SecureBit.chat - P2P Encrypted Messenger Files

Privacy-focused messaging controls in the composer. Per-message metadata (id / view-once / timer) travels inside the encrypted message envelope, never in the sanitized text, so message content cannot spoof or corrupt these controls.

Added

• Code blocks — a button wraps the message in a fenced block; both peers render a monospace code window with a copy button. Built from already-sanitized text via React nodes only (no dangerouslySetInnerHTML) — no new XSS surface.
• Clipboard auto-clear — copying a code block clears the clipboard after ~30s, only when it can confirm the clipboard still holds the copied value (never clobbering a later copy).
• View-once messages — recipient sees a blurred bubble that reveals on tap and is then wiped. Honestly cooperative (a malicious client or screenshot can still capture it) — hygiene, not a guarantee.
• Disappearing messages — optional 30s / 5m / 1h timer auto-deletes on both sides with a live countdown; incoming TTL clamped to [5s, 24h].
• Unsend (delete for everyone) — removes your message locally and asks the peer to drop it via a new message_delete control message.
• Panic wipe — one button clears the conversation, wipes keys and disconnects, behind a confirm prompt.

Security

• New per-message metadata is whitelisted and bounded by _sanitizeMessageMeta on send and receive.
• AAD/replay protection, the SAS verification gate and receive-side DOMPurify sanitization are unchanged.

Tests

• Added tests/secure-chat-features.test.mjs. Full suite: 17 files, all passing.

Live at https://securebit-chat.fly.dev/