malice

public

Star0

Fork 0

Watch0

60 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `132eeceeb362`

tarball

atagen <boss@atagen.co>2026-10-25 06:17 UTC

28 files changed+1135-146

packs: support room cloning and personal image controls

Modified file: Cargo.lock+11 additions−11 deletions@@ -1935,7 +1935,7 @@ checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 [[package]]
 name = "macltok"
 version = "0.1.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=80381e06a573f253c11a8b4c89366a9aa299ca55#80381e06a573f253c11a8b4c89366a9aa299ca55"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=2656c1d26d6b12a7d19e2c8902c8c88ffe20f982#2656c1d26d6b12a7d19e2c8902c8c88ffe20f982"
 dependencies = [
  "futures-util",
  "getrandom 0.2.17",
@@ -2166,7 +2166,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "anymap2",
  "aquamarine",
@@ -2229,7 +2229,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-base"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "assert_matches",
@@ -2259,7 +2259,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-common"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "eyeball-im",
  "futures-core",
@@ -2282,7 +2282,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-crypto"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "aes",
  "aquamarine",
@@ -2323,7 +2323,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-indexeddb"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -2354,7 +2354,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-sqlite"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "async-trait",
@@ -2381,7 +2381,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-store-encryption"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -2402,7 +2402,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-test"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "ctor",
@@ -2425,7 +2425,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-test-macros"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "quote",
  "syn 2.0.119",
@@ -2434,7 +2434,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-ui"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "async-rx",

Modified file: Cargo.toml+1−1

@@ -3,7 +3,7 @@ resolver = "3"

33 members = ["crates/malice-core", "crates/malice-server", "crates/malice-static"]

55 [workspace.dependencies]

-macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "80381e06a573f253c11a8b4c89366a9aa299ca55" }

+macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "2656c1d26d6b12a7d19e2c8902c8c88ffe20f982" }

77 ruma = { version = "0.16", default-features = false }

88 serde = { version = "1", features = ["derive"] }

99 serde_json = "1"

Added file: MACLTOK_TIMELINE_REPAIR_HANDOFF.md+69 additions@@ -0,0 +1,69 @@
+# Macltok timeline repair handoff
+
+## Publication status
+
+The SDK API is published on the user fork's `macltok` bookmark at `9b9b16982dcab5dd499547bb87e121b9d0cba6b5`. It includes durable reseeding, room clear cleanup, and support for replacement snapshots in existing UI timelines. `RoomEventCache::reseed(events, prev_batch)` takes events oldest first. Reverse a backward `/messages` chunk and pass its `end` token. A missing token means the beginning of accessible history.
+
+Macltok is published on the user fork's `vapour` bookmark at `80381e06a573f253c11a8b4c89366a9aa299ca55`, with the SDK revision above pinned in its manifest and lockfile. It is based on current `vapour`, whose head had not advanced during the final fetch and rebase. Update both `Cargo.toml` and `crates/malice-worker/Cargo.toml`, then regenerate their applicable lockfiles. Keep both transports on the same published revision.
+
+The repair action restores access to recent history while the cause of the missing interval remains under investigation. It does not fix the underlying gap loss.
+
+## Command and transport API
+
+The shared command is `Command::HistoryRepair(HistoryRepairCommand)`. Its variants are `Start { room_id, policy, budget }`, `Continue { room_id, budget }`, `Cancel { room_id }`, `StartRecent { room_id }`, `GetPolicy`, and `SetPolicy(policy)`. `Start` accepts an optional one off policy override. Omitting it uses the saved policy.
+
+The policy variants are `StartRecent`, `Bridge`, and `BridgeShortGaps { threshold_ms }`. A threshold is an integer number of milliseconds. Zero disables automatic bridging. The default policy is `StartRecent`.
+
+Serde uses externally tagged enums. A `HistoryRepairCommand` start value has this shape. The outer `Command` adds its `HistoryRepair` tag.
+
+```json
+{
+  "Start": {
+    "room_id": "!room:example.org",
+    "policy": {
+      "BridgeShortGaps": {
+        "threshold_ms": 15000
+      }
+    },
+    "budget": {
+      "max_pages": 10,
+      "max_events": 1000,
+      "max_duration_ms": 15000
+    }
+  }
+}
+```
+
+The corresponding `ClientHandle` methods are `history_repair`, `continue_history_repair`, `cancel_history_repair`, `start_recent_history`, `history_repair_policy`, and `set_history_repair_policy`. The report separates requested policy, selected strategy, coverage duration, threshold evaluation, bridge progress, recent availability, continuity, stop reason, and failure.
+
+Repair requires an open room. A successful command response can still contain a paused report with `failure` or `stop` set. Inspect `recent_available` before announcing restored history. `Verified` means a server page chain reached the retained event anchor. `AccessibleStart` means the server reached the beginning of history visible to this account. `Unresolved` must retain the gap explanation even when recent history is available. Permission and rate limit details remain in `failure.server`, while transport rejection remains a command error. Undecryptable events use the existing timeline item representation and key recovery flow.
+
+## Progress publication
+
+Consumers can restore the latest report from `State.repairs`, keyed by room ID. `Event::HistoryRepairChanged` carries progress. The final `Event::HistoryRepairPublished` is a hidden internal acknowledgement barrier. The mirror folds it into `State.repairs` and emits the same visible history repair update. Its acknowledgement field is skipped by serde, so transports should not expose it as application data.
+
+## Runtime behavior and limits
+
+The initial recent fetch is independent of the existing cache pagination cursor and is capped at 50 events. The SDK reseed takes events oldest first with a cursor for normal pagination into earlier history. Each repair budget accepts 1 to 100 pages, 50 to 10000 events, and 1 to 60000 milliseconds. Defaults are 10 pages, 1000 events, and 15000 milliseconds.
+
+The account `SyncService` pauses for the bounded initial recent fetch and cache install, then resumes while bridge pages are fetched. It pauses again for a bounded final head catchup. Repair closes cached thread timelines and pinned timelines, which must be reopened afterward.
+
+Continuation staging lives in actor memory. It clears when the room closes or the worker restarts. The installed recent history remains durable, and a new repair can be started afterward.
+
+Only one repair runs per room. Cancel signals the active operation, whose original command then returns a paused report. Await that result before requesting Continue or StartRecent. StartRecent abandons staged bridging and keeps the installed recent window. Fetch budgets restart for each continuation, while staged history is capped at 10000 events. Replacement also fences earlier pagination results. A final head that cannot overlap the staged range leaves it separate and reports unavailable history rather than joining disconnected events.
+
+## Coverage threshold limitation
+
+The sync position and `/messages` pagination cursor do not provide a trustworthy event time for the gap boundary. Receipt timestamps are also unreliable. The implementation therefore leaves `coverage_duration_ms` as `None` and `threshold_evaluated` as `false`. `BridgeShortGaps` starts at recent messages until upstream timing support can measure coverage reliably. A user can still explicitly choose `Bridge` for a repair.
+
+## Remaining Malice work
+
+Finish the room menu action and saved repair settings. The settings need policy lookup and update, the millisecond threshold, and a one off policy override for the room action. The room action needs busy and cancel states, plus continue bridging and start recent actions when a bridge pauses or cannot finish. Extend the shared frontend transport contract, the HTTP command adapter, and the worker command adapter together. Fold repair reports into the frontend room state and preserve them in snapshots.
+
+After a normal timeline reset, restore the visible scroll anchor. Preserve the composer draft when jumping to recent history and keep the composer usable under the existing room readiness rules. Keep recent history restoration distinct from continuity repair in the result shown to the user.
+
+## Verification
+
+Seven focused native integration tests passed for fresh cursor selection, failed fetch preservation, valid older pagination, bridge budget continuation, cancellation, all policy overlap paths, unknown coverage fallback, and mirror publication ordering. Seven focused unit tests passed for threshold boundaries, saved policy and coverage, old inbox compatibility, serde, and publication acknowledgement. The SDK live timeline regression passed with a pending local echo preserved through reseeding. The unit tests and locked IndexedDB WebAssembly check passed against the published SDK pin, with no local dependency patches.
+
+Browser runtime, encrypted room recovery, and complete worker restart end to end verification remain for Malice integration. A page refresh is not a full worker restart. Check that the encryption identity, pending sends, and composer draft survive. Exercise the reported offline gap using persistent stores and distinguish recent access from proven continuity. Investigating discarded gap markers and adding startup, subscription, and sync diagnostics remains prevention work. Full gates were intentionally not run.

