perf(P6C.T12): optimistic UI for mute / mentions-only / archive / pin / device-revoke

Audit of write-actions revealed that send (and edit via realtime UPDATE) are
already optimistic via local state insertion in `useConversationMessages`,
and friend nicknames are pure-local localStorage. Five user-write actions
were waiting on the ~100-200 ms server roundtrip + realtime echo:

* Toggle mute (`setConversationMutedUntil`)
* Toggle mentions-only (`setConversationMentionsOnly`)
* Toggle archive (`setConversationArchived`)
* Pin / unpin message (`pinMessage` / `unpinMessage`)
* Revoke device (`revokeDevice` RPC)

All five now flip local state synchronously and roll back on failure. The
existing realtime subscriptions reconcile canonically (no-op when the
optimistic patch already matches the server row), so this is purely a UX
latency improvement — no protocol or persistence changes.

Reactions (`toggleReaction` / `voteExclusive`) were intentionally skipped
this round: rollback semantics for the exclusive-vote path with multiple
sequential awaits are messy enough to warrant a dedicated pass.

.gitignore

@@ -33,6 +33,10 @@ web-build/
 apps/desktop/out/
 apps/desktop/release/
 
+# Bundle visualizer reports
+apps/desktop/stats.html
+apps/desktop/stats.json
+
 # Logs
 *.log
 npm-debug.log*

apps/desktop/electron.vite.config.ts

@@ -10,6 +10,9 @@
 import react from '@vitejs/plugin-react';
 import { defineConfig, externalizeDepsPlugin } from 'electron-vite';
 import path from 'node:path';
+import { visualizer } from 'rollup-plugin-visualizer';
+
+const ANALYZE = process.env.ANALYZE === 'true';
 
 const rendererAliases = {
   '@': path.resolve(__dirname, './src'),
@@ -44,7 +47,30 @@ export default defineConfig({
     // bundle. Relative base produces `./assets/...` which works in both
     // dev (served from /) and packaged builds.
     base: './',
-    plugins: [react()],
+    // Visualizer plugins are gated behind ANALYZE=true so the production
+    // build never pays the analysis cost. Re-enable with:
+    //   ANALYZE=true pnpm --filter @chat-app/desktop build
+    // which writes apps/desktop/stats.html (treemap) + stats.json (raw).
+    plugins: [
+      react(),
+      ...(ANALYZE
+        ? [
+            visualizer({
+              filename: 'stats.html',
+              template: 'treemap',
+              gzipSize: true,
+              brotliSize: true,
+              open: false,
+            }),
+            visualizer({
+              filename: 'stats.json',
+              template: 'raw-data',
+              gzipSize: true,
+              brotliSize: true,
+            }),
+          ]
+        : []),
+    ],
     resolve: {
       alias: rendererAliases,
     },

apps/desktop/package.json

@@ -35,6 +35,7 @@
     "react-easy-crop": "^5.5.7",
     "react-i18next": "^15.1.1",
     "react-router-dom": "^6.28.0",
+    "react-virtuoso": "^4.18.7",
     "zustand": "^5.0.1"
   },
   "devDependencies": {
@@ -51,6 +52,7 @@
     "electron-vite": "^2.3.0",
     "postcss": "^8.4.49",
     "rimraf": "^6.0.0",
+    "rollup-plugin-visualizer": "^7.0.1",
     "tailwindcss": "^3.4.15",
     "vite": "^5.4.11"
   },

apps/desktop/src/components/AppShell.tsx

@@ -2,6 +2,7 @@ import { useEffect } from 'react';
 import { Outlet } from 'react-router-dom';
 
 import { useAuth } from '../context/AuthContext';
+import { useIdleAutoLock } from '../hooks/useIdleAutoLock';
 import { startConversationKeySync } from '../lib/conversationKeySync';
 import { startDeviceApprovalListener } from '../lib/deviceApproval';
 import { ensureInstallId } from '../lib/installId';
@@ -14,6 +15,7 @@ import { Sidebar } from './Sidebar';
 
 export function AppShell() {
   const { session } = useAuth();
+  useIdleAutoLock();
   useMentionNotifications(session?.user.id);
   useEffect(() => {
     // Prompt once per authenticated shell mount. Module-level guard prevents

apps/desktop/src/components/AttachmentImage.tsx

@@ -1,4 +1,8 @@
-import { type AttachmentHandle, downloadAndDecryptAttachment } from '@chat-app/shared/chat';
+import {
+  type AttachmentHandle,
+  downloadAndDecryptAttachment,
+  downloadAndDecryptAttachmentThumb,
+} from '@chat-app/shared/chat';
 import { useEffect, useState } from 'react';
 
 import { getCachedAttachment, putCachedAttachment } from '../lib/attachmentCache';
@@ -56,6 +60,17 @@ export function AttachmentImage({ handle, mine = false }: Props) {
   const [error, setError] = useState<string | null>(null);
   const [lightboxOpen, setLightboxOpen] = useState(false);
 
+  // Whether the sender shipped a pre-built WebP thumb alongside this attachment
+  // (Phase 6B+). When true we render the bubble from just the thumb and only
+  // fetch the full blob when the user opens the lightbox or for view-once.
+  const hasServerThumb = Boolean(handle.thumbStoragePath && handle.thumbNonceB64);
+  // View-once needs the full blob ready instantly the moment the recipient
+  // taps (otherwise we'd show a spinner during the burn animation, then race
+  // the "mark viewed" RPC). Same for the legacy path with no server thumb —
+  // we have to download the whole thing just to render the client-side
+  // makeThumbnail fallback.
+  const needsEagerFull = handle.viewOnce === true || !hasServerThumb;
+
   useEffect(() => {
     let cancelled = false;
     const created: string[] = [];
@@ -69,9 +84,39 @@ export function AttachmentImage({ handle, mine = false }: Props) {
       return u;
     };
 
-    // OPFS cache → decrypt → generate thumbnail for inline display.
+    const thumbCacheId = handle.id + '-thumb';
-    // Lightbox swaps to the full blob when opened.
+
     void (async () => {
+      // Phase 6B fast path: if the sender shipped a server-side WebP thumb,
+      // grab it first so the bubble paints from ~20KB instead of waiting on
+      // the multi-MB full blob. The OPFS cache is keyed separately so the
+      // thumb survives independent of full-blob eviction.
+      if (hasServerThumb) {
+        try {
+          let thumbBlob: Blob | null = await getCachedAttachment(thumbCacheId);
+          if (!thumbBlob) {
+            thumbBlob = await downloadAndDecryptAttachmentThumb({
+              client: supabase,
+              handle,
+            });
+            if (thumbBlob) void putCachedAttachment(thumbCacheId, thumbBlob);
+          }
+          if (cancelled) return;
+          if (thumbBlob) {
+            setThumbUrl(take(thumbBlob));
+          }
+        } catch (err: unknown) {
+          // Thumb decrypt failure isn't fatal — fall through to the full
+          // blob path below so the user still sees the image.
+          console.warn('thumb load failed', err);
+        }
+      }
+
+      // Eagerly resolve the full blob when we need it for view-once or as
+      // the only render source (no server thumb). For the thumb-first path
+      // the full blob is deferred until the lightbox opens (see below).
+      if (!needsEagerFull) return;
+
       const cached = await getCachedAttachment(handle.id);
       let blob: Blob;
       if (cached) {
@@ -90,10 +135,14 @@ export function AttachmentImage({ handle, mine = false }: Props) {
       if (cancelled) return;
       const full = take(blob);
       setFullUrl(full);
-      const thumb = await makeThumbnail(blob);
+      // Pre-Phase-6B fallback: no server thumb shipped, so re-derive a
-      if (cancelled) return;
+      // smaller preview on the client to keep memory pressure down.
-      if (thumb) {
+      if (!hasServerThumb) {
-        setThumbUrl(take(thumb));
+        const thumb = await makeThumbnail(blob);
+        if (cancelled) return;
+        if (thumb) {
+          setThumbUrl(take(thumb));
+        }
       }
     })();
 
@@ -101,7 +150,51 @@ export function AttachmentImage({ handle, mine = false }: Props) {
       cancelled = true;
       for (const u of created) URL.revokeObjectURL(u);
     };
-  }, [handle.id, handle.storagePath, handle.keyB64, handle.nonceB64]);
+  }, [
+    handle,
+    handle.id,
+    handle.storagePath,
+    handle.keyB64,
+    handle.nonceB64,
+    handle.thumbStoragePath,
+    handle.thumbNonceB64,
+    hasServerThumb,
+    needsEagerFull,
+  ]);
+
+  // Lazy full-image fetch for click-to-expand (only kicks in when we
+  // skipped the eager full-blob download above). Resolves into the same
+  // `fullUrl` state that the Lightbox consumes; the thumb URL keeps
+  // backing the bubble until the lightbox actually mounts.
+  useEffect(() => {
+    if (!lightboxOpen) return;
+    if (fullUrl) return;
+    let cancelled = false;
+    const created: string[] = [];
+    void (async () => {
+      const cached = await getCachedAttachment(handle.id);
+      let blob: Blob;
+      if (cached) {
+        blob = cached;
+      } else {
+        try {
+          blob = await downloadAndDecryptAttachment({ client: supabase, handle });
+          void putCachedAttachment(handle.id, blob);
+        } catch (err: unknown) {
+          if (!cancelled) setError(err instanceof Error ? err.message : 'download failed');
+          return;
+        }
+      }
+      if (cancelled) return;
+      const u = URL.createObjectURL(blob);
+      created.push(u);
+      setFullUrl(u);
+    })();
+    return () => {
+      cancelled = true;
+      for (const u of created) URL.revokeObjectURL(u);
+    };
+  }, [lightboxOpen, fullUrl, handle]);
 
   const blobUrl = thumbUrl ?? fullUrl;
 
@@ -157,7 +250,15 @@ export function AttachmentImage({ handle, mine = false }: Props) {
           className="block h-auto max-h-80 w-auto max-w-full object-contain"
         />
       </button>
-      {lightboxOpen && fullUrl && <Lightbox url={fullUrl} onClose={() => setLightboxOpen(false)} />}
+      {lightboxOpen && (
+        <Lightbox
+          // Prefer the full blob the moment it's available; otherwise show
+          // the thumb so the user sees *something* during the lazy fetch
+          // (typical full-blob fetch is 100ms–2s depending on size).
+          url={fullUrl ?? blobUrl}
+          onClose={() => setLightboxOpen(false)}
+        />
+      )}
     </>
   );
 }

apps/desktop/src/components/ConversationRowMenu.tsx

@@ -8,6 +8,7 @@ import { forwardRef, useCallback, useEffect, useRef, useState } from 'react';
 import { createPortal } from 'react-dom';
 import { useTranslation } from 'react-i18next';
 
+import { useConversationsContext } from '../context/ConversationsContext';
 import { supabase } from '../lib/supabase';
 import { ArchiveIcon, AtIcon, BellIcon, BellOffIcon, MoreVerticalIcon } from './icons';
 
@@ -54,6 +55,7 @@ interface MenuPos {
 // under the trigger so it doesn't push off-screen on narrow windows.
 export function ConversationRowMenu({ conversationId, archived, mutedUntil, mentionsOnly }: Props) {
   const { t } = useTranslation(['app']);
+  const { patchConversation } = useConversationsContext();
   const [open, setOpen] = useState(false);
   const [submenuOpen, setSubmenuOpen] = useState<'mute' | null>(null);
   const [menuPos, setMenuPos] = useState<MenuPos | null>(null);
@@ -122,44 +124,59 @@ export function ConversationRowMenu({ conversationId, archived, mutedUntil, ment
   const isMuted =
     mutedUntil !== null && new Date(mutedUntil).getTime() > Date.now();
 
