redact_secrets__masks_credentials(void** state);
 
 #endif

tests/unittests/unittests.c

@@ -48,6 +48,7 @@
 #include "test_ai_client.h"
 #include "test_database_export.h"
 #include "test_database_stress.h"
+#include "omemo/test_omemo_crypto.h"
 
 #define muc_unit_test(f) cmocka_unit_test_setup_teardown(f, muc_before_test, muc_after_test)
 
@@ -687,6 +688,12 @@ main(int argc, char* argv[])
         cmocka_unit_test(get_mentions__tests__various),
         cmocka_unit_test(release_is_new__tests__various),
         cmocka_unit_test(str_xml_sanitize__strips_illegal_characters),
+        cmocka_unit_test(redact_secrets__masks_credentials),
+#ifdef HAVE_OMEMO
+        cmocka_unit_test(aes256gcm_crypt_file__roundtrip_succeeds),
+        cmocka_unit_test(aes256gcm_crypt_file__rejects_tampered_tag),
+        cmocka_unit_test(aes256gcm_crypt_file__rejects_tampered_ciphertext),
+#endif
 
         cmocka_unit_test_setup_teardown(plugins_get_command_names__returns__no_commands,
                                         load_preferences,
@@ -753,9 +760,6 @@ main(int argc, char* argv[])
         cmocka_unit_test_setup_teardown(test_ai_get_provider_default_model, ai_client_setup, ai_client_teardown),
         cmocka_unit_test_setup_teardown(test_ai_set_provider_setting, ai_client_setup, ai_client_teardown),
         cmocka_unit_test_setup_teardown(test_ai_set_provider_setting_reserved_key, ai_client_setup, ai_client_teardown),
-        cmocka_unit_test_setup_teardown(test_ai_get_provider_setting_keys, ai_client_setup, ai_client_teardown),
-        cmocka_unit_test_setup_teardown(test_ai_set_provider_api_type, ai_client_setup, ai_client_teardown),
-        cmocka_unit_test(test_ai_api_type_string_round_trip),
         cmocka_unit_test_setup_teardown(test_ai_get_provider_setting, ai_client_setup, ai_client_teardown),
         /* Model caching tests */
         cmocka_unit_test_setup_teardown(test_ai_models_are_fresh_initial, ai_client_setup, ai_client_teardown),
@@ -778,21 +782,8 @@ main(int argc, char* argv[])
         cmocka_unit_test(test_ai_json_escape_backslash_quote),
         /* Chat response parser */
         cmocka_unit_test(test_ai_parse_response_openai_content),
-        cmocka_unit_test(test_ai_parse_response_responses_output_text),
-        cmocka_unit_test(test_ai_parse_response_responses_full_envelope),
-        cmocka_unit_test(test_ai_parse_response_responses_reasoning_summary_skipped),
-        cmocka_unit_test(test_ai_parse_response_choices_win_over_output),
-        cmocka_unit_test(test_ai_parse_response_choices_in_string_value),
-        cmocka_unit_test(test_ai_parse_response_content_before_choices),
+        cmocka_unit_test(test_ai_parse_response_legacy_text_format_unsupported),
         cmocka_unit_test(test_ai_parse_response_content_preferred_over_text),
-        cmocka_unit_test(test_ai_parse_response_responses_brace_in_text),
-        cmocka_unit_test(test_ai_parse_response_choices_logprobs_before_content),
-        cmocka_unit_test(test_ai_parse_response_reasoning_not_leaked_without_text),
-        cmocka_unit_test(test_ai_parse_response_responses_reasoning_only_returns_null),
-        cmocka_unit_test(test_ai_parse_response_responses_reasoning_after_message_skipped),
-        cmocka_unit_test(test_ai_parse_response_responses_empty_content_not_leaked),
-        cmocka_unit_test(test_ai_parse_response_responses_text_value_before_later_item),
-        cmocka_unit_test(test_ai_parse_response_responses_text_value_text),
         cmocka_unit_test(test_ai_parse_response_escaped_quote),
         cmocka_unit_test(test_ai_parse_response_newline_escape),
         cmocka_unit_test(test_ai_parse_response_empty_content),
@@ -847,7 +838,6 @@ main(int argc, char* argv[])
         /* Prefs round-trip (uses prefs+ai setup) */
         cmocka_unit_test_setup_teardown(test_ai_prefs_round_trip_api_key, ai_client_setup_with_prefs, ai_client_teardown_with_prefs),
         cmocka_unit_test_setup_teardown(test_ai_prefs_round_trip_remove_key, ai_client_setup_with_prefs, ai_client_teardown_with_prefs),
-        cmocka_unit_test_setup_teardown(test_ai_prefs_round_trip_api_type, ai_client_setup_with_prefs, ai_client_teardown_with_prefs),
         cmocka_unit_test_setup_teardown(test_ai_prefs_multiple_providers_persist, ai_client_setup_with_prefs, ai_client_teardown_with_prefs),
         /* Autocomplete deeper coverage */
         cmocka_unit_test_setup_teardown(test_ai_providers_find_after_remove_skips_removed, ai_client_setup, ai_client_teardown),

tests/unittests/xmpp/stub_xmpp.c

@@ -500,6 +500,11 @@ caps_jid_has_feature(const char* const jid, const char* const feature)
     return FALSE;
 }
 
+void
+caps_cache_clear(void)
+{
+}
+
 gboolean
 bookmark_add(const char* jid, const char* nick, const char* password, const char* autojoin_str, const char* name)
 {