Modified file: crates/malice-core/src/request.rs+25 additions−3 deletions@@ -364,18 +364,21 @@ pub enum Request {
         from_pack: String,
         shortcode: String,
         to: PackTarget,
+        usage: Option<Vec<PackUsage>>,
     },
     CloneSticker {
         room_id: String,
         event_id: String,
         to: PackTarget,
         shortcode: String,
+        usage: Option<Vec<PackUsage>>,
     },
     ClonePack {
         from_pack: String,
         to: PackTarget,
         #[serde(default)]
         display_name: Option<String>,
+        usage: Option<Vec<PackUsage>>,
     },
     Unignore {
         user_id: String,
@@ -431,6 +434,15 @@ fn pack_text(value: String, what: &str) -> Result<String, CoreError> {
     Ok(value)
 }
 
+fn clone_usage(usage: Option<Vec<PackUsage>>) -> Result<Option<Vec<PackUsage>>, CoreError> {
+    if usage.as_ref().is_some_and(Vec::is_empty) {
+        return Err(CoreError::bad_request(
+            "choose at least one use for copied images",
+        ));
+    }
+    Ok(usage)
+}
+
 #[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum SendKind {
@@ -1135,12 +1147,14 @@ pub async fn dispatch(
             from_pack,
             shortcode,
             to,
+            usage,
         } => {
             let shortcode = handle
-                .clone_pack_image(
+                .clone_pack_image_with_usage(
                     pack_text(from_pack, "pack_id")?,
                     pack_text(shortcode, "shortcode")?,
                     to.source()?,
+                    clone_usage(usage)?,
                 )
                 .await?;
             Ok(Reply::Json(json!({ "shortcode": shortcode })))
@@ -1150,13 +1164,15 @@ pub async fn dispatch(
             event_id,
             to,
             shortcode,
+            usage,
         } => {
             let shortcode = handle
-                .clone_sticker(
+                .clone_sticker_with_usage(
                     parse_room_id(&room_id)?,
                     parse_event_id(&event_id)?,
                     to.source()?,
                     pack_text(shortcode, "shortcode")?,
+                    clone_usage(usage)?,
                 )
                 .await?;
             Ok(Reply::Json(json!({ "shortcode": shortcode })))
@@ -1165,9 +1181,15 @@ pub async fn dispatch(
             from_pack,
             to,
             display_name,
+            usage,
         } => {
             let skipped = handle
-                .clone_pack(pack_text(from_pack, "pack_id")?, to.source()?, display_name)
+                .clone_pack_with_usage(
+                    pack_text(from_pack, "pack_id")?,
+                    to.source()?,
+                    display_name,
+                    clone_usage(usage)?,
+                )
                 .await?;
             Ok(Reply::Json(json!({ "skipped": skipped })))
         }

Modified file: crates/malice-worker/Cargo.lock+9 additions−9 deletions@@ -1722,7 +1722,7 @@ checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 [[package]]
 name = "macltok"
 version = "0.1.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=80381e06a573f253c11a8b4c89366a9aa299ca55#80381e06a573f253c11a8b4c89366a9aa299ca55"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=2656c1d26d6b12a7d19e2c8902c8c88ffe20f982#2656c1d26d6b12a7d19e2c8902c8c88ffe20f982"
 dependencies = [
  "futures-util",
  "getrandom 0.2.17",
@@ -1929,7 +1929,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "anymap2",
  "aquamarine",
@@ -1989,7 +1989,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-base"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "async-trait",
@@ -2015,7 +2015,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-common"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "eyeball-im",
  "futures-core",
@@ -2038,7 +2038,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-crypto"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "aes",
  "aquamarine",
@@ -2078,7 +2078,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-indexeddb"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -2110,7 +2110,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-sqlite"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "async-trait",
@@ -2137,7 +2137,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-store-encryption"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -2158,7 +2158,7 @@ dependencies = [
 [[package]]
 name = "matrix-sdk-ui"
 version = "0.18.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=9b9b16982dcab5dd499547bb87e121b9d0cba6b5#9b9b16982dcab5dd499547bb87e121b9d0cba6b5"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk?rev=c0a29939d88bc8a55ae4f6bb05443913fb8dea85#c0a29939d88bc8a55ae4f6bb05443913fb8dea85"
 dependencies = [
  "as_variant",
  "async-rx",

Modified file: crates/malice-worker/Cargo.toml+2 additions−2 deletions@@ -14,7 +14,7 @@ publish = false
 crate-type = ["cdylib", "rlib"]
 
 [target.'cfg(target_family = "wasm")'.dependencies]
-macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "80381e06a573f253c11a8b4c89366a9aa299ca55", features = ["indexeddb", "serde", "mirror"] }
+macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "2656c1d26d6b12a7d19e2c8902c8c88ffe20f982", features = ["indexeddb", "serde", "mirror"] }
 malice-core = { path = "../malice-core" }
 ruma = { version = "0.16", default-features = false }
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
@@ -27,7 +27,7 @@ wasm-bindgen-futures = "=0.4.78"
 js-sys = "=0.3.105"
 