+  // Optimistic updates: flip the local state before the server RPC so the
+  // bell / archive icon / checkmark update on the same frame as the click.
+  // Realtime echo via ConversationsContext will reconcile (no-op since the
+  // optimistic patch already matches the server row). On error we restore
+  // the previous value so the menu doesn't lie about persisted state.
   const handleArchive = useCallback(
     async (next: boolean) => {
       setOpen(false);
+      const previous = archived;
+      patchConversation(conversationId, { archived: next });
       try {
         await setConversationArchived(supabase, conversationId, next);
       } catch (err: unknown) {
+        patchConversation(conversationId, { archived: previous });
         console.error('archive toggle failed', err);
       }
     },
-    [conversationId],
+    [conversationId, archived, patchConversation],
   );
 
   const handleMute = useCallback(
     async (minutes: number | null) => {
       setOpen(false);
       setSubmenuOpen(null);
+      const previous = mutedUntil;
+      const nextIso = muteDurationToIso(minutes);
+      patchConversation(conversationId, { mutedUntil: nextIso });
       try {
-        await setConversationMutedUntil(supabase, conversationId, muteDurationToIso(minutes));
+        await setConversationMutedUntil(supabase, conversationId, nextIso);
       } catch (err: unknown) {
+        patchConversation(conversationId, { mutedUntil: previous });
         console.error('mute toggle failed', err);
       }
     },
-    [conversationId],
+    [conversationId, mutedUntil, patchConversation],
   );
 
   const handleMentionsOnly = useCallback(
     async (next: boolean) => {
       setOpen(false);
+      const previous = mentionsOnly;
+      patchConversation(conversationId, { mentionsOnly: next });
       try {
         await setConversationMentionsOnly(supabase, {
           conversationId,
           mentionsOnly: next,
         });
       } catch (err: unknown) {
+        patchConversation(conversationId, { mentionsOnly: previous });
         console.warn('mentions-only toggle failed', err);
       }
     },
-    [conversationId],
+    [conversationId, mentionsOnly, patchConversation],
   );
 
   return (

apps/desktop/src/components/SecurityCenter.tsx

@@ -1,5 +1,11 @@
 import { useState } from 'react';
 
+import {
+  type AutoLockMinutes,
+  getAutoLockMinutes,
+  notifyAutoLockChanged,
+  setAutoLockMinutes,
+} from '../lib/autoLockSettings';
 import { isWipeOnCloseEnabled, setWipeOnClose } from '../lib/memoryWipeSettings';
 import {
   changePin,
@@ -21,6 +27,7 @@ export function SecurityCenter({ userId }: Props) {
   const [recovery, setRecovery] = useState<string | null>(null);
   const [migration, setMigration] = useState<LegacyMigrationReport | null>(null);
   const [wipeOnClose, setWipeOnCloseState] = useState<boolean>(() => isWipeOnCloseEnabled());
+  const [autoLockMinutes, setAutoLockMinutesState] = useState<AutoLockMinutes>(() => getAutoLockMinutes());
 
   async function handleRetryMigration() {
     setBusy(true); setMsg(null); setMigration(null);
@@ -149,6 +156,39 @@ export function SecurityCenter({ userId }: Props) {
         </label>
       </section>
 
+      <section>
+        <h3 className="mb-2 text-xs font-medium uppercase tracking-wide text-fg-muted">
+          Auto-Lock nach Inaktivität
+        </h3>
+        <p className="mb-2 text-xs text-fg-muted">
+          Verlangt erneute PIN-Eingabe nach der gewählten Inaktivitätsdauer. Empfohlen für gemeinsam genutzte Rechner.
+        </p>
+        <div className="flex items-center justify-between gap-3">
+          <div>
+            <div className="text-sm font-medium text-fg">Automatisch sperren</div>
+            <div className="text-xs text-fg-muted">
+              Verlangt erneute PIN-Eingabe nach X Minuten Inaktivität.
+            </div>
+          </div>
+          <select
+            value={autoLockMinutes}
+            onChange={(e) => {
+              const next = Number(e.target.value) as AutoLockMinutes;
+              setAutoLockMinutes(next);
+              notifyAutoLockChanged(next);
+              setAutoLockMinutesState(next);
+            }}
+            className="cursor-pointer rounded-md border border-line bg-surface-2 px-3 py-1.5 text-sm text-fg focus:border-accent focus:outline-none focus:ring-1 focus:ring-accent/40"
+          >
+            <option value={0}>Aus</option>
+            <option value={5}>5 min</option>
+            <option value={15}>15 min</option>
+            <option value={30}>30 min</option>
+            <option value={60}>60 min</option>
+          </select>
+        </div>
+      </section>
+
       <section>
         <h3 className="mb-2 text-xs font-medium uppercase tracking-wide text-rose-400">Identität zurücksetzen</h3>
         <p className="mb-2 text-xs text-fg-muted">Erstellt einen neuen Schlüssel. Alle alten Chats werden unlesbar.</p>

apps/desktop/src/context/ConversationsContext.tsx

@@ -54,6 +54,15 @@ interface ConversationsContextValue {
   refresh: () => Promise<void>;
   markRead: (conversationId: string) => void;
   setActiveConversation: (conversationId: string | null) => void;
+  // Optimistic patch for the caller's per-membership preferences (mute /
+  // mentions-only / archive). Mutations to `conversation_members` echo back
+  // via the realtime channel and `refresh()` reconciles canonically, but the
+  // ~100-200ms roundtrip leaves the UI looking unresponsive. Callers patch
+  // immediately, snapshot the previous state, and roll back on failure.
+  patchConversation: (
+    conversationId: string,
+    patch: Partial<Pick<ConversationSummary, 'archived' | 'mutedUntil' | 'mentionsOnly'>>,
+  ) => void;
 }
 
 const ConversationsContext = createContext<ConversationsContextValue | null>(null);
@@ -164,6 +173,19 @@ export function ConversationsProvider({ children }: { children: ReactNode }) {
     [markRead],
   );
 
+  const patchConversation = useCallback<ConversationsContextValue['patchConversation']>(
+    (convId, patch) => {
+      setConversations((prev) => {
+        const idx = prev.findIndex((c) => c.id === convId);
+        if (idx === -1) return prev;
+        const next = [...prev];
+        next[idx] = { ...next[idx]!, ...patch };
+        return next;
+      });
+    },
+    [],
+  );
+
   useEffect(() => {
     if (!myId) {
       setConversations([]);
@@ -308,6 +330,7 @@ export function ConversationsProvider({ children }: { children: ReactNode }) {
       refresh,
       markRead,
       setActiveConversation,
+      patchConversation,
     }),
     [
       conversations,
@@ -318,6 +341,7 @@ export function ConversationsProvider({ children }: { children: ReactNode }) {
       refresh,
       markRead,
       setActiveConversation,
+      patchConversation,
     ],
   );
 

apps/desktop/src/hooks/useIdleAutoLock.ts

@@ -0,0 +1,79 @@
+import { useEffect, useRef } from 'react';
+
+import { useAuth } from '../context/AuthContext';
+import {
+  getAutoLockMinutes,
+  subscribeAutoLockSetting,
+  type AutoLockMinutes,
+} from '../lib/autoLockSettings';
+
+const ACTIVITY_EVENTS: Array<keyof WindowEventMap> = [
+  'keydown',
+  'mousedown',
+  'pointermove',
+  'touchstart',
+  'wheel',
+];
+
+// Throttle activity-event resets to once per second to avoid thrashing the
+// timer on rapid mouse movement.
+const RESET_THROTTLE_MS = 1000;
+
+export function useIdleAutoLock(): void {
+  const { session, signOut } = useAuth();
+  const minutesRef = useRef<AutoLockMinutes>(getAutoLockMinutes());
+  const timerRef = useRef<number | null>(null);
+  const lastResetAtRef = useRef<number>(0);
+
+  // Keep minutesRef live to the setting.
+  useEffect(() => {
+    const unsub = subscribeAutoLockSetting((v) => {
+      minutesRef.current = v;
+      scheduleNext();
+    });
+    return unsub;
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  // Helper: schedule the lock based on the current setting.
+  function scheduleNext(): void {
+    if (timerRef.current !== null) {
+      window.clearTimeout(timerRef.current);
+      timerRef.current = null;
+    }
+    const min = minutesRef.current;
+    if (min === 0) return; // disabled
+    timerRef.current = window.setTimeout(() => {
+      timerRef.current = null;
+      // Fire the lock. signOut wipes local state and navigates to /device
+      // (PIN re-entry screen).
+      void signOut().catch((err) => console.warn('auto-lock signOut failed', err));
+    }, min * 60 * 1000);
+  }
+
+  useEffect(() => {
+    if (!session) return;
+    scheduleNext();
+
+    const onActivity = () => {
+      const now = Date.now();
+      if (now - lastResetAtRef.current < RESET_THROTTLE_MS) return;
+      lastResetAtRef.current = now;
+      scheduleNext();
+    };
+
+    for (const ev of ACTIVITY_EVENTS) {
+      window.addEventListener(ev, onActivity, { passive: true });
+    }
+    return () => {
+      for (const ev of ACTIVITY_EVENTS) {
+        window.removeEventListener(ev, onActivity);
+      }
+      if (timerRef.current !== null) {
+        window.clearTimeout(timerRef.current);
+        timerRef.current = null;
+      }
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [session]);
+}

apps/desktop/src/hooks/useOwnDevices.ts

@@ -64,10 +64,37 @@ export function useOwnDevices(): {
 
   const revoke = useCallback(
     async (deviceId: string) => {
-      await revokeDevice(supabase, deviceId);
+      // Optimistic: flip `revokedAt` on the row so the "Abgemeldet" badge
-      await refresh();
+      // appears on the same frame as the click. Capture a snapshot so we
+      // can restore exactly on RPC failure (the realtime subscription's
+      // own UPDATE echo would otherwise reconcile back to "not revoked"
+      // anyway). Skip if the row isn't in our list — nothing to undo.
+      let snapshot: DeviceRecord[] | null = null;
+      const stampedAt = new Date().toISOString();
+      setState((prev) => {
+        if (!prev.devices.some((d) => d.id === deviceId)) return prev;
+        snapshot = prev.devices;
+        return {
+          ...prev,
+          devices: prev.devices.map((d) =>
+            d.id === deviceId ? { ...d, revokedAt: d.revokedAt ?? stampedAt } : d,
+          ),
+        };
+      });
+      try {
+        await revokeDevice(supabase, deviceId);
+        // Skip the eager refresh: the realtime UPDATE on `devices` triggers
+        // refresh() via the subscription and the optimistic row already
+        // shows the badge. Avoids a list flicker between optimistic and
+        // canonical state.
+      } catch (err) {
+        if (snapshot) {
+          setState((prev) => ({ ...prev, devices: snapshot! }));
+        }
+        throw err;
+      }
     },
-    [refresh],
+    [],
   );
 
   return { devices: state.devices, loading: state.loading, error: state.error, refresh, revoke };

