Merge pull request #284 from basecamp/mention-menu-spacing

Fix mention menu spacing and check the registry login before releasing
Check the registry login before releasing
2026-10-28 00:16:48 +09:00 · 2026-09-26 13:03:34 +02:00 · 2026-09-26 11:16:03 +02:00 · 2026-09-26 11:16:03 +02:00 · 2026-09-26 10:43:55 +02:00 · 2026-09-26 10:38:13 +02:00
114 changed files with 2689 additions and 961 deletions
@@ -50,3 +50,6 @@

 # Ignore test files
 /test/
+
+# Agent session state — worktrees under .claude/ are whole extra checkouts of this repo
+.claude
@@ -20,13 +20,12 @@ updates:
      semver-minor-days: 3
      semver-patch-days: 2
      default-days: 7
+      exclude:
+        - "brakeman"

-  - package-ecosystem: docker
-    directory: "/"
-    schedule:
-      interval: weekly
-    cooldown:
-      semver-major-days: 7
-      semver-minor-days: 3
-      semver-patch-days: 2
-      default-days: 7
+  # No docker ecosystem. Our base image tag is a build arg
+  # (`FROM ruby:$RUBY_VERSION-slim`), which the updater cannot read, so the
+  # entry only ever matched nothing — worse than no entry, because it looked
+  # like coverage. Ruby base image bumps are a manual, reviewed step here, as
+  # they are across the rest of the fleet. Keep Dockerfile, Dockerfile-export
+  # and .ruby-version on the same version by hand.
@@ -16,12 +16,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
        with:
          ruby-version: .ruby-version
          bundler-cache: true
@@ -35,12 +35,12 @@ jobs:
      contents: read
    steps:
      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
        with:
          ruby-version: .ruby-version
          bundler-cache: true
@@ -55,15 +55,15 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run actionlint
-        uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          advanced-security: false

@@ -82,12 +82,12 @@ jobs:
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg

      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
        env:
          REDIS_URL: redis://localhost:6379/0
        with:
@@ -112,12 +112,12 @@ jobs:
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg

      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
        env:
          REDIS_URL: redis://localhost:6379/0
        with:
@@ -44,15 +44,15 @@ jobs:
      IMAGE_NAME: ${{ github.repository }}
    steps:
      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Log in to GHCR
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -80,7 +80,7 @@ jobs:

      - name: Extract Docker metadata (tags, labels) with arch suffix
        id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ steps.vars.outputs.canonical }}
          tags: |
@@ -98,7 +98,7 @@ jobs:

      - name: Build and push (${{ matrix.platform }})
        id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
@@ -118,7 +118,7 @@ jobs:

      - name: Attest image provenance (per-arch)
        if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ steps.vars.outputs.canonical }}
          subject-digest: ${{ steps.build.outputs.digest }}
@@ -139,10 +139,10 @@ jobs:
      IMAGE_NAME: ${{ github.repository }}
    steps:
      - name: Set up Docker Buildx (for imagetools)
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Log in to GHCR
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -159,7 +159,7 @@ jobs:

      - name: Compute base tags (no suffix)
        id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ steps.vars.outputs.canonical }}
          tags: |
@@ -207,7 +207,7 @@ jobs:
          done <<< "$tags"

      - name: Install Cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Cosign sign all tags (keyless OIDC)
        shell: bash
@@ -1 +1 @@
-3.4.5
+3.4.10
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1

 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.5
+ARG RUBY_VERSION=3.4.10
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base

 # Rails app lives here
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1

 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=3.4.10
 FROM ruby:$RUBY_VERSION-slim as base

 # Install the tools we need
@@ -26,6 +26,9 @@ gem "importmap-rails", github: "rails/importmap-rails"
 gem "turbo-rails", github: "hotwired/turbo-rails"
 gem "stimulus-rails"

+# Rich text
+gem "lexxy", "~> 0.9.24"
+
 # Media handling
 gem "image_processing", ">= 1.2"

@@ -41,6 +44,7 @@ gem "rails_autolink"
 gem "geared_pagination"
 gem "jbuilder"
 gem "net-http-persistent"
+gem "surfguard", github: "basecamp/surfguard" # The SSRF address policy behind RestrictedHTTP
 gem "kredis"
 gem "platform_agent"
 gem "thruster"
@@ -1,3 +1,9 @@
+GIT
+  remote: https://github.com/basecamp/surfguard.git
+  revision: 59e278c01a537755f22791429051891949231ead
+  specs:
+    surfguard (0.2.0)
+
 GIT
  remote: https://github.com/hotwired/turbo-rails.git
  revision: 30cd8fcc6f82c1ad4edd1ed6069ba878f21f02b3
@@ -137,7 +143,7 @@ GEM
    bcrypt (3.1.22)
    benchmark (0.5.0)
    bigdecimal (3.3.1)
-    brakeman (8.0.5)
+    brakeman (8.0.6)
      racc
    builder (3.3.0)
    bundler-audit (0.9.3)
@@ -168,6 +174,7 @@ GEM
    erubi (1.13.1)
    faker (3.5.2)
      i18n (>= 1.8.11, < 2)
+    ffi (1.17.2)
    ffi (1.17.2-aarch64-linux-gnu)
    ffi (1.17.2-arm64-darwin)
    ffi (1.17.2-x86_64-darwin)
@@ -191,7 +198,7 @@ GEM
    jbuilder (2.14.1)
      actionview (>= 7.0.0)
      activesupport (>= 7.0.0)
-    json (2.20.0)
+    json (2.21.2)
    jwt (3.2.0)
      base64
    kredis (1.8.0)
@@ -199,12 +206,14 @@ GEM
      activesupport (>= 6.0.0)
      redis (>= 4.2, < 6)
    language_server-protocol (3.17.0.5)
+    lexxy (0.9.24)
+      rails (>= 8.0.2)
    lint_roller (1.1.0)
    logger (1.7.0)
    loofah (2.25.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
      logger
      mini_mime (>= 0.1.1)
      net-imap
@@ -216,7 +225,7 @@ GEM
      logger
    mini_mime (1.1.5)
    minitest (5.26.2)
-    mocha (2.7.1)
+    mocha (3.1.0)
      ruby2_keywords (>= 0.0.5)
    mono_logger (1.1.2)
    multi_json (1.17.0)
@@ -242,7 +251,7 @@ GEM
      racc (~> 1.4)
    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
-    openssl (3.3.0)
+    openssl (4.0.2)
    ostruct (0.6.3)
    parallel (1.27.0)
    parser (3.3.9.0)
@@ -346,7 +355,7 @@ GEM
      ffi (~> 1.12)
      logger
    ruby2_keywords (0.0.5)
-    rubyzip (3.0.2)
+    rubyzip (3.4.0)
    securerandom (0.4.1)
    selenium-webdriver (4.35.0)
      base64 (~> 0.2)
@@ -367,18 +376,18 @@ GEM
      rack-protection (= 4.2.1)
      rack-session (>= 2.0.0, < 3)
      tilt (~> 2.0)
-    sqlite3 (2.9.5-aarch64-linux-gnu)
-    sqlite3 (2.9.5-arm64-darwin)
-    sqlite3 (2.9.5-x86_64-darwin)
-    sqlite3 (2.9.5-x86_64-linux-gnu)
+    sqlite3 (2.9.6-aarch64-linux-gnu)
+    sqlite3 (2.9.6-arm64-darwin)
+    sqlite3 (2.9.6-x86_64-darwin)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
    stimulus-rails (1.3.4)
      railties (>= 6.0.0)
    stringio (3.1.8)
    thor (1.4.0)
-    thruster (0.1.15-aarch64-linux)
-    thruster (0.1.15-arm64-darwin)
-    thruster (0.1.15-x86_64-darwin)
-    thruster (0.1.15-x86_64-linux)
+    thruster (0.1.23-aarch64-linux)
+    thruster (0.1.23-arm64-darwin)
+    thruster (0.1.23-x86_64-darwin)
+    thruster (0.1.23-x86_64-linux)
    tilt (2.6.1)
    timeout (0.6.1)
    tsort (0.2.0)
@@ -389,9 +398,9 @@ GEM
    unicode-emoji (4.2.0)
    uri (1.1.1)
    useragent (0.16.11)
-    web-push (3.0.2)
+    web-push (3.1.0)
      jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
    webmock (3.25.1)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
@@ -424,6 +433,7 @@ DEPENDENCIES
  importmap-rails!
  jbuilder
  kredis
+  lexxy (~> 0.9.24)
  mocha
  net-http-persistent
  ostruct
@@ -442,6 +452,7 @@ DEPENDENCIES
  sentry-ruby
  sqlite3
  stimulus-rails
+  surfguard!
  thruster
  turbo-rails!
  web-push
@@ -1,165 +1,160 @@
-trix-toolbar {
-  display: none;
-  inset: auto 0 0 0;
-  min-width: 0;
-  position: sticky;
-  z-index: 3;
+/* Resolve Lexxy's palette to Campfire's, in the editor and in rendered messages,
+   so everything follows Campfire's light/dark color scheme */
+.lexxy-content {
+  --lexxy-color-canvas: transparent;
+  --lexxy-color-text: var(--color-text);
+  --lexxy-color-text-subtle: var(--color-text);
+  --lexxy-color-link: var(--color-link);
+  --lexxy-color-ink: var(--color-text);
+  --lexxy-color-ink-inverted: var(--color-text-reversed);
+  --lexxy-color-ink-medium: var(--color-text);
+  --lexxy-color-ink-lighter: var(--color-border-darker);
+  --lexxy-color-ink-lightest: var(--color-bg);
+  --lexxy-color-selected: var(--color-selected, var(--color-bg));
+  --lexxy-color-code-bg: var(--color-bg);

-  .trix-dialog {
-    bottom: 3rem !important;
-    top: auto !important;
-  }
-
-  .trix-button--icon {
-    height: auto !important;
-  }
-
-  .trix-dialog {
-    background-color: var(--color-bg) !important;
-    border-radius: 1rem !important;
-    border: 2px solid var(--color-text) !important;
-    box-shadow: none !important;
-    color: var(--color-text) !important;
-    gap: var(--inline-space);
-    padding: 0 !important;
-    overflow: clip;
-
-    .trix-input {
-      background: transparent !important;
-      border: 0 !important;
-      color: var(--color-text) !important;
-      font-size: max(16px, 1em) !important;
-      padding: var(--input-padding, 0.5em 0.8em) !important;
-    }
-
-    .trix-button {
-      color: var(--color-text) !important;
-    }
-  }
-
-  .trix-dialog--link {
-    .trix-dialog__link-fields {
-      align-items: center;
-      padding-right: 0.3em;
-    }
-
-    [value="Link"],
-    [value="Unlink"] {
-      width: 2.6em;
-      aspect-ratio: 1 / 1;
-      background-position: center center;
-      background-repeat: no-repeat;
-      text-indent: -9999%;
-      padding: 0;
-    }
-
-    [value="Link"] { background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' fill='none'%3E%3Cpath fill='%23000' fill-rule='evenodd' d='M18.948 5.258a4.337 4.337 0 0 0-6.108 0L11.217 6.87a.993.993 0 0 0 0 1.41c.392.39 1.027.39 1.418 0l1.623-1.613a2.323 2.323 0 0 1 3.271 0 2.29 2.29 0 0 1 0 3.251l-2.393 2.38a3.021 3.021 0 0 1-4.255 0l-.05-.049a1.007 1.007 0 0 0-1.418 0 .993.993 0 0 0 0 1.41l.05.049a5.036 5.036 0 0 0 7.091 0l2.394-2.38a4.275 4.275 0 0 0 0-6.072Zm-13.683 13.6a4.337 4.337 0 0 0 6.108 0l1.262-1.255a.993.993 0 0 0 0-1.41 1.007 1.007 0 0 0-1.418 0L9.954 17.45a2.323 2.323 0 0 1-3.27 0 2.29 2.29 0 0 1 0-3.251l2.344-2.331a2.579 2.579 0 0 1 3.631 0c.392.39 1.027.39 1.419 0a.993.993 0 0 0 0-1.41 4.593 4.593 0 0 0-6.468 0l-2.345 2.33a4.275 4.275 0 0 0 0 6.072Z' clip-rule='evenodd'/%3E%3C/svg%3E"); }
-
-    [value="Unlink"] {
-      background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' fill='none'%3E%3Cpath fill='%23000' fill-rule='evenodd' d='M18.954 5.264a3.58 3.58 0 0 0-5.04 0l-2.157 2.144a.993.993 0 0 0 0 1.41c.392.39 1.027.39 1.418 0l2.157-2.144a1.565 1.565 0 0 1 2.204 0c.607.603.609 1.58.005 2.186l-2.348 2.355a.993.993 0 0 0 .006 1.41 1.007 1.007 0 0 0 1.419-.007l2.347-2.354a3.528 3.528 0 0 0-.01-5ZM5.257 18.852a3.59 3.59 0 0 0 5.041.015l2.6-2.554a.993.993 0 0 0 .01-1.41 1.007 1.007 0 0 0-1.419-.009l-2.6 2.554c-.615.603-1.603.6-2.214-.006a1.554 1.554 0 0 1-.012-2.195l2.539-2.58a.993.993 0 0 0-.016-1.41 1.007 1.007 0 0 0-1.418.015l-2.539 2.58a3.54 3.54 0 0 0 .028 5Z' clip-rule='evenodd'/%3E%3Cpath stroke='%23000' stroke-linecap='round' stroke-width='2' d='M10.233 5.78V3.769M5.968 9.802H4.21M7.343 7.107 5.968 5.781M14.348 17.523v2.013M18.613 13.502h1.758M17.238 16.196l1.375 1.327'/%3E%3C/svg%3E%0A");
-      border-top-right-radius: 1em !important;
-      border-bottom-right-radius: 1em !important;
-    }
-  }
+  /* Campfire's message lines stack without extra block margins */
+  --lexxy-content-margin: 0;
 }

-trix-editor {
+lexxy-editor {
  &.input {
+    --lexxy-editor-padding: 0;
+
+    /* One line high when empty. Lexxy derives this from attr(rows lh, 8lh),
+       whose resolution differs between Chrome versions — pin it instead of
+       risking the 8-line fallback */
+    --lexxy-editor-rows: 1lh;
+
+    background: transparent;
+    border: 0;
+    border-radius: 0;
    min-height: 24px;
  }

  .attachment--content {
    margin: 0;
    display: inline-flex;
-
-    .attachment__toolbar {
-      top: 0;
-      z-index: 2;
-    }
  }
 }

-.trix-button-group--file-tools,
-.trix-button-group--history-tools {
-  display: none !important;
+/* The mentions menu needs a solid surface — the editor's transparent canvas
+   would let messages show through it */
+.lexxy-prompt-menu {
+  --lexxy-color-canvas: var(--color-bg);
+
+  border: 1px solid var(--color-border-dark);
 }

-.trix-button-group,
-.trix-button {
-  border: 0 !important;
-  margin: 0 !important;
-  border-radius: 0.3em !important;
-  box-shadow: none;
+/* Same for the code block language picker: with a transparent canvas the
+   native dropdown renders white-on-white in dark mode */
+lexxy-editor lexxy-code-language-picker select {
+  background-color: var(--color-bg);
+  color: var(--color-text);

-  &::before {
-    opacity: 1 !important;
-  }
-
-  @media (prefers-color-scheme: dark) {
-    &::before {
-      filter: invert(100);
-    }
-  }
-
-  &.trix-active {
-    background-color: var(--color-text) !important;
-
-    &::before {
-      filter: invert(100);
-    }
-
-    @media (prefers-color-scheme: dark) {
-      &::before {
-        filter: invert(0);
-      }
-    }
-  }
-
-  &.trix-button--remove {
-    background-color: var(--color-negative);
-    border-radius: 1.8em !important;
-
-    &::before {
-      filter: invert(100);
-      background-size: 70%;
-      background-image: url("minus.svg");
-    }
+  option {
+    background-color: var(--color-bg);
+    color: var(--color-text);
  }
 }

-[data-trix-content-type~='application/vnd.campfire.mention'] {
-  .trix-button-group {
-    display: inline;
+/* The toolbar only shows when rich text mode is toggled on (see composer.css) */
+lexxy-toolbar {
+  /* Wide, airy button spacing like the Trix toolbar */
+  --lexxy-toolbar-gap: 1.3em;
+
+  /* Match the compact size of the Trix toolbar buttons */
+  --lexxy-toolbar-button-size: 1.7em;
+  --lexxy-toolbar-icon-size: 1.125em;
+
+  display: none;
+  border-block-end: 0;
+  min-width: 0;
+  z-index: 3;
+
+  /* Tools Campfire doesn't offer, matching the Trix toolbar: underline,
+     color highlights, tables, dividers and undo/redo (history tools were
+     hidden under Trix as well) */
+  button[name="underline"],
+  button[name="table"],
+  button[name="divider"],
+  button[name="undo"],
+  button[name="redo"],
+  lexxy-highlight-dropdown {
+    display: none !important;
+  }
+
+  /* No group separator pipes, like the Trix toolbar */
+  .lexxy-editor__toolbar-button.lexxy-editor__toolbar-group-end::after {
+    display: none;
+  }
+
+  /* Dropdown panels: a solid surface with a uniform radius. Lexxy derives
+     the panel's radius and gap from --lexxy-toolbar-gap, which Campfire
+     repurposes for button spacing */
+  .lexxy-editor__toolbar-dropdown [data-dropdown-panel] {
+    --lexxy-color-canvas: var(--color-bg);
+    --lexxy-color-ink-lightest: var(--color-message-bg);
+    --lexxy-color-selected: var(--color-selected);
+    --lexxy-color-selected-hover: var(--color-message-bg);
+
+    border: 1px solid var(--color-border-dark);
+    border-radius: 0.5em;
+    gap: 0.25em;
+    padding: 0.25em;
+  }
+
+  .lexxy-editor__toolbar-dropdown > .lexxy-editor__toolbar-button[aria-expanded="true"] {
+    border-radius: var(--lexxy-radius);
  }
 }

-[data-trix-content-type~="application/vnd.actiontext.opengraph-embed"] {
-  * {
-    text-decoration: none;
-  }
+/* Attachment markup contains formatting whitespace that must not turn into
+   line breaks under the editor's white-space: pre-wrap */
+lexxy-editor action-text-attachment {
+  white-space: normal;
+}

-  trix-editor & {
+action-text-attachment[content-type~="application/vnd.campfire.mention"] {
+  display: inline-flex;
+  margin: 0;
+  padding: 0;
+  position: relative;
+}
+
+action-text-attachment[content-type~="application/vnd.actiontext.opengraph-embed"] {
+  lexxy-editor & {
    display: block;
    inline-size: fit-content;
    max-inline-size: 100%;
  }
-}