 [dev-dependencies]
-matrix-sdk = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk", rev = "9b9b16982dcab5dd499547bb87e121b9d0cba6b5", default-features = false }
+matrix-sdk = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/matrix-rust-sdk", rev = "c0a29939d88bc8a55ae4f6bb05443913fb8dea85", default-features = false }
 wasm-bindgen-test = "0.3"
 web-sys = { version = "0.3", features = ["SharedWorkerGlobalScope"] }
 gloo-timers = { version = "0.3", features = ["futures"] }

Modified file: web/src/App.svelte+34 additions−30 deletions@@ -11,7 +11,11 @@
   import ContextMenu, { type MenuItem } from './lib/ContextMenu.svelte';
   import StickerPicker from './lib/StickerPicker.svelte';
   import PackManager from './lib/PackManager.svelte';
-  import { clonePackDestinations, editableChoices, shortcodeFor } from './lib/packs';
+  import PackCloneDialog from './lib/PackCloneDialog.svelte';
+  import type { CloneSource } from './lib/pack-clone';
+  import { allPacks, findSticker, reactionShortcode } from './lib/packs';
+  import { disabledPackImages, loadPackPreferences } from './lib/pack-preferences';
+  import { enabledPacks, enabledQuickReactions } from './lib/pack-preferences-model';
   import type { CommandRequest } from './lib/transport';
   import UserCard, { type UserAction } from './lib/UserCard.svelte';
   import { allowed, canRedact, groupMembers, isMuted, parsePowerLevels, type PowerLevels } from './lib/permissions';
@@ -120,6 +124,7 @@
   let replyingTo: ReplyReference | null = null;
   let dialog: 'join' | 'create' | 'security' | 'settings' | 'packs' | null = null;
   let stickersOpen = false;
+  let cloneSource: CloneSource | null = null;
   let joinTarget = '';
   let joinBusy = false;
   let createName = '';
@@ -293,13 +298,15 @@
     const online = $connection === 'online';
     if (online && !wasOnline) {
       void loadQuickReactions();
+      void loadPackPreferences();
       void loadUrlPreviewSettings();
     }
     wasOnline = online;
   }
   $: selectedRoom = $rooms.find((r) => r.room_id === $selectedRoomId) ?? null;
-  $: roomPacks = packsForRoom($imagePacks, $selectedRoomId);
+  $: roomPacks = enabledPacks(packsForRoom($imagePacks, $selectedRoomId, $rooms), $disabledPackImages);
   $: roomEmotes = customEmotes(roomPacks);
+  $: usableQuickReactions = enabledQuickReactions($quickReactions, allPacks($imagePacks), $disabledPackImages);
   $: previewsAllowed = selectedRoom !== null && (!selectedRoom.encrypted || $urlPreviewSettings.encrypted_rooms);
   $: loadPreview = previewsAllowed && $selectedRoomId ? previewLoader($selectedRoomId) : null;
   $: spaceRooms = $rooms.filter((r) => r.space);
@@ -485,6 +492,7 @@
         void loadProfile();
         void loadEncryption();
         void loadQuickReactions();
+        void loadPackPreferences();
         void loadUrlPreviewSettings();
       } else {
         softLogout.set(session.soft_logout ?? null);
@@ -541,6 +549,7 @@
     void loadProfile();
     void loadEncryption();
     void loadQuickReactions();
+    void loadPackPreferences();
     void loadUrlPreviewSettings();
   }
 
@@ -561,6 +570,7 @@
     composer = '';
     drafts = {};
     dialog = null;
+    cloneSource = null;
     membersOpen = false;
     sidebarOpen = false;
     profile = null;
@@ -946,6 +956,11 @@
           await sendMessage(roomId, said, null, mentions, name === 'me' ? 'emote' : 'notice', resolveEmotes(said, roomEmotes));
           break;
         }
+        case 'sticker': {
+          const { pack, sticker } = findSticker(enabledPacks(packsForRoom($imagePacks, roomId, $rooms), $disabledPackImages), required('a sticker name'));
+          await runCommand({ op: 'send_sticker', room_id: roomId, pack_id: pack.id, shortcode: sticker.shortcode });
+          break;
+        }
         case 'msg': {
           const { user_id, rest } = target();
           const res = (await runCommand({ op: 'direct', user_id })) as { room_id: string };
@@ -1427,7 +1442,7 @@
     if (!roomId || !eventId || reacting) return;
     reacting = true;
     try {
-      await reactToMessage(roomId, eventId, key, shortcode);
+      await reactToMessage(roomId, eventId, key, reactionShortcode(key, shortcode, allPacks($imagePacks)));
     } catch (e) {
       pushBanner(e instanceof Error ? e.message : 'Reaction failed');
     } finally {
@@ -1741,39 +1756,22 @@
   }
 
   function openCloneImageMenu(pack: ImagePack, image: PackImage, x: number, y: number): void {
-    const items = editableChoices($imagePacks, roomName)
-      .filter((c) => c.pack?.id !== pack.id)
-      .map((choice) => ({
-        label: `Clone to ${choice.label}`,
-        action: () =>
-          void runClone({ op: 'clone_pack_image', from_pack: pack.id, shortcode: image.shortcode, to: choice.target }, 'Could not clone the sticker')
-      }));
-    menu = { items, x, y };
+    stickersOpen = false;
+    menu = null;
+    cloneSource = { kind: 'image', pack, image };
   }
 
   function openClonePackMenu(pack: ImagePack, x: number, y: number): void {
-    const packRooms = $rooms.filter((r) => r.can_edit_packs && r.membership === 'Joined');
-    const items = clonePackDestinations(pack, packRooms, roomName).map((d) => ({
-      label: d.label,
-      action: () => void runClone({ op: 'clone_pack', from_pack: pack.id, to: d.target, display_name: d.display_name }, 'Could not clone the pack')
-    }));
-    menu = { items, x, y };
+    stickersOpen = false;
+    menu = null;
+    cloneSource = { kind: 'pack', pack };
   }
 
   function openCloneStickerMenu(eventId: string, body: string, x: number, y: number): void {
     const roomId = $selectedRoomId;
     if (!roomId) return;
-    const items = editableChoices($imagePacks, roomName).map((choice) => ({
-      label: `Clone to ${choice.label}`,
-      action: () => {
-        const taken = new Set(choice.pack?.images.map((i) => i.shortcode) ?? []);
-        void runClone(
-          { op: 'clone_sticker', room_id: roomId, event_id: eventId, to: choice.target, shortcode: shortcodeFor(body || 'sticker', taken) },
-          'Could not clone the sticker'
-        );
-      }
-    }));
-    menu = { items, x, y };
+    menu = null;
+    cloneSource = { kind: 'sticker', room_id: roomId, event_id: eventId, body };
   }
 
   async function openMessageMenu(event: TimelineEvent, x: number, y: number): Promise<void> {
@@ -2601,7 +2599,7 @@
                     senderAvatar={senderAvatarFor(g.item.event.sender.user_id) ?? g.item.event.sender.avatar}
                     {reacting}
                     onReact={(eventId, key, shortcode) => void react(eventId, key, shortcode)}
-                    quickReactions={$quickReactions}
+                    quickReactions={usableQuickReactions}
                     packs={roomPacks}
                     linkPreviews={$linkPreviews}
                     {loadPreview}
@@ -2629,7 +2627,7 @@
                 senderAvatar={senderAvatarFor($sessionUser ?? '')}
                 {reacting}
                 onReact={(eventId, key, shortcode) => void react(eventId, key, shortcode)}
-                quickReactions={$quickReactions}
+                quickReactions={usableQuickReactions}
                 packs={roomPacks}
                 linkPreviews={$linkPreviews}
                 {loadPreview}
@@ -2902,6 +2900,12 @@
       </aside>
     {/if}
 