apps/desktop/src/lib/autoLockSettings.ts

@@ -0,0 +1,43 @@
+// Per-install setting for PIN-idle-auto-lock. 0 = disabled.
+// Values match the dropdown options (5/15/30/60 minutes).
+
+const KEY = 'chatapp.autoLockMinutes.v1';
+
+export type AutoLockMinutes = 0 | 5 | 15 | 30 | 60;
+
+const VALID: AutoLockMinutes[] = [0, 5, 15, 30, 60];
+
+export function getAutoLockMinutes(): AutoLockMinutes {
+  try {
+    const raw = window.localStorage.getItem(KEY);
+    if (!raw) return 0;
+    const n = Number(raw);
+    if (VALID.includes(n as AutoLockMinutes)) return n as AutoLockMinutes;
+    return 0;
+  } catch {
+    return 0;
+  }
+}
+
+type Listener = (value: AutoLockMinutes) => void;
+const listeners = new Set<Listener>();
+
+export function subscribeAutoLockSetting(l: Listener): () => void {
+  listeners.add(l);
+  return () => listeners.delete(l);
+}
+
+export function notifyAutoLockChanged(value: AutoLockMinutes): void {
+  for (const l of listeners) {
+    try { l(value); } catch (err) { console.warn(err); }
+  }
+}
+
+export function setAutoLockMinutes(value: AutoLockMinutes): void {
+  try {
+    window.localStorage.setItem(KEY, String(value));
+  } catch {
+    /* quota */
+  }
+  notifyAutoLockChanged(value);
+}

apps/desktop/src/lib/cryptoWorker.ts

@@ -0,0 +1,73 @@
+// Main-thread wrapper around the crypto Web Worker (Argon2id pwhash +
+// sealed user-key open). Each unlock attempt spawns a fresh one-shot worker
+// — workers are cheap and the pwhash is a one-time cost per login, so we
+// avoid the bookkeeping needed for a persistent request queue.
+//
+// Falls back to inline (main-thread) `openUserKey` when the `Worker`
+// constructor is unavailable (e.g. vitest's jsdom environment, strict CSPs).
+// The fallback path is identical in semantics to the worker path; the only
+// difference is whether it blocks the main thread.
+//
+// Why not a long-lived worker? The KDF cost dwarfs the spawn cost (~1-2 s
+// vs. a few ms), and PIN-unlock happens at most once per session. Keeping a
+// worker resident would also require a request-id correlation map which the
+// decrypt.worker uses (because per-message decrypts are high-volume).
+
+import { openUserKey } from '@chat-app/shared/crypto';
+
+import type {
+  OpenUserKeyInput,
+  OpenUserKeyResult,
+} from '../workers/crypto.worker';
+
+type WorkerResponse =
+  | { ok: true; result: OpenUserKeyResult }
+  | { ok: false; error: string };
+
+export type { OpenUserKeyInput, OpenUserKeyResult };
+
+export async function openUserKeyInWorker(
+  input: OpenUserKeyInput,
+): Promise<OpenUserKeyResult> {
+  const worker = new Worker(
+    new URL('../workers/crypto.worker.ts', import.meta.url),
+    { type: 'module' },
+  );
+  try {
+    return await new Promise<OpenUserKeyResult>((resolve, reject) => {
+      worker.addEventListener('message', (ev: MessageEvent<WorkerResponse>) => {
+        const msg = ev.data;
+        if (msg && msg.ok) resolve(msg.result);
+        else reject(new Error(msg?.error ?? 'crypto worker returned malformed response'));
+      });
+      worker.addEventListener('error', (ev: ErrorEvent) => {
+        reject(new Error(ev.message || 'crypto worker error'));
+      });
+      worker.postMessage({ op: 'openUserKey', input });
+    });
+  } finally {
+    worker.terminate();
+  }
+}
+
+// Public entry point: route through the worker when possible, fall back to
+// the synchronous-on-main-thread path otherwise. Callers should prefer this
+// over importing `openUserKey` directly so we get the worker speedup
+// everywhere it's available.
+export async function openUserKeyMaybeWorker(
+  input: OpenUserKeyInput,
+): Promise<Uint8Array> {
+  if (typeof Worker === 'undefined') {
+    return openUserKey(input);
+  }
+  try {
+    const result = await openUserKeyInWorker(input);
+    return result.privateKey;
+  } catch (err) {
+    // If the worker spawn or message round-trip fails (e.g. CSP blocks
+    // module workers in some packaging modes), fall back to inline so the
+    // unlock still succeeds — just with a brief main-thread hitch.
+    console.warn('[cryptoWorker] worker path failed, falling back to inline', err);
+    return openUserKey(input);
+  }
+}

apps/desktop/src/lib/imageCompress.ts

@@ -55,3 +55,51 @@ function renameToWebp(original: string): string {
 export async function compressImages(files: File[]): Promise<File[]> {
   return Promise.all(files.map((f) => compressImage(f)));
 }
+
+// Bandwidth threshold for thumb generation. Below ~50KB the WebP overhead
+// of a fresh re-encode can exceed the original; not worth a second upload.
+const THUMB_SKIP_BELOW_BYTES = 50 * 1024;
+const THUMB_MAX_DIM = 320;
+const THUMB_QUALITY = 0.7;
+// Animated formats lose motion when redrawn onto a Canvas, so we skip them
+// and let the receiver render the full file. GIF is the dominant case; the
+// rest stay too (apng/animated-webp).
+const THUMB_ANIMATED_MIME = /^image\/(gif|apng)$/;
+
+// Generates a small WebP preview thumb (max 320×320) from an image file.
+// Used by the send path so each image attachment can ship a tiny inline
+// preview alongside the encrypted full blob. Returns `null` when:
+//  - the input isn't an image,
+//  - the input is animated (GIF/APNG — would lose motion),
+//  - the input is already small enough that a thumb wouldn't save bandwidth,
+//  - OffscreenCanvas / createImageBitmap aren't available, or
+//  - decode/encode threw (corrupt input).
+// The caller treats `null` as "skip thumb" and uploads only the full blob.
+export async function generateWebPThumb(
+  file: File,
+  maxDim: number = THUMB_MAX_DIM,
+): Promise<Blob | null> {
+  if (!file.type.startsWith('image/')) return null;
+  if (THUMB_ANIMATED_MIME.test(file.type)) return null;
+  if (file.size < THUMB_SKIP_BELOW_BYTES) return null;
+  if (typeof createImageBitmap !== 'function') return null;
+  if (typeof OffscreenCanvas !== 'function') return null;
+  try {
+    const bitmap = await createImageBitmap(file);
+    const ratio = Math.min(maxDim / bitmap.width, maxDim / bitmap.height, 1);
+    const w = Math.max(1, Math.round(bitmap.width * ratio));
+    const h = Math.max(1, Math.round(bitmap.height * ratio));
+    const canvas = new OffscreenCanvas(w, h);
+    const ctx = canvas.getContext('2d');
+    if (!ctx) {
+      bitmap.close();
+      return null;
+    }
+    ctx.drawImage(bitmap, 0, 0, w, h);
+    bitmap.close();
+    return await canvas.convertToBlob({ type: 'image/webp', quality: THUMB_QUALITY });
+  } catch (err: unknown) {
+    console.warn('generateWebPThumb failed', err);
+    return null;
+  }
+}

apps/desktop/src/lib/memoryWipe.ts

@@ -16,6 +16,7 @@ const PRESERVE_LOCAL_STORAGE = new Set([
   'chatapp.locale',
   'chatapp.installId',
   'chatapp.wipeOnClose.v1',
+  'chatapp.autoLockMinutes.v1',
   'i18nextLng',
 ]);
 

apps/desktop/src/lib/useConversationMessages.ts

@@ -16,6 +16,7 @@ import { bytesToPgHex, pgBytesToBytes } from '@chat-app/shared/supabase';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import { decryptBatch as decryptBatchWorker } from './decryptWorker';
+import { generateWebPThumb } from './imageCompress';
 import {
   loadCachedMessages,
   persistMessages,
@@ -632,6 +633,12 @@ export function useConversationMessages({ conversationId, userId, deviceId }: Ar
           throw new Error('attachment exceeds max size (10 MB)');
         }
         const dims = await readImageDimensions(file);
+        // Phase 6B: generate a small WebP preview thumb so the receiver's
+        // bubble loads fast (typical 320×240 WebP is 10–30KB vs the full
+        // image's 1–10MB). `generateWebPThumb` short-circuits to null on
+        // non-images, animated formats, and small files — and on failure;
+        // the upload helper then just skips the second upload.
+        const thumbBlob = await generateWebPThumb(file);
         const res = await encryptAndUploadAttachment({
           client: supabase,
           conversationId,
@@ -640,6 +647,7 @@ export function useConversationMessages({ conversationId, userId, deviceId }: Ar
           sizeBytes: file.size,
           ...(dims.width !== undefined ? { width: dims.width } : {}),
           ...(dims.height !== undefined ? { height: dims.height } : {}),
+          ...(thumbBlob ? { thumbBlob } : {}),
         });
         // Stamp the view-once flag on each handle the caller requested it
         // for. The flag rides inside the encrypted payload (so peers can

apps/desktop/src/lib/usePinnedMessages.ts

@@ -1,12 +1,26 @@
 import { listPinnedMessages, type PinnedMessage } from '@chat-app/shared/chat';
-import { useEffect, useState } from 'react';
+import { useCallback, useEffect, useState } from 'react';
 
 import { supabase } from './supabase';
 
+export interface UsePinnedMessagesResult {
+  pins: PinnedMessage[];
+  // Optimistic insert. Caller flips the UI immediately; server insert +
+  // realtime echo will reconcile (dedup'd by messageId). Returns the
+  // previous snapshot so the caller can roll back on error.
+  applyOptimisticPin: (messageId: string, pinnedBy: string) => PinnedMessage[];
+  applyOptimisticUnpin: (messageId: string) => PinnedMessage[];
+  // Hard restore for rollback after a failed server call.
+  restorePins: (snapshot: PinnedMessage[]) => void;
+}
+
 // Live list of pinned messages for one conversation. Subscribes to the
 // `pinned_messages` realtime channel for the conv so the header pill +
-// side-panel update without a refetch.
+// side-panel update without a refetch. The `applyOptimistic*` helpers let
-export function usePinnedMessages(conversationId: string | undefined): PinnedMessage[] {
+// callers flip local state synchronously on user action so the pin button
+// doesn't appear unresponsive while the ~100-200ms server roundtrip + the
+// realtime refetch round complete.
+export function usePinnedMessages(conversationId: string | undefined): UsePinnedMessagesResult {
   const [pins, setPins] = useState<PinnedMessage[]>([]);
 
   useEffect(() => {
@@ -44,5 +58,42 @@ export function usePinnedMessages(conversationId: string | undefined): PinnedMes
     };
   }, [conversationId]);
 
-  return pins;
+  const applyOptimisticPin = useCallback<UsePinnedMessagesResult['applyOptimisticPin']>(
+    (messageId, pinnedBy) => {
+      if (!conversationId) return pins;
+      let snapshot: PinnedMessage[] = pins;
+      setPins((prev) => {
+        snapshot = prev;
+        if (prev.some((p) => p.messageId === messageId)) return prev;
+        const optimistic: PinnedMessage = {
+          conversationId,
+          messageId,
+          pinnedBy,
+          pinnedAt: new Date().toISOString(),
+        };
+        // Newest first matches the listPinnedMessages order.
+        return [optimistic, ...prev];
+      });
+      return snapshot;
+    },
+    [conversationId, pins],
+  );
+
+  const applyOptimisticUnpin = useCallback<UsePinnedMessagesResult['applyOptimisticUnpin']>(
+    (messageId) => {
+      let snapshot: PinnedMessage[] = pins;
+      setPins((prev) => {
+        snapshot = prev;
+        return prev.filter((p) => p.messageId !== messageId);
+      });
+      return snapshot;
+    },
+    [pins],
+  );
+
+  const restorePins = useCallback<UsePinnedMessagesResult['restorePins']>((snapshot) => {
+    setPins(snapshot);
+  }, []);
+
+  return { pins, applyOptimisticPin, applyOptimisticUnpin, restorePins };
 }

apps/desktop/src/lib/userIdentity.ts

@@ -4,10 +4,11 @@ import {
 } from '@chat-app/shared/auth';
 import {
   generateRecoveryCode, generateUserKeyPair, getCryptoBackend, normalizeRecoveryCode,
-  openUserKey, sealUserKey,
+  sealUserKey,
 } from '@chat-app/shared/crypto';
 import { migrateOwnLegacyBundles } from '@chat-app/shared/chat';
 