-.trix-button:not(.trix-button--remove) {
-  @media (any-hover: hover) {
-    &:where(:not(:active):hover) {
-      filter: brightness(0.9);
-      background-color: var(--color-bg);
+  /* No selection background — it peeks through the card's rounded corners.
+     The lexxy-editor prefix out-specifies Lexxy's own selection rule. */
+  lexxy-editor &.node--selected {
+    --lexxy-attachment-bg-color: transparent;
+  }
+
+  /* A prominent remove button on the card's top edge, horizontally
+     centered, like the Trix one. The lexxy-editor prefix out-specifies
+     Lexxy's own placement rules. */
+  lexxy-editor & lexxy-node-delete-button {
+    inset-block-start: 0;
+    inset-inline-start: 50%;
+    inset-inline-end: auto;
+    transform: translate(-50%, -50%);
+
+    .lexxy-floating-controls__group {
+      --button-size: 2.2em;
+
+      background-color: var(--color-negative);
+      border-radius: 50%;
+      color: white;
    }
  }
-
-  &:disabled {
-    opacity: 0.33;
-  }
 }

-trix-editor,
-.trix-content {
+.lexxy-content {
  pre {
    background-color: var(--color-bg) !important;
    border-radius: 0.5em;
@@ -179,11 +174,13 @@ trix-editor,
  blockquote {
    border: 0 solid var(--color-border-darker) !important;
    border-inline-start-width: var(--blockquote-border) !important;
+    font-style: normal;
    margin: 0 var(--blockquote-margin) !important;
    padding-inline-start: var(--blockquote-padding) !important;
  }

  cite {
+    display: block;
    margin-inline-start: calc(var(--blockquote-padding));
    font-style: normal;
    font-size: 0.8rem;
@@ -199,13 +196,14 @@ trix-editor,
    color: var(--color-link);
  }

-  ul,
+  /* The composer's mention menu is a list inside the editor too, and keeps Lexxy's own spacing */
+  ul:not(.lexxy-prompt-menu),
  ol {
    margin: 0 !important;
    padding: 0 !important;
  }

-  li {
+  li:not(.lexxy-prompt-menu__item) {
    margin: 0 0 0 var(--inline-space-double) !important;
    padding: 0 !important;
  }
@@ -33,7 +33,7 @@
  }
 }

-[data-trix-content-type~='application/vnd.campfire.mention'] {
+action-text-attachment[content-type~='application/vnd.campfire.mention'] {
  display: inline-flex;
  margin: 0;
  padding: 0;
@@ -100,16 +100,42 @@
  }

  .composer--rich-text {
-    trix-toolbar {
-      display: block;
+    lexxy-toolbar {
+      display: flex;
    }

-    trix-editor.input {
+    lexxy-editor.input {
      margin-block-start: var(--block-space-half);
    }
  }

-  .composer--edit trix-toolbar {
+  /* In the message composer the toolbar goes below the text, on the same
+     row as the surrounding action buttons, like the Trix toolbar did.
+     The edit composer keeps it on top. */
+  #composer.composer--rich-text lexxy-editor.input {
+    display: flex;
+    flex-direction: column;
+
+    /* Sit the toolbar row on the same baseline as the composer's round
+       buttons, which pull themselves down with negative margins */
+    margin-block-end: -0.25em;
+
+    .lexxy-editor__content {
+      order: -1;
+    }
+
+    lexxy-toolbar {
+      margin-block-start: 0.4em;
+
+      /* Dropdowns open upward — the toolbar sits at the bottom of the screen */
+      [data-dropdown-panel] {
+        inset-block-start: auto;
+        inset-block-end: 100%;
+      }
+    }
+  }
+
+  .composer--edit lexxy-toolbar {
    border-block-end: 1px solid var(--color-border);
    margin-inline: -0.8em;
    padding-inline: 0.3em;
@@ -117,6 +143,16 @@
  }
 }

+/* The editor's container-type prevents it from sizing the message bubble by
+   its content, so give the bubble the full available width while editing */
+.message__body:has(.composer--edit) {
+  inline-size: 100%;
+
+  .message__body-content--editing {
+    flex-grow: 1;
+  }
+}
+
 /* Typing indicator */
 .typing-indicator {
  inset-block-start: var(--indicator-position, 0.15rem);
@@ -1,5 +1,5 @@
-trix-editor,
-.trix-content {
+
+.lexxy-content {
  .og-embed {
    background: var(--color-bg);
    border: 1px solid var(--color-border-dark);
@@ -15,7 +15,7 @@ trix-editor,
      flex-direction: row;
    }

-    .cf-twitter-avatar & {
+    &.og-embed--twitter-avatar {
      flex-direction: row;
    }
  }
@@ -35,10 +35,11 @@ trix-editor,

  .og-embed__title {
    font-weight: 600;
-    text-decoration: underline;

+    /* Underline the link itself so the line is link-colored */
    a {
      color: var(--color-link);
+      text-decoration: underline;
    }
  }

@@ -53,7 +54,11 @@ trix-editor,
      inline-size: 15dvw;
    }

+    /* block-size/border-radius guard against Lexxy's 1em round avatar
+       styling for custom attachment images */
    > * {
+      block-size: auto;
+      border-radius: 0;
      object-position: top right;
      inline-size: 100%;
      object-fit: contain;
@@ -63,7 +68,7 @@ trix-editor,
      }
    }

-    .cf-twitter-avatar & {
+    .og-embed--twitter-avatar & {
      aspect-ratio: 1;
      border-radius: 50%;
      inline-size: 2lh;
@@ -537,7 +537,7 @@ img.message__attachment {
    padding: var(--content-padding-block) 0 var(--content-padding-block) var(--content-padding-inline);
    text-shadow: 0 0 3px var(--color-text-reversed);

-    .trix-content {
+    .lexxy-content {
      font-size: 2.4em;
      line-height: 1.4;
    }
@@ -2,7 +2,6 @@ class Accounts::LogosController < ApplicationController
  include ActiveStorage::Streaming, ActionView::Helpers::AssetUrlHelper

  allow_unauthenticated_access only: :show
-  content_security_policy false, only: :show
  before_action :ensure_can_administer, only: :destroy

  def show
@@ -1,11 +1,26 @@
 class Autocompletable::UsersController < ApplicationController
  def index
    set_page_and_extract_portion_from find_autocompletable_users.with_attached_avatar.ordered, per_page: 20
+
+    respond_to do |format|
+      format.html { render layout: false } # <lexxy-prompt-item> elements for the mentions prompt
+      format.json
+    end
  end

  private
    def find_autocompletable_users
-      params[:query].present? ? users_scope.active.filtered_by(params[:query]) : users_scope.active
+      if query.present?
+        users_scope.active.filtered_by(query)
+      else
+        users_scope.active
+      end
+    end
+
+    # The rich text editor's mentions prompt filters with `filter`, the
+    # autocomplete inputs with `query`
+    def query
+      params[:filter].presence || params[:query].presence
    end

    def users_scope
@@ -0,0 +1,9 @@
+module ActiveStorageAuthentication
+  extend ActiveSupport::Concern
+  include Authentication::SessionLookup
+
+  private
+    def require_active_storage_authentication
+      head :unauthorized unless find_session_by_cookie
+    end
+end
@@ -71,6 +71,13 @@ module Authentication
      Current.session&.destroy!
      reset_session
      remove_authentication_cookie
+      disconnect_remote_connections
+    end
+
+    def disconnect_remote_connections
+      Current.user&.reset_remote_connections
+    rescue => error
+      Rails.logger.warn "Could not disconnect remote connections on sign out: #{error.class}"
    end

    def authenticated_as(session)
@@ -0,0 +1,12 @@
+module RawRequestBody
+  extend ActiveSupport::Concern
+
+  private
+
+  def raw_request_body
+    request.body.rewind
+    request.body.read.force_encoding("UTF-8")
+  ensure
+    request.body.rewind
+  end
+end
@@ -0,0 +1,39 @@
+class Messages::Boosts::ByBotsController < Messages::BoostsController
+  include RawRequestBody
+
+  allow_bot_access only: %i[ create destroy ]
+
+  before_action :ensure_content_present, only: :create
+
+  def create
+    @boost = @message.boosts.create!(boost_params)
+
+    broadcast_create
+    render :show, status: :created
+  end
+
+  private
+    def set_message
+      if room = Current.user.rooms.find_by(id: params[:room_id])
+        @message = room.messages.find_by(id: params[:message_id])
+      end
+
+      head :not_found unless @message
+    end
+
+    def set_boost
+      super
+    rescue ActiveRecord::RecordNotFound
+      head :not_found
+    end
+
+    def ensure_content_present
+      if raw_request_body.blank?
+        head :unprocessable_content
+      end
+    end
+
+    def boost_params
+      { content: raw_request_body }
+    end
+end
@@ -1,5 +1,6 @@
 class Messages::BoostsController < ApplicationController
  before_action :set_message
+  before_action :set_boost, only: :destroy

  def index
  end
@@ -15,7 +16,6 @@ class Messages::BoostsController < ApplicationController
  end

  def destroy
-    @boost = Current.user.boosts.find(params[:id])
    @boost.destroy!

    broadcast_remove
@@ -26,6 +26,10 @@ class Messages::BoostsController < ApplicationController
      @message = Current.user.reachable_messages.find(params[:message_id])
    end

+    def set_boost
+      @boost = @message.boosts.find_by!(id: params[:id], booster: Current.user)
+    end
+
    def boost_params
      params.require(:boost).permit(:content)
    end
@@ -1,24 +1,64 @@
 class Messages::ByBotsController < MessagesController
-  allow_bot_access only: :create
+  include RawRequestBody
+
+  allow_bot_access only: %i[ index create update destroy ]
+
+  before_action :set_room
+  before_action :set_message, only: %i[ update destroy ]
+  before_action :ensure_can_administer, only: %i[ update destroy ]
+  before_action :ensure_body_or_attachment_present, only: :create
+
+  def index
+    @messages = find_paged_messages
+    set_pagination_headers
+  end

  def create
    super
    head :created, location: message_url(@message)
  end

+  def destroy
+    super
+    head :no_content
+  end
+
  private
+    def set_room
+      @room = Current.user.rooms.find_by(id: params[:room_id])
+
+      head :not_found unless @room
+    end
+
+    def ensure_body_or_attachment_present
+      if params[:attachment].blank? && raw_request_body.blank?
+        head :unprocessable_content
+      end
+    end
+
+    def set_pagination_headers
+      headers["X-Total-Count"] = @room.messages.count.to_s
+
+      if next_page = next_page_params
+        headers["Link"] = %(<#{room_bot_messages_url(@room, params[:bot_key], **next_page)}>; rel="next")
+      end
+    end
+
+    def next_page_params
+      if @messages.any?
+        if params[:after].present?
+          { after: @messages.last.id } if @room.messages.after(@messages.last).exists?
+        else
+          { before: @messages.first.id } if @room.messages.before(@messages.first).exists?
+        end
+      end
+    end
+
    def message_params
      if params[:attachment]
        params.permit(:attachment)
      else
-        reading(request.body) { |body| { body: body } }
+        { body: raw_request_body }
      end
    end
-
-    def reading(io)
-      io.rewind
-      yield io.read.force_encoding("UTF-8")
-    ensure
-      io.rewind
-    end
 end
@@ -37,7 +37,11 @@ class MessagesController < ApplicationController
    @message.update!(message_params)

    @message.broadcast_replace_to @room, :messages, target: [ @message, :presentation ], partial: "messages/presentation", attributes: { maintain_scroll: true }
-    redirect_to room_message_url(@room, @message)
+
+    respond_to do |format|
+      format.html { redirect_to room_message_url(@room, @message) }
+      format.json { render :show }
+    end
  end

  def destroy
@@ -1,6 +1,5 @@
 class QrCodeController < ApplicationController
  allow_unauthenticated_access
-  content_security_policy false

  def show
    url = Base64.urlsafe_decode64(params[:id])
@@ -1,8 +1,6 @@
 class Users::AvatarsController < ApplicationController
  include ActiveStorage::Streaming

-  content_security_policy false, only: :show
-
  rescue_from(ActiveSupport::MessageVerifier::InvalidSignature) { head :not_found }

  def show
@@ -6,12 +6,17 @@ class Users::PushSubscriptionsController < ApplicationController

  def create
    if subscription = @push_subscriptions.find_by(push_subscription_params)
-      subscription.touch
+      # Existing endpoints must pass current validations
+      if subscription.valid?
+        subscription.touch
+        head :ok
+      else
+        head :unprocessable_entity
+      end
    else
-      @push_subscriptions.create! push_subscription_params.merge(user_agent: request.user_agent)
+      subscription = @push_subscriptions.create push_subscription_params.merge(user_agent: request.user_agent)
+      head subscription.persisted? ? :ok : :unprocessable_entity
    end
-
-    head :ok
  end

  def destroy
@@ -1,3 +1,13 @@
 module ContentFilters
-  TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, StyleUnfurledTwitterAvatars, SanitizeTags)
+  # Formatting the rich text editor produces that Rails' sanitizers don't
+  # allow by default. A message passes through three sanitization layers on
+  # its way to the screen, and each builds on this list:
+  #
+  #   * SanitizeTags strips disallowed markup from the message body
+  #   * Action Text sanitizes the rendered content (lib/rails_ext/action_text_allowed_tags.rb)
+  #   * auto_link re-sanitizes the final html (MessagesHelper#message_presentation)
+  EDITOR_FORMATTING_TAGS = %w[ s u mark table thead tbody tfoot tr th td ]
+  EDITOR_FORMATTING_ATTRIBUTES = %w[ data-language ]
+
+  TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, SanitizeTags, SanitizeAttributes)
 end
@@ -1,18 +1,22 @@
 class ContentFilters::RemoveSoloUnfurledLinkText < ActionText::Content::Filter
+  TWITTER_DOMAINS = %w[ x.com twitter.com ]
+  TWITTER_DOMAIN_MAPPING = { "x.com" => "twitter.com" }
+
  def applicable?
    normalize_tweet_url(solo_unfurled_url) == normalize_tweet_url(content.to_plain_text)
  end

  def apply
-    fragment.replace("div") { |node| node.tap { |n| n.inner_html = unfurled_links.first.to_s } }
+    if trix_body?
+      remove_link_text_from_wrapping_div
+    else
+      remove_link_paragraphs
+    end
  end

  private
-    TWITTER_DOMAINS = %w[ x.com twitter.com ]
-    TWITTER_DOMAIN_MAPPING = { "x.com" => "twitter.com" }
-
    def solo_unfurled_url
-      unfurled_links.first["href"] if unfurled_links.size == 1
+      ActionText::Attachment::OpengraphEmbed.from_node(unfurled_links.first)&.href if unfurled_links.size == 1
    end

    def unfurled_links
@@ -35,4 +39,20 @@ class ContentFilters::RemoveSoloUnfurledLinkText < ActionText::Content::Filter
    def twitter_url?(url)
      url.present? && TWITTER_DOMAINS.any? { |domain| url.strip.include?(domain) }
    end
+
+    def trix_body?
+      fragment.find_all("div").any?
+    end
+
+    def remove_link_text_from_wrapping_div
+      fragment.replace("div") { |node| node.tap { |n| n.inner_html = unfurled_links.first.to_s } }
+    end
+
+    def remove_link_paragraphs
+      fragment.replace("p") do |node|
+        if node.at_css("action-text-attachment")
+          node
+        end
+      end
+    end
 end
@@ -0,0 +1,47 @@
+class ContentFilters::SanitizeAttributes < ActionText::Content::Filter
+  def applicable?
+    true
+  end
+
+  # Scrub attributes on the tags that SanitizeTags allows, using Rails' safe-list
+  # sanitizer so unsafe URI schemes and event-handler attributes are stripped.
+  # Runs after SanitizeTags, so passing the same allowed tags makes the tag pass
+  # a no-op and only attributes are scrubbed.
+  def apply
+    sanitizer.sanitize fragment.to_html, tags: allowed_tags, attributes: allowed_attributes
+  end
+
+  private
+    # Presentation styling relies on class attributes (e.g. unfurled link embeds),
+    # which the standard ActionText set doesn't include.
+    EXTRA_ALLOWED_ATTRIBUTES = %w[ class ]
+
+    # ActionText::ContentHelper.sanitizer is a single process-wide instance, and
+    # rails-html-sanitizer reuses one mutable permit scrubber that it reconfigures
+    # from the tags/attributes on every #sanitize call. Sharing it here would race
+    # our stricter tag set against ActionText's default rendering on concurrent
+    # requests, so use a dedicated instance of the same sanitizer class to keep the
+    # scrubber isolated.
+    def sanitizer
+      sanitizer_class.new
+    end
+
+    def sanitizer_class
+      ActionText::ContentHelper.sanitizer.class
+    end
+
+    def allowed_tags
+      ContentFilters::SanitizeTags::ALLOWED_TAGS
+    end
+
+    def allowed_attributes
+      standard_allowed_attributes + EXTRA_ALLOWED_ATTRIBUTES
+    end
+
+    # Mirrors ActionText::ContentHelper#sanitizer_allowed_attributes, which isn't
+    # exposed at the module level.
+    def standard_allowed_attributes
+      ActionText::ContentHelper.allowed_attributes ||
+        (sanitizer_class.allowed_attributes + ActionText::Attachment::ATTRIBUTES).to_a
+    end
+end
@@ -1,4 +1,8 @@
 class ContentFilters::SanitizeTags < ActionText::Content::Filter
+  ALLOWED_TAGS = %w[ a abbr acronym address b big blockquote br cite code dd del dfn div dl dt em h1 h2 h3 h4 h5 h6 hr i ins kbd li ol
+    p pre samp small span strong sub sup time tt ul var ] + ContentFilters::EDITOR_FORMATTING_TAGS +
+    [ ActionText::Attachment.tag_name, "figure", "figcaption" ]
+
  def applicable?
    true
  end
@@ -8,9 +12,6 @@ class ContentFilters::SanitizeTags < ActionText::Content::Filter
  end

  private
-    ALLOWED_TAGS = %w[ a abbr acronym address b big blockquote br cite code dd del dfn div dl dt em h1 h2 h3 h4 h5 h6 hr i ins kbd li ol
-      p pre samp small span strong sub sup time tt ul var ] + [ ActionText::Attachment.tag_name, "figure", "figcaption" ]
-
    def not_allowed_tags_css_selector
      ALLOWED_TAGS.map { |tag| ":not(#{tag})" }.join("")
    end
@@ -1,24 +0,0 @@
-class ContentFilters::StyleUnfurledTwitterAvatars < ActionText::Content::Filter
-  def applicable?
-    unfurled_twitter_avatars.present?
-  end
-
-  def apply
-    fragment.update do |source|
-      div = source.at_css("div")
-      div["class"] = UNFURLED_TWITTER_AVATAR_CSS_CLASS
-    end
-  end
-
-  private
-    UNFURLED_TWITTER_AVATAR_CSS_CLASS = "cf-twitter-avatar"
-    TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
-
-    def unfurled_twitter_avatars
-      fragment.find_all("#{opengraph_css_selector}[url*='#{TWITTER_AVATAR_URL_PREFIX}']")
-    end
-
-    def opengraph_css_selector
-      "action-text-attachment[@content-type='#{ActionText::Attachment::OpengraphEmbed::OPENGRAPH_EMBED_CONTENT_TYPE}']"
-    end
-end
@@ -1,4 +1,9 @@
 module MessagesHelper
+  # auto_link re-sanitizes with Rails' default safe list, which lacks the
+  # formatting the rich text editor produces
+  AUTO_LINK_ALLOWED_TAGS = Rails::HTML5::SafeListSanitizer.allowed_tags + ContentFilters::EDITOR_FORMATTING_TAGS
+  AUTO_LINK_ALLOWED_ATTRIBUTES = Rails::HTML5::SafeListSanitizer.allowed_attributes + ContentFilters::EDITOR_FORMATTING_ATTRIBUTES
+
  def message_area_tag(room, &)
    tag.div id: "message-area", class: "message-area", contents: true, data: {
      controller: "messages presence drop-target",
@@ -57,7 +62,8 @@ module MessagesHelper
    when "sound"
      message_sound_presentation(message)
    else
-      auto_link h(ContentFilters::TextMessagePresentationFilters.apply(message.body.body)), html: { target: "_blank" }
+      auto_link h(ContentFilters::TextMessagePresentationFilters.apply(message.body.body)),
+        html: { target: "_blank" }, sanitize_options: { tags: AUTO_LINK_ALLOWED_TAGS, attributes: AUTO_LINK_ALLOWED_ATTRIBUTES }
    end
  rescue Exception => e
    Sentry.capture_exception(e, extra: { message: message })
@@ -1,11 +1,33 @@
 module RichTextHelper
  def rich_text_data_actions
-    default_actions =
-      "trix-change->typing-notifications#start keydown->composer#submitByKeyboard"
+    # submitByKeyboard runs in the capture phase so it can submit on Enter
+    # before the editor turns the keystroke into a newline
+    "lexxy:change->typing-notifications#start keydown->composer#submitByKeyboard:capture"
+  end

