feat(M4): Windows WinForms client, TOFU identity pinning, VAD threshold + always-on mode
Core ABI extensions (voicecat.h): - vc_list_channels / vc_list_users / vc_list_user_streams — pull-based snapshot getters for the channel-tree and user-list UI; session_model_mu_ guards cross-thread reads - VC_EVENT_JOIN_RESULT / vc_join_channel — channel join with optional password - VC_EVENT_SERVER_IDENTITY + vc_confirm_server_identity — TOFU gate that blocks io_thread_ until the UI approves or rejects; pins TLS leaf-cert SHA-256 (not declared Ed25519) - vc_get_server_identity_display — Ed25519 fingerprint for human-readable display only - VC_INPUT_ALWAYS_ON = 2 in vc_input_mode — transmit unconditionally, no VAD gate - vc_set_vad_threshold — live RMS threshold update (0.0–1.0); EnergyVadProcessor stores it atomically so the audio RT path reads without a lock C++ implementation: - SessionModel::apply_snapshot / apply_channel_event fixed to populate parent_id, password_protected, and max_users (were permanently zeroed) - TlsContext::peer_cert_fingerprint — SHA-256 of peer leaf cert DER via mbedTLS - TofuStore split into peek (read-only) + pin (write) so first-connect only persists after user approval; tofu_store_path in vc_config for per-user pin file location - TcpAcceptor uses dual-stack IPv6+IPv4 fallback (fixes localhost → ::1 on Windows) - windows-client CMake preset: Release shared DLL, static MinGW runtime, no tools/tests - New C++ tests: test_channel_user_list_abi, test_tofu_flow (14/14 green) Windows client (clients/windows/ — .NET 10 WinForms): - VoiceCat.Interop: LibraryImport P/Invoke surface, UnmanagedCallersOnly callbacks, Channel<VoiceCatEvent> event delivery drained by 30ms WinForms Timer - VoiceCat.App: ConnectDialog (saved servers, DPAPI password storage), ServerIdentity- Dialog (TOFU first-connect / mismatch warning), MainForm (channel TreeView, user ListBox, RichTextBox chat, voice controls, device pickers, VAD/PTT/always-on mode, per-user gain/mute/NR tuning, VAD sensitivity TrackBar, level meter ProgressBar) - PttKeyCaptureDialog — focus-scoped PTT key capture (documented limitation) - PerUserTuningDialog — real-time gain/mute/NR applied to all of a user's streams - Accessibility: explicit AccessibleName/Description on every control, & mnemonics, Activity log ListBox as durable screen-reader record, AutomationNotification for curated live announcements Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -83,6 +83,10 @@ typedef enum vc_connection_state {
|
||||
VC_STATE_TLS_HANDSHAKE = 2,
|
||||
VC_STATE_AUTHENTICATING = 3,
|
||||
VC_STATE_CONNECTED = 4,
|
||||
/* M4: between TLS_HANDSHAKE and AUTHENTICATING — the handshake succeeded and the core is
|
||||
* waiting for vc_confirm_server_identity() (see VC_EVENT_SERVER_IDENTITY below). Appended
|
||||
* at the end (not inserted) to keep existing enum values stable — additive-only ABI. */
|
||||
VC_STATE_VERIFYING_IDENTITY = 5,
|
||||
} vc_connection_state;
|
||||
|
||||
typedef enum vc_text_scope {
|
||||
@@ -106,6 +110,8 @@ typedef enum vc_stream_kind {
|
||||
typedef enum vc_input_mode {
|
||||
VC_INPUT_VOICE_ACTIVATION = 0,
|
||||
VC_INPUT_PUSH_TO_TALK = 1,
|
||||
/* Transmit unconditionally — no VAD gate. Added at the end to keep existing values stable. */
|
||||
VC_INPUT_ALWAYS_ON = 2,
|
||||
} vc_input_mode;
|
||||
|
||||
typedef enum vc_event_type {
|
||||
@@ -121,8 +127,32 @@ typedef enum vc_event_type {
|
||||
VC_EVENT_TALK_STATE = 9, /* user_id, stream_id, u32a = talking(0/1) */
|
||||
VC_EVENT_ERROR = 10, /* result, text */
|
||||
VC_EVENT_DISCONNECTED = 11, /* result, text = reason */
|
||||
/* M4 additions — appended, not inserted, to keep existing values stable. */
|
||||
VC_EVENT_JOIN_RESULT = 12, /* result (VC_OK/VC_ERR_*), channel_id, text = error on
|
||||
failure. Reply to vc_join_channel(). */
|
||||
VC_EVENT_SERVER_IDENTITY = 13, /* u32a = vc_tofu_status, text = hex-encoded TLS leaf-cert
|
||||
SHA-256 fingerprint (the value being pinned — see
|
||||
vc_confirm_server_identity). Emitted once per connect
|
||||
attempt, right after the TLS handshake succeeds. The