+import { openUserKeyMaybeWorker } from './cryptoWorker';
 import { devLocalSecretStore } from './secretStore';
 import { supabase } from './supabase';
 
@@ -71,7 +72,7 @@ export async function loadOrUnlockUserKey(p: UnlockParams): Promise<UnlockOutcom
   if (!sealed || !salt) throw new Error('no recovery blob configured');
   let priv: Uint8Array;
   try {
-    priv = await openUserKey({ sealed, pin: secret, salt, kdfParams: remote.kdfParams });
+    priv = await openUserKeyMaybeWorker({ sealed, pin: secret, salt, kdfParams: remote.kdfParams });
   } catch (err) {
     await recordPinAttempt(supabase, p.userId, false, p.isRecoveryCode === true).catch(() => {});
     throw err;

apps/desktop/src/pages/ConversationPage.tsx

@@ -1,8 +1,9 @@
 import { parseMessagePayload, pinMessage, unpinMessage } from '@chat-app/shared/chat';
 import { extractErrorCode } from '@chat-app/shared/i18n';
-import { lazy, Suspense, useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
+import { lazy, Suspense, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useParams } from 'react-router-dom';
+import { Virtuoso, type VirtuosoHandle } from 'react-virtuoso';
 
 import { ConversationHeader } from '../components/ConversationHeader';
 import { EmojiPicker } from '../components/EmojiPicker';
@@ -77,7 +78,14 @@ import { usePeerPresence } from '../lib/usePeerPresence';
 import { usePinnedMessages } from '../lib/usePinnedMessages';
 import { useTypingChannel } from '../lib/useTypingChannel';
 
-const STICK_THRESHOLD = 80;
+// Discriminated union for rows inside the virtualized message list. Keeping
+// pending bubbles and the "load older" tile inside the same Virtuoso
+// instance means scroll-to-bottom / followOutput stay coherent across both
+// (we don't need a sibling scroll container for pending items).
+type VirtuosoRow =
+  | { kind: 'loader'; key: string }
+  | { kind: 'message'; key: string; message: DecryptedMessage; idx: number }
+  | { kind: 'pending'; key: string; item: OutboxItem };
 
 // Stable empty-reactions sentinel. We pass this when a message has no
 // reactions instead of `[]` literal — a fresh array per render would defeat
@@ -89,10 +97,16 @@ const EMPTY_REACTIONS: AggregatedReaction[] = [];
 // of ConversationPage when the route param (`id`) changes — switching
 // chats unmounts/remounts the page in our router setup. Session-only
 // (lost on reload, like Discord). The `stickToBottom` flag is preserved
-// alongside the pixel offset so a chat the user left at the bottom keeps
+// alongside the topmost-visible row index so a chat the user left at the
-// auto-following new messages when they return; a chat scrolled up
+// bottom keeps auto-following new messages when they return; a chat
-// returns to the exact spot the user was reading.
+// scrolled up returns to roughly the same row the user was reading.
-const scrollPositions = new Map<string, { scrollTop: number; stickToBottom: boolean }>();
+//
+// We track the topmost-visible row index rather than a pixel `scrollTop`
+// because `react-virtuoso` virtualizes the list — the underlying scroll
+// element's pixel offset depends on dynamically-measured row heights and
+// is not stable across re-mounts. Using a row index restores the user's
+// reading position even if some rows above re-render at different heights.
+const scrollPositions = new Map<string, { topmostIndex: number; stickToBottom: boolean }>();
 
 export function ConversationPage() {
   const { t } = useTranslation(['app', 'errors']);
@@ -227,24 +241,34 @@ export function ConversationPage() {
   // Auto-clears on a successful send so the composer doesn't accidentally
   // burn the message-after-next.
   const [viewOnceNext, setViewOnceNext] = useState(false);
-  const pins = usePinnedMessages(id);
+  const { pins, applyOptimisticPin, applyOptimisticUnpin, restorePins } = usePinnedMessages(id);
   const [pinnedPanelOpen, setPinnedPanelOpen] = useState(false);
   const pinnedIds = useMemo(() => new Set(pins.map((p) => p.messageId)), [pins]);
 
+  // Optimistic pin/unpin: flip the local list synchronously so the pin badge
+  // / panel updates on the same frame as the click. Realtime echo via
+  // usePinnedMessages will refetch and reconcile (no-op since the optimistic
+  // row matches the server). On error we restore the snapshot so the badge
+  // doesn't lie about persisted state.
   const handleTogglePin = useCallback(
     async (messageId: string) => {
       if (!id || !myId) return;
+      const wasPinned = pinnedIds.has(messageId);
+      const snapshot = wasPinned
+        ? applyOptimisticUnpin(messageId)
+        : applyOptimisticPin(messageId, myId);
       try {
-        if (pinnedIds.has(messageId)) {
+        if (wasPinned) {
           await unpinMessage(supabase, id, messageId);
         } else {
           await pinMessage(supabase, id, messageId, myId);
         }
       } catch (err) {
+        restorePins(snapshot);
         console.warn('pin toggle failed', err);
       }
     },
-    [id, myId, pinnedIds],
+    [id, myId, pinnedIds, applyOptimisticPin, applyOptimisticUnpin, restorePins],
   );
 
   const handleGifPick = useCallback(
@@ -263,8 +287,8 @@ export function ConversationPage() {
     },
     [send],
   );
-  const scrollRef = useRef<HTMLDivElement>(null);
+  const virtuosoRef = useRef<VirtuosoHandle>(null);
-  const loadMoreSentinelRef = useRef<HTMLDivElement>(null);
+  const topmostIndexRef = useRef<number>(0);
   const fileInputRef = useRef<HTMLInputElement>(null);
   const composerRef = useRef<HTMLTextAreaElement>(null);
 
@@ -309,21 +333,17 @@ export function ConversationPage() {
     previousMessageIdsRef.current = new Set(messages.map((message) => message.id));
   }, [messages, myId, stickToBottom]);
 
-  useEffect(() => {
+  // Replaces the previous IntersectionObserver-on-sentinel pattern: Virtuoso
-    const el = loadMoreSentinelRef.current;
+  // calls `startReached` when the user scrolls near the first row of the
-    if (!el) return;
+  // virtualized list. We bump `displayCount` the same way the old observer
-    if (displayCount >= messages.length) return;
+  // did. Wrapped in useCallback so Virtuoso doesn't tear down its scroll
-    const observer = new IntersectionObserver(
+  // observer on every parent re-render.
-      (entries) => {
+  const handleStartReached = useCallback(() => {
-        if (entries[0]?.isIntersecting) {
+    setDisplayCount((n) => {
-          setDisplayCount((n) => Math.min(messages.length, n * 2));
+      if (n >= messages.length) return n;
-        }
+      return Math.min(messages.length, n * 2);
-      },
+    });
-      { root: scrollRef.current, rootMargin: '200px 0px' },
+  }, [messages.length]);
-    );
-    observer.observe(el);
-    return () => observer.disconnect();
-  }, [displayCount, messages.length]);
 
   const messageById = useMemo(() => {
     const m = new Map<string, DecryptedMessage>();
@@ -390,15 +410,87 @@ export function ConversationPage() {
     return out;
   }, [messages, buildQuoted]);
 
-  const jumpToMessage = useCallback((targetId: string) => {
+  // Build the discriminated-union row list Virtuoso renders. We use a
-    const el = scrollRef.current?.querySelector<HTMLElement>(
+  // single virtualized list rather than separate "messages" and "pending"
-      '[data-message-id="' + CSS.escape(targetId) + '"]',
+  // sections so the unsent items stay at the bottom of the scroll viewport
-    );
+  // (and Virtuoso's `followOutput` still triggers correctly when a new
-    if (!el) return;
+  // outbox item is appended). Optional row 0 is the "load older" tile —
-    el.scrollIntoView({ behavior: 'smooth', block: 'center' });
+  // matches the old IntersectionObserver-sentinel pattern.
-    setHighlightedId(targetId);
+  const virtuosoRows = useMemo<VirtuosoRow[]>(() => {
-    window.setTimeout(() => setHighlightedId((cur) => (cur === targetId ? null : cur)), 1600);
+    const out: VirtuosoRow[] = [];
-  }, []);
+    const hasLoader = displayCount < messages.length;
+    if (hasLoader) {
+      out.push({ kind: 'loader', key: '__loader__' });
+    }
+    const sliceStart = Math.max(0, messages.length - displayCount);
+    for (let i = sliceStart; i < messages.length; i++) {
+      const m = messages[i];
+      if (!m) continue;
+      out.push({ kind: 'message', key: m.id, message: m, idx: i });
+    }
+    for (const p of pending) {
+      out.push({ kind: 'pending', key: 'pending-' + p.id, item: p });
+    }
+    return out;
+  }, [messages, pending, displayCount]);
+
+  // Initial scroll position for the freshly-mounted Virtuoso instance.
+  // Default = bottom (newest message). If we have a saved position from a
+  // previous visit to this chat AND the user wasn't sticking to the
+  // bottom, restore the saved row index (clamped to the current row
+  // count in case the cache was trimmed).
+  const initialTopMostIndex = useMemo(() => {
+    const saved = savedPositionRef.current;
+    if (saved && !saved.stickToBottom) {
+      return Math.max(0, Math.min(saved.topmostIndex, virtuosoRows.length - 1));
+    }
+    return virtuosoRows.length - 1;
+    // virtuosoRows.length changes when the conversation loads — that's the
+    // intentional trigger so a freshly-loaded chat anchors to the bottom
+    // on first paint. We deliberately don't re-derive this on every row
+    // append; Virtuoso owns scroll position from that point on.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [virtuosoRows.length > 0]);
+
+  const jumpToMessage = useCallback(
+    (targetId: string) => {
+      const msgIdx = messages.findIndex((m) => m.id === targetId);
+      if (msgIdx < 0) return; // pinned message outside loaded cache — no-op
+      // Make sure the target is actually inside the rendered slice; if the
+      // user has only loaded the most-recent 150 rows but is jumping to an
+      // older message, expand the slice so the row exists in the virtual
+      // list before we ask Virtuoso to scroll to it.
+      const needsAtLeast = messages.length - msgIdx;
+      if (needsAtLeast > displayCount) {
+        setDisplayCount(needsAtLeast);
+      }
+      // Convert message-array index into row index for the virtuoso rows
+      // array (see `rows` further down). The slice starts at
+      // `messages.length - displayCount`, and row 0 is the optional
+      // "load older" header.
+      const targetDisplayCount = Math.max(displayCount, needsAtLeast);
+      const sliceStart = Math.max(0, messages.length - targetDisplayCount);
+      const hasLoader = targetDisplayCount < messages.length;
+      const rowIndex = (hasLoader ? 1 : 0) + (msgIdx - sliceStart);
+      // requestAnimationFrame: when we just bumped `displayCount`, Virtuoso
+      // needs a paint to register the new rows before scrollToIndex can
+      // resolve the target row. Without this, the scroll either no-ops or
+      // lands on a stale row.
+      requestAnimationFrame(() => {
+        virtuosoRef.current?.scrollToIndex({
+          index: rowIndex,
+          align: 'center',
+          behavior: 'smooth',
+        });
+      });
+      setHighlightedId(targetId);
+      window.setTimeout(
+        () => setHighlightedId((cur) => (cur === targetId ? null : cur)),
+        1600,
+      );
+    },
+    [messages, displayCount],
+  );
 
   const handleReply = useCallback((m: DecryptedMessage) => {
     setReplyTo(m);
@@ -549,85 +641,91 @@ export function ConversationPage() {
     if (id && messages.length > 0) markRead(id);
   }, [id, messages.length, markRead]);
 