-    autocomplete_actions =
-      "trix-focus->rich-autocomplete#focus trix-change->rich-autocomplete#search trix-blur->rich-autocomplete#blur"
+  def mention_prompt_tag(room)
+    tag.lexxy_prompt trigger: "@", name: "mention", src: autocompletable_users_path(room_id: room.id),
+      "remote-filtering": true, "empty-results": "No matches"
+  end

-    [ default_actions, autocomplete_actions ].join(" ")
+  # The editor keeps an attachment's content as it finds it, so every
+  # attachment is rebuilt from its attachable before editing: a Trix-era
+  # embed carries its details as node attributes the editor doesn't
+  # round-trip, a mention edited under Trix carries the generic content type
+  # the editor doesn't permit, and a hand-written embed carries whatever
+  # markup the author put there.
+  def editable_body(message)
+    fragment = ActionText::Fragment.wrap(message.body.body_before_type_cast)
+
+    transformed = fragment.replace(ActionText::Attachment.tag_name) do |node|
+      attachment = ActionText::Attachment.from_node(node)
+
+      node.tap do |n|
+        n["content-type"] = attachment.attachable.attachable_content_type
+        n["content"] = render_action_text_attachment(attachment)
+      end
+    end
+
+    ActionText::RichText.new(body: transformed.to_html)
  end
 end
@@ -73,12 +73,12 @@ module RoomsHelper
    def composer_data_actions
      drag_and_drop_actions = "drop-target:drop@window->composer#dropFiles"

-      trix_attachment_actions =
-        "trix-file-accept->composer#preventAttachment refresh-room:online@window->composer#online"
+      attachment_actions =
+        "lexxy:file-accept->composer#preventAttachment refresh-room:online@window->composer#online"

      remaining_actions =
        "typing-notifications#stop paste->composer#pasteFiles turbo:submit-end->composer#submitEnd refresh-room:offline@window->composer#offline"

-      [ drop_target_actions, drag_and_drop_actions, trix_attachment_actions, remaining_actions ].join(" ")
+      [ drop_target_actions, drag_and_drop_actions, attachment_actions, remaining_actions ].join(" ")
    end
 end
@@ -1,6 +1,4 @@
 // Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails
 import "@hotwired/turbo-rails"
-import "trix"
-import "@rails/actiontext"
 import "initializers"
 import "controllers"
@@ -1,7 +1,7 @@
 import { Controller } from "@hotwired/stimulus"
 import FileUploader from "models/file_uploader"
 import { onNextEventLoopTick, nextFrame } from "helpers/timing_helpers"
-import { escapeHTML } from "helpers/dom_helpers"
+import { escapeHTML } from "helpers/string_helpers"

 export default class extends Controller {
  static classes = ["toolbar"]
@@ -12,11 +12,21 @@ export default class extends Controller {
  #files = []

  connect() {
+    this.#restoreDraft()
+
    if (!this.#usingTouchDevice) {
      onNextEventLoopTick(() => this.textTarget.focus())
    }
  }

+  saveDraft() {
+    if (this.textTarget.isBlank) {
+      localStorage.removeItem(this.#draftKey)
+    } else {
+      localStorage.setItem(this.#draftKey, this.textTarget.value)
+    }
+  }
+
  submit(event) {
    event.preventDefault()

@@ -44,21 +54,20 @@ export default class extends Controller {
  }

  replaceMessageContent(content) {
-    const editor = this.textTarget.editor
-
-    editor.recordUndoEntry("Format reply")
-    editor.setSelectedRange([0, editor.getDocument().toString().length])
-    editor.deleteInDirection("forward")
-    editor.insertHTML(content)
-    editor.setSelectedRange([editor.getDocument().toString().length - 1])
+    this.textTarget.value = content
+    this.textTarget.focus()
+    this.textTarget.selection.placeCursorAtTheEnd()
  }

  submitByKeyboard(event) {
+    if (event.key != "Enter" || this.textTarget.hasOpenPrompt) return
+
    const toolbarVisible = this.element.classList.contains(this.toolbarClass)
-    const metaEnter = event.key == "Enter" && (event.metaKey || event.ctrlKey)
-    const plainEnter = event.keyCode == 13 && !event.shiftKey && !event.isComposing
+    const metaEnter = event.metaKey || event.ctrlKey
+    const plainEnter = !event.shiftKey && !event.isComposing

    if (!this.#usingTouchDevice && (metaEnter || (plainEnter && !toolbarVisible))) {
+      event.stopPropagation()
      this.submit(event)
    }
  }
@@ -108,6 +117,19 @@ export default class extends Controller {
    this.fieldsTarget.disabled = true
  }

+  #restoreDraft() {
+    const draft = localStorage.getItem(this.#draftKey)
+
+    if (draft) {
+      this.textTarget.value = draft
+      this.textTarget.selection.placeCursorAtTheEnd()
+    }
+  }
+
+  get #draftKey() {
+    return `composer-draft-${this.roomIdValue}`
+  }
+
  get #usingTouchDevice() {
    return 'ontouchstart' in window || navigator.maxTouchPoints > 0 || navigator.msMaxTouchPoints > 0;
  }
@@ -126,7 +148,7 @@ export default class extends Controller {
  }

  #validInput() {
-    return this.textTarget.textContent.trim().length > 0
+    return !this.textTarget.isBlank
  }

  async #submitFiles() {
@@ -159,6 +181,7 @@ export default class extends Controller {

  #reset() {
    this.textTarget.value = ""
+    localStorage.removeItem(this.#draftKey)
  }

  #updateFileList() {
@@ -89,7 +89,7 @@ export default class extends Controller {
  }

  async editMyLastMessage() {
-    const editorEmpty = document.querySelector("#composer trix-editor").matches(":empty")
+    const editorEmpty = document.querySelector("#composer lexxy-editor").isBlank

    if (editorEmpty && this.#paginator.upToDate) {
      this.#myLastMessage?.querySelector(".message__edit-btn")?.click()
@@ -11,7 +11,7 @@ export default class extends Controller {
  }

  reply() {
-    const content = `<blockquote>${this.#bodyContent}</blockquote><cite>${this.authorTarget.innerHTML} ${this.#linkToOriginal}</cite><br>`
+    const content = `<blockquote>${this.#bodyContent}</blockquote><cite>${this.authorTarget.innerHTML} ${this.#linkToOriginal}</cite><p><br></p>`
    this.composerOutlet.replaceMessageContent(content)
  }

@@ -23,7 +23,7 @@ export default class extends Controller {
  }

  get #bodyContent() {
-    const body = this.bodyTarget.querySelector(".trix-content").cloneNode(true)
+    const body = this.bodyTarget.querySelector(".lexxy-content").cloneNode(true)
    return this.#stripMentionAttachments(this.#stripUnfurledAttachments(body)).innerHTML
  }

@@ -1,46 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-import MentionsAutocompleteHandler from "lib/autocomplete/mentions_autocomplete_handler"
-import { debounce } from "helpers/timing_helpers"
-
-export default class extends Controller {
-  static values = { url: String }
-
-  initialize() {
-    this.handlers = []
-    this.search = debounce(this.search.bind(this), 300)
-  }
-
-  connect() {
-    if (this.element == document.activeElement) {
-      this.#installHandlers()
-    }
-  }
-
-  focus(event) {
-    this.#installHandlers()
-  }
-
-  search(event) {
-    const content = this.editor.getDocument().toString()
-    const position = this.editor.getPosition()
-    this.handlers.forEach(handler => handler.updateWithContentAndPosition(content, position))
-  }
-
-  blur(event) {
-    this.#uninstallHandlers()
-  }
-
-  #installHandlers() {
-    this.#uninstallHandlers()
-    this.handlers = [ new MentionsAutocompleteHandler(this.element, this.urlValue) ]
-  }
-
-  #uninstallHandlers() {
-    this.handlers.forEach(handler => handler.destroy())
-    this.handlers = []
-  }
-
-  get editor() {
-    return this.element.editor
-  }
-}
@@ -0,0 +1,84 @@
+import { Controller } from "@hotwired/stimulus"
+import { post } from "@rails/request.js"
+import { escapeHTML, truncateString } from "helpers/string_helpers"
+
+const OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
+
+const UNFURLED_TWITTER_AVATAR_CSS_CLASS = "og-embed--twitter-avatar"
+const TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
+
+export default class extends Controller {
+  #abortController
+
+  disconnect() {
+    this.#abortController?.abort()
+  }
+
+  async unfurl(event) {
+    if (!this.element.permitsAttachmentContentType(OPENGRAPH_EMBED_CONTENT_TYPE)) return
+
+    const { url, insertBelowLink } = event.detail
+
+    const metadata = await this.#fetchOpengraphMetadata(url)
+
+    if (metadata) {
+      insertBelowLink(this.#opengraphEmbedHTML(metadata), { attachment: { contentType: OPENGRAPH_EMBED_CONTENT_TYPE } })
+    }
+  }
+
+  async #fetchOpengraphMetadata(url) {
+    this.#abortController?.abort()
+    this.#abortController = new AbortController()
+
+    try {
+      const response = await post("/unfurl_link", {
+        body: { url },
+        contentType: "application/json",
+        signal: this.#abortController.signal
+      })
+
+      if (response.ok && response.statusCode !== 204) {
+        const { title, url: href, image, description } = await response.json
+        if (title && href) return { title, href, image, description }
+      }
+    } catch {
+      // Ignore aborted and failed requests
+    }
+
+    return null
+  }
+
+  #opengraphEmbedHTML({ title, href, image, description }) {
+    return `<actiontext-opengraph-embed>
+      <div class="og-embed gap ${this.#embedClass(image)}">
+        <div class="og-embed__content">
+          <div class="og-embed__title">
+            <a href="${escapeHTML(href)}" rel="noreferrer" target="_blank">${escapeHTML(truncateString(title, 280))}</a>
+          </div>
+          <div class="og-embed__description">${escapeHTML(truncateString(description, 560))}</div>
+        </div>
+        ${this.#imageHTML(image)}
+      </div>
+    </actiontext-opengraph-embed>`
+  }
+
+  #embedClass(image) {
+    if (this.#isTwitterAvatar(image)) {
+      return UNFURLED_TWITTER_AVATAR_CSS_CLASS
+    } else {
+      return ""
+    }
+  }
+
+  #isTwitterAvatar(image) {
+    return Boolean(image) && image.startsWith(TWITTER_AVATAR_URL_PREFIX)
+  }
+
+  #imageHTML(image) {
+    if (image) {
+      return `<div class="og-embed__image"><img src="${escapeHTML(image)}" class="image center" alt="" /></div>`
+    } else {
+      return ""
+    }
+  }
+}
@@ -4,12 +4,6 @@ export function scrollToBottom(container) {
  container.scrollTop = container.scrollHeight
 }

-export function escapeHTML(html) {
-  const div = document.createElement("div")
-  div.textContent = html
-  return div.innerHTML
-}
-
 export function parseHTMLFragment(html) {
  const template = document.createElement("template")
  template.innerHTML = html
@@ -1,3 +1,5 @@
+const HTML_ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "\"": "&quot;", "'": "&#39;" }
+
 export function truncateString(string, length, omission = "…") {
  if (string.length <= length) {
    return string
@@ -5,3 +7,7 @@ export function truncateString(string, length, omission = "…") {
    return string.slice(0, length - omission.length) + omission
  }
 }
+
+export function escapeHTML(string) {
+  return String(string ?? "").replace(/[&<>"']/g, character => HTML_ESCAPES[character])
+}
@@ -1,10 +1,19 @@
-import Unfurler from "lib/rich_text/unfurl/unfurler"
+import * as Lexxy from "lexxy"
+import CampfireRichTextExtension from "lib/rich_text/campfire_extension"

-// Support a `cite` block for attribution links
-Trix.config.blockAttributes.cite = {
-  tagName: "cite",
-  inheritable: false,
-}
+Lexxy.configure({
+  global: {
+    // Keep the content type of mention attachments (application/vnd.campfire.mention)
+    // that Campfire has used since its Trix days
+    attachmentContentTypeNamespace: "campfire",
+    extensions: [ CampfireRichTextExtension ]
+  },
+  default: {
+    // Campfire sends files as separate messages via the composer's own
+    // attach button, never through the editor
+    toolbar: { attachments: false },