|
||||
connection is held open until vc_confirm_server_identity()
|
||||
is called. */
|
||||
} vc_event_type;
|
||||
|
||||
/* TOFU server-identity classification (M4) — see VC_EVENT_SERVER_IDENTITY and
|
||||
* vc_confirm_server_identity. Pins the TLS leaf certificate's own SHA-256 fingerprint
|
||||
* (verifiable directly from the handshake), NOT the declared Ed25519
|
||||
* server_identity_fingerprint from ServerHello — the TLS cert and the server's Ed25519
|
||||
* identity key are generated independently with no cryptographic binding between them today
|
||||
* (docs/security.md §1.1), so pinning the self-declared value would be circular. The Ed25519
|
||||
* fingerprint is still available for human-readable display via
|
||||
* vc_get_server_identity_display(), it just isn't the value this gate accepts/rejects on. */
|
||||
typedef enum vc_tofu_status {
|
||||
VC_TOFU_FIRST_CONNECT = 0, /* no pin on file yet for this host:port */
|
||||
VC_TOFU_MATCHED = 1, /* matches the previously pinned fingerprint */
|
||||
VC_TOFU_MISMATCH = 2, /* DIFFERENT from the pinned fingerprint — possible MITM or a
|
||||
legitimate server key rotation; warn loudly */
|
||||
} vc_tofu_status;
|
||||
|
||||
/* ── Structs ──────────────────────────────────────────────────────────────── */
|
||||
|
||||
/*
|
||||
@@ -155,6 +185,13 @@ typedef struct vc_config {
|
||||
const char* client_name; /* e.g. "VoiceCat-macOS" */
|
||||
const char* client_version; /* e.g. "0.0.1" */
|
||||
vc_log_level log_level;
|
||||
/* M4, optional (added at the end — existing brace-initialized callers default this to
|
||||
* NULL, no source change needed). Path to the TOFU pin file (see VC_EVENT_SERVER_IDENTITY/
|
||||
* vc_confirm_server_identity). NULL = a built-in relative default
|
||||
* ("./voicecat_tofu_pins.txt") so existing tests need no real persistence. A real app
|
||||
* (e.g. the Windows client) should pass an explicit per-user path, e.g.
|
||||
* "%AppData%\VoiceCat\tofu_pins.txt". */
|
||||
const char* tofu_store_path;
|
||||
} vc_config;
|
||||
|
||||
typedef struct vc_stream_desc {
|
||||
@@ -190,6 +227,49 @@ typedef struct vc_device_list {
|
||||
size_t count;
|
||||
} vc_device_list;
|
||||
|
||||
/* ── Channel / user / stream snapshots (M4 — for the channel-tree/user-list UI) ───────────
|
||||
* Pull-based: re-call after VC_EVENT_CHANNEL_LIST / VC_EVENT_USER_JOINED / _LEFT / _UPDATED to
|
||||
* refresh — there is no push variant; those events just mean "go look". Same ownership
|
||||
* contract as vc_device/vc_device_list above: core-allocated, caller frees with the matching
|
||||
* vc_free_*, items' const char* fields are invalid after that call. */
|
||||
typedef struct vc_channel {
|
||||
uint32_t id;
|
||||
uint32_t parent_id; /* 0 = root */
|
||||
const char* name;
|
||||
int password_protected; /* bool */
|
||||
uint32_t max_users; /* 0 = unlimited */
|
||||
} vc_channel;
|
||||
|
||||
typedef struct vc_channel_list {
|
||||
vc_channel* items;
|
||||
size_t count;
|
||||
} vc_channel_list;
|
||||
|
||||
typedef struct vc_user {
|
||||
uint32_t id;
|
||||
const char* nickname;
|
||||
int is_guest; /* bool */
|
||||
uint32_t channel_id;
|
||||
} vc_user;
|
||||
|
||||
typedef struct vc_user_list {
|
||||
vc_user* items;
|
||||
size_t count;
|
||||
} vc_user_list;
|
||||
|
||||
/* Per-user stream summary — lighter than vc_audio_config; for the full effective Opus config
|
||||
* of a specific (user_id, stream_id), use the existing vc_get_stream_audio_config. */
|
||||
typedef struct vc_stream_summary {
|
||||
uint32_t stream_id;
|
||||
vc_stream_kind kind;
|
||||
const char* label;
|
||||
} vc_stream_summary;
|
||||
|
||||
typedef struct vc_stream_summary_list {
|
||||
vc_stream_summary* items;
|
||||
size_t count;
|
||||
} vc_stream_summary_list;
|
||||
|
||||
/* Opaque client handle. */
|
||||
typedef struct vc_client vc_client;
|
||||
|
||||
@@ -208,6 +288,11 @@ VC_API vc_result vc_authenticate_user(vc_client* c, const char* username,
|
||||
const char* password);
|
||||
|
||||
/* ── Channels ─────────────────────────────────────────────────────────────── */