-  // useLayoutEffect: run synchronously after DOM commit, before the
+  // Scroll-to-bottom is handled by Virtuoso's `followOutput` prop, which
-  // browser paints. Using useEffect here let one frame of "scrollTop = 0
+  // fires whenever the rendered row count grows and auto-scrolls down only
-  // (top of list)" paint between message-list mount and the auto-scroll,
+  // if the user was already at the bottom — exactly the Discord behavior
-  // which is exactly the "flickers to a different position, then jumps"
+  // we want for both outgoing sends and incoming realtime messages.
-  // glitch users saw when re-entering a chat. Layout-effect fires while
+  // The old useLayoutEffect that wrote `scrollTop = scrollHeight` is no
-  // the message list is in the DOM but before paint, so the first frame
+  // longer needed: Virtuoso owns scroll positioning now.
-  // already shows the correct scroll position.
-  useLayoutEffect(() => {
-    const el = scrollRef.current;
-    if (!el || !stickToBottom) return;
-    el.scrollTop = el.scrollHeight;
-  }, [messages.length, stickToBottom]);
 
-  // Restore saved scroll position once the conversation's messages have
+  // Snapshot of the saved position for this conversation, captured once on
-  // actually rendered. The earlier version fired on `[id]` alone and ran
+  // mount. Used to derive the `initialTopMostItemIndex` we hand to the
-  // before the message list populated — scrollHeight was still tiny, so
+  // Virtuoso instance below — Virtuoso applies that index synchronously
-  // `el.scrollTop = saved.scrollTop` got clamped to 0 by the browser
+  // before its first paint, so re-entering a chat shows the saved row in
-  // and the user landed at the top instead of the saved position. By
+  // one frame rather than a "starts at top, jumps" flicker.
-  // waiting for `messages.length > 0` we know the rendered scrollHeight
+  const savedPositionRef = useRef<{ topmostIndex: number; stickToBottom: boolean } | null>(
-  // is meaningful. `restoredForRef` ensures the restore runs at most
+    null,
-  // once per chat switch (subsequent message arrivals don't re-trigger).
+  );
-  const restoredForRef = useRef<string | null>(null);
+  if (savedPositionRef.current === null && id) {
-  const isRestoringRef = useRef(false);
+    savedPositionRef.current = scrollPositions.get(id) ?? null;
+  }
 
-  // useLayoutEffect, same reason as above: writing scrollTop here happens
+  // Track whether the user is currently scrolled to the bottom. Virtuoso
-  // before the first paint of the freshly-mounted chat, so the user
+  // calls this whenever the bottom-state changes; we feed it into
-  // doesn't see a frame at scrollTop=0 before the jump to the saved
+  // `stickToBottom` (used by the "jump to newest" pill and by the
-  // position. Combined with the messages.length gate this means the
+  // "new messages while away" counter logic). Also clears the unread-
-  // re-entry shows the message list AT the saved scroll location in one
+  // away counter when the user actually reaches the bottom.
-  // single paint — no "loaded then jumped" effect.
+  const handleAtBottomStateChange = useCallback(
-  useLayoutEffect(() => {
+    (atBottom: boolean) => {
-    const el = scrollRef.current;
+      setStickToBottom(atBottom);
-    if (!el || !id) return;
+      if (atBottom) setNewMessagesWhileAway(0);
-    if (restoredForRef.current === id) return;
+      if (id) {
-    // Wait for the conversation's messages to populate; for a chat that
+        scrollPositions.set(id, {
-    // truly has zero messages the bottom and the top are the same anyway.
+          topmostIndex: topmostIndexRef.current,
-    if (messages.length === 0) return;
+          stickToBottom: atBottom,
-    restoredForRef.current = id;
+        });
-    const saved = scrollPositions.get(id);
+      }
-    // Suppress handleScroll's persistence during the programmatic scroll
+    },
-    // below — otherwise the browser's clamp/normalisation could write a
+    [id],
-    // different scrollTop back into the Map and lose the saved position.
+  );
-    isRestoringRef.current = true;
-    if (saved && !saved.stickToBottom) {
-      el.scrollTop = saved.scrollTop;
-      setStickToBottom(false);
-    } else {
-      setStickToBottom(true);
-      el.scrollTop = el.scrollHeight;
-    }
-    requestAnimationFrame(() => {
-      isRestoringRef.current = false;
-    });
-  }, [id, messages.length]);
 
-  const handleScroll = useCallback(() => {
+  // Persists the topmost-visible row index per conversation so re-entering
-    const el = scrollRef.current;
+  // the chat lands roughly where the user left off (see scrollPositions
-    if (!el) return;
+  // Map). Virtuoso fires `rangeChanged` whenever the visible range shifts;
-    const distanceFromBottom = el.scrollHeight - el.scrollTop - el.clientHeight;
+  // we only care about the start of the range here.
-    const nextStick = distanceFromBottom < STICK_THRESHOLD;
+  const handleRangeChanged = useCallback(
-    setStickToBottom(nextStick);
+    (range: { startIndex: number; endIndex: number }) => {
-    if (nextStick) setNewMessagesWhileAway(0);
+      topmostIndexRef.current = range.startIndex;
-    // Persist position per chat so re-entering this conversation lands
+      if (id) {
-    // where the user left off (see scrollPositions module-level Map).
+        const prev = scrollPositions.get(id);
-    // Skipped during the in-flight restore so we don't immediately
+        scrollPositions.set(id, {
-    // overwrite the saved position with a clamped value.
+          topmostIndex: range.startIndex,
-    if (id && !isRestoringRef.current) {
+          stickToBottom: prev?.stickToBottom ?? true,
-      scrollPositions.set(id, { scrollTop: el.scrollTop, stickToBottom: nextStick });
+        });
-    }
+      }
-  }, [id]);
+    },
+    [id],
+  );
 
   const jumpToBottom = useCallback(() => {
-    const el = scrollRef.current;
+    virtuosoRef.current?.scrollToIndex({
-    if (!el) return;
+      index: 'LAST',
-    el.scrollTo({ top: el.scrollHeight, behavior: 'smooth' });
+      align: 'end',
+      behavior: 'smooth',
+    });
     setStickToBottom(true);
     setNewMessagesWhileAway(0);
   }, []);
 
+  // Whenever an outgoing pending row appears, snap the viewport to the
+  // bottom so the user sees their freshly-sent message land. This replaces
+  // the old `setStickToBottom(true)` pattern that piggy-backed on a
+  // `useLayoutEffect` writing scrollTop — Virtuoso owns scroll positioning
+  // now, so we have to call it explicitly. Tracked via a ref so we only
+  // scroll when the count actually grew (not on every render where it
+  // happens to be > 0).
+  const lastPendingCountRef = useRef(0);
+  useEffect(() => {
+    if (pending.length > lastPendingCountRef.current) {
+      virtuosoRef.current?.scrollToIndex({
+        index: 'LAST',
+        align: 'end',
+        behavior: 'auto',
+      });
+    }
+    lastPendingCountRef.current = pending.length;
+  }, [pending.length]);
+
   async function handleSend(e?: React.FormEvent) {
     e?.preventDefault();
     if ((!text.trim() && attachments.length === 0) || sending) return;
@@ -879,39 +977,69 @@ export function ConversationPage() {
           {incomingHere && conversation && <IncomingCallPanel conversation={conversation} />}
           {conversation && <InCallPanel conversation={conversation} />}
 
-      <div
+      <div className="discord-chat-surface flex min-h-0 flex-1 flex-col bg-surface-3">
-        ref={scrollRef}
-        onScroll={handleScroll}
-        className="discord-chat-surface flex-1 overflow-y-auto bg-surface-3 px-5 py-4"
-      >
         {loading ? (
-          <div className="flex items-center gap-2 text-xs text-fg-muted">
+          <div className="flex items-center gap-2 px-5 py-4 text-xs text-fg-muted">
             <SpinnerIcon className="h-3.5 w-3.5 text-accent" />
           </div>
         ) : error ? (
-          <Banner>{error}</Banner>
+          <div className="px-5 py-4">
+            <Banner>{error}</Banner>
+          </div>
         ) : messages.length === 0 ? (
-          <EmptyState
+          <div className="px-5 py-4">
-            icon={<SendIcon className="h-8 w-8" />}
+            <EmptyState
-            title={t('app:chats.conv_empty_title', { defaultValue: 'Sag Hallo 👋' })}
+              icon={<SendIcon className="h-8 w-8" />}
-            description={t('app:chats.conv_empty_desc', {
+              title={t('app:chats.conv_empty_title', { defaultValue: 'Sag Hallo 👋' })}
-              defaultValue: 'Hier ist noch nichts. Schreibe die erste Nachricht.',
+              description={t('app:chats.conv_empty_desc', {
-            })}
+                defaultValue: 'Hier ist noch nichts. Schreibe die erste Nachricht.',
-          />
+              })}
+            />
+          </div>
         ) : (
-          <ul className="space-y-0.5">
+          <Virtuoso
-            {displayCount < messages.length && (
+            ref={virtuosoRef}
-              <li>
+            className="flex-1"
-                <div
+            style={{ height: '100%' }}
-                  ref={loadMoreSentinelRef}
+            data={virtuosoRows}
-                  className="flex items-center justify-center py-2 text-xs text-fg-muted"
+            computeItemKey={(_idx, row) => row.key}
-                >
+            // Initial position: either restored from per-conv memory, or
-                  Lade ältere Nachrichten…
+            // pinned to the bottom for fresh entry. Virtuoso applies this
-                </div>
+            // synchronously before its first paint so the user doesn't see
-              </li>
+            // a "loaded at top, then jumped" flicker (matches the layout-
-            )}
+            // effect behavior we used in the non-virtualized version).
-            {messages.slice(Math.max(0, messages.length - displayCount)).map((m, sliceIdx) => {
+            initialTopMostItemIndex={initialTopMostIndex}
-              const idx = Math.max(0, messages.length - displayCount) + sliceIdx;
+            // followOutput auto-scrolls only when the user was already at
+            // the bottom; returning `false` from the callback when they're
+            // scrolled up preserves their reading position when realtime
+            // messages arrive (critical UX: do NOT jerk the user).
+            followOutput={(isAtBottom) => (isAtBottom ? 'smooth' : false)}
+            atBottomStateChange={handleAtBottomStateChange}
+            atBottomThreshold={80}
+            rangeChanged={handleRangeChanged}
+            startReached={handleStartReached}
+            // Render rows just outside the viewport so fast scrolling
+            // doesn't briefly flash empty space.
+            increaseViewportBy={400}
+            itemContent={(_index, row) => {
+              if (row.kind === 'loader') {
+                return (
+                  <div className="flex items-center justify-center py-2 text-xs text-fg-muted">
+                    Lade ältere Nachrichten…
+                  </div>
+                );
+              }
+              if (row.kind === 'pending') {
+                return (
+                  <PendingBubble
+                    item={row.item}
+                    onRetry={() => retryPending(row.item.id)}
+                    onCancel={() => cancelPending(row.item.id)}
+                  />
+                );
+              }
+              const m = row.message;
+              const idx = row.idx;
               const prevRaw = messages[idx - 1];
               const nextRaw = messages[idx + 1];
               const prevIsCallEvent =
@@ -925,7 +1053,7 @@ export function ConversationPage() {
               const senderProfile =
                 memberProfile ?? (m.senderId !== myId ? (conversation?.peer ?? null) : null);
               return (
-                <li key={m.id}>
+                <div className="px-5">
                   {firstUnreadId === m.id && (
                     <div
                       aria-label="Neue Nachrichten"
@@ -972,19 +1100,10 @@ export function ConversationPage() {
                     isPinned={pinnedIds.has(m.id)}
                     onTogglePin={handleTogglePin}
                   />
-                </li>
+                </div>
               );
-            })}
+            }}
-            {pending.map((p) => (
+          />
-              <li key={p.id}>
-                <PendingBubble
-                  item={p}
-                  onRetry={() => retryPending(p.id)}
-                  onCancel={() => cancelPending(p.id)}
-                />
-              </li>
-            ))}
-          </ul>
         )}
       </div>
 