-const unfurler = new Unfurler()
-unfurler.install()
+    // Trix offered a single heading level, rendered as h1
+    headings: [ "h1" ]
+  }
+})
@@ -1,48 +0,0 @@
-import BaseAutocompleteHandler from "lib/autocomplete/base_autocomplete_handler"
-import { PUNCTUATION_PATTERN } from "lib/autocomplete/constants"
-
-export default class extends BaseAutocompleteHandler {
-  get pattern() {
-    return new RegExp(`^@(.*?)(${PUNCTUATION_PATTERN.source}*)$`)
-  }
-
-  insertAutocompletable(autocompletable, range, terminator, options = {}) {
-    const attachment = this.#createAttachmentForAutocompletable(autocompletable)
-    this.#insertAttachmentAndTerminatorIntoEditorAtRange(attachment, terminator, range, options)
-  }
-
-  // Override to set selector's position relative to the cursor in the editor
-  getOffsetsAtPosition(position) {
-    return this.#getOffsetsFromEditorAtPosition(this.#editor, position)
-  }
-
-  #createAttachmentForAutocompletable(mentionable) {
-    const mention = `
-      <span class="mention" sgid=${mentionable.sgid}>
-        <img src="${mentionable.avatar_url}" class="avatar" alt="${mentionable.name}">
-        ${mentionable.name}
-      </span>
-    `
-
-    return new Trix.Attachment({
-      content: mention,
-      contentType: "application/vnd.campfire.mention",
-      sgid: mentionable.sgid
-    })
-  }
-
-  #insertAttachmentAndTerminatorIntoEditorAtRange(attachment, terminator, range) {
-    if (range) { this.#editor.setSelectedRange(range) }
-    this.#editor.insertAttachment(attachment)
-    this.#editor.insertString(terminator)
-  }
-
-  get #editor() {
-    return this.element.editor
-  }
-
-  #getOffsetsFromEditorAtPosition(editor, position) {
-    const rect = this.#editor.getClientRectAtPosition(position)
-    return rect ? rect : {}
-  }
-}
@@ -0,0 +1,24 @@
+import * as Lexxy from "lexxy"
+import CiteNode from "lib/rich_text/cite_node"
+
+export default class CampfireRichTextExtension extends Lexxy.Extension {
+  get allowedElements() {
+    return [
+      "cite",
+      "figure",
+      "figcaption",
+      "actiontext-opengraph-embed",
+      { tag: "div", attributes: [ "sgid" ] },
+      { tag: "span", attributes: [ "sgid" ] },
+      { tag: "img", attributes: [ "alt" ] },
+      { tag: "a", attributes: [ "rel", "target" ] }
+    ]
+  }
+
+  get lexicalExtension() {
+    return this.defineExtension({
+      name: "campfire/rich-text",
+      nodes: [ CiteNode ]
+    })
+  }
+}
@@ -0,0 +1,39 @@
+import * as Lexxy from "lexxy"
+
+const { ElementNode } = Lexxy.Lexical
+
+export default class CiteNode extends ElementNode {
+  static getType() {
+    return "cite"
+  }
+
+  static clone(node) {
+    return new CiteNode(node.__key)
+  }
+
+  static importJSON(serializedNode) {
+    return new CiteNode().updateFromJSON(serializedNode)
+  }
+
+  static importDOM() {
+    return {
+      cite: () => ({ conversion: () => ({ node: new CiteNode() }), priority: 1 })
+    }
+  }
+
+  exportJSON() {
+    return { ...super.exportJSON(), type: "cite" }
+  }
+
+  createDOM() {
+    return document.createElement("cite")
+  }
+
+  updateDOM() {
+    return false
+  }
+
+  exportDOM() {
+    return { element: document.createElement("cite") }
+  }
+}
@@ -1,80 +0,0 @@
-import { post } from "@rails/request.js"
-import { truncateString } from "helpers/string_helpers"
-
-const UNFURLED_TWITTER_AVATAR_CSS_CLASS = "cf-twitter-avatar"
-const TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"
-
-export default class OpengraphEmbedOperation {
-  constructor(paste) {
-    this.paste = paste
-    this.editor = this.paste.editor
-    this.url = this.paste.string
-
-    this.abortController = new AbortController()
-  }
-
-  perform() {
-    return this.#createOpenGraphMetadataRequest()
-      .then(response => response.json)
-      .then(this.#insertOpengraphAttachment.bind(this))
-      .catch(() => null)
-  }
-
-  abort() {
-    this.abortController.abort()
-  }
-
-  #createOpenGraphMetadataRequest() {
-    return post("/unfurl_link", {
-      body: { url: this.url },
-      contentType: "application/json",
-      signal: this.abortController.signal
-    })
-  }
-
-  #insertOpengraphAttachment(response) {
-    if (this.#shouldInsertOpengraphPreview) {
-      const currentRange = this.editor.getSelectedRange()
-      this.editor.setSelectedRange(this.editor.getSelectedRange())
-      this.editor.recordUndoEntry("Insert Opengraph preview for Pasted URL")
-      this.editor.insertAttachment(this.#createOpengraphAttachment(response))
-      this.editor.setSelectedRange(currentRange)
-    }
-  }
-
-  get #shouldInsertOpengraphPreview() {
-    return this.editor.getDocument().toString().includes(this.url)
-  }
-
-  #createOpengraphAttachment(response) {
-    const { title, url, image, description } = response
-    const html = this.#generateOpengraphEmbedHTML({ title, url, image, description })
-
-    return new Trix.Attachment({
-      contentType: "application/vnd.actiontext.opengraph-embed",
-      content: html,
-      filename: title,
-      href: url,
-      url: image,
-      caption: description
-    })
-  }
-
-  #generateOpengraphEmbedHTML(embed) {
-    return `<actiontext-opengraph-embed class="${this.#isTwitterAvatar(embed) ? UNFURLED_TWITTER_AVATAR_CSS_CLASS : ''}">
-      <div class="og-embed">
-        <div class="og-embed__content">
-          <div class="og-embed__title">${truncateString(embed.title, 560)}</div>
-          <div class="og-embed__description">${truncateString(embed.description, 560)}</div>
-        </div>
-        <div class="og-embed__image">
-          <img src="${embed.image}" class="image" alt="" />
-        </div>
-      </div>
-    </actiontext-opengraph-embed>`
-  }
-
-  #isTwitterAvatar(embed) {
-    return embed.image.startsWith(TWITTER_AVATAR_URL_PREFIX)
-  }
-}
@@ -1,39 +0,0 @@
-export default class Paste {
-  constructor(range, editor, document) {
-    this.range = range
-    this.editor = editor
-    this.document = document
-    if (this.document == null) { this.document = this.editor.getDocument() }
-    this.string = this.document.getStringAtRange(this.range)
-  }
-
-  isURL() {
-    return /^(?:[a-z0-9]+:\/\/|www\.)[^\s]+$/.test(this.string)
-  }
-
-  getPathname() {
-    const a = document.createElement("a")
-    a.href = this.string
-    return a.pathname
-  }
-
-  isLinked() {
-    const {href} = this.getCommonAttributes()
-    return (href != null) && (href !== this.string)
-  }
-
-  getCommonAttributes() {
-    return this.document.getCommonAttributesAtRange(this.range)
-  }
-
-  getSignificantPaste() {
-    return new this.constructor(this.getSignificantRange(), this.editor, this.document)
-  }
-
-  getSignificantRange() {
-    const significantString = this.string.trim()
-    const startOffset = this.range[0] + this.string.indexOf(significantString)
-    const endOffset = startOffset + significantString.length
-    return [startOffset, endOffset]
-  }
-}
@@ -1,59 +0,0 @@
-import OpengraphEmbedOperation from "lib/rich_text/unfurl/lib/opengraph_embed_operation"
-import Paste from "lib/rich_text/unfurl/lib/paste"
-
-const performOperation = (function() {
-  let operation = null
-  let requestId = null
-
-  return function(operationToPerform) {
-    operation?.abort()
-    cancelAnimationFrame(requestId)
-
-    requestId = requestAnimationFrame(function() {
-      operation = operationToPerform
-      operation.perform().then(() => operation = null)
-    })
-  }
-})()
-
-export default class Unfurler {
-  install() {
-    this.#addEventListeners()
-  }
-
-  #addEventListeners() {
-    addEventListener("trix-initialize", function(event) {
-      if (this.#editorElementPermitsAttribute(event.target, "href")) {
-        return event.target.addEventListener("trix-paste", this.#didPaste.bind(this))
-      }
-    }.bind(this))
-  }
-
-  #didPaste(event) {
-    const {range} = event.paste
-    const {editor} = event.target
-
-    if (range != null) {
-      const paste = new Paste(range, editor).getSignificantPaste()
-
-      if (paste.isURL()) {
-        if (this.#editorElementPermitsOpengraphAttachment(event.target)) {
-          performOperation(new OpengraphEmbedOperation(paste))
-        }
-      }
-    }
-  }
-
-  #editorElementPermitsAttribute(element, attributeName) {
-    if (element.hasAttribute("data-permitted-attributes")) {
-      return Array.from(element.getAttribute("data-permitted-attributes").split(" ")).includes(attributeName)
-    } else {
-      return true
-    }
-  }
-
-  #editorElementPermitsOpengraphAttachment(element) {
-    const permittedAttachmentTypes = element.getAttribute("data-permitted-attachment-types")
-    return permittedAttachmentTypes && permittedAttachmentTypes.includes("application/vnd.actiontext.opengraph-embed")
-  }
-}
@@ -18,7 +18,7 @@ export default class ClientMessage {
      body,
      messageTimestamp: Math.floor(now.getTime()),
      messageDatetime: now.toISOString(),
-      messageClasses: this.#containsOnlyEmoji(node.textContent) ? "message--emoji" : "",
+      messageClasses: this.#messageClassesFromNode(node),
    })
  }

@@ -52,26 +52,37 @@ export default class ClientMessage {
    }
  }

+  #messageClassesFromNode(node) {
+    if (this.#containsOnlyEmoji(this.#plainTextFromNode(node))) {
+      return "message--emoji"
+    } else {
+      return ""
+    }
+  }
+

  #isPlayCommand(node) {
    return this.#matchPlayCommand(node)
  }

  #matchPlayCommand(node) {
-    return this.#stripWrapperElement(node)?.match(new RegExp(`^/play (${SOUND_NAMES.join("|")})`))?.[1]
+    return this.#plainTextFromNode(node)?.match(new RegExp(`^/play (${SOUND_NAMES.join("|")})`))?.[1]
  }

-  #stripWrapperElement(node) {
-    return node.innerHTML?.replace(/<div>(?:<!--[\s\S]*?-->)*([\s\S]*?)<\/div>/i, '$1')
+  #plainTextFromNode(node) {
+    if (this.#isRichText(node)) {
+      return node.toString().trim()
+    } else {
+      return node
+    }
  }

-
  #isRichText(node) {
    return typeof(node) != "string"
  }

  #richTextContent(node) {
-    return `<div class="trix-content">${node.innerHTML}</div>`
+    return `<div class="lexxy-content">${node.value}</div>`
  }


@@ -76,7 +76,21 @@ export default class MessageFormatter {
  }

  #highlightCodeBlock(block) {
-    if (this.#isPlainText(block)) window.hljs.highlightElement(block)
+    this.#normalizeLineBreaks(block)
+
+    if (this.#isPlainText(block)) {
+      const language = block.dataset.language
+      if (language && window.hljs.getLanguage(language)) {
+        block.classList.add(`language-${language}`)
+      }
+
+      window.hljs.highlightElement(block)
+    }
+  }
+
+  // Lexxy breaks code block lines with <br>, Trix-era blocks used newlines
+  #normalizeLineBreaks(block) {
+    block.querySelectorAll("br").forEach(br => br.replaceWith("\n"))
  }

  #isPlainText(element) {
@@ -1,7 +1,61 @@
+require "restricted_http/private_network_guard"
+
 class Push::Subscription < ApplicationRecord
+  PERMITTED_ENDPOINT_HOSTS = %w[
+    jmt17.google.com
+    fcm.googleapis.com
+    updates.push.services.mozilla.com
+    web.push.apple.com
+    notify.windows.com
+  ].freeze
+
  belongs_to :user

+  validates :endpoint, presence: true
+  validate :validate_endpoint_url
+
  def notification(**params)
-    WebPush::Notification.new(**params, badge: user.memberships.unread.count, endpoint: endpoint, p256dh_key: p256dh_key, auth_key: auth_key)
+    # Defer DNS lookup to the delivery worker to prevent rebinding
+    WebPush::Notification.new(**params, badge: user.memberships.unread.count, endpoint: endpoint, endpoint_ip_resolver: method(:resolved_endpoint_ip), p256dh_key: p256dh_key, auth_key: auth_key)
  end
+
+  # Validate at point of use, not just when saved.
+  def resolved_endpoint_ip
+    RestrictedHTTP::PrivateNetworkGuard.resolve(endpoint_uri.host) if permitted_endpoint_uri?
+  rescue RestrictedHTTP::Violation, Surfguard::Unresolvable
+    nil
+  end
+
+  private
+    # Validate endpoint shape. Belt & suspenders.
+    def permitted_endpoint_uri?
+      endpoint_uri&.scheme == "https" && endpoint_uri.port == 443 && permitted_endpoint_host?
+    end
+
+    def endpoint_uri
+      URI.parse(endpoint) if endpoint.present?
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def validate_endpoint_url
+      if endpoint_uri.nil?
+        errors.add(:endpoint, "is not a valid URL")
+      elsif endpoint_uri.scheme != "https"
+        errors.add(:endpoint, "must use HTTPS")
+      elsif endpoint_uri.port != 443
+        errors.add(:endpoint, "must use the default HTTPS port")
+      elsif !permitted_endpoint_host?
+        errors.add(:endpoint, "is not a permitted push service")
+      elsif resolved_endpoint_ip.nil?
+        errors.add(:endpoint, "resolves to a private or invalid IP address")
+      end
+    end
+
+    def permitted_endpoint_host?
+      host = endpoint_uri&.host&.downcase
+      host.present? && PERMITTED_ENDPOINT_HOSTS.any? do |permitted|
+        host == permitted || host.end_with?(".#{permitted}")
+      end
+    end
 end
@@ -1,11 +1,13 @@
 module User::Mentionable
  include ActionText::Attachable

-  def to_attachable_partial_path
-    "users/mention"
+  MENTION_CONTENT_TYPE = "application/vnd.campfire.mention"
+
+  def attachable_content_type
+    MENTION_CONTENT_TYPE
  end

-  def to_trix_content_attachment_partial_path
+  def to_attachable_partial_path
    "users/mention"
  end

@@ -1,11 +1,11 @@
 <figure class="attachment attachment--content attachment--og">
  <actiontext-opengraph-embed>
-    <div class="og-embed gap">
+    <div class="og-embed gap <%= "og-embed--twitter-avatar" if opengraph_embed.twitter_avatar? %>">
      <div class="og-embed__content">
        <div class="og-embed__title">
-          <%= link_to truncate(opengraph_embed.filename, length: 280, omission: "…"), opengraph_embed.href, rel: "noreferrer", target: "_blank" %>
+          <%= link_to_if opengraph_embed.href.present?, truncate(opengraph_embed.filename, length: 280, omission: "…"), opengraph_embed.href, rel: "noreferrer", target: "_blank" %>
        </div>
-        <div class="og-embed__description"><%= truncate(opengraph_embed.caption, length: 560, omission: "…").html_safe %></div>
+        <div class="og-embed__description"><%= truncate(opengraph_embed.description.to_s, length: 560, omission: "…") %></div>
      </div>
      <% if opengraph_embed.url %>
        <div class="og-embed__image">
@@ -0,0 +1,11 @@
+<lexxy-prompt-item search="<%= user.name %>" sgid="<%= user.attachable_sgid %>">
+  <template type="menu">
+    <span class="autocomplete__item flex align-center gap unpad">
+      <%= avatar_tag user %>
+      <span class="autocompletable__name"><%= user.name %></span>
+    </span>
+  </template>
+  <template type="editor">
+    <%= render "users/mention", user: user %>
+  </template>
+</lexxy-prompt-item>
@@ -0,0 +1 @@
+<%= render partial: "autocompletable/users/prompt_item", collection: @page.records, as: :user %>
@@ -1,3 +1,3 @@
-<div class="trix-content">
+<div class="lexxy-content">
  <%= yield -%>
 </div>
@@ -1,6 +1,7 @@
 <%# Be sure to check/update messages/_template.html.erb when changing this file %>

-<% cache message do %>
+<%# Bump this version when the message presentation filters change what they emit. Editing this line changes the template digest, which busts BOTH this fragment cache and the collection cache that keys on this partial's digest (helper Ruby changes alone don't). %>
+<% cache [ message, "presentation-v3" ] do %>
  <%= message_tag message do %>
    <h2 class="message__day-separator"><%= local_datetime_tag message.created_at, style: :date %></h2>

@@ -0,0 +1,18 @@
+json.cache! message do
+  json.(message, :id)
+
+  json.created_at message.created_at.utc
+
+  json.body do
+    json.plain_text message.plain_text_body
+    json.html message.body.to_s
+  end
+
+  json.creator message.creator, partial: "users/user", as: :user
+
+  json.room do
+    json.id message.room_id
+  end
+
+  json.url room_message_url(message.room, message)
+end
@@ -0,0 +1,12 @@
+json.cache! boost do
+  json.(boost, :id, :content)
+
+  json.created_at boost.created_at.utc
+
+  json.booster boost.booster, partial: "users/user", as: :user
+
+  json.message do
+    json.id boost.message_id
+    json.url room_message_url(boost.message.room, boost.message)
+  end
+end
@@ -0,0 +1 @@
+json.partial! "messages/boosts/boost", boost: @boost
@@ -0,0 +1 @@
+json.array! @messages, partial: "messages/message", as: :message
@@ -0,0 +1 @@
+json.partial! "messages/message", message: @message
@@ -14,17 +14,18 @@
      <% else %>
        <div class="composer--edit composer--rich-text">
          <%= form_with model: @message, url: room_message_path(@room, @message), id: dom_id(@message, :form), data: {
-                controller: "form", action: "trix-file-accept->form#preventAttachment keydown.esc->form#cancel keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent" } do |form| %>
+                controller: "form", action: "lexxy:file-accept->form#preventAttachment keydown.esc->form#cancel keydown.ctrl+enter->form#submit:prevent keydown.meta+enter->form#submit:prevent" } do |form| %>
            <div class="full-width input input--actor min-width fill-white">
              <%= form.rich_text_area :body,
+                    value: editable_body(@message),
                    rows: 1,
-                    class: "input",
+                    class: "input lexxy-content",
                    aria: { multiline: "true", label: "Edit message" },
                    autofocus: true,
-                    data: {
-                      controller: "rich-autocomplete",
-                      action: rich_text_data_actions,
-                      rich_autocomplete_url_value: autocompletable_users_path(room_id: @room.id) } %>
+                    "permitted-attachment-types": "application/vnd.campfire.mention application/vnd.actiontext.opengraph-embed",
+                    data: { action: rich_text_data_actions } do %>
+                <%= mention_prompt_tag @room %>
+              <% end %>
            </div>

            <%= link_to "Close editor and discard changes", room_message_path(@room, @message), data: { form_target: "cancel" }, hidden: true %>
@@ -19,15 +19,16 @@
                <div class="flex flex-column flex-item-grow min-width gap">
                  <%= form.rich_text_area :body,
                        rows: 1,
-                        class: "input",
+                        class: "input lexxy-content",
                        style: "order: -1",
                        aria: { multiline: "true", label: "Write a message" },
+                        "permitted-attachment-types": "application/vnd.campfire.mention application/vnd.actiontext.opengraph-embed",
                        data: {
-                          controller: "rich-autocomplete",
-                          action: rich_text_data_actions,
-                          rich_autocomplete_url_value: autocompletable_users_path(room_id: room.id),
-                          permitted_attachment_types: "application/vnd.actiontext.opengraph-embed",
-                          composer_target: "text" } %>
+                          controller: "unfurl",
+                          action: "#{rich_text_data_actions} lexxy:change->composer#saveDraft lexxy:insert-link->unfurl#unfurl",
+                          composer_target: "text" } do %>
+                    <%= mention_prompt_tag room %>
+                  <% end %>
                </div>

                <label class="btn btn--borderless txt-small flex-item-no-shrink composer__attachment-btn input--file">
@@ -1,4 +1,4 @@
-<div class="mention" sgid="<%= user.attachable_sgid %>">
-  <%= avatar_tag user %>
-  <%= user.name %>
-</div>
+<%# A span rather than a div: mentions render inline inside the <p> paragraphs
+    the editor produces, and block elements would make the browser split the
+    paragraph when parsing %>
+<span class="mention" sgid="<%= user.attachable_sgid %>"><%= avatar_tag user %> <%= user.name %></span>
@@ -0,0 +1,5 @@
+json.cache! user do
+  json.(user, :id, :name, :role)
+
+  json.avatar_url fresh_user_avatar_url(user)
+end
@@ -2,6 +2,6 @@
 require "rubygems"
 require "bundler/setup"

-ARGV.unshift("--ensure-latest")
+ARGV.unshift("--ensure-latest", "15")

 load Gem.bin_path("brakeman", "brakeman")
@@ -18,7 +18,8 @@ GIT_SHA = `git rev-parse HEAD`.strip
 MANUAL_NOTES = ARGV.delete("--notes")
 VERSION = ARGV[0]

-DOCKER_IMAGE_NAME = "registry.once.com/campfire"
+DOCKER_REGISTRY = "registry.once.com"
+DOCKER_IMAGE_NAME = "#{DOCKER_REGISTRY}/campfire"
 DOCKER_LATEST_IMAGE_NAME = [ DOCKER_IMAGE_NAME, :latest ].join(":")
 DOCKER_TAGGED_IMAGE_NAME = [ DOCKER_IMAGE_NAME, GIT_SHA ].join(":")

@@ -47,6 +48,18 @@ def announcing(message)
  yield
 end

+announcing "Checking #{DOCKER_REGISTRY} login..." do
+  unless system "docker", "manifest", "inspect", DOCKER_LATEST_IMAGE_NAME, out: File::NULL, err: File::NULL
+    abort <<~MESSAGE
+      Not logged in to #{DOCKER_REGISTRY}. Run:
+
+        docker login #{DOCKER_REGISTRY}
+
+      The credentials are in the "chatinabox" entry in 1Password.
+    MESSAGE
+  end
+end
+
 on(:local) do
  builder_found = test :docker, :buildx, :inspect, BUILDER_NAME

@@ -1,6 +1,6 @@
 default: &default
  adapter: redis
-  url: redis://localhost:6379
+  url: <%= ENV.fetch("REDIS_URL") { "redis://localhost:6379" } %>

 development:
  <<: *default
@@ -1,5 +1,6 @@
 require "active_support/core_ext/integer/time"
 require "active_support/core_ext/numeric/bytes"
+require_relative "../../lib/rails_ext/log_scrubbing_formatter"

 Rails.application.configure do
  # Settings specified here will take precedence over those in config/application.rb.
@@ -50,7 +51,7 @@ Rails.application.configure do

  # Log to STDOUT by default
  config.logger = ActiveSupport::Logger.new(STDOUT)
-    .tap  { |logger| logger.formatter = ::Logger::Formatter.new }
+    .tap  { |logger| logger.formatter = LogScrubbingFormatter.new }
    .then { |logger| ActiveSupport::TaggedLogging.new(logger) }

  # Prepend all log lines with the following tags.
@@ -5,8 +5,7 @@ pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin "@hotwired/turbo-rails", to: "turbo.js"
 pin "@rails/actioncable", to: "actioncable.esm.js"
 pin "@rails/request.js", to: "@rails--request.js" # @0.0.8
-pin "trix", to: "trix.esm.min.js" # @2.1.19
-pin "@rails/actiontext", to: "actiontext.js"
+pin "lexxy", to: "lexxy.js"
 pin "highlight.js", to: "highlight.js/core.js"

 pin_all_from "app/javascript/initializers", under: "initializers"
@@ -1,6 +1,4 @@
 ActiveSupport.on_load(:active_storage_blob) do
-  ActiveStorage::DiskController.content_security_policy false, only: :show
-
  ActiveStorage::DiskController.after_action only: :show do
    response.set_header("Cache-Control", "max-age=3600, public")
  end
@@ -0,0 +1,15 @@
+# Active Storage mounts its direct-upload write endpoints
+# (POST /rails/active_storage/direct_uploads and the disk-service PUT) on
+# framework controllers that inherit from ActiveStorage::BaseController, so
+# they never pass through ApplicationController's require_authentication.
+# Campfire uploads attachments through MessagesController instead and does not
+# use direct uploads at all, leaving these endpoints reachable by anyone who
+# can read the public login page. Require a valid Campfire session before an
+# anonymous caller can allocate a Blob or persist bytes to disk.
+Rails.application.config.to_prepare do
+  ActiveStorage::DirectUploadsController.include ActiveStorageAuthentication
+  ActiveStorage::DirectUploadsController.before_action :require_active_storage_authentication
+
+  ActiveStorage::DiskController.include ActiveStorageAuthentication
+  ActiveStorage::DiskController.before_action :require_active_storage_authentication, only: :update
+end
@@ -1,120 +1,25 @@
 # Be sure to restart your server when you modify this file.

