KOKOTO WebChat (Fabric, Forge, NeoForge)

## KOKOTO WebChat 5.2.0

5.2.0 adds message reactions, personal conversation archives/PDF export, public/DM/group typing indicators, custom-emoji picker enhancements, and Relay Protocol 2.1 capability negotiation. It also includes security and account-linking corrections carried forward from the 5.1.0 public release baseline.

### Added

#### Message reactions
- Added persistent reactions for logged-in users on public chat, DMs, and normal group-chat messages using Unicode emoji and KWC custom emoji.
- Added multi-server reactions: public reaction state is committed by the message-origin server, cross-server DM reactions remain participant-only, and group-room reactions remain local.
- Added reactor-name hover details, compact reaction controls, and partial reaction-bar updates that preserve active media and virtual-scroll state.
- Added **Admin > Emojis > Reaction icons** management with master enable/disable, separate custom-emoji allowance, catalog ordering, and administrator-managed search aliases.
- Added one **Reactions** Chat-settings preference shared by live browser notifications and background/mobile Web Push; each browser/device uses only the notification delivery path it supports.
- Suppress duplicate private-chat attention account-wide when the exact DM/group conversation is actively viewed in any signed-in KWC browser for the account. The page must be visible and focused, chat must not be minimized, the private modal must be open, and the thread/room ID must match. While that condition is true, live browser notifications, browser-local notification-inbox insertion, and Web Push are all suppressed for that conversation across the account; normal notifications resume as soon as no active client is viewing it.

#### Custom-emoji picker
- Added a browser-local **Recent** pseudo-folder and an optional **Favorites** pseudo-folder shared by public chat, DM, and group-chat pickers. Favorites can be disabled or stored in browser-local storage or the signed-in KWC account, with an administrator-configurable maximum; account storage is independent of chat-history storage.
- Added floating custom-emoji search across ID, name, display label, pack name, and every public alias with NFKC/case normalization.

#### Relay Protocol 2.1
- Added independent relay revision/capability negotiation with `public`, `dm`, `read`, `reaction`, `reaction-authority`, and `typing` capabilities.
- KWC 5.1.0 and 5.2.0 remain compatible for the common Relay v2 public-chat/DM/read feature set. Reactions and typing require participating KWC 5.2.0 / Relay 2.1 peers.

#### Saved conversations and PDF export
- Added per-account **Saved conversations** for public chat, DMs, and group rooms, with server-side range validation before a snapshot is created.
- Added static archive/PDF views that preserve KWC chat presentation, reply/reaction/server context, display name and real account name, while keeping attachments as references to their original KWC sources.
- Added PDF export using the user's currently applied KWC appearance.
- Added `chat.conversation-archive.enabled` (default `true`). Disabled mode does not register archive API routes, does not open/create `conversation-archives.db`, and does not create saved-conversation controls in the web DOM; existing archive data remains untouched.
- Added configurable archive quotas: 100 archives/account, 1,000 messages/archive, and 10,000 saved messages/account by default, controlled by `max-archives-per-user`, `max-messages-per-archive`, and `max-messages-per-user`.

#### Public/DM/group typing and private-chat controls
- Added event-driven public/DM/group typing indicators without polling or persistent typing state. Server administrators control Open chat, DM, and Group chat independently in Web Admin **Settings** or `chat.typing-indicator.*` in `config.yml` (defaults: OFF / ON / ON); `chat.typing-indicator.user-display-control` defaults OFF; when enabled by the administrator, signed-in users get one account-stored **Show typing indicators** preference that hides incoming hints on their own screen without suppressing their outgoing typing activity. The rounded high-opacity indicator floats above the active composer, uses each viewer's normal display-name/original-name toggle, strips formatting tags from shown names, and scales to about 80% of the user chat font without dropping below the base UI font. Public and remote-DM typing can use Relay 2.1; group typing remains scoped to actual room participants.
- Consolidated private-room invite, saved-conversation, hide, and room-management actions under Settings according to permission.

### Fixed from 5.1.0
- Corrected mention notification matching inherited from 5.1.0. Ordinary occurrences of a user's name no longer count as mentions: a mention must start with `@`, matches registered real/display names using the longest name at each `@`, and notifies all accounts that share the same exact display name.
- Corrected existing built-in account-linking text that still showed the obsolete `/kwc auth` command; upgrades migrate those built-in values to `/kchat auth <code>` without overwriting unrelated customized translations.
- Enforced guest-disabled public-chat visibility on server-side history/search/around/SSE endpoints instead of frontend hiding only.
- Hardened trusted-proxy / `X-Forwarded-For` client-IP resolution against leftmost-header spoofing.
- Enforced exact routing for leaf HTTP API contexts.
- Reduced the unauthenticated client-config response to the fields actually consumed by the frontend.