@@ -1348,9 +1467,12 @@ export function ConversationPage() {
         open={pinnedPanelOpen}
         pins={pins}
         onClose={() => setPinnedPanelOpen(false)}
-        onJump={(_messageId) => {
+        onJump={(messageId) => {
-          // Future: scroll to message. For now just close the panel.
+          // Close the panel first so the underlying message-list viewport
+          // is fully visible before the smooth-scroll runs (otherwise the
+          // panel would briefly cover the highlighted target row).
           setPinnedPanelOpen(false);
+          jumpToMessage(messageId);
         }}
         onUnpin={(messageId) => void handleTogglePin(messageId)}
       />

apps/desktop/src/workers/crypto.worker.ts

@@ -0,0 +1,78 @@
+// Web Worker — runs Argon2id pwhash + sealed user-key open off the main
+// thread. PIN-unlock used to freeze the UI for ~1-2 s on mid-hardware while
+// the moderate-preset KDF ran; pushing it here keeps the unlock screen
+// responsive.
+//
+// The worker bundles its own libsodium-wrappers-sumo instance and registers
+// it as the shared CryptoBackend inside this worker realm — there is no
+// shared state with the main thread, so we initialise once per worker and
+// re-use it across messages (the client wrapper currently spawns one-shot,
+// but the worker is safe to keep alive too).
+//
+// Message protocol (one-shot RPC):
+//   request:  { op: 'openUserKey', input: OpenUserKeyInput }
+//   response: { ok: true,  result: { privateKey: Uint8Array } }
+//           | { ok: false, error: string }
+//
+// The private key bytes are transferred (zero-copy) back to the caller via
+// the structured-clone Transferable list; the worker's view of the buffer is
+// detached on transfer which also clears the only worker-side reference.
+
+/// <reference lib="webworker" />
+
+import { setCryptoBackend, openUserKey } from '@chat-app/shared/crypto';
+import type { KdfParams } from '@chat-app/shared/crypto';
+import sodium from 'libsodium-wrappers-sumo';
+
+import { createLibsodiumBackend } from '../lib/cryptoBackend';
+
+export interface OpenUserKeyInput {
+  sealed: Uint8Array;
+  pin: string;
+  salt: Uint8Array;
+  kdfParams: KdfParams;
+}
+
+export interface OpenUserKeyResult {
+  privateKey: Uint8Array;
+}
+
+type WorkerRequest = { op: 'openUserKey'; input: OpenUserKeyInput };
+type WorkerResponse =
+  | { ok: true; result: OpenUserKeyResult }
+  | { ok: false; error: string };
+
+let backendReady: Promise<void> | null = null;
+
+async function ensureBackend(): Promise<void> {
+  if (!backendReady) {
+    backendReady = (async () => {
+      await sodium.ready;
+      setCryptoBackend(await createLibsodiumBackend());
+    })();
+  }
+  return backendReady;
+}
+
+self.addEventListener('message', (ev: MessageEvent<WorkerRequest>) => {
+  const msg = ev.data;
+  void (async () => {
+    try {
+      if (!msg || msg.op !== 'openUserKey') {
+        throw new Error('unknown op: ' + String((msg as { op?: unknown })?.op));
+      }
+      await ensureBackend();
+      const privateKey = await openUserKey(msg.input);
+      const response: WorkerResponse = { ok: true, result: { privateKey } };
+      const transfers: Transferable[] = [];
+      if (privateKey?.buffer instanceof ArrayBuffer) {
+        transfers.push(privateKey.buffer);
+      }
+      (self as unknown as Worker).postMessage(response, transfers);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const response: WorkerResponse = { ok: false, error: message };
+      (self as unknown as Worker).postMessage(response);
+    }
+  })();
+});

packages/shared/src/chat/attachments.ts

@@ -35,6 +35,14 @@ export interface AttachmentHandle {
   /** UUID of the first non-sender who viewed. Populated alongside `viewedAt`
    *  by the mark-viewed RPC so the renderer can render attribution. */
   viewedBy?: string | null;
+  /** Storage path of the encrypted WebP preview thumb (max 320×320). The
+   *  thumb shares the per-attachment symmetric key with the full blob but
+   *  uses its own nonce. Absent on pre-Phase-6B messages — the receiver
+   *  falls through to downloading the full blob in that case. */
+  thumbStoragePath?: string;
+  /** Base-64 nonce that decrypts `<id>-thumb.bin`. Always present iff
+   *  `thumbStoragePath` is set. */
+  thumbNonceB64?: string;
 }
 
 export type CallEventStatus = 'ended' | 'missed' | 'declined';
@@ -241,6 +249,13 @@ export interface EncryptedAttachmentResult {
 // Encrypt + upload a blob. Does NOT insert the message_attachments row —
 // the caller combines this with a message insert so everything commits
 // atomically at the application layer.
+//
+// When `thumbBlob` is supplied (Phase 6B image-thumbnail path) a second
+// ciphertext is uploaded to `<conversationId>/<id>-thumb.bin` encrypted
+// with the SAME per-attachment key + a fresh nonce. The handle's
+// `thumbStoragePath` / `thumbNonceB64` get populated so the receiver
+// can prefer the thumb for inline preview. Thumb-upload failure is
+// non-fatal — we log and fall through so the full image still posts.
 export async function encryptAndUploadAttachment(params: {
   client: AppSupabaseClient;
   conversationId: string;
@@ -249,6 +264,7 @@ export async function encryptAndUploadAttachment(params: {
   sizeBytes: number;
   width?: number;
   height?: number;
+  thumbBlob?: Blob | null;
 }): Promise<EncryptedAttachmentResult> {
   const backend = getCryptoBackend();
 
@@ -268,6 +284,35 @@ export async function encryptAndUploadAttachment(params: {
     });
   if (error) throw error;
 
+  let thumbStoragePath: string | undefined;
+  let thumbNonceB64: string | undefined;
+  if (params.thumbBlob) {
+    try {
+      const thumbBytes = new Uint8Array(await params.thumbBlob.arrayBuffer());
+      const thumbNonce = backend.randomBytes(backend.secretboxNonceLength);
+      const thumbCipher = backend.secretbox(thumbBytes, thumbNonce, key);
+      const thumbPath = params.conversationId + '/' + id + '-thumb.bin';
+      const { error: thumbErr } = await params.client.storage
+        .from(ATTACHMENT_BUCKET)
+        .upload(thumbPath, thumbCipher, {
+          contentType: 'application/octet-stream',
+          upsert: false,
+        });
+      if (thumbErr) {
+        // Non-fatal: log and continue with full-only handle. Receiver will
+        // fall back to fetching the full blob.
+        console.warn('thumb upload failed', thumbErr);
+      } else {
+        thumbStoragePath = thumbPath;
+        thumbNonceB64 = await toBase64(thumbNonce);
+      }
+      // Wipe nonce buffer.
+      for (let i = 0; i < thumbNonce.length; i++) thumbNonce[i] = 0;
+    } catch (err: unknown) {
+      console.warn('thumb encrypt/upload failed', err);
+    }
+  }
+
   const handle: AttachmentHandle = {
     id,
     storagePath,
@@ -277,6 +322,8 @@ export async function encryptAndUploadAttachment(params: {
     ...(params.height !== undefined ? { height: params.height } : {}),
     keyB64: await toBase64(key),
     nonceB64: await toBase64(nonce),
+    ...(thumbStoragePath !== undefined ? { thumbStoragePath } : {}),
+    ...(thumbNonceB64 !== undefined ? { thumbNonceB64 } : {}),
   };
 
   return { handle, key, nonce };
@@ -309,6 +356,51 @@ export async function downloadAndDecryptAttachment(params: {
   return new Blob([copy.buffer], { type: params.handle.mimeType });
 }
 
+// Download + decrypt the small WebP preview thumb that the sender uploaded
+// alongside an image attachment (Phase 6B optimisation). Returns `null` if
+// the handle has no thumb metadata (pre-Phase-6B message) or if the thumb
+// blob is missing from storage — caller falls back to the full image.
+//
+// We deliberately swallow ANY download error (missing object, transient
+// 5xx) so the receiver gracefully degrades to the full-blob path; only a
+// successful decrypt-failure throws, since that signals a real corruption.
+export async function downloadAndDecryptAttachmentThumb(params: {
+  client: AppSupabaseClient;
+  handle: AttachmentHandle;
+}): Promise<Blob | null> {
+  if (!params.handle.thumbStoragePath || !params.handle.thumbNonceB64) {
+    return null;
+  }
+  const backend = getCryptoBackend();
+
+  let data: Blob | null = null;
+  try {
+    const res = await params.client.storage
+      .from(ATTACHMENT_BUCKET)
+      .download(params.handle.thumbStoragePath);
+    if (res.error) {
+      // Likely 404 — sender failed to upload thumb, or it's been GC'd.
+      // Receiver falls back to full image.
+      return null;
+    }
+    data = res.data;
+  } catch {
+    return null;
+  }
+  if (!data) return null;
+
+  const ciphertext = new Uint8Array(await data.arrayBuffer());
+  const key = await fromBase64(params.handle.keyB64);
+  const nonce = await fromBase64(params.handle.thumbNonceB64);
+  const plainBytes = backend.secretboxOpen(ciphertext, nonce, key);
+  for (let i = 0; i < key.length; i++) key[i] = 0;
+  for (let i = 0; i < nonce.length; i++) nonce[i] = 0;
+  const copy = new Uint8Array(plainBytes.byteLength);
+  copy.set(plainBytes);
+  // Thumbs are always image/webp regardless of original mime.
+  return new Blob([copy.buffer], { type: 'image/webp' });
+}
+
 // Insert the public metadata row for an attachment. The ciphertext itself has
 // already been uploaded to storage under `handle.storagePath`.
 export async function insertAttachmentRow(