-# Baseline application-wide Content-Security-Policy, deployed in Report-Only
-# mode: browsers evaluate the policy and report violations (once a report
-# endpoint is wired up) but enforce nothing, so rendering cannot break.
-# Tune the policy against observed violations, then flip
-# `content_security_policy_report_only` off to enforce it.
-#
+# Define an application-wide content security policy.
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header

-# Session-stable nonce for permitted inline scripts (the importmap JSON + shim,
-# auto-nonced by importmap-rails).
+# Rails.application.configure do
+#   config.content_security_policy do |policy|
+#     policy.default_src :self, :https
+#     policy.font_src    :self, :https, :data
+#     policy.img_src     :self, :https, :data
+#     policy.object_src  :none
+#     policy.script_src  :self, :https
+#     policy.style_src   :self, :https
+#     # Specify URI for violation reports
+#     # policy.report_uri "/csp-violation-report-endpoint"
+#   end
 #
-# The nonce is stable across a session's requests so Turbo snapshot restores
-# don't replay a stale nonce and trip CSP. It's the HMAC of a stable cookie
-# value keyed by the server secret: the cookie is client-settable, but the
-# client can't predict the resulting nonce without knowing secret_key_base.
+#   # Generate session nonces for permitted importmap and inline scripts
+#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+#   config.content_security_policy_nonce_directives = %w(script-src)
 #
-# Campfire sets no per-session verification cookie, so the lightweight
-# nonce_id cookie — set on first visit, present for every session including
-# unauthenticated ones — is the sole identifier.
-#
-# The generator runs for every response that carries the policy, so the cookie
-# write would otherwise land on public, shared-cacheable responses (QR codes,
-# logos, avatars, disk-served blobs) where a cache could replay one client's
-# identifier and nonce to others. Those endpoints opt out of the policy with
-# `content_security_policy false`; the nonce is only meaningful on documents.
-module CSP
-  module Nonce
-    COOKIE = "campfire_csp_nonce_id"
-
-    def self.generate(request)
-      hmac(nonce_id(request))
-    end
-
-    def self.hmac(identifier)
-      OpenSSL::HMAC.hexdigest("SHA256", Rails.application.secret_key_base, identifier)
-    end
-
-    # Read or initialize a stable nonce identifier cookie.
-    def self.nonce_id(request)
-      request.cookies[COOKIE] || set_nonce_id(request)
-    end
-
-    def self.set_nonce_id(request)
-      value = SecureRandom.base64(16)
-      request.cookie_jar[COOKIE] = { value: value, httponly: true, same_site: :lax }
-      value
-    end
-  end
-
-  # Per-install CSP extras.
-  #
-  # Campfire is a ONCE product: each customer self-hosts it on their own domain
-  # and an admin may embed or connect to external hosts — video/embed providers,
-  # image CDNs, analytics, form or webhook endpoints — that vary per install and
-  # are unknown at build time. `:self` already tracks this install's own origin;
-  # these ENV knobs let an admin allow additional hosts without editing this file
-  # (and without which enforcement would break their legitimate integrations).
-  #
-  # Each is a comma-, semicolon-, or whitespace-separated list of CSP source
-  # expressions, e.g.
-  #
-  #   CSP_EXTRA_FRAME_SRC="https://www.youtube.com https://player.vimeo.com"
-  #
-  # Leave them unset (the default) to keep each directive at :self only.
-  EXTRA_ENV = {
-    script_src:  "CSP_EXTRA_SCRIPT_SRC",
-    style_src:   "CSP_EXTRA_STYLE_SRC",
-    img_src:     "CSP_EXTRA_IMG_SRC",
-    connect_src: "CSP_EXTRA_CONNECT_SRC",
-    frame_src:   "CSP_EXTRA_FRAME_SRC",
-    form_action: "CSP_EXTRA_FORM_ACTION"
-  }.freeze
-
-  # Parse one ENV knob into a list of extra host sources.
-  #
-  # Semicolons are tokenized like commas/whitespace: because the nonce forces a
-  # per-request policy build, a stray `;` in a value (a plausible operator paste,
-  # e.g. "https://youtube.com; https://vimeo.com") would otherwise land inside a
-  # single source token and make Rails raise InvalidDirectiveError on every
-  # request — a site-wide 500 even in report-only mode. Splitting on `;` yields
-  # valid tokens instead; Rails still validates each one, so no injection is
-  # introduced (a token with an embedded space still fails validation).
-  def self.extra(directive)
-    ENV[EXTRA_ENV.fetch(directive)].to_s.split(/[,;\s]+/).reject(&:blank?)
-  end
-
-  # Build the baseline policy. Kept as a reusable method so it can be exercised
-  # in isolation by tests as well as at boot.
-  def self.apply(policy)
-    policy.default_src     :self
-    policy.script_src      :self, *extra(:script_src)  # nonce auto-appended via nonce_directives below
-    # unsafe_inline retained: many style="…" attributes across the message
-    # composer and ActionText content can't be nonced yet.
-    policy.style_src       :self, :unsafe_inline, *extra(:style_src)
-    # frame_src / img_src / connect_src start at :self plus any per-install extras
-    # and get tuned against violation reports during the report-only window.
-    policy.img_src         :self, :data, :blob, *extra(:img_src)
-    policy.connect_src     :self, *extra(:connect_src)
-    policy.frame_src       :self, *extra(:frame_src)
-    policy.frame_ancestors :self
-    policy.base_uri        :self
-    policy.form_action     :self, *extra(:form_action)
-    policy.object_src      :none
-    # Specify URI for violation reports once a report sink is available
-    # policy.report_uri "/csp-violation-report-endpoint"
-  end
-end
-
-Rails.application.configure do
-  config.content_security_policy { |policy| CSP.apply(policy) }
-
-  config.content_security_policy_nonce_generator = ->(request) { CSP::Nonce.generate(request) }
-  config.content_security_policy_nonce_directives = %w[ script-src ]
-
-  # Report violations without enforcing the policy.
-  config.content_security_policy_report_only = true
-end
+#   # Report violations without enforcing the policy.
+#   # config.content_security_policy_report_only = true
+# end
@@ -0,0 +1 @@
+Resque.redis = ENV.fetch("REDIS_URL") { "redis://localhost:6379" }
@@ -17,7 +17,25 @@ end

 module WebPush::PersistentRequest
  def perform
-    if @options[:connection]
+    if endpoint_ip = @options[:endpoint_ip]
+      # Pin the connection to the public IP resolved (and guarded) by
+      # Push::Subscription so delivery can't be rebound to a private address
+      # between resolution and connect. Bypasses the shared persistent pool,
+      # which would re-resolve the host itself.
+      #
+      # The explicit nil proxy address disables proxy discovery from
+      # http_proxy/https_proxy. An egress proxy would open the TCP connection
+      # itself and re-resolve the endpoint host, so http.ipaddr would no longer
+      # pin the destination and the DNS-rebinding guarantee would be lost. This
+      # path is already committed to a direct connection (it bypasses the pool);
+      # push delivery to public vendor endpoints goes direct.
+      http = Net::HTTP.new(uri.host, uri.port, nil)
+      http.ipaddr = endpoint_ip
+      http.use_ssl = true
+      http.ssl_timeout = @options[:ssl_timeout] unless @options[:ssl_timeout].nil?
+      http.open_timeout = @options[:open_timeout] unless @options[:open_timeout].nil?
+      http.read_timeout = @options[:read_timeout] unless @options[:read_timeout].nil?
+    elsif @options[:connection]
      http = @options[:connection]
    else
      http = Net::HTTP.new(uri.host, uri.port, *proxy_options)
@@ -62,7 +62,13 @@ Rails.application.routes.draw do
  resources :rooms do
    resources :messages

-    post ":bot_key/messages", to: "messages/by_bots#create", as: :bot_messages
+    nested do
+      scope path: ":bot_key", as: :bot, defaults: { format: :json } do
+        resources :messages, controller: "messages/by_bots", only: %i[ index create update destroy ] do
+          resources :boosts, controller: "messages/boosts/by_bots", only: %i[ create destroy ]
+        end
+      end
+    end

    scope module: "rooms" do
      resource :refresh, only: :show
@@ -0,0 +1,11 @@
+# The rich text editor produces formatting that Rails' default Action Text
+# sanitizer strips on render. The additions are declared once in
+# ContentFilters, shared by every sanitization layer.
+Rails.application.config.to_prepare do
+  defaults = Class.new.include(ActionText::ContentHelper).new
+
+  ActionText::ContentHelper.allowed_tags =
+    (ActionText::ContentHelper.allowed_tags || defaults.sanitizer_allowed_tags) | ContentFilters::EDITOR_FORMATTING_TAGS
+  ActionText::ContentHelper.allowed_attributes =
+    (ActionText::ContentHelper.allowed_attributes || defaults.sanitizer_allowed_attributes) | ContentFilters::EDITOR_FORMATTING_ATTRIBUTES
+end
@@ -2,6 +2,7 @@ class ActionText::Attachment::OpengraphEmbed
  include ActiveModel::Model

  OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
+  TWITTER_AVATAR_URL_PREFIX = "https://pbs.twimg.com/profile_images"

  class << self
    def from_node(node)
@@ -14,18 +15,85 @@ class ActionText::Attachment::OpengraphEmbed
    end

    private
+      # Trix serialized the embed's details as attributes of the
+      # <action-text-attachment> node. Lexxy only serializes the sgid, content
+      # and content-type, so newer attachments carry the details in their
+      # content markup instead.
      def attributes_from_node(node)
+        if node["filename"].present?
+          {
+            href: web_url(node["href"]),
+            url: web_url(node["url"]),
+            filename: node["filename"],
+            description: node["caption"]
+          }
+        else
+          attributes_from_content(node["content"].to_s)
+        end
+      end
+
+      def attributes_from_content(content)
+        fragment = Nokogiri::HTML.fragment(content)
+        title = fragment.at_css(".og-embed__title")
+        link = title&.at_css("a")
+
        {
-          href: node["href"],
-          url: node["url"],
-          filename: node["filename"],
-          description: node["caption"]
+          href: web_url(link&.[]("href")),
+          url: web_url(fragment.at_css(".og-embed__image img")&.[]("src")),
+          filename: (link || title)&.text&.strip,
+          description: fragment.at_css(".og-embed__description")&.text&.strip
        }
      end
+
+      # A link preview points at what we unfurled: an absolute http or https URL
+      # on some other host. Drop anything else a message body asks for, so it
+      # can't aim the preview's link or its image at this Campfire and have every
+      # reader's browser fetch it with their session attached.
+      def web_url(value)
+        return if value.blank?
+
+        parsed = URI.parse(value)
+        value if parsed.is_a?(URI::HTTP) && elsewhere?(parsed.host)
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      # "https:/rooms/1" parses as HTTPS with no host at all, and a browser
+      # resolves both that and our own hostname against the origin Campfire is
+      # served from. A percent-escape hides our hostname from this comparison
+      # while a browser still unescapes it back to us, so an escaped host is out
+      # too, and neither case is anything an unfurl could have produced.
+      def elsewhere?(host)
+        return false unless named_host?(host)
+
+        canonical_host(host) != canonical_host(Current.request_host.to_s)
+      end
+
+      # A preview names a page on the public internet, so its host is a domain
+      # name, written plainly. A bare address is not one, and a browser rewrites
+      # the many spellings of an address ("2130706433", "0x7f.0.0.1") into a
+      # single one before it fetches, which is a race a comparison here loses.
+      def named_host?(host)
+        host.present? && host.exclude?("%") && host.include?(".") && domain_ending?(host.split(".").last)
+      end
+
+      # What keeps a name from reading as an address is its last label, which is
+      # a word: never a number, and never the hexadecimal spelling of one.
+      def domain_ending?(label)
+        label.match?(/[a-z]/i) && !label.match?(/\A0x/i)
+      end
+
+      def canonical_host(host)
+        host.downcase.delete_suffix(".")
+      end
  end

  attr_accessor :href, :url, :filename, :description

+  def twitter_avatar?
+    url.to_s.start_with?(TWITTER_AVATAR_URL_PREFIX)
+  end
+
  def attachable_content_type
    OPENGRAPH_EMBED_CONTENT_TYPE
  end
@@ -37,8 +105,4 @@ class ActionText::Attachment::OpengraphEmbed
  def to_partial_path
    "action_text/attachables/opengraph_embed"
  end
-
-  def to_trix_content_attachment_partial_path
-    "action_text/attachables/opengraph_embed"
-  end
 end
@@ -0,0 +1,16 @@
+# Bot requests carry the bot key as a URL path segment (/rooms/:room_id/:bot_key/...).
+# config.filter_parameters redacts query and form parameters but never path segments,
+# so the key would otherwise be written verbatim to the request log. Redact it wherever
+# it appears in a formatted log line.
+class LogScrubbingFormatter < ::Logger::Formatter
+  BOT_KEY_IN_PATH = %r{(/rooms/\d+/)\d+-[A-Za-z0-9]+}
+
+  def call(severity, time, progname, message)
+    scrub(super)
+  end
+
+  private
+    def scrub(line)
+      line.gsub(BOT_KEY_IN_PATH, '\1[FILTERED]')
+    end
+end
@@ -1,76 +1,29 @@
-require "ipaddr"
-require "resolv"
+require "surfguard"

 module RestrictedHTTP
  class Violation < StandardError; end

+  # The address policy lives in the surfguard gem so this app, Basecamp, HEY and
+  # Fizzy classify "internal" the same way instead of each keeping a copy that
+  # drifts. The callers here hand a bare hostname in and pin the address that
+  # comes back, so this stays a hostname-in, address-out shim.
  module PrivateNetworkGuard
    extend self