+    {#if cloneSource}
+      <div class="modal-wrap" role="presentation" on:click|self={() => (cloneSource = null)}>
+        <PackCloneDialog source={cloneSource} packs={$imagePacks} rooms={$rooms} onError={pushBanner} onClose={() => (cloneSource = null)} />
+      </div>
+    {/if}
+
     {#if dialog}
       <div class="modal-wrap" role="presentation" on:click|self={() => (dialog = null)}>
         {#if dialog === 'security'}

Added file: web/src/lib/PackCloneDialog.svelte+126 additions@@ -0,0 +1,126 @@
+<script lang="ts">
+  import { runCommand } from './api';
+  import type { CloneSource } from './pack-clone';
+  import { cloneRequest, editableChoices, freePackStateKey, packLabel } from './packs';
+  import type { PackTarget } from './transport';
+  import type { ImagePacks, PackUsage, RoomSummary } from './types';
+
+  export let source: CloneSource;
+  export let packs: ImagePacks;
+  export let rooms: RoomSummary[];
+  export let onClose: () => void;
+  export let onError: (message: string) => void;
+
+  const roomName = (id: string) => rooms.find((room) => room.room_id === id)?.name ?? id;
+  let destinationId = '';
+  let roomId = '';
+  let name = source.kind === 'sticker' ? 'Sticker pack' : packLabel(source.pack, roomName);
+  let asSticker = true;
+  let asEmoji = true;
+  let busy = false;
+  let error = '';
+  let createdTarget: { roomId: string; name: string; target: PackTarget } | null = null;
+
+  $: choices = editableChoices(packs, roomName).filter((choice) =>
+    source.kind !== 'pack' || choice.pack?.id !== source.pack.id);
+  $: locations = rooms.filter((room) => room.can_edit_packs && room.membership === 'Joined')
+    .sort((a, b) => Number(b.space) - Number(a.space) || a.name.localeCompare(b.name));
+  $: if (!destinationId) destinationId = choices[0]?.pack?.id ?? (choices.length ? 'user' : 'new');
+  $: if (!roomId && locations.length) roomId = locations[0].room_id;
+  $: creating = destinationId === 'new';
+
+  function key(event: KeyboardEvent): void {
+    if (event.key !== 'Escape') return;
+    event.stopImmediatePropagation();
+    if (!busy) onClose();
+  }
+
+  async function copy(): Promise<void> {
+    if (busy) return;
+    const usage: PackUsage[] = [...(asSticker ? ['Sticker' as const] : []), ...(asEmoji ? ['Emoticon' as const] : [])];
+    if (!usage.length) {
+      error = 'Choose stickers, emoji, or both';
+      return;
+    }
+    busy = true;
+    error = '';
+    try {
+      const choice = choices.find((item) => (item.pack?.id ?? 'user') === destinationId);
+      let target = choice?.target;
+      const displayName = name.trim();
+      if (creating) {
+        if (!roomId || !displayName) throw new Error('Choose a space or room and give the pack a name');
+        if (!createdTarget || createdTarget.roomId !== roomId || createdTarget.name !== displayName) {
+          const stateKey = freePackStateKey(packs, roomId, displayName);
+          target = { kind: 'room', room_id: roomId, state_key: stateKey };
+          await runCommand({ op: 'create_room_pack', room_id: roomId, state_key: stateKey, display_name: displayName });
+          createdTarget = { roomId, name: displayName, target };
+        } else target = createdTarget.target;
+      }
+      if (!target) throw new Error('Choose a destination pack');
+      const result = await runCommand(cloneRequest(source, target, usage, creating ? displayName : null, choice?.pack ?? null)) as { skipped?: string[] };
+      if (result?.skipped?.length) onError(`Could not copy ${result.skipped.join(', ')}`);
+      onClose();
+    } catch (e) {
+      error = e instanceof Error ? e.message : 'Could not copy the images';
+    } finally {
+      busy = false;
+    }
+  }
+</script>
+
+<svelte:window on:keydown|capture={key} />
+
+<div class="modal clone" role="dialog" aria-modal="true" aria-label={source.kind === 'pack' ? 'Clone pack' : 'Clone image'}>
+  <h2>{source.kind === 'pack' ? 'Clone pack' : 'Clone image'}</h2>
+  <form on:submit|preventDefault={() => void copy()}>
+    <fieldset disabled={busy}>
+      <label class="field">
+        <span>Destination pack</span>
+        <select bind:value={destinationId}>
+          {#each choices as choice}
+            <option value={choice.pack?.id ?? 'user'}>{choice.label}</option>
+          {/each}
+          {#if locations.length}<option value="new">New pack in a space or room</option>{/if}
+        </select>
+      </label>
+      {#if creating && locations.length}
+        <label class="field">
+          <span>Space or room</span>
+          <select bind:value={roomId}>
+            {#each locations as room (room.room_id)}
+              <option value={room.room_id}>{room.space ? 'Space' : 'Room'} · {room.name}</option>
+            {/each}
+          </select>
+        </label>
+        <label class="field"><span>New pack name</span><input type="text" bind:value={name} required /></label>
+      {:else if choices.length === 0}
+        <p>No writable destination packs are available. Creating shared packs requires permission in a joined space or room.</p>
+      {:else}
+        <p>Copies are appended to the selected pack. Existing images stay in place and duplicate names get a numbered suffix.</p>
+      {/if}
+      <div class="uses" role="group" aria-label="Use copied images as">
+        <label><input type="checkbox" bind:checked={asSticker} /> Stickers</label>
+        <label><input type="checkbox" bind:checked={asEmoji} /> Emoji and reactions</label>
+      </div>
+      {#if error}<p class="error" role="alert">{error}</p>{/if}
+      <div class="actions">
+        <button type="button" class="ghost-btn" on:click={onClose}>Cancel</button>
+        <button type="submit" class="primary-btn" disabled={(!choices.length && !locations.length) || (!asSticker && !asEmoji)}>{busy ? 'Copying…' : 'Copy'}</button>
+      </div>
+    </fieldset>
+  </form>
+</div>
+
+<style>
+  .clone { width: min(460px, 100%); }
+  h2 { margin: 0 0 16px; font-size: 18px; }
+  fieldset { display: flex; flex-direction: column; gap: 14px; border: 0; padding: 0; margin: 0; min-width: 0; }
+  .field { display: flex; flex-direction: column; gap: 6px; }
+  input[type='text'], select { width: 100%; padding: 8px; background: var(--bg-soft); border: 1px solid var(--border); border-radius: var(--r-sm); color: var(--text); }
+  p { margin: 0; font-size: 13px; color: var(--muted); }
+  .uses, .actions { display: flex; flex-wrap: wrap; gap: 14px; }
+  .uses label { display: flex; align-items: center; gap: 6px; font-size: 13px; }
+  .actions { justify-content: flex-end; }
+  .error { color: var(--danger); }
+</style>