packages/shared/src/i18n/locales/de/app.json

@@ -53,8 +53,6 @@
     "archive": "Archivieren",
     "unarchive": "Entarchivieren",
     "archived_title": "Archiv",
-    "show_archived": "Archiv anzeigen",
-    "show_active": "Aktive anzeigen",
     "archived_empty_title": "Nichts archiviert",
     "archived_empty_subtitle": "Archivierte Unterhaltungen erscheinen hier.",
     "mute": "Stummschalten",
@@ -84,8 +82,6 @@
     "join": "Beitreten",
     "in_call": "Im Anruf",
     "waiting_for_peers": "Warte auf andere…",
-    "voice_connected": "Sprachchat verbunden",
-    "still_live": "Anruf läuft noch",
     "share_screen": "Bildschirm teilen",
     "stop_share_screen": "Screen-Share stoppen",
     "is_sharing_screen": "{{name}} teilt den Bildschirm",
@@ -133,11 +129,9 @@
     "action_unfriend": "Entfernen",
     "action_accept": "Annehmen",
     "action_decline": "Ablehnen",
-    "action_cancel": "Abbrechen",
+    "action_cancel": "Abbrechen"
-    "confirm_unfriend": "Diesen Freund entfernen?"
   },
   "admin": {
-    "nav": "Admin",
     "title": "Admin-Panel",
     "settings_title": "Globale Einstellungen",
     "invites_enabled": "Neue Registrierungen erlauben",
@@ -188,15 +182,11 @@
     "screen_share_quality": "Qualität",
     "screen_share_hint": "WebRTC passt Bitrate + Auflösung dynamisch an die Netzwerkqualität an (SVC/VP9). Die Werte sind Obergrenzen. Änderungen greifen beim nächsten Call.",
     "language": "Sprache",
-    "presence": "Status",
     "show_read_receipts": "Lesebestätigungen anzeigen",
     "show_read_receipts_hint": "Wenn aus, sehen andere nicht wann du ihre Nachrichten gelesen hast — und du siehst nicht wann sie deine gelesen haben.",
     "allow_dms_strangers": "DMs von Fremden erlauben",
     "allow_dms_strangers_hint": "Wenn aus, können dich nur Freunde direkt anschreiben.",
-    "this_device": "Dieses Gerät",
-    "danger_zone": "Gefahrenzone",
     "sign_out": "Abmelden",
-    "section_ringtone": "Klingelton",
     "ringtone_incoming": "Eingehender Anruf",
     "ringtone_default_active": "Standard-Klingelton (Doppelton)",
     "ringtone_custom_active": "{{name}} · {{size}} MB",

packages/shared/src/i18n/locales/de/auth.json

@@ -50,28 +50,8 @@
   "footer_studio": "Supabase Studio",
   "legal_note": "Mit der Registrierung akzeptierst du, dass der Server nur Chiffretext sieht.",
   "signed_in": {
-    "title": "Angemeldet",
-    "session_active": "Sitzung aktiv",
-    "user_id": "Benutzer-ID",
     "email": "E-Mail",
     "username": "Benutzername",
-    "display_name": "Anzeigename",
+    "display_name": "Anzeigename"
-    "admin": "Admin",
-    "yes": "Ja",
-    "no": "Nein",
-    "sign_out": "Abmelden",
-    "device_active": "Aktives Gerät",
-    "device_platform": "Plattform",
-    "device_registered_at": "Registriert"
-  },
-  "device": {
-    "title": "Dieses Gerät registrieren",
-    "subtitle": "Erzeugt ein X25519-Schlüsselpaar. Der private Schlüssel bleibt auf diesem Gerät.",
-    "name_label": "Gerätename",
-    "name_hint": "Erscheint in deiner Geräteliste. Wähle einen erkennbaren Namen.",
-    "name_placeholder": "Dennis Laptop",
-    "cta": "Gerät registrieren",
-    "cta_loading": "Schlüsselpaar wird erzeugt…",
-    "security_note_dev": "Dev-Build: Privater Schlüssel liegt unverschlüsselt im localStorage. Stronghold folgt vor dem Release."
   }
 }

packages/shared/src/i18n/locales/de/common.json

@@ -1,16 +1,8 @@
 {
   "app_name": "ChatApp",
-  "loading": "Lädt…",
   "finalising_session": "Sitzung wird abgeschlossen…",
-  "cancel": "Abbrechen",
   "save": "Speichern",
   "close": "Schließen",
-  "retry": "Wiederholen",
-  "online": "Online",
-  "offline": "Offline",
-  "idle": "Abwesend",
-  "dnd": "Nicht stören",
-  "invisible": "Unsichtbar",
   "local_stack_online": "Lokaler Stack online",
   "dev_build": "Dev-Build"
 }

packages/shared/src/i18n/locales/en/app.json

@@ -53,8 +53,6 @@
     "archive": "Archive",
     "unarchive": "Unarchive",
     "archived_title": "Archive",
-    "show_archived": "Show archive",
-    "show_active": "Show active",
     "archived_empty_title": "Nothing archived",
     "archived_empty_subtitle": "Archived conversations appear here.",
     "mute": "Mute",
@@ -84,8 +82,6 @@
     "join": "Join",
     "in_call": "In call",
     "waiting_for_peers": "Waiting for others…",
-    "voice_connected": "Voice connected",
-    "still_live": "Call still live",
     "share_screen": "Share screen",
     "stop_share_screen": "Stop sharing",
     "is_sharing_screen": "{{name}} is sharing their screen",
@@ -133,11 +129,9 @@
     "action_unfriend": "Unfriend",
     "action_accept": "Accept",
     "action_decline": "Decline",
-    "action_cancel": "Cancel",
+    "action_cancel": "Cancel"
-    "confirm_unfriend": "Remove this friend?"
   },
   "admin": {
-    "nav": "Admin",
     "title": "Admin panel",
     "settings_title": "Global settings",
     "invites_enabled": "Allow new signups",
@@ -188,15 +182,11 @@
     "screen_share_quality": "Quality",
     "screen_share_hint": "WebRTC dynamically adjusts bitrate + resolution to match network conditions (SVC/VP9). Values are upper bounds. Changes apply on the next call.",
     "language": "Language",
-    "presence": "Presence",
     "show_read_receipts": "Show read receipts",
     "show_read_receipts_hint": "When off, others can't see when you read their messages — and you won't see when they read yours.",
     "allow_dms_strangers": "Allow DMs from strangers",
     "allow_dms_strangers_hint": "When off, only friends can DM you.",
-    "this_device": "This device",
-    "danger_zone": "Danger zone",
     "sign_out": "Sign out",
-    "section_ringtone": "Ringtone",
     "ringtone_incoming": "Incoming call",
     "ringtone_default_active": "Default ringtone (double beep)",
     "ringtone_custom_active": "{{name}} · {{size}} MB",

packages/shared/src/i18n/locales/en/auth.json

@@ -50,28 +50,8 @@
   "footer_studio": "Supabase Studio",
   "legal_note": "By signing up you accept that the server sees only ciphertext.",
   "signed_in": {
-    "title": "Signed in",
-    "session_active": "Session active",
-    "user_id": "User ID",
     "email": "Email",
     "username": "Username",
-    "display_name": "Display name",
+    "display_name": "Display name"
-    "admin": "Admin",
-    "yes": "yes",
-    "no": "no",
-    "sign_out": "Sign out",
-    "device_active": "Active device",
-    "device_platform": "Platform",
-    "device_registered_at": "Registered"
-  },
-  "device": {
-    "title": "Register this device",
-    "subtitle": "Generates an X25519 keypair. Private key stays on this device.",
-    "name_label": "Device name",
-    "name_hint": "Shown to you in your device list. Keep it recognisable.",
-    "name_placeholder": "Dennis Laptop",
-    "cta": "Register device",
-    "cta_loading": "Generating keypair…",
-    "security_note_dev": "Dev build: private key stored unencrypted in localStorage. Stronghold comes before release."
   }
 }

packages/shared/src/i18n/locales/en/common.json

@@ -1,16 +1,8 @@
 {
   "app_name": "ChatApp",
-  "loading": "Loading…",
   "finalising_session": "Finalising session…",
-  "cancel": "Cancel",
   "save": "Save",
   "close": "Close",
-  "retry": "Retry",
-  "online": "Online",
-  "offline": "Offline",
-  "idle": "Idle",
-  "dnd": "Do not disturb",
-  "invisible": "Invisible",
   "local_stack_online": "local stack online",
   "dev_build": "dev build"
 }

pnpm-lock.yaml

@@ -98,6 +98,9 @@ importers:
       react-router-dom:
         specifier: ^6.28.0
         version: 6.30.3(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react-virtuoso:
+        specifier: ^4.18.7
+        version: 4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       zustand:
         specifier: ^5.0.1
         version: 5.0.12(@types/react@18.3.28)(react@18.3.1)(use-sync-external-store@1.6.0(react@18.3.1))
@@ -141,6 +144,9 @@ importers:
       rimraf:
         specifier: ^6.0.0
         version: 6.1.3
+      rollup-plugin-visualizer:
+        specifier: ^7.0.1
+        version: 7.0.1(rollup@4.60.1)
       tailwindcss:
         specifier: ^3.4.15
         version: 3.4.19
@@ -2612,6 +2618,10 @@ packages:
   builder-util@25.1.7:
     resolution: {integrity: sha512-7jPjzBwEGRbwNcep0gGNpLXG9P94VA3CPAZQCzxkFXiV2GMQKlziMbY//rXPI7WKfhsvGgFXjTcXdBEwgXw9ww==}
 
+  bundle-name@4.1.0:
+    resolution: {integrity: sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==}
+    engines: {node: '>=18'}
+
   bytes@3.1.2:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
@@ -2757,6 +2767,10 @@ packages:
     resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
     engines: {node: '>=12'}
 
+  cliui@9.0.1:
+    resolution: {integrity: sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w==}
+    engines: {node: '>=20'}
+
   clone-deep@4.0.1:
     resolution: {integrity: sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==}
     engines: {node: '>=6'}
@@ -2988,6 +3002,14 @@ packages:
     resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
     engines: {node: '>=0.10.0'}
 
+  default-browser-id@5.0.1:
+    resolution: {integrity: sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==}
+    engines: {node: '>=18'}
+
+  default-browser@5.5.0:
+    resolution: {integrity: sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==}
+    engines: {node: '>=18'}
+
   default-gateway@4.2.0:
     resolution: {integrity: sha512-h6sMrVB1VMWVrW13mSc6ia/DwYYw5MN6+exNu1OaJeFac5aSAvwM7lZ0NVfTABuSkQelr4h5oebg3KB1XPdjgA==}
     engines: {node: '>=6'}
@@ -3007,6 +3029,10 @@ packages:
     resolution: {integrity: sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==}
     engines: {node: '>=8'}
 
+  define-lazy-prop@3.0.0:
+    resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
+    engines: {node: '>=12'}
+
   define-properties@1.2.1:
     resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
     engines: {node: '>= 0.4'}
@@ -3128,6 +3154,9 @@ packages:
     engines: {node: '>= 12.20.55'}
     hasBin: true
 
+  emoji-regex@10.6.0:
+    resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
+
   emoji-regex@8.0.0:
     resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
 
@@ -3719,6 +3748,10 @@ packages:
     resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
     engines: {node: 6.* || 8.* || >= 10.*}
 
+  get-east-asian-width@1.6.0:
+    resolution: {integrity: sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==}
+    engines: {node: '>=18'}
+
   get-intrinsic@1.3.0:
     resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
     engines: {node: '>= 0.4'}
@@ -4051,6 +4084,11 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
+  is-docker@3.0.0:
+    resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+    hasBin: true
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -4071,6 +4109,15 @@ packages:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
 