-    # IPv4 special-use ranges (RFC 5735/6890) not already covered by the
-    # private?/loopback?/link_local? predicates in #disallowed_ipv4?.
-    DISALLOWED_IPV4 = %w[
-      0.0.0.0/8 100.64.0.0/10 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24
-      198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
-    ].map { |cidr| IPAddr.new(cidr) }.freeze
-
-    # IPv6 special-use ranges not caught by the predicates. 6to4 (2002::/16) and
-    # Teredo (2001::/32) are deprecated transition mechanisms with no legitimate
-    # fetch target, so they are blocked outright. ULA (fc00::/7, incl. the AWS
-    # IMDSv6 address fd00:ec2::254), link-local, and loopback are covered by the
-    # predicates in #disallowed_ipv6?.
-    DISALLOWED_IPV6 = %w[
-      ::/128 100::/64 2001::/32 2001:2::/48 2001:db8::/32 2002::/16
-      fec0::/10 ff00::/8
-    ].map { |cidr| IPAddr.new(cidr) }.freeze
-
-    # NAT64 prefixes: the well-known prefix (RFC 6052/6146) and the local-use
-    # prefix (RFC 8215). An address here embeds an IPv4 target in its low 32
-    # bits; we extract it and re-check against the IPv4 rules so NAT64 to a
-    # public address still resolves while NAT64 to an internal address is
-    # blocked.
-    NAT64_PREFIXES = [
-      IPAddr.new("64:ff9b::/96"),
-      IPAddr.new("64:ff9b:1::/48")
-    ].freeze
-
+    # A hostname that resolves to nothing (NXDOMAIN, timeout, empty answer)
+    # raises Surfguard::Unresolvable, which we let propagate as a lookup failure
+    # -- the same way the old Resolv.getaddress guard raised Resolv::ResolvError,
+    # and the callers here already treat it as a fetch failure. The Violation is
+    # reserved for a host that resolves to a blocked address (an empty list back
+    # from resolve_public_ips), so a transient DNS miss is never misreported as
+    # an SSRF attempt.
    def resolve(hostname)
-      Resolv.getaddress(hostname).tap do |ip|
-        raise Violation.new("Attempt to access private IP via #{hostname}") if ip && private_ip?(ip)
-      end
+      Surfguard.resolve_public_ips(hostname).first or
+        raise Violation.new("Attempt to access private IP via #{hostname}")
    end

    def private_ip?(ip)
-      ipaddr = IPAddr.new(ip)
-
-      # DNS never legitimately returns these embedded forms, so block them all
-      # regardless of the address they wrap.
-      if ipaddr.ipv4_mapped? || ipaddr.ipv4_compat?
-        true
-      elsif ipaddr.ipv4?
-        disallowed_ipv4?(ipaddr)
-      elsif NAT64_PREFIXES.any? { |prefix| prefix.include?(ipaddr) }
-        disallowed_ipv4?(embedded_ipv4(ipaddr))
-      else
-        disallowed_ipv6?(ipaddr)
-      end
-    rescue IPAddr::InvalidAddressError
-      true
+      Surfguard.blocked_address?(ip)
    end
-
-    private
-      def disallowed_ipv4?(ipaddr)
-        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
-          DISALLOWED_IPV4.any? { |range| range.include?(ipaddr) }
-      end
-
-      def disallowed_ipv6?(ipaddr)
-        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
-          DISALLOWED_IPV6.any? { |range| range.include?(ipaddr) }
-      end
-
-      def embedded_ipv4(ipaddr)
-        IPAddr.new([ ipaddr.to_i & 0xffffffff ].pack("N").unpack("C4").join("."))
-      end
  end
 end
@@ -1,16 +1,18 @@
 class WebPush::Notification
-  def initialize(title:, body:, path:, badge:, endpoint:, p256dh_key:, auth_key:)
+  def initialize(title:, body:, path:, badge:, endpoint:, endpoint_ip_resolver:, p256dh_key:, auth_key:)
    @title, @body, @path, @badge = title, body, path, badge
-    @endpoint, @p256dh_key, @auth_key = endpoint, p256dh_key, auth_key
+    @endpoint, @endpoint_ip_resolver, @p256dh_key, @auth_key = endpoint, endpoint_ip_resolver, p256dh_key, auth_key
  end

  def deliver(connection: nil)
-    WebPush.payload_send \
-      message: encoded_message,
-      endpoint: @endpoint, p256dh: @p256dh_key, auth: @auth_key,
-      vapid: vapid_identification,
-      connection: connection,
-      urgency: "high"
+    if endpoint_ip = @endpoint_ip_resolver.call
+      WebPush.payload_send \
+        message: encoded_message,
+        endpoint: @endpoint, endpoint_ip: endpoint_ip, p256dh: @p256dh_key, auth: @auth_key,
+        vapid: vapid_identification,
+        connection: connection,
+        urgency: "high"
+    end
  end

  private
@@ -3,7 +3,7 @@ class WebPush::Pool
  attr_reader :delivery_pool, :invalidation_pool, :connection, :invalid_subscription_handler

  def initialize(invalid_subscription_handler:)
-    @delivery_pool = Concurrent::ThreadPoolExecutor.new(max_threads: 50, queue_size: 10000)
+    @delivery_pool = Concurrent::ThreadPoolExecutor.new(max_threads: 50, max_queue: 10000)
    @invalidation_pool = Concurrent::FixedThreadPool.new(1)
    @connection = Net::HTTP::Persistent.new(name: "web_push", pool_size: 150)
    @invalid_subscription_handler = invalid_subscription_handler
@@ -6,4 +6,5 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  driven_by :selenium, using: :headless_chrome, screen_size: [ 1400, 1400 ]

  include SystemTestHelper
+  include RichTextEditorHelper
 end
@@ -0,0 +1,73 @@
+require "test_helper"
+
+class ActiveStorageAuthenticationTest < ActionDispatch::IntegrationTest
+  setup do
+    host! "once.campfire.test"
+  end
+
+  test "direct upload metadata endpoint rejects anonymous callers" do
+    get new_session_url
+    assert_response :success
+
+    assert_no_difference -> { ActiveStorage::Blob.count } do
+      post rails_direct_uploads_url, params: blob_params, as: :json
+    end
+
+    assert_response :unauthorized
+  end
+
+  test "direct upload metadata endpoint allows authenticated users" do
+    sign_in :david
+
+    assert_difference -> { ActiveStorage::Blob.count }, 1 do
+      post rails_direct_uploads_url, params: blob_params, as: :json
+    end
+
+    assert_response :success
+  end
+
+  test "disk service upload endpoint rejects anonymous callers" do
+    sign_in :david
+    post rails_direct_uploads_url, params: blob_params, as: :json
+    assert_response :success
+    upload_path = URI.parse(response.parsed_body.dig("direct_upload", "url")).request_uri
+
+    anonymous = open_session
+    anonymous.host! "once.campfire.test"
+    anonymous.put upload_path,
+      params: attachment_bytes,
+      headers: { "Content-Type" => "application/octet-stream" }
+
+    assert_equal 401, anonymous.status
+  end
+
+  test "disk service download endpoint stays public" do
+    ActiveStorage::Current.url_options = { host: "once.campfire.test", protocol: "https" }
+    blob = ActiveStorage::Blob.create_and_upload! \
+      io: StringIO.new(attachment_bytes), filename: "hi.txt", content_type: "text/plain"
+    download_path = URI.parse(blob.url).request_uri
+
+    anonymous = open_session
+    anonymous.host! "once.campfire.test"
+    anonymous.get download_path
+
+    assert_equal 200, anonymous.status
+    assert_equal attachment_bytes, anonymous.response.body
+  ensure
+    blob&.purge
+  end
+
+  private
+    def attachment_bytes
+      "hello!"
+    end
+
+    def blob_params
+      { blob: {
+        filename: "quota.bin",
+        byte_size: attachment_bytes.bytesize,
+        checksum: Digest::MD5.base64digest(attachment_bytes),
+        content_type: "application/octet-stream"
+      } }
+    end
+end
@@ -0,0 +1,112 @@
+require "test_helper"
+
+class Messages::Boosts::ByBotsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @room = rooms(:watercooler)
+    @message = messages(:fourth)
+    @bot = users(:bender)
+  end
+
+  test "create adds a boost to the message and returns it" do
+    assert_difference -> { @message.boosts.count }, +1 do
+      post room_bot_message_boosts_url(@room, @bot.bot_key, @message), params: +"👀"
+      assert_response :created
+    end
+
+    boost = @message.boosts.last
+    assert_equal "👀", boost.content
+    assert_equal @bot, boost.booster
+
+    json = JSON.parse(response.body)
+    assert_equal boost.id, json["id"]
+    assert_equal "👀", json["content"]
+    assert_equal @bot.id, json["booster"]["id"]
+    assert_equal @message.id, json["message"]["id"]
+    assert_equal room_message_url(@room, @message), json["message"]["url"]
+  end
+
+  test "create with text content" do
+    assert_difference -> { Boost.count }, +1 do
+      post room_bot_message_boosts_url(@room, @bot.bot_key, @message), params: +"Nice!"
+      assert_response :created
+    end
+
+    assert_equal "Nice!", @message.boosts.last.content
+  end
+
+  test "create broadcasts the boost" do
+    assert_turbo_stream_broadcasts [ @message.room, :messages ], count: 1 do
+      post room_bot_message_boosts_url(@room, @bot.bot_key, @message), params: +"👍"
+    end
+  end
+
+  test "create without content" do
+    assert_no_difference -> { Boost.count } do
+      post room_bot_message_boosts_url(@room, @bot.bot_key, @message)
+      assert_response :unprocessable_content
+
+      post room_bot_message_boosts_url(@room, @bot.bot_key, @message), params: +"   "
+      assert_response :unprocessable_content
+    end
+  end
+
+  test "create requires a valid bot key" do
+    assert_no_difference -> { Boost.count } do
+      post room_bot_message_boosts_url(@room, "invalid-bot-key", @message), params: +"👀"
+    end
+    assert_response :redirect
+  end
+
+  test "create is not found for a room the bot is not a member of" do
+    assert_no_difference -> { Boost.count } do
+      post room_bot_message_boosts_url(rooms(:designers), @bot.bot_key, messages(:first)), params: +"👀"
+    end
+    assert_response :not_found
+  end
+
+  test "create is not found for a message outside the room" do
+    assert_no_difference -> { Boost.count } do
+      post room_bot_message_boosts_url(@room, @bot.bot_key, messages(:first)), params: +"👀"
+    end
+    assert_response :not_found
+  end
+
+  test "create can't be abused to post boosts as a regular user" do
+    bot_key = "#{users(:kevin).id}-"
+
+    assert_no_difference -> { Boost.count } do
+      post room_bot_message_boosts_url(@room, bot_key, @message), params: +"👀"
+    end
+    assert_response :redirect
+  end
+
+  test "destroy removes the bot's own boost" do
+    assert_difference -> { Boost.count }, -1 do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender))
+    end
+
+    assert_response :no_content
+  end
+
+  test "destroy broadcasts the removal" do
+    assert_turbo_stream_broadcasts [ @message.room, :messages ], count: 1 do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender))
+    end
+  end
+
+  test "destroy can't touch a boost the bot did not make" do
+    assert_no_difference -> { Boost.count } do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, messages(:thirteenth), boosts(:thirteenth))
+    end
+
+    assert_response :not_found
+  end
+
+  test "destroy requires a valid bot key" do
+    assert_no_difference -> { Boost.count } do
+      delete room_bot_message_boost_url(@room, "invalid-bot-key", @message, boosts(:fourth_by_bender))
+    end
+
+    assert_response :redirect
+  end
+end
@@ -1,6 +1,6 @@
 require "test_helper"

-class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
+class Messages::ByBotsControllerTest < ActionDispatch::IntegrationTest
  setup do
    @room = rooms(:watercooler)
  end
@@ -40,6 +40,16 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
    end
  end

+  test "create without a body or attachment" do
+    assert_no_difference -> { Message.count } do
+      post room_bot_messages_url(@room, users(:bender).bot_key)
+      assert_response :unprocessable_content
+
+      post room_bot_messages_url(@room, users(:bender).bot_key), params: +"   "
+      assert_response :unprocessable_content
+    end
+  end
+
  test "create can't be abused to post messages as any user" do
    user = users(:kevin)
    bot_key = "#{user.id}-"
@@ -51,8 +61,175 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
    assert_response :redirect
  end

-  test "denied index" do
-    get room_messages_url(@room, bot_key: users(:bender).bot_key, format: :json)
+  test "index returns the room's messages in the order they were sent" do
+    get room_bot_messages_url(@room, users(:bender).bot_key)
+    assert_response :success
+
+    json = JSON.parse(response.body)
+    assert_equal @room.messages.ordered.map(&:id), json.map { it["id"] }
+  end
+
+  test "index includes message details" do
+    post room_bot_messages_url(@room, users(:bender).bot_key), params: +"Hello from Bender!"
+
+    get room_bot_messages_url(@room, users(:bender).bot_key)
+    assert_response :success
+
+    message = Message.last
+    json_message = JSON.parse(response.body).last
+    assert_equal message.id, json_message["id"]
+    assert_equal "Hello from Bender!", json_message["body"]["plain_text"]
+    assert_includes json_message["body"]["html"], "Hello from Bender!"
+    assert_equal message.created_at.utc.iso8601(3), json_message["created_at"]
+    assert_equal users(:bender).id, json_message["creator"]["id"]
+    assert_equal "Bender Bot", json_message["creator"]["name"]
+    assert_equal "bot", json_message["creator"]["role"]
+    assert_equal @room.id, json_message["room"]["id"]
+    assert_equal room_message_url(@room, message), json_message["url"]
+  end
+
+  test "index pages through older messages with the Link header" do
+    (Message::PAGE_SIZE - @room.messages.count + 1).times do |i|
+      @room.messages.create!(body: "Filler #{i}", creator: users(:jason), client_message_id: "filler-#{i}")
+    end
+
+    get room_bot_messages_url(@room, users(:bender).bot_key)
+    assert_response :success
+
+    json = JSON.parse(response.body)
+    assert_equal Message::PAGE_SIZE, json.size
+    assert_equal "41", response.headers["X-Total-Count"]
+    assert_not_includes json.map { it["id"] }, messages(:fourth).id
+
+    get response.headers["Link"][/<(.*)>/, 1]
+    assert_response :success
+
+    json = JSON.parse(response.body)
+    assert_equal [ messages(:fourth).id ], json.map { it["id"] }
+    assert_nil response.headers["Link"]
+  end
+
+  test "index pages newer messages with after" do
+    get room_bot_messages_url(@room, users(:bender).bot_key, after: messages(:tenth).id)
+    assert_response :success
+
+    json = JSON.parse(response.body)
+    assert_equal %i[ eleventh twelfth thirteenth ].map { messages(it).id }, json.map { it["id"] }
+    assert_nil response.headers["Link"]
+  end
+
+  test "index in a room with no messages" do
+    get room_bot_messages_url(rooms(:bender_and_kevin), users(:bender).bot_key)
+    assert_response :success
+
+    assert_equal [], JSON.parse(response.body)
+    assert_equal "0", response.headers["X-Total-Count"]
+    assert_nil response.headers["Link"]
+  end
+
+  test "index requires a valid bot key" do
+    get room_bot_messages_url(@room, "invalid-bot-key")
+    assert_response :redirect
+  end
+
+  test "index is not found for a room the bot is not a member of" do
+    get room_bot_messages_url(rooms(:designers), users(:bender).bot_key)
+    assert_response :not_found
+  end
+
+  test "create is not found for a room the bot is not a member of" do
+    assert_no_difference -> { Message.count } do
+      post room_bot_messages_url(rooms(:designers), users(:bender).bot_key), params: +"Hello!"
+    end
+    assert_response :not_found
+  end
+
+  test "regular messages index remains denied for bots" do
+    get room_messages_url(@room, bot_key: users(:bender).bot_key)
    assert_response :forbidden
  end
+
+  test "update" do
+    message = post_bot_message "Deploying..."
+
+    assert_no_difference -> { Message.count } do
+      patch room_bot_message_url(@room, users(:bender).bot_key, message), params: +"Deployed."
+    end
+
+    assert_response :ok
+    assert_equal "Deployed.", message.reload.plain_text_body
+
+    json = JSON.parse(response.body)
+    assert_equal message.id, json["id"]
+    assert_equal "Deployed.", json["body"]["plain_text"]
+    assert_equal users(:bender).id, json["creator"]["id"]
+    assert_equal room_message_url(@room, message), json["url"]
+  end
+
+  test "update with UTF-8 content" do
+    message = post_bot_message "Deploying..."
+
+    patch room_bot_message_url(@room, users(:bender).bot_key, message), params: +"Deployed 🚀!"
+
+    assert_response :ok
+    assert_equal "Deployed 🚀!", message.reload.plain_text_body
+    assert_equal "Deployed 🚀!", JSON.parse(response.body)["body"]["plain_text"]
+  end
+
+  test "update can't touch a message the bot did not create" do
+    message = messages(:fourth)
+    original = message.plain_text_body
+
+    patch room_bot_message_url(@room, users(:bender).bot_key, message), params: +"Hijacked!"
+
+    assert_response :forbidden
+    assert_equal original, message.reload.plain_text_body
+  end
+
+  test "update is not found for a room the bot is not a member of" do
+    message = messages(:first)
+    original = message.plain_text_body
+
+    patch room_bot_message_url(rooms(:designers), users(:bender).bot_key, message), params: +"Hijacked!"
+
+    assert_response :not_found
+    assert_equal original, message.reload.plain_text_body
+  end
+
+  test "update can't be abused to edit messages as any user" do
+    message = messages(:fourth)
+    bot_key = "#{users(:jz).id}-"
+    original = message.plain_text_body
+
+    patch room_bot_message_url(@room, bot_key, message), params: +"Hijacked!"
+
+    assert_response :redirect
+    assert_equal original, message.reload.plain_text_body
+  end
+
+  test "destroy" do
+    message = post_bot_message "Deploying..."
+
+    assert_difference -> { Message.count }, -1 do
+      delete room_bot_message_url(@room, users(:bender).bot_key, message)
+    end
+
+    assert_response :no_content
+  end
+
+  test "destroy can't touch a message the bot did not create" do
+    message = messages(:fourth)
+
+    assert_no_difference -> { Message.count } do
+      delete room_bot_message_url(@room, users(:bender).bot_key, message)
+    end
+
+    assert_response :forbidden
+  end
+
+  private
+    def post_bot_message(body)
+      post room_bot_messages_url(@room, users(:bender).bot_key), params: +body
+      Message.last
+    end
 end
@@ -20,6 +20,51 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
    assert response.cookies[:last_room] = users(:david).rooms.last.id
  end

+  test "show renders a link preview written by hand without its off-scheme image and link" do
+    room = rooms(:watercooler)
+    post room_messages_url(room, format: :turbo_stream), params: { message: {
+      body: link_preview_body(href: "javascript:alert(1)", url: "data:image/svg+xml;base64,PHN2Zy8+"),
+      client_message_id: "hand-written-preview" } }
+    assert_response :success
+
+    get room_url(room)
+
+    assert_response :success
+    assert_no_match /javascript:alert/, response.body
+    assert_no_match /data:image\/svg/, response.body
+    assert_match "Free cookies", response.body
+  end
+
+  test "show renders a link preview written by hand without its image pointed at this Campfire" do
+    room = rooms(:watercooler)
+    own_url = room_url(room, host: "www.example.com")
+    post room_messages_url(room, format: :turbo_stream), params: { message: {
+      body: link_preview_body(href: own_url, url: own_url),
+      client_message_id: "same-host-preview" } }
+    assert_response :success
+
+    get room_url(room)
+
+    assert_response :success
+    assert_no_match %r{<img src="#{Regexp.escape(own_url)}"}, response.body
+    assert_no_match %r{<a rel="noreferrer" target="_blank" href="#{Regexp.escape(own_url)}"}, response.body
+    assert_match "Free cookies", response.body
+  end
+
+  test "show renders an unfurled link preview" do
+    room = rooms(:watercooler)
+    post room_messages_url(room, format: :turbo_stream), params: { message: {
+      body: link_preview_body(href: "https://example.com/page", url: "https://example.com/image.png"),
+      client_message_id: "unfurled-preview" } }
+    assert_response :success
+
+    get room_url(room)
+
+    assert_response :success
+    assert_match %r{<img src="https://example\.com/image\.png"}, response.body
+    assert_match %r{href="https://example\.com/page"}, response.body
+  end
+
  test "destroy" do
    assert_turbo_stream_broadcasts :rooms, count: 1 do
      assert_difference -> { Room.count }, -1 do
@@ -42,4 +87,10 @@ class RoomsControllerTest < ActionDispatch::IntegrationTest
      delete room_url(rooms(:designers))
    end
  end
+
+  private
+    def link_preview_body(href:, url:)
+      %(<div><action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" ) +
+        %(href="#{href}" url="#{url}" filename="Free cookies" caption="Cookies here"></action-text-attachment></div>)
+    end
 end
@@ -56,6 +56,30 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
    assert_nil Session.find_by(id: session.id)
  end