Added file: web/src/lib/PackManager.stories.ts+205 additions@@ -0,0 +1,205 @@
+import type { Meta, StoryObj } from '@storybook/svelte-vite';
+import { expect, fn, userEvent, waitFor, within } from 'storybook/test';
+import PackManager from './PackManager.svelte';
+import { disabledPackImages } from './pack-preferences';
+import type { ImagePack, ImagePacks, PackImage, RoomSummary } from './types';
+
+const roomId = '!wonderland:example.org';
+const spaceId = '!tea-party:example.org';
+const readOnlyRoomId = '!looking-glass:example.org';
+
+function room(
+  room_id: string,
+  name: string,
+  space: boolean,
+  can_edit_packs: boolean,
+  children: string[] = []
+): RoomSummary {
+  return {
+    room_id,
+    name,
+    membership: 'Joined',
+    unread_messages: 0,
+    unread_mentions: 0,
+    unread_notifications: 0,
+    encrypted: false,
+    space,
+    direct: false,
+    favourite: false,
+    low_priority: false,
+    avatar: null,
+    latest_event_timestamp_ms: null,
+    latest_event: null,
+    notification_mode: null,
+    notification_mode_custom: false,
+    topic: null,
+    canonical_alias: null,
+    joined_members: 1,
+    invited_members: 0,
+    heroes: [],
+    successor: null,
+    inviter: null,
+    parent_spaces: space ? [] : [spaceId],
+    children,
+    space_order: null,
+    can_edit_packs,
+    pinned_events: [],
+    can_pin: false
+  };
+}
+
+function image(shortcode: string): PackImage {
+  const media_id = `mxc://example.org/${shortcode}`;
+  return {
+    shortcode,
+    media_id,
+    reaction_key: media_id,
+    body: null,
+    mimetype: 'image/png',
+    width: 128,
+    height: 128,
+    usage: ['Emoticon', 'Sticker']
+  };
+}
+
+function pack(
+  id: string,
+  display_name: string,
+  source: ImagePack['source'],
+  editable: boolean,
+  images: PackImage[] = []
+): ImagePack {
+  return { id, display_name, avatar: null, attribution: null, source, images, editable, enabled_everywhere: true };
+}
+
+const rooms = [
+  room(roomId, 'Wonderland', false, true),
+  room(spaceId, 'Tea Party Space', true, true, [roomId]),
+  room(readOnlyRoomId, 'Looking Glass Room', false, false)
+];
+
+const packs: ImagePacks = {
+  global: [pack('user', 'Personal pack', 'User', true)],
+  rooms: {
+    [roomId]: [pack('room-pack', 'Editable room pack', { Room: { room_id: roomId, state_key: 'editable-room' } }, true)],
+    [spaceId]: [pack('space-pack', 'Editable space pack', { Room: { room_id: spaceId, state_key: 'editable-space' } }, true)],
+    [readOnlyRoomId]: [
+      pack(
+        'read-only-pack',
+        'Shared pack',
+        { Room: { room_id: readOnlyRoomId, state_key: 'shared' } },
+        false,
+        [image('one'), image('two')]
+      )
+    ]
+  }
+};
+
+let accountDataPosts = 0;
+let commandRequests: Record<string, unknown>[] = [];
+
+const meta = {
+  title: 'Packs/PackManager',
+  component: PackManager,
+  args: { packs, rooms, onError: fn() }
+} satisfies Meta<typeof PackManager>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const CloneReadOnlyPack: Story = {
+  play: async ({ canvas }) => {
+    await userEvent.click(canvas.getByText('Shared pack · Looking Glass Room'));
+    await userEvent.click(canvas.getByRole('button', { name: 'Clone pack' }));
+
+    const dialog = canvas.getByRole('dialog', { name: 'Clone pack' });
+    const cloneDialog = within(dialog);
+    await expect(cloneDialog.getByRole('checkbox', { name: 'Stickers' })).toBeChecked();
+    await expect(cloneDialog.getByRole('checkbox', { name: 'Emoji and reactions' })).toBeChecked();
+
+    const destination = cloneDialog.getByLabelText('Destination pack');
+    await expect(within(destination).getByRole('option', { name: 'Editable room pack · Wonderland' })).toBeInTheDocument();
+    await expect(within(destination).getByRole('option', { name: 'Editable space pack · Tea Party Space' })).toBeInTheDocument();
+    await userEvent.selectOptions(destination, 'new');
+
+    const location = cloneDialog.getByLabelText('Space or room');
+    await expect(within(location).getByRole('option', { name: 'Space · Tea Party Space' })).toBeInTheDocument();
+  }
+};
+
+export const CloneIntoSpacePack: Story = {
+  beforeEach: () => {
+    const originalFetch = window.fetch;
+    commandRequests = [];
+    window.fetch = async (input, init) => {
+      const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+      const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+      if (new URL(url, window.location.href).pathname === '/api/command' && method === 'POST') {
+        commandRequests.push(JSON.parse(String(init?.body)) as Record<string, unknown>);
+        return new Response('{}', { status: 200, headers: { 'content-type': 'application/json' } });
+      }
+      return originalFetch(input, init);
+    };
+    return () => {
+      window.fetch = originalFetch;
+    };
+  },
+  play: async ({ canvas }) => {
+    await userEvent.click(canvas.getByText('Shared pack · Looking Glass Room'));
+    await userEvent.click(canvas.getByRole('button', { name: 'Clone pack' }));
+
+    const dialog = canvas.getByRole('dialog', { name: 'Clone pack' });
+    const cloneDialog = within(dialog);
+    await userEvent.selectOptions(cloneDialog.getByLabelText('Destination pack'), 'space-pack');
+    await userEvent.click(cloneDialog.getByRole('button', { name: 'Copy' }));
+
+    await waitFor(() => expect(commandRequests).toHaveLength(1));
+    await expect(commandRequests).toEqual([
+      {
+        op: 'clone_pack',
+        from_pack: 'read-only-pack',
+        to: { kind: 'room', room_id: spaceId, state_key: 'editable-space' },
+        display_name: null,
+        usage: ['Sticker', 'Emoticon']
+      }
+    ]);
+    await expect(canvas.queryByRole('dialog', { name: 'Clone pack' })).toBeNull();
+  }
+};
+
+export const PersonalImagePreference: Story = {
+  beforeEach: () => {
+    const originalFetch = window.fetch;
+    accountDataPosts = 0;
+    disabledPackImages.set({});
+    window.fetch = async (input, init) => {
+      const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+      const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+      if (new URL(url, window.location.href).pathname === '/api/account-data' && method === 'POST') {
+        accountDataPosts += 1;
+        return new Response('{}', { status: 200, headers: { 'content-type': 'application/json' } });
+      }
+      return originalFetch(input, init);
+    };
+    return () => {
+      window.fetch = originalFetch;
+    };
+  },
+  play: async ({ canvas }) => {
+    await userEvent.click(canvas.getByText('Shared pack · Looking Glass Room'));
+    const card = canvas.getByAltText('one').closest('.image') as HTMLElement | null;
+    if (!card) throw new Error('Image one has no card');
+    const checkbox = within(card).getByRole('checkbox', { name: 'Use for me' });
+
+    await expect(checkbox).toBeChecked();
+    await userEvent.click(checkbox);
+    await expect(checkbox).not.toBeChecked();
+    await expect(card).toBeInTheDocument();
+    await waitFor(() => expect(accountDataPosts).toBe(1));
+
+    await userEvent.click(checkbox);
+    await expect(checkbox).toBeChecked();
+    await expect(card).toBeInTheDocument();
+    await waitFor(() => expect(accountDataPosts).toBe(2));
+  }
+};