+  is-in-ssh@1.0.0:
+    resolution: {integrity: sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw==}
+    engines: {node: '>=20'}
+
+  is-inside-container@1.0.0:
+    resolution: {integrity: sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==}
+    engines: {node: '>=14.16'}
+    hasBin: true
+
   is-interactive@1.0.0:
     resolution: {integrity: sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
     engines: {node: '>=8'}
@@ -4169,6 +4216,10 @@ packages:
     resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
     engines: {node: '>=8'}
 
+  is-wsl@3.1.1:
+    resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
+    engines: {node: '>=16'}
+
   isarray@1.0.0:
     resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
 
@@ -4962,6 +5013,10 @@ packages:
     resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
     engines: {node: '>=6'}
 
+  open@11.0.0:
+    resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
+    engines: {node: '>=20'}
+
   open@7.4.2:
     resolution: {integrity: sha512-MVHddDVweXZF3awtlAS+6pgKLlm/JgxZ90+/NBurBoQctVOOB/zDdVjcyPzQ+0laDGbsWgrRkflI65sQeOgT9Q==}
     engines: {node: '>=8'}
@@ -5187,6 +5242,10 @@ packages:
     resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==}
     engines: {node: ^10 || ^12 || >=14}
 
+  powershell-utils@0.1.0:
+    resolution: {integrity: sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==}
+    engines: {node: '>=20'}
+
   prebuild-install@7.1.3:
     resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==}
     engines: {node: '>=10'}
@@ -5420,6 +5479,12 @@ packages:
     peerDependencies:
       react: ^18.3.1
 
+  react-virtuoso@4.18.7:
+    resolution: {integrity: sha512-xNF5zDGEEIMB7cKwcen/pLig0YDf6OnfFrVgKFa7sHPf9fRem0CaLshyObbBcP88jzn0enavL39EgplgdyT21g==}
+    peerDependencies:
+      react: '>=16 || >=17 || >= 18 || >= 19'
+      react-dom: '>=16 || >=17 || >= 18 || >=19'
+
   react@18.3.1:
     resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==}
     engines: {node: '>=0.10.0'}
@@ -5577,11 +5642,28 @@ packages:
     resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
     engines: {node: '>=8.0'}
 
+  rollup-plugin-visualizer@7.0.1:
+    resolution: {integrity: sha512-UJUT4+1Ho4OcWmPYU3sYXgUqI8B8Ayfe06MX7y0qCJ1K8aGoKtR/NDd/2nZqM7ADkrzny+I99Ul7GgyoiVNAgg==}
+    engines: {node: '>=22'}
+    hasBin: true
+    peerDependencies:
+      rolldown: 1.x || ^1.0.0-beta || ^1.0.0-rc
+      rollup: 2.x || 3.x || 4.x
+    peerDependenciesMeta:
+      rolldown:
+        optional: true
+      rollup:
+        optional: true
+
   rollup@4.60.1:
     resolution: {integrity: sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  run-applescript@7.1.0:
+    resolution: {integrity: sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==}
+    engines: {node: '>=18'}
+
   run-parallel@1.2.0:
     resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
 
@@ -5817,6 +5899,10 @@ packages:
     resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
     engines: {node: '>=0.10.0'}
 
+  source-map@0.7.6:
+    resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
+    engines: {node: '>= 12'}
+
   split-on-first@1.1.0:
     resolution: {integrity: sha512-43ZssAJaMusuKWL8sKUBQXHWOpq8d6CfN/u1p4gUzfJkM05C8rxTmYrkIPTXapZpORA6LkkzcUulJ8FqA7Uudw==}
     engines: {node: '>=6'}
@@ -5884,6 +5970,10 @@ packages:
     resolution: {integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==}
     engines: {node: '>=12'}
 
+  string-width@7.2.0:
+    resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
+    engines: {node: '>=18'}
+
   string.prototype.trim@1.2.10:
     resolution: {integrity: sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA==}
     engines: {node: '>= 0.4'}
@@ -6470,6 +6560,10 @@ packages:
     resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
     engines: {node: '>=12'}
 
+  wrap-ansi@9.0.2:
+    resolution: {integrity: sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==}
+    engines: {node: '>=18'}
+
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
@@ -6515,6 +6609,10 @@ packages:
       utf-8-validate:
         optional: true
 
+  wsl-utils@0.3.1:
+    resolution: {integrity: sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg==}
+    engines: {node: '>=20'}
+
   xcode@3.0.1:
     resolution: {integrity: sha512-kCz5k7J7XbJtjABOvkc5lJmkiDh8VhjVCGNiqdKCscmVpdVUpEAyXv1xmCLkQJ5dsHqx3IPO4XW+NTDhU/fatA==}
     engines: {node: '>=10.0.0'}
@@ -6556,10 +6654,18 @@ packages:
     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
     engines: {node: '>=12'}
 
+  yargs-parser@22.0.0:
+    resolution: {integrity: sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==}
+    engines: {node: ^20.19.0 || ^22.12.0 || >=23}
+
   yargs@17.7.2:
     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
     engines: {node: '>=12'}
 
+  yargs@18.0.0:
+    resolution: {integrity: sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg==}
+    engines: {node: ^20.19.0 || ^22.12.0 || >=23}
+
   yauzl@2.10.0:
     resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==}
 
@@ -9557,6 +9663,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  bundle-name@4.1.0:
+    dependencies:
+      run-applescript: 7.1.0
+
   bytes@3.1.2: {}
 
   cac@6.7.14: {}
@@ -9741,6 +9851,12 @@ snapshots:
       strip-ansi: 6.0.1
       wrap-ansi: 7.0.0
 
+  cliui@9.0.1:
+    dependencies:
+      string-width: 7.2.0
+      strip-ansi: 7.2.0
+      wrap-ansi: 9.0.2
+
   clone-deep@4.0.1:
     dependencies:
       is-plain-object: 2.0.4
@@ -9960,6 +10076,13 @@ snapshots:
 
   deepmerge@4.3.1: {}
 
+  default-browser-id@5.0.1: {}
+
+  default-browser@5.5.0:
+    dependencies:
+      bundle-name: 4.1.0
+      default-browser-id: 5.0.1
+
   default-gateway@4.2.0:
     dependencies:
       execa: 1.0.0
@@ -9979,6 +10102,8 @@ snapshots:
 
   define-lazy-prop@2.0.0: {}
 
+  define-lazy-prop@3.0.0: {}
+
   define-properties@1.2.1:
     dependencies:
       define-data-property: 1.1.4
@@ -10152,6 +10277,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  emoji-regex@10.6.0: {}
+
   emoji-regex@8.0.0: {}
 
   emoji-regex@9.2.2: {}
@@ -10936,6 +11063,8 @@ snapshots:
 
   get-caller-file@2.0.5: {}
 
+  get-east-asian-width@1.6.0: {}
+
   get-intrinsic@1.3.0:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -11305,6 +11434,8 @@ snapshots:
 
   is-docker@2.2.1: {}
 
+  is-docker@3.0.0: {}
+
   is-extglob@2.1.1: {}
 
   is-finalizationregistry@1.1.1:
@@ -11325,6 +11456,12 @@ snapshots:
     dependencies:
       is-extglob: 2.1.1
 
+  is-in-ssh@1.0.0: {}
+
+  is-inside-container@1.0.0:
+    dependencies:
+      is-docker: 3.0.0
+
   is-interactive@1.0.0: {}
 
   is-lambda@1.0.1: {}
@@ -11406,6 +11543,10 @@ snapshots:
     dependencies:
       is-docker: 2.2.1
 
+  is-wsl@3.1.1:
+    dependencies:
+      is-inside-container: 1.0.0
+
   isarray@1.0.0: {}
 
   isarray@2.0.5: {}
@@ -12338,6 +12479,15 @@ snapshots:
     dependencies:
       mimic-fn: 2.1.0
 
+  open@11.0.0:
+    dependencies:
+      default-browser: 5.5.0
+      define-lazy-prop: 3.0.0
+      is-in-ssh: 1.0.0
+      is-inside-container: 1.0.0
+      powershell-utils: 0.1.0
+      wsl-utils: 0.3.1
+
   open@7.4.2:
     dependencies:
       is-docker: 2.2.1
@@ -12539,6 +12689,8 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
+  powershell-utils@0.1.0: {}
+
   prebuild-install@7.1.3:
     dependencies:
       detect-libc: 2.1.2
@@ -12820,6 +12972,11 @@ snapshots:
       react-shallow-renderer: 16.15.0(react@18.3.1)
       scheduler: 0.23.2
 
+  react-virtuoso@4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
   react@18.3.1:
     dependencies:
       loose-envify: 1.4.0
@@ -13004,6 +13161,15 @@ snapshots:
       sprintf-js: 1.1.3
     optional: true
 
+  rollup-plugin-visualizer@7.0.1(rollup@4.60.1):
+    dependencies:
+      open: 11.0.0
+      picomatch: 4.0.4
+      source-map: 0.7.6
+      yargs: 18.0.0
+    optionalDependencies:
+      rollup: 4.60.1
+
   rollup@4.60.1:
     dependencies:
       '@types/estree': 1.0.8
@@ -13035,6 +13201,8 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.60.1
       fsevents: 2.3.3
 
+  run-applescript@7.1.0: {}
+
   run-parallel@1.2.0:
     dependencies:
       queue-microtask: 1.2.3
@@ -13294,6 +13462,8 @@ snapshots:
 
   source-map@0.6.1: {}
 
+  source-map@0.7.6: {}
+
   split-on-first@1.1.0: {}
 
   sprintf-js@1.0.3: {}
@@ -13350,6 +13520,12 @@ snapshots:
       emoji-regex: 9.2.2
       strip-ansi: 7.2.0
 
+  string-width@7.2.0:
+    dependencies:
+      emoji-regex: 10.6.0
+      get-east-asian-width: 1.6.0
+      strip-ansi: 7.2.0
+
   string.prototype.trim@1.2.10:
     dependencies:
       call-bind: 1.0.9
@@ -13993,6 +14169,12 @@ snapshots:
       string-width: 5.1.2
       strip-ansi: 7.2.0
 
+  wrap-ansi@9.0.2:
+    dependencies:
+      ansi-styles: 6.2.3
+      string-width: 7.2.0
+      strip-ansi: 7.2.0
+
   wrappy@1.0.2: {}
 
   write-file-atomic@2.4.3:
@@ -14014,6 +14196,11 @@ snapshots:
 
   ws@8.20.0: {}
 
+  wsl-utils@0.3.1:
+    dependencies:
+      is-wsl: 3.1.1
+      powershell-utils: 0.1.0
+
   xcode@3.0.1:
     dependencies:
       simple-plist: 1.3.1
@@ -14042,6 +14229,8 @@ snapshots:
 
   yargs-parser@21.1.1: {}
 
+  yargs-parser@22.0.0: {}
+
   yargs@17.7.2:
     dependencies:
       cliui: 8.0.1
@@ -14052,6 +14241,15 @@ snapshots:
       y18n: 5.0.8
       yargs-parser: 21.1.1
 
+  yargs@18.0.0:
+    dependencies:
+      cliui: 9.0.1
+      escalade: 3.2.0
+      get-caller-file: 2.0.5
+      string-width: 7.2.0
+      y18n: 5.0.8
+      yargs-parser: 22.0.0
+
   yauzl@2.10.0:
     dependencies:
       buffer-crc32: 0.2.13