+  test "destroy closes the signed-out user's live connections" do
+    sign_in :david
+
+    remote_connections = mock
+    remote_connections.expects(:disconnect).with(reconnect: true)
+    ActionCable.server.stubs(:remote_connections).returns(mock.tap { |m| m.expects(:where).with(current_user: users(:david)).returns(remote_connections) })
+
+    delete session_url
+
+    assert_redirected_to root_url
+  end
+
+  test "destroy still signs out when the realtime service is unreachable" do
+    sign_in :david
+    session = users(:david).sessions.last
+    ActionCable.server.stubs(:remote_connections).raises(RuntimeError.new("cable down"))
+
+    delete session_url
+
+    assert_redirected_to root_url
+    assert_not cookies[:session_token].present?
+    assert_nil Session.find_by(id: session.id)
+  end
+
  test "destroy removes the push subscription for the device" do
    sign_in :david

@@ -18,6 +18,18 @@ class UnfurlLinksControllerTest < ActionDispatch::IntegrationTest
    assert_equal "desc..", json_response["description"]
  end

+  test "create strips markup from the title and description" do
+    entity_encoded_image_tag = "&#x3c;&#x69;&#x6d;&#x67;&#x20;&#x73;&#x72;&#x63;&#x3d;&#x61;&#x20;&#x6f;&#x6e;&#x65;&#x72;&#x72;&#x6f;&#x72;&#x3d;&#x70;&#x72;&#x6f;&#x6d;&#x70;&#x74;&#x28;&#x31;&#x29;&#x3e;"
+    stub_successful_request title: "#{entity_encoded_image_tag}Hey!", description: "#{entity_encoded_image_tag}desc.."
+
+    post unfurl_link_url, params: { url: "https://www.example.com" }
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    assert_equal "Hey!", json_response["title"]
+    assert_equal "desc..", json_response["description"]
+  end
+
  test "create with missing opengraph meta tags" do
    WebMock.stub_request(:get, "https://www.example.com/").to_return(status: 200, body: "<html><head></head></html>", headers: {})

@@ -25,6 +37,21 @@ class UnfurlLinksControllerTest < ActionDispatch::IntegrationTest
    assert_response :no_content
  end

+  test "create returns no content when the title and description are only a markup tag" do
+    image_tag = "<img src='x' onerror='alert(document.domain)'/>"
+    body = "<html><head>" \
+      "<meta property=\"og:url\" content=\"https://example.com\">" \
+      "<meta property=\"og:title\" content=\"#{image_tag}\">" \
+      "<meta property=\"og:description\" content=\"#{image_tag}\">" \
+      "<meta property=\"og:image\" content=\"https://example.com/image.png\">" \
+      "</head></html>"
+    WebMock.stub_request(:get, "https://www.example.com/").to_return(status: 200, body: body, headers: { content_type: "text/html" })
+    WebMock.stub_request(:head, "https://example.com/image.png").to_return(status: 200, headers: { content_type: "image/png" })
+
+    post unfurl_link_url, params: { url: "https://www.example.com" }
+    assert_response :no_content
+  end
+
  test "create with a missing URL" do
    assert_raise ActionController::ParameterMissing do
      post unfurl_link_url, params: { url: "" }
@@ -49,10 +76,10 @@ class UnfurlLinksControllerTest < ActionDispatch::IntegrationTest
  end

  private
-    def stub_successful_request(url: "https://www.example.com/")
+    def stub_successful_request(url: "https://www.example.com/", title: "Hey!", description: "desc..")
      WebMock.stub_request(:get, url).to_return(
        status: 200,
-        body: "<html><head><meta property=\"og:url\" content=\"https://example.com\"><meta property=\"og:title\" content=\"Hey!\"><meta property=\"og:description\" content=\"desc..\"><meta property=\"og:image\" content=\"https://example.com/image.png\"></head></html>",
+        body: "<html><head><meta property=\"og:url\" content=\"https://example.com\"><meta property=\"og:title\" content=\"#{title}\"><meta property=\"og:description\" content=\"#{description}\"><meta property=\"og:image\" content=\"https://example.com/image.png\"></head></html>",
        headers: { content_type: "text/html" }
      )

@@ -3,10 +3,11 @@ require "test_helper"
 class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
  setup do
    sign_in :david
+    stub_web_push_dns_resolution
  end

  test "create new push subscription" do
-    subscription_params = { "endpoint" => "https://apple", "p256dh_key" => "123", "auth_key" => "456" }
+    subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }

    post user_push_subscriptions_url,
      params: { push_subscription: subscription_params }, headers: { "HTTP_USER_AGENT" => "Mozilla/5.0" }
@@ -29,6 +30,44 @@ class Users::PushSubscriptionsControllerTest < ActionDispatch::IntegrationTest
    assert_response :ok
  end

+  test "rejects subscription with non-permitted endpoint" do
+    subscription_params = { "endpoint" => "https://attacker.example.com/steal", "p256dh_key" => "123", "auth_key" => "456" }
+
+    assert_no_difference -> { Push::Subscription.count } do
+      post user_push_subscriptions_url, params: { push_subscription: subscription_params }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "rejects subscription with endpoint resolving to a private IP" do
+    stub_dns_resolution("169.254.169.254")
+    subscription_params = { "endpoint" => "https://fcm.googleapis.com/fcm/send/abc123", "p256dh_key" => "123", "auth_key" => "456" }
+
+    assert_no_difference -> { Push::Subscription.count } do
+      post user_push_subscriptions_url, params: { push_subscription: subscription_params }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "re-registering a legacy invalid subscription is rejected with 422" do
+    # A row that predates endpoint validation (saved without validation, as a
+    # sink planted before this shipped could be). Re-POSTing its params must hit
+    # the same 422 as a fresh create, not be kept alive by touch.
+    legacy = users(:david).push_subscriptions.build \
+      endpoint: "https://attacker.example.com/steal", p256dh_key: "123", auth_key: "456"
+    legacy.save!(validate: false)
+
+    assert_no_difference -> { Push::Subscription.count } do
+      post user_push_subscriptions_url, params: {
+        push_subscription: { endpoint: "https://attacker.example.com/steal", p256dh_key: "123", auth_key: "456" }
+      }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
  test "destroy a push subscription via dev mode" do
    assert_difference -> { Push::Subscription.count }, -1 do
      delete user_push_subscription_url(push_subscriptions(:david_chrome))
@@ -6,3 +6,7 @@ thirteenth:
  message: thirteenth
  booster: jason
  content: 💯
+fourth_by_bender:
+  message: fourth
+  booster: bender
+  content: 👀
@@ -1,6 +1,7 @@
 require "test_helper"

 class ContentFiltersTest < ActionView::TestCase
+  include MessagesHelper, ERB::Util
  test "entire message contains an unfurled URL" do
    text = "https://basecamp.com/"
    message = Message.create! room: rooms(:pets), body: unfurled_message_body_for_basecamp(text), client_message_id: "0015", creator: users(:jason)
@@ -10,6 +11,16 @@ class ContentFiltersTest < ActionView::TestCase
    assert_match /<div><action-text-attachment/, filtered.to_html
  end

+  test "entire message contains an unfurled URL in a lexxy body" do
+    text = "https://basecamp.com/"
+    body = "<p><a href=\"#{text}\">#{text}</a></p>#{unfurled_link_trix_attachment_for_basecamp}"
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body)
+    assert_no_match %r{>\s*https://basecamp\.com/\s*</a>}, filtered.to_html
+    assert_match /<action-text-attachment/, filtered.to_html
+  end
+
  test "message includes additional text besides an unfurled URL" do
    text = "Hello https://basecamp.com/"
    message = Message.create! room: rooms(:pets), body: unfurled_message_body_for_basecamp(text), client_message_id: "0015", creator: users(:jason)
@@ -19,20 +30,26 @@ class ContentFiltersTest < ActionView::TestCase
    assert_match %r{<div>Hello https://basecamp\.com/<action-text-attachment}, filtered.to_html
  end

-  test "unfurled tweet without any image" do
-    text = "<div>https://twitter.com/37signals/status/1750290547908952568<action-text-attachment content-type=\"application/vnd.actiontext.opengraph-embed\" url=\"https://pbs.twimg.com/profile_images/1671940407633010689/9P5gi6LF_200x200.jpg\" href=\"https://twitter.com/37signals/status/1750290547908952568\" filename=\"37signals (@37signals)\" caption=\"We're back up on all apps, everyone. Really sorry for the disruption to your day.\" content=\"<actiontext-opengraph-embed>\n      <div class=&quot;og-embed&quot;>\n        <div class=&quot;og-embed__content&quot;>\n          <div class=&quot;og-embed__title&quot;>37signals (@37signals)</div>\n          <div class=&quot;og-embed__description&quot;>We're back up on all apps, everyone. Really sorry for the disruption to your day.</div>\n        </div>\n        <div class=&quot;og-embed__image&quot;>\n          <img src=&quot;https://pbs.twimg.com/profile_images/1671940407633010689/9P5gi6LF_200x200.jpg&quot; class=&quot;image&quot; alt=&quot;&quot; />\n        </div>\n      </div>\n    </actiontext-opengraph-embed>\"></action-text-attachment></div>"
-    message = Message.create! room: rooms(:pets), body: unfurled_message_body_for_basecamp(text), client_message_id: "0015", creator: users(:jason)
+  test "unfurled tweet with an avatar image gets the twitter avatar treatment" do
+    body = %(<div>https://twitter.com/37signals/status/1750290547908952568<action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" url="https://pbs.twimg.com/profile_images/1671940407633010689/9P5gi6LF_200x200.jpg" href="https://twitter.com/37signals/status/1750290547908952568" filename="37signals (@37signals)" caption="We're back up on all apps, everyone."></action-text-attachment></div>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)

-    filtered = ContentFilters::StyleUnfurledTwitterAvatars.apply(message.body.body)
-    assert_match %r{<div class="cf-twitter-avatar">}, filtered.to_html
+    assert_match /og-embed--twitter-avatar/, message_presentation(message)
  end

-  test "unfurled tweet containing an image" do
-    text = "<div>https://twitter.com/dhh/status/1748445489648050505<action-text-attachment content-type=\"application/vnd.actiontext.opengraph-embed\" url=\"https://pbs.twimg.com/media/GEO5l04bsAA9f6H.jpg\" href=\"https://twitter.com/dhh/status/1748445489648050505\" filename=\"DHH (@dhh)\" caption=\"We pay homage to the glorious MIT License with the ONCE license. May all our future legalese be as succinct!\" content=\"<actiontext-opengraph-embed>\n      <div class=&quot;og-embed&quot;>\n        <div class=&quot;og-embed__content&quot;>\n          <div class=&quot;og-embed__title&quot;>DHH (@dhh)</div>\n          <div class=&quot;og-embed__description&quot;>We pay homage to the glorious MIT License with the ONCE license. May all our future legalese be as succinct!</div>\n        </div>\n        <div class=&quot;og-embed__image&quot;>\n          <img src=&quot;https://pbs.twimg.com/media/GEO5l04bsAA9f6H.jpg&quot; class=&quot;image&quot; alt=&quot;&quot; />\n        </div>\n      </div>\n    </actiontext-opengraph-embed>\"></action-text-attachment></div>"
-    message = Message.create! room: rooms(:pets), body: unfurled_message_body_for_basecamp(text), client_message_id: "0015", creator: users(:jason)
+  test "unfurled tweet with an avatar image in a lexxy body gets the twitter avatar treatment" do
+    content = %(<actiontext-opengraph-embed><div class="og-embed gap"><div class="og-embed__content"><div class="og-embed__title"><a href="https://twitter.com/x/status/1">Tweet</a></div><div class="og-embed__description">desc</div></div><div class="og-embed__image"><img src="https://pbs.twimg.com/profile_images/x.jpg" class="image center" alt="" /></div></div></actiontext-opengraph-embed>)
+    body = %(<p><a href="https://twitter.com/x/status/1">https://twitter.com/x/status/1</a></p><action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" content="#{CGI.escapeHTML(content)}"></action-text-attachment>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)

-    filtered = ContentFilters::StyleUnfurledTwitterAvatars.apply(message.body.body)
-    assert_no_match %r{<div class="cf-twitter-avatar">}, filtered.to_html
+    assert_match /og-embed--twitter-avatar/, message_presentation(message)
+  end
+
+  test "unfurled tweet with a content image is not styled as an avatar" do
+    body = %(<div>https://twitter.com/dhh/status/1748445489648050505<action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" url="https://pbs.twimg.com/media/GEO5l04bsAA9f6H.jpg" href="https://twitter.com/dhh/status/1748445489648050505" filename="DHH (@dhh)" caption="We pay homage to the glorious MIT License!"></action-text-attachment></div>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)
+
+    assert_no_match /og-embed--twitter-avatar/, message_presentation(message)
  end

  test "entire message contains an unfurled URL from x.com but unfurls to twitter.com" do
@@ -53,6 +70,17 @@ class ContentFiltersTest < ActionView::TestCase
    assert_match /<div><action-text-attachment/, filtered.to_html
  end

+  test "message keeps strikethrough, underline and code block formatting" do
+    body = %(<p>Hello <s>struck</s> <u>under</u> <mark>marked</mark></p><pre data-language="ruby">def x<br>end</pre>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0016", creator: users(:jason)
+
+    html = message_presentation(message)
+    assert_match %r{<s>struck</s>}, html
+    assert_match %r{<u>under</u>}, html
+    assert_match %r{<mark>marked</mark>}, html
+    assert_match %r{<pre data-language="ruby">}, html
+  end
+
  test "message contains a forbidden tag" do
    exploit_image_tag = 'Hello <img src="https://ssecurityrise.com/tests/billionlaughs-cache.svg">World'
    message = Message.create! room: rooms(:pets), body: exploit_image_tag, client_message_id: "0015", creator: users(:jason)
@@ -61,6 +89,93 @@ class ContentFiltersTest < ActionView::TestCase
    assert_equal "Hello World", filtered.to_html
  end

+  test "message with a link using an unsafe URI scheme" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="javascript:alert(1)">x</a></div>', client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body)
+    assert_no_match /javascript:/, filtered.to_html
+    assert_match /<a>x<\/a>/, filtered.to_html
+  end
+
+  test "message with an event handler attribute on an allowed tag" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="/x" onmouseover="alert(1)">x</a> <span onclick="alert(2)">y</span></div>', client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body)
+    assert_no_match /onmouseover/, filtered.to_html
+    assert_no_match /onclick/, filtered.to_html
+    assert_match /<a href="\/x">x<\/a>/, filtered.to_html
+    assert_match /<span>y<\/span>/, filtered.to_html
+  end
+
+  test "message with a data URI link" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="data:text/html,pwned">x</a></div>', client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body)
+    assert_no_match /data:/, filtered.to_html
+    assert_match /<a>x<\/a>/, filtered.to_html
+  end
+
+  test "message with a safe link and formatting is preserved" do
+    body = '<div><a href="https://example.com">example</a> <strong>bold</strong> <code>code</code><ul><li>one</li><li>two</li></ul></div>'
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body)
+    assert_match /<a href="https:\/\/example\.com">example<\/a>/, filtered.to_html
+    assert_match /<strong>bold<\/strong>/, filtered.to_html
+    assert_match /<code>code<\/code>/, filtered.to_html
+    assert_match /<ul>\s*<li>one<\/li>\s*<li>two<\/li>\s*<\/ul>/, filtered.to_html
+  end
+
+  test "SanitizeAttributes uses an isolated sanitizer rather than the shared ActionText instance" do
+    filter = ContentFilters::SanitizeAttributes.new(ActionText::Content.new("<div>x</div>"))
+
+    isolated = filter.send(:sanitizer)
+    assert_not_same ActionText::ContentHelper.sanitizer, isolated,
+      "must not reuse the process-wide ActionText sanitizer, whose permit scrubber is mutated per call"
+    assert_not_same isolated, filter.send(:sanitizer),
+      "each call must build a fresh sanitizer so concurrent requests never share scrubber state"
+    assert_kind_of ActionText::ContentHelper.sanitizer.class, isolated
+  end
+
+  test "SanitizeAttributes neutralizes unsafe input and preserves benign content on its isolated sanitizer" do
+    body = <<~HTML.squish
+      <div><a href="javascript:alert(1)" onclick="x()">link</a>
+      <a href="data:text/html,pwned">data</a>
+      <span class="cf-twitter-avatar" onmouseover="y()">avatar</span>
+      <img src="https://evil.example/x.svg"> Hey #{mention_attachment_for(:david)}</div>
+    HTML
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0015", creator: users(:jason)
+
+    filtered = ContentFilters::SanitizeAttributes.apply(message.body.body).to_html
+
+    assert_no_match /javascript:/, filtered
+    assert_no_match /data:text\/html/, filtered
+    assert_no_match /onclick/, filtered
+    assert_no_match /onmouseover/, filtered
+    assert_no_match /evil\.example/, filtered
+    assert_match /<span class="cf-twitter-avatar">avatar<\/span>/, filtered
+    assert_match />link</, filtered
+    assert_match /<action-text-attachment sgid="#{users(:david).attachable_sgid}"/, filtered
+  end
+
+  test "message with formatting saved under Trix renders unchanged" do
+    body = %(<div>Hello <strong>bold</strong> <em>it</em> <del>gone</del> <a href="https://example.com/">link</a><br>second line</div><h1>Heading</h1><blockquote>quoted</blockquote><pre>line 1\nline 2</pre><ul><li>one</li></ul><ol><li>first</li></ol>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0021", creator: users(:jason)
+
+    assert_equal body, ContentFilters::TextMessagePresentationFilters.apply(message.body.body).to_html
+    assert_includes message_presentation(message), body
+  end
+
+  test "message with a table keeps the table" do
+    body = "<figure class=\"lexxy-content__table-wrapper\"><table><tbody><tr><th><p>Name</p></th></tr><tr><td><p>Jason</p></td></tr></tbody></table></figure>"
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0016", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body).to_html
+
+    assert_equal body, filtered
+    assert_match %r{<table>.*<th><p>Name</p></th>.*<td><p>Jason</p></td>}m, message_presentation(message)
+  end
+
  test "message with a mention attachment" do
    message = Message.create! room: rooms(:pets), body: "<div>Hey #{mention_attachment_for(:david)}</div>", creator: users(:jason)