Modified file: web/src/lib/PackManager.svelte+110 additions−53 deletions@@ -1,16 +1,17 @@
 <script lang="ts">
   import { createEventDispatcher } from 'svelte';
-  import ContextMenu, { type MenuItem } from './ContextMenu.svelte';
+  import PackCloneDialog from './PackCloneDialog.svelte';
   import MxcAvatar from './MxcAvatar.svelte';
   import EmojiText from './EmojiText.svelte';
   import { messageMediaUrl, runCommand, uploadMedia } from './api';
+  import { disabledPackImages, setPackImageEnabled } from './pack-preferences';
+  import { imageEnabled } from './pack-preferences-model';
+  import type { CloneSource } from './pack-clone';
   import {
     allPacks,
-    clonePackDestinations,
-    editableChoices,
+    freePackStateKey,
     hasUsage,
     packLabel,
-    packSlug,
     packTarget,
     shortcodeFor,
     validShortcode
@@ -30,17 +31,29 @@
   let newName = '';
   let confirmDelete = false;
   let uploading: { done: number; total: number } | null = null;
-  let menu: { items: MenuItem[]; x: number; y: number } | null = null;
+  let cloneSource: CloneSource | null = null;
   let fileInput: HTMLInputElement;
   let avatarInput: HTMLInputElement;
 
   const roomName = (roomId: string) => rooms.find((r) => r.room_id === roomId)?.name ?? roomId;
+  const sidebarPackLabel = (pack: ImagePack) => {
+    const label = packLabel(pack, roomName);
+    if (pack.source === 'User' || !pack.display_name) return label;
+    return `${label} · ${roomName(pack.source.Room.room_id)}`;
+  };
+  const packScope = (pack: ImagePack) => {
+    if (pack.source === 'User') return 'Personal pack synced to your account';
+    const roomId = pack.source.Room.room_id;
+    return `${rooms.find((room) => room.room_id === roomId)?.space ? 'Space' : 'Room'} pack in ${roomName(roomId)}`;
+  };
 
   $: list = allPacks(packs);
   $: userPack = list.find((p) => p.source === 'User') ?? null;
   $: roomPacks = list.filter((p) => p.source !== 'User' && p.editable);
   $: otherPacks = list.filter((p) => p.source !== 'User' && !p.editable);
   $: packRooms = rooms.filter((r) => r.can_edit_packs && r.membership === 'Joined');
+  $: spacePackRooms = packRooms.filter((room) => room.space);
+  $: regularPackRooms = packRooms.filter((room) => !room.space);
   $: selected = selectedId === 'user' ? userPack : (list.find((p) => p.id === selectedId) ?? null);
   $: target = selectedId === 'user' ? ({ kind: 'user' } as PackTarget) : selected ? packTarget(selected) : null;
   $: editable = selectedId === 'user' || (selected?.editable ?? false);
@@ -59,7 +72,7 @@
   async function createPack(): Promise<void> {
     const name = newName.trim();
     if (!newRoom || !name) return;
-    const state_key = packSlug(name);
+    const state_key = freePackStateKey(packs, newRoom, name);
     const ok = await run(
       () => runCommand({ op: 'create_room_pack', room_id: newRoom, state_key, display_name: name }),
       'Could not create the pack'
@@ -130,6 +143,28 @@
     await run(() => runCommand({ op: 'rename_pack_image', target: target!, from: image.shortcode, to }), 'Could not rename');
   }
 
+  async function renameImageBody(image: PackImage, event: Event): Promise<void> {
+    const input = event.currentTarget as HTMLInputElement;
+    const body = input.value.trim() || image.shortcode;
+    const currentBody = image.body?.trim() || image.shortcode;
+    if (!target || body === currentBody) {
+      input.value = currentBody;
+      return;
+    }
+    const ok = await run(
+      () => runCommand({
+        op: 'put_pack_image',
+        target: target!,
+        shortcode: image.shortcode,
+        mxc: image.media_id,
+        body,
+        usage: null
+      }),
+      'Could not rename the sticker'
+    );
+    if (!ok) input.value = currentBody;
+  }
+
   async function toggleUsage(image: PackImage, usage: PackUsage): Promise<void> {
     if (!target) return;
     const current: PackUsage[] = image.usage.length ? image.usage : ['Emoticon', 'Sticker'];
@@ -166,36 +201,16 @@
     if (ok) selectedId = 'user';
   }
 
-  function cloneImageMenu(pack: ImagePack, image: PackImage, ev: MouseEvent): void {
-    menu = {
-      x: ev.clientX,
-      y: ev.clientY,
-      items: editableChoices(packs, roomName).map((choice) => ({
-        label: `Clone to ${choice.label}`,
-        action: () =>
-          void run(
-            () => runCommand({ op: 'clone_pack_image', from_pack: pack.id, shortcode: image.shortcode, to: choice.target }),
-            'Could not clone the image'
-          )
-      }))
-    };
+  function openImageClone(image: PackImage): void {
+    if (selected) cloneSource = { kind: 'image', pack: selected, image };
   }
 