|
||||
/* Result arrives as VC_EVENT_JOIN_RESULT, not a return value beyond "request queued". `password`
|
||||
* is forwarded to the server's JoinChannelRequest.password for channels with
|
||||
* vc_channel.password_protected set; NOTE (M4): no in-tree channel currently has a server-side
|
||||
* password to check against — channel creation/passwords are a future (M5+) feature, so this
|
||||
* path is wired but not yet exercisable end-to-end. */
|
||||
VC_API vc_result vc_join_channel(vc_client* c, uint32_t channel_id,
|
||||
const char* password /* nullable */);
|
||||
VC_API vc_result vc_leave_channel(vc_client* c);
|
||||
@@ -221,6 +306,10 @@ VC_API vc_result vc_set_input_device(vc_client* c, uint32_t stream_id,
|
||||
|
||||
/* Send-side: input gate mode + PTT key state, and self mute/deafen. */
|
||||
VC_API vc_result vc_set_input_mode(vc_client* c, vc_input_mode mode);
|
||||
/* VAD threshold: normalized RMS 0.0–1.0; default ~0.025. Takes effect immediately —
|
||||
* recreates the VAD gate if a MIC stream is already active. No-op when mode != VOICE_ACTIVATION
|
||||
* (value is remembered and applied if the mode switches back). */
|
||||
VC_API vc_result vc_set_vad_threshold(vc_client* c, float threshold);
|
||||
VC_API vc_result vc_set_push_to_talk(vc_client* c, int active /* bool */);
|
||||
VC_API vc_result vc_set_self_mute(vc_client* c, int mic_muted, int deafened);
|
||||
|
||||
@@ -249,6 +338,38 @@ VC_API vc_result vc_send_text(vc_client* c, vc_text_scope scope, uint32_t target
|
||||
VC_API vc_result vc_list_devices(vc_client* c, vc_device_kind kind, vc_device_list* out);
|
||||
VC_API void vc_free_device_list(vc_device_list* list);
|
||||
|
||||
/* ── Channel / user / stream enumeration (M4; mirrors vc_list_devices above) ─────────────── */
|
||||
VC_API vc_result vc_list_channels(vc_client* c, vc_channel_list* out);
|
||||
VC_API void vc_free_channel_list(vc_channel_list* list);
|
||||
|
||||
VC_API vc_result vc_list_users(vc_client* c, vc_user_list* out);
|
||||
VC_API void vc_free_user_list(vc_user_list* list);
|
||||
|
||||
/* Streams currently owned by user_id (their mic/screen-audio/aux), per the last snapshot/
|
||||
* event. VC_ERR_INVALID_ARG if user_id is unknown. */
|
||||
VC_API vc_result vc_list_user_streams(vc_client* c, uint32_t user_id,
|
||||
vc_stream_summary_list* out);
|
||||
VC_API void vc_free_stream_summary_list(vc_stream_summary_list* list);
|
||||
|
||||
/* ── TOFU server-identity confirmation (M4) — see VC_EVENT_SERVER_IDENTITY/vc_tofu_status ── */
|
||||
/* Accept or reject the pending server-identity check for the in-progress connect(). Must be
|
||||
* called after a VC_EVENT_SERVER_IDENTITY event; the io_thread_ holds the connection open
|
||||
* (ClientHello/auth deferred) until this is called, up to a generous internal timeout (after
|
||||
* which it's treated as a reject). accept=0 aborts the connection (emits
|
||||
* VC_EVENT_DISCONNECTED, result=VC_ERR_CRYPTO) and does NOT update the pin file. accept=1 on
|
||||
* FIRST_CONNECT/MISMATCH updates the pin file to the new fingerprint and proceeds; accept=1 on
|
||||
* MATCHED is a no-op confirmation (always safe) and proceeds. VC_ERR_INVALID_ARG if no
|
||||
* identity confirmation is currently pending. */
|
||||
VC_API vc_result vc_confirm_server_identity(vc_client* c, int accept /* bool */);
|
||||
|
||||
/* The Ed25519 identity fingerprint from ServerHello, hex-formatted for display (e.g. "this
|
||||
* server also identifies as <hex>"). Purely informational — NOT the value
|
||||
* vc_confirm_server_identity gates on (see vc_tofu_status's doc comment). Empty string if not
|
||||
* yet available. Pass out_buf=NULL to query the required buffer size via *out_len first;
|
||||
* otherwise out_buf must be >= *out_len + 1 bytes (NUL-terminated UTF-8/ASCII hex). */
|
||||
VC_API vc_result vc_get_server_identity_display(vc_client* c, char* out_buf, size_t buf_cap,
|
||||
size_t* out_len);
|
||||
|
||||
#if defined(__cplusplus)
|
||||
} /* extern "C" */
|
||||
#endif
|
||||
|
||||
Reference in New Issue
Block a user