@@ -0,0 +1,27 @@
+require "test_helper"
+
+class MessagesHelperTest < ActionView::TestCase
+  test "message_presentation neutralizes unsafe URI schemes in links" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="javascript:alert(1)">x</a></div>', client_message_id: "0015", creator: users(:jason)
+
+    presentation = view.message_presentation(message)
+    assert_no_match /javascript:/, presentation
+    assert_match /<a>x<\/a>/, presentation
+  end
+
+  test "message_presentation strips event handler attributes from allowed tags" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="/x" onmouseover="alert(1)">x</a></div>', client_message_id: "0015", creator: users(:jason)
+
+    presentation = view.message_presentation(message)
+    assert_no_match /onmouseover/, presentation
+    assert_match /<a href="\/x">x<\/a>/, presentation
+  end
+
+  test "message_presentation preserves safe links and formatting" do
+    message = Message.create! room: rooms(:pets), body: '<div><a href="https://example.com">example</a> <strong>bold</strong></div>', client_message_id: "0015", creator: users(:jason)
+
+    presentation = view.message_presentation(message)
+    assert_match /<a href="https:\/\/example\.com"[^>]*>example<\/a>/, presentation
+    assert_match /<strong>bold<\/strong>/, presentation
+  end
+end
@@ -0,0 +1,53 @@
+require "test_helper"
+
+class RichTextHelperTest < ActionView::TestCase
+  include ActionText::ContentHelper
+  test "editable_body renders legacy opengraph embeds into the content attribute" do
+    body = %(<div>https://example.com/ <action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" url="https://example.com/image.png" href="https://example.com/" filename="Example title" caption="Example description"></action-text-attachment></div>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0017", creator: users(:jason)
+
+    node = editable_body(message).body.fragment.find_all("action-text-attachment").first
+    content = Nokogiri::HTML.fragment(node["content"])
+
+    assert_equal "Example title", content.at_css(".og-embed__title a").text.strip
+    assert_equal "https://example.com/", content.at_css(".og-embed__title a")["href"]
+    assert_equal "Example description", content.at_css(".og-embed__description").text.strip
+    assert_equal "https://example.com/image.png", content.at_css(".og-embed__image img")["src"]
+  end
+
+  test "editable_body rebuilds a hand-written embed from its validated details" do
+    content = <<~HTML.squish
+      <actiontext-opengraph-embed data-controller="pwn" data-action="click->pwn#run">
+        <div class="og-embed"><div class="og-embed__title"><a href="/rooms/1">Free cookies</a></div>
+        <div class="og-embed__image"><img src="/rooms/1/avatar" data-action="load->pwn#run"></div></div>
+      </actiontext-opengraph-embed>
+    HTML
+    body = %(<p><action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" url="https://example.com/image.png" content="#{ERB::Util.html_escape(content)}"></action-text-attachment></p>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0019", creator: users(:jason)
+
+    node = editable_body(message).body.fragment.find_all("action-text-attachment").first
+    rebuilt = Nokogiri::HTML.fragment(node["content"])
+
+    assert_equal "Free cookies", rebuilt.at_css(".og-embed__title").text.strip
+    assert_no_match /rooms\/1/, node["content"]
+    assert_no_match /data-/, node["content"]
+    assert_nil rebuilt.at_css("a")
+    assert_nil rebuilt.at_css("img")
+  end
+
+  test "editable_body restores the content type of a mention edited under Trix" do
+    body = %(<div>Hey <action-text-attachment sgid="#{users(:david).attachable_sgid}" content-type="application/octet-stream"></action-text-attachment></div>)
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0020", creator: users(:jason)
+
+    node = editable_body(message).body.fragment.find_all("action-text-attachment").first
+
+    assert_equal "application/vnd.campfire.mention", node["content-type"]
+    assert_match "David", node["content"]
+  end
+
+  test "editable_body leaves bodies without attachments unchanged" do
+    message = Message.create! room: rooms(:pets), body: "<p>Plain text</p>", client_message_id: "0018", creator: users(:jason)
+
+    assert_equal message.body.body.to_html, editable_body(message).body.to_html
+  end
+end
@@ -1,128 +0,0 @@
-require "test_helper"
-
-class CspNonceTest < ActionDispatch::IntegrationTest
-  test "policy is delivered Report-Only, not enforced" do
-    sign_in :david
-    get root_url
-    follow_redirect!  # root redirects to the last room
-
-    assert_response :success
-    assert response.headers["Content-Security-Policy-Report-Only"].present?,
-      "Expected a Report-Only CSP header"
-    assert_nil response.headers["Content-Security-Policy"],
-      "Policy must not be enforced yet"
-  end
-
-  test "nonce is stable across requests so Turbo restores don't trip CSP" do
-    sign_in :david
-
-    get root_url
-    nonce1 = report_only_nonce
-
-    get root_url
-    nonce2 = report_only_nonce
-
-    assert nonce1.present?, "Expected a nonce in the Report-Only CSP header"
-    assert_equal nonce1, nonce2, "Nonce must be stable across requests"
-  end
-
-  test "client-set identifier still yields an unpredictable HMAC nonce" do
-    fake_id = "attacker-controlled-value"
-    cookies[CSP::Nonce::COOKIE] = fake_id
-
-    get root_url
-    nonce = report_only_nonce
-
-    assert_equal CSP::Nonce.hmac(fake_id), nonce,
-      "Nonce must be HMAC-SHA256 of the identifier keyed by secret_key_base"
-  end
-
-  test "importmap script tag carries the nonce" do
-    sign_in :david
-    get root_url
-    follow_redirect!  # root redirects to the last room
-
-    assert_response :success
-    nonce = report_only_nonce
-    assert_select "script[type='importmap'][nonce=?]", nonce
-  end
-
-  test "a per-install ENV extra host is appended to its directive" do
-    with_env "CSP_EXTRA_FRAME_SRC" => "https://player.vimeo.com https://www.youtube.com",
-             "CSP_EXTRA_IMG_SRC"   => "https://cdn.example.test" do
-      header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-
-      assert_match %r{frame-src[^;]*\bhttps://player\.vimeo\.com\b}, header
-      assert_match %r{frame-src[^;]*\bhttps://www\.youtube\.com\b}, header
-      assert_match %r{img-src[^;]*\bhttps://cdn\.example\.test\b}, header
-      # :self is preserved alongside the extras.
-      assert_match %r{frame-src 'self'}, header
-    end
-  end
-
-  test "a semicolon-separated ENV extra tokenizes into valid sources without raising" do
-    # A plausible operator paste separates hosts with "; ". Because the nonce
-    # forces a per-request policy build, a semicolon left inside a single source
-    # token would make Rails raise InvalidDirectiveError on every request — a
-    # site-wide 500 even in report-only mode. Splitting on ';' must yield both
-    # hosts as valid tokens and never raise.
-    with_env "CSP_EXTRA_FRAME_SRC" => "https://a.example; https://b.example" do
-      header = nil
-      assert_nothing_raised do
-        header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-      end
-
-      assert_match %r{frame-src[^;]*\bhttps://a\.example\b}, header
-      assert_match %r{frame-src[^;]*\bhttps://b\.example\b}, header
-      # Both hosts share the one frame-src directive; the semicolon did not leak
-      # a second directive into the policy.
-      assert_equal 1, header.scan(/(?:^|;\s*)frame-src\b/).size,
-        "Expected exactly one frame-src directive"
-    end
-  end
-
-  test "public cacheable responses carry neither the policy nor the nonce cookie" do
-    sign_in :david
-    blob = ActiveStorage::Blob.create_and_upload!(io: file_fixture("moon.jpg").open, filename: "moon.jpg", content_type: "image/jpeg")
-    get rails_blob_path(blob)
-    disk_blob_url = response.location
-
-    [
-      qr_code_path(Base64.urlsafe_encode64("http://example.com")),
-      account_logo_path,
-      user_avatar_path(users(:kevin).avatar_token),
-      disk_blob_url
-    ].each do |path|
-      cookies.delete CSP::Nonce::COOKIE
-
-      get path
-
-      assert_response :success
-      assert response.cache_control[:public], "#{path} is expected to be publicly cacheable"
-      assert_nil response.headers["Content-Security-Policy-Report-Only"], "#{path} must not carry the policy"
-      assert_nil cookies[CSP::Nonce::COOKIE], "#{path} must not set the nonce cookie"
-    end
-  end
-
-  test "directives default to :self only when no ENV extras are set" do
-    with_env "CSP_EXTRA_FRAME_SRC" => nil, "CSP_EXTRA_IMG_SRC" => nil do
-      header = ActionDispatch::ContentSecurityPolicy.new { |p| CSP.apply(p) }.build
-
-      assert_match %r{frame-src 'self'(;|\z)}, header
-    end
-  end
-
-  private
-    def with_env(vars)
-      original = {}
-      vars.each_key { |k| original[k] = ENV.key?(k) ? ENV[k] : :__unset__ }
-      vars.each { |k, v| v.nil? ? ENV.delete(k) : ENV[k] = v }
-      yield
-    ensure
-      original.each { |k, v| v == :__unset__ ? ENV.delete(k) : ENV[k] = v }
-    end
-
-    def report_only_nonce
-      response.headers["Content-Security-Policy-Report-Only"].to_s[/'nonce-([^']+)'/, 1]
-    end
-end
@@ -28,9 +28,11 @@ class ActionText::AttachmentTest < ActiveSupport::TestCase
  end

  test "from_node with an invalid SGID" do
-    room = rooms(:pets).tap { |r| r.extend ActionText::Attachable }
+    # A Room is not attachable; mint the sgid an attachable would carry
+    # (`ActionText::Attachable#attachable_sgid` is exactly this call).
+    sgid = rooms(:pets).to_sgid(expires_in: nil, for: ActionText::Attachable::LOCATOR_NAME).to_s

-    html = %Q(<action-text-attachment sgid="#{room.attachable_sgid}invalid"></action-text-attachment>)
+    html = %Q(<action-text-attachment sgid="#{sgid}invalid"></action-text-attachment>)
    node = ActionText::Fragment.wrap(html).find_all(ActionText::Attachment.tag_name).first

    attachment = ActionText::Attachment.from_node(node)
@@ -0,0 +1,133 @@
+require "test_helper"
+
+# Every case runs against both ways an embed is stored: the Trix-era node
+# attributes and the content markup Lexxy serializes.
+class ActionText::Attachment::OpengraphEmbedTest < ActiveSupport::TestCase
+  test "keeps absolute http and https links and images" do
+    embeds_from(href: "http://example.com/page", url: "https://example.com/image.png").each do |embed|
+      assert_equal "http://example.com/page", embed.href
+      assert_equal "https://example.com/image.png", embed.url
+    end
+  end
+
+  test "drops a link and an image that aren't web URLs" do
+    [ "javascript:alert(1)", "data:text/html,pwned", "vbscript:msgbox(1)", "//example.com/image.png",
+      "/rooms/1", "rooms/1", "", "http://exa mple.com/ ",
+      "https:/rooms/1", "https:rooms/1", "http:/rooms/1", "https://", "http://:80/rooms/1" ].each do |value|
+      embeds_from(href: value, url: value).each do |embed|
+        assert_nil embed.href, "expected #{value.inspect} to be dropped as a link"
+        assert_nil embed.url, "expected #{value.inspect} to be dropped as an image"
+      end
+    end
+  end
+
+  test "drops a link and an image on this Campfire's own host, however it is spelled" do
+    Current.set request: ActionDispatch::TestRequest.create("HTTP_HOST" => "once.campfire.test") do
+      [ "https://once.campfire.test/rooms/1", "http://once.campfire.test/rooms/1",
+        "https://ONCE.Campfire.Test/rooms/1", "https://once.campfire.test./rooms/1",
+        "https://%6fnce.campfire.test/rooms/1", "https://%77ww.example.com/x.png" ].each do |value|
+        embeds_from(href: value, url: value).each do |embed|
+          assert_nil embed.href, "expected #{value.inspect} to be dropped as a link"
+          assert_nil embed.url, "expected #{value.inspect} to be dropped as an image"
+        end
+      end
+
+      embeds_from(href: "https://example.com/page", url: "https://example.com/image.png").each do |embed|
+        assert_equal "https://example.com/page", embed.href
+        assert_equal "https://example.com/image.png", embed.url
+      end
+    end
+  end
+
+  test "drops a link and an image on a bare address rather than a domain name" do
+    [ "http://127.0.0.1/rooms/1", "http://2130706433/rooms/1", "http://0177.0.0.1/rooms/1",
+      "http://0x7f.0.0.1/rooms/1", "http://1.2.3.0xff/rooms/1", "http://[::1]/rooms/1",
+      "http://localhost/rooms/1", "https://203.0.113.10/image.png" ].each do |value|
+      embeds_from(href: value, url: value).each do |embed|
+        assert_nil embed.href, "expected #{value.inspect} to be dropped as a link"
+        assert_nil embed.url, "expected #{value.inspect} to be dropped as an image"
+      end
+    end
+  end
+
+  test "keeps an internationalized domain written in punycode" do
+    embeds_from(href: "https://xn--80aswg.xn--p1ai/page", url: "https://xn--80aswg.xn--p1ai/image.png").each do |embed|
+      assert_equal "https://xn--80aswg.xn--p1ai/page", embed.href
+      assert_equal "https://xn--80aswg.xn--p1ai/image.png", embed.url
+    end
+  end
+
+  test "reads the details out of content markup" do
+    embed = content_attachment_for(href: "https://example.com/page", url: "https://example.com/image.png",
+      filename: "Example title", caption: "Example description").attachable
+
+    assert_equal "Example title", embed.filename
+    assert_equal "Example description", embed.description
+  end
+
+  test "renders the image and the link when both are web URLs" do
+    render_embeds(href: "https://example.com/page", url: "https://example.com/image.png").each do |html|
+      assert_match %r{<a rel="noreferrer" target="_blank" href="https://example\.com/page">Title</a>}, html
+      assert_match %r{<img src="https://example\.com/image\.png"}, html
+    end
+  end
+
+  test "renders no image and no link when neither is a web URL" do
+    render_embeds(href: "javascript:alert(1)", url: "data:image/svg+xml;base64,PHN2Zy8+").each do |html|
+      assert_no_match /javascript:/, html
+      assert_no_match /data:/, html
+      assert_no_match /<img/, html
+      assert_no_match /<a /, html
+      assert_match "Title", html
+    end
+  end
+
+  test "renders the title and the description as text" do
+    render_embeds(href: "https://example.com/page", url: "https://example.com/image.png",
+      filename: "<b>Title</b>", caption: "<img src=x onerror=alert(1)>").each do |html|
+      assert_no_match /<b>/, html
+      assert_no_match /<img src=x/, html
+      assert_match "&lt;b&gt;Title&lt;/b&gt;", html
+      assert_match "&lt;img src=x onerror=alert(1)&gt;", html
+    end
+  end
+
+  private
+    def attachments_for(**details)
+      [ attribute_attachment_for(**details), content_attachment_for(**details) ]
+    end
+
+    def attribute_attachment_for(href:, url:, filename: "Title", caption: "Description")
+      attachment_from %(<action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" ) +
+        %(href="#{href}" url="#{url}" filename="#{filename}" caption="#{caption}"></action-text-attachment>)
+    end
+
+    def content_attachment_for(href:, url:, filename: "Title", caption: "Description")
+      content = <<~HTML.squish
+        <actiontext-opengraph-embed><div class="og-embed">
+          <div class="og-embed__content">
+            <div class="og-embed__title"><a href="#{ERB::Util.html_escape(href)}">#{ERB::Util.html_escape(filename)}</a></div>
+            <div class="og-embed__description">#{ERB::Util.html_escape(caption)}</div>
+          </div>
+          <div class="og-embed__image"><img src="#{ERB::Util.html_escape(url)}"></div>
+        </div></actiontext-opengraph-embed>
+      HTML
+
+      attachment_from %(<action-text-attachment content-type="application/vnd.actiontext.opengraph-embed" ) +
+        %(content="#{ERB::Util.html_escape(content)}"></action-text-attachment>)
+    end
+
+    def attachment_from(html)
+      ActionText::Attachment.from_node ActionText::Fragment.wrap(html).find_all(ActionText::Attachment.tag_name).first
+    end
+
+    def embeds_from(**details)
+      attachments_for(**details).map(&:attachable)
+    end
+
+    def render_embeds(**details)
+      attachments_for(**details).map do |attachment|
+        ApplicationController.render partial: attachment.to_partial_path, locals: { opengraph_embed: attachment }
+      end
+    end
+end
@@ -0,0 +1,54 @@
+require "test_helper"
+
+class LogScrubbingFormatterTest < ActiveSupport::TestCase
+  setup { @formatter = LogScrubbingFormatter.new }
+
+  test "redacts the bot key path segment from a request log line" do
+    line = format(%(Started POST "/rooms/1/5-Ab3xK9mQz1Rt/messages" for 203.0.113.10))
+    assert_includes line, "/rooms/1/[FILTERED]/messages"
+    assert_not_includes line, "Ab3xK9mQz1Rt"
+  end
+
+  test "redacts the bot key reflected in a pagination Link header" do
+    line = format(%(Link: <https://campfire.example.com/rooms/42/7-Zt9QmK1xz3Ab/messages?before=99>; rel="next"))
+    assert_includes line, "/rooms/42/[FILTERED]/messages?before=99"
+    assert_not_includes line, "Zt9QmK1xz3Ab"
+  end
+
+  test "redacts every occurrence on a line" do
+    line = format("/rooms/1/5-Ab3xK9mQz1Rt/messages and /rooms/2/6-Cd4yL0nR2St7/messages/9/boosts")
+    assert_not_includes line, "Ab3xK9mQz1Rt"
+    assert_not_includes line, "Cd4yL0nR2St7"
+    assert_equal 2, line.scan("[FILTERED]").length
+  end
+
+  test "leaves non-bot room paths untouched" do
+    line = format(%(Started GET "/rooms/1/messages" for 203.0.113.10))
+    assert_includes line, "/rooms/1/messages"
+    assert_not_includes line, "[FILTERED]"
+  end
+
+  test "preserves surrounding log content" do
+    line = format("hello")
+    assert_includes line, "hello"
+  end
+
+  test "scrubs through the TaggedLogging + STDOUT logger stack as production wires it" do
+    io = StringIO.new
+    logger = ActiveSupport::Logger.new(io)
+      .tap  { |logger| logger.formatter = LogScrubbingFormatter.new }
+      .then { |logger| ActiveSupport::TaggedLogging.new(logger) }
+
+    logger.tagged("req-123") { logger.info(%(Started POST "/rooms/1/5-Ab3xK9mQz1Rt/messages")) }
+
+    output = io.string
+    assert_includes output, "[req-123]"
+    assert_includes output, "/rooms/1/[FILTERED]/messages"
+    assert_not_includes output, "Ab3xK9mQz1Rt"
+  end
+
+  private
+    def format(message)
+      @formatter.call("INFO", Time.now, "app", message)
+    end
+end
@@ -1 +1 @@
 .4.5
 .4.10
				`@@ -0,0 +1 @@`
				`<%= render partial: "autocompletable/users/prompt_item", collection: @page.records, as: :user %>`
				`@@ -0,0 +1 @@`
				`json.partial! "messages/boosts/boost", boost: @boost`
				`@@ -0,0 +1 @@`
				`json.array! @messages, partial: "messages/message", as: :message`
				`@@ -0,0 +1 @@`
				`json.partial! "messages/message", message: @message`
				`@@ -0,0 +1 @@`
				`Resque.redis = ENV.fetch("REDIS_URL") { "redis://localhost:6379" }`