-  function clonePackMenu(pack: ImagePack, ev: MouseEvent): void {
-    menu = {
-      x: ev.clientX,
-      y: ev.clientY,
-      items: clonePackDestinations(pack, packRooms, roomName).map((d) => ({
-        label: d.label,
-        action: () =>
-          void run(async () => {
-            const res = (await runCommand({ op: 'clone_pack', from_pack: pack.id, to: d.target, display_name: d.display_name })) as {
-              skipped?: string[];
-            };
-            if (res?.skipped?.length) onError(`Couldn't copy ${res.skipped.map((s) => `:${s}:`).join(', ')}`);
-          }, 'Could not clone the pack')
-      }))
-    };
+  async function togglePersonalImage(image: PackImage, enabled: boolean): Promise<void> {
+    if (!selected) return;
+    await run(
+      () => setPackImageEnabled(selected!.id, image.shortcode, enabled),
+      'Could not save your image preference'
+    );
   }
 </script>
 
@@ -214,11 +229,11 @@
         <span><EmojiText text={userPack?.display_name ?? 'Your pack'} /></span>
       </button>
       {#if roomPacks.length}
-        <h4>Room packs</h4>
+        <h4>Room and space packs</h4>
         {#each roomPacks as pack (pack.id)}
           <button type="button" class="pack-item" class:active={selectedId === pack.id} on:click={() => (selectedId = pack.id)}>
-            <MxcAvatar mxc={pack.avatar} label={packLabel(pack, roomName)} size={28} shape="rounded" />
-            <span><EmojiText text={packLabel(pack, roomName)} /></span>
+            <MxcAvatar mxc={pack.avatar} label={sidebarPackLabel(pack)} size={28} shape="rounded" />
+            <span><EmojiText text={sidebarPackLabel(pack)} /></span>
           </button>
         {/each}
       {/if}
@@ -226,18 +241,21 @@
         <h4>Other packs</h4>
         {#each otherPacks as pack (pack.id)}
           <button type="button" class="pack-item" class:active={selectedId === pack.id} on:click={() => (selectedId = pack.id)}>
-            <MxcAvatar mxc={pack.avatar} label={packLabel(pack, roomName)} size={28} shape="rounded" />
-            <span><EmojiText text={packLabel(pack, roomName)} /></span>
+            <MxcAvatar mxc={pack.avatar} label={sidebarPackLabel(pack)} size={28} shape="rounded" />
+            <span><EmojiText text={sidebarPackLabel(pack)} /></span>
           </button>
         {/each}
       {/if}
       {#if packRooms.length}
         {#if creating}
           <form class="new-pack" on:submit|preventDefault={() => void createPack()}>
-            <select bind:value={newRoom} aria-label="Room">
-              <option value="" disabled>Room</option>
-              {#each packRooms as room (room.room_id)}
-                <option value={room.room_id}>{room.name}</option>
+            <select bind:value={newRoom} aria-label="Space or room">
+              <option value="" disabled>Space or room</option>
+              {#each spacePackRooms as room (room.room_id)}
+                <option value={room.room_id}>Space · {room.name}</option>
+              {/each}
+              {#each regularPackRooms as room (room.room_id)}
+                <option value={room.room_id}>Room · {room.name}</option>
               {/each}
             </select>
             <input type="text" placeholder="Pack name" bind:value={newName} aria-label="Pack name" />
@@ -247,12 +265,17 @@
             </div>
           </form>
         {:else}
-          <button type="button" class="ghost-btn new-btn" on:click={() => (creating = true)}>New room pack</button>
+          <button type="button" class="ghost-btn new-btn" on:click={() => (creating = true)}>New pack</button>
         {/if}
       {/if}
     </nav>
 
     <section class="editor" aria-label="Pack">
+      {#if selectedId === 'user'}
+        <p class="scope">Personal pack synced to your account</p>
+      {:else if selected}
+        <p class="scope">{packScope(selected)}</p>
+      {/if}
       {#if editable && target}
         <div class="meta">
           <button type="button" class="avatar-btn" title="Change pack avatar" on:click={() => avatarInput.click()}>
@@ -267,6 +290,9 @@
             on:change={(e) => void rename(e)}
           />
           <input type="file" accept="image/*" class="visually-hidden" bind:this={avatarInput} on:change={() => void changeAvatar()} />
+          {#if selected}
+            <button type="button" class="ghost-btn" on:click={() => selected && (cloneSource = { kind: 'pack', pack: selected })}>Clone pack</button>
+          {/if}
         </div>
         <div class="row">
           {#if selected && selected.source !== 'User'}
@@ -289,14 +315,21 @@
             {/if}
           {/if}
         </div>
+        <p class="preference-note">Hiding an image with Use for me only affects you, and syncs to your account. Emoji and sticker settings apply for everyone.</p>
         <div class="images">
           {#each selected?.images ?? [] as image (image.shortcode)}
             <div class="image">
-              <img src={messageMediaUrl(image.media_id, 'Thumbnail')} alt={image.shortcode} loading="lazy" />
+              <img class:hidden={!imageEnabled($disabledPackImages, selected?.id ?? 'user', image.shortcode)} src={messageMediaUrl(image.media_id, 'Thumbnail')} alt={image.shortcode} loading="lazy" />
               <input type="text" value={image.shortcode} aria-label="Shortcode" on:change={(e) => void renameImage(image, e)} />
+              <input type="text" value={image.body?.trim() || image.shortcode} aria-label="Sticker name" on:change={(e) => void renameImageBody(image, e)} />
+              <label class="personal-check">
+                <input type="checkbox" checked={imageEnabled($disabledPackImages, selected?.id ?? 'user', image.shortcode)} on:change={(e) => void togglePersonalImage(image, e.currentTarget.checked)} />
+                Use for me
+              </label>
               <div class="usage">
-                <button type="button" aria-pressed={hasUsage(image, 'Emoticon')} title="Emoji" on:click={() => void toggleUsage(image, 'Emoticon')}>☺</button>
-                <button type="button" aria-pressed={hasUsage(image, 'Sticker')} title="Sticker" on:click={() => void toggleUsage(image, 'Sticker')}>▣</button>
+                <button type="button" aria-pressed={hasUsage(image, 'Emoticon')} title="Emoji for everyone" aria-label="Emoji for everyone" on:click={() => void toggleUsage(image, 'Emoticon')}>☺</button>
+                <button type="button" aria-pressed={hasUsage(image, 'Sticker')} title="Sticker for everyone" aria-label="Sticker for everyone" on:click={() => void toggleUsage(image, 'Sticker')}>▣</button>
+                <button type="button" class="ghost-btn clone" on:click={() => openImageClone(image)}>Clone</button>
                 <button type="button" class="remove" title="Remove" aria-label={`Remove ${image.shortcode}`} on:click={() => void removeImage(image)}>✕</button>
               </div>
             </div>
@@ -309,14 +342,25 @@
           <MxcAvatar mxc={selected.avatar} label={packLabel(selected, roomName)} size={48} shape="rounded" />
           <strong class="name"><EmojiText text={packLabel(selected, roomName)} /></strong>
           <span class="spacer"></span>
-          <button type="button" class="primary-btn" on:click={(ev) => selected && clonePackMenu(selected, ev)}>Clone pack</button>
+          <button type="button" class="primary-btn" on:click={() => (cloneSource = { kind: 'pack', pack: selected })}>Clone pack</button>
         </div>
+        {#if selected.source !== 'User'}
+          <label class="check">
+            <input type="checkbox" checked={selected.enabled_everywhere} on:change={(e) => void setEverywhere(e.currentTarget.checked)} />
+            Use everywhere
+          </label>
+        {/if}
+        <p class="preference-note">Hiding an image with Use for me only affects you, and syncs to your account. Emoji and sticker settings apply for everyone.</p>
         <div class="images">
           {#each selected.images as image (image.shortcode)}
             <div class="image">
-              <img src={messageMediaUrl(image.media_id, 'Thumbnail')} alt={image.shortcode} loading="lazy" />
-              <span class="code">{image.shortcode}</span>
-              <button type="button" class="ghost-btn" on:click={(ev) => selected && cloneImageMenu(selected, image, ev)}>Clone</button>
+              <img class:hidden={!imageEnabled($disabledPackImages, selected?.id ?? 'user', image.shortcode)} src={messageMediaUrl(image.media_id, 'Thumbnail')} alt={image.shortcode} loading="lazy" />
+              <span class="code">{image.body?.trim() ? `${image.body.trim()} · ${image.shortcode}` : image.shortcode}</span>
+              <label class="personal-check">
+                <input type="checkbox" checked={imageEnabled($disabledPackImages, selected?.id ?? 'user', image.shortcode)} on:change={(e) => void togglePersonalImage(image, e.currentTarget.checked)} />
+                Use for me
+              </label>
+              <button type="button" class="ghost-btn" on:click={() => openImageClone(image)}>Clone</button>
             </div>
           {/each}
         </div>
@@ -325,8 +369,16 @@
   </div>
 </div>
 
-{#if menu}
-  <ContextMenu items={menu.items} x={menu.x} y={menu.y} onClose={() => (menu = null)} />
+{#if cloneSource}
+  <div class="modal-wrap">
+    <PackCloneDialog
+      source={cloneSource}
+      {packs}
+      {rooms}
+      onClose={() => (cloneSource = null)}
+      {onError}
+    />
+  </div>
 {/if}
 
 <style>
@@ -353,6 +405,7 @@
   .pack-item.active { background: color-mix(in srgb, var(--accent) 20%, transparent); }
   .new-btn { margin-top: 8px; }
   .new-pack { display: flex; flex-direction: column; gap: 6px; margin-top: 8px; }
+  .scope, .preference-note { margin: 0; color: var(--muted); font-size: 12px; }
   .editor { flex: 1; min-width: 0; display: flex; flex-direction: column; gap: 10px; overflow-y: auto; }
   .meta { display: flex; align-items: center; gap: 10px; }
   .avatar-btn { padding: 0; border: none; background: none; cursor: pointer; border-radius: var(--r-md); }
@@ -381,7 +434,9 @@
     background: var(--bg-soft);
   }
   .image img { width: 100%; aspect-ratio: 1; object-fit: contain; }
+  .image img.hidden { opacity: 0.35; }
   .image input { width: 100%; font-size: 12px; padding: 3px 6px; }
+  .personal-check { display: flex; align-items: center; gap: 5px; font-size: 12px; color: var(--muted); }
   .code { font-size: 12px; color: var(--muted); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
   .usage { display: flex; gap: 4px; }
   .usage button {
@@ -396,5 +451,7 @@
   .usage button[aria-pressed='true'] { color: var(--accent); border-color: var(--accent); }
   .usage .remove { flex: none; padding: 2px 6px; }
   .usage .remove:hover { color: var(--danger); border-color: var(--danger); }
+  .usage .clone { flex: none; padding: 2px 6px; font-size: 12px; }
   .empty { color: var(--muted); font-size: 13px; }
+  .modal-wrap { position: fixed; inset: 0; z-index: 70; display: grid; place-items: center; background: rgb(0 0 0 / 55%); }
 </style>

Modified file: web/src/lib/ReactionPicker.svelte+2 additions@@ -7,6 +7,7 @@
   import type { EmojiGroup } from './emoji';
   import { MAX_QUICK_REACTIONS } from './types';
   import type { ImagePack, PackImage, QuickReaction } from './types';
+  import { hasUsage } from './packs';
 
   export let packs: ImagePack[];
   export let quick: QuickReaction[];
@@ -39,6 +40,7 @@
   $: nothingFound = q !== '' && groups !== null && filteredPacks.length === 0 && filteredGroups.length === 0;
 
   function imageMatches(image: PackImage, needle: string): boolean {
+    if (!hasUsage(image, 'Emoticon')) return false;
     if (!needle) return true;
     return image.shortcode.toLowerCase().includes(needle) || (image.body ?? '').toLowerCase().includes(needle);
   }

Modified file: web/src/lib/StickerPicker.svelte+1 additions−3 deletions@@ -79,9 +79,7 @@
       <section class="group" aria-label={packLabel(g.pack, roomName)}>
         <div class="group-head">
           <h3><EmojiText text={packLabel(g.pack, roomName)} /></h3>
-          {#if !g.pack.editable}
-            <button type="button" class="clone-pack" on:click={(ev) => onClonePack(g.pack, ev.clientX, ev.clientY)}>Clone pack</button>
-          {/if}
+          <button type="button" class="clone-pack" on:click={(ev) => onClonePack(g.pack, ev.clientX, ev.clientY)}>Clone pack</button>
         </div>
         <div class="grid">
           {#each g.images as image (image.shortcode)}

Added file: web/src/lib/avatar-cache.ts+43 additions@@ -0,0 +1,43 @@
+export interface AvatarCache {
+  match(key: string): Promise<Response | undefined>;
+  put(key: string, response: Response): Promise<void>;
+}
+
+export function createAvatarLoader(
+  cache: () => Promise<AvatarCache>,
+  load: (mxc: string) => Promise<Response>
+): (key: string, mxc: string) => Promise<Response> {
+  const pending = new Map<string, Promise<Response>>();
+
+  return async (key, mxc) => {
+    const active = pending.get(mxc);
+    if (active) return (await active).clone();
+
+    const request = (async () => {
+      let store: AvatarCache | null = null;
+      try {
+        store = await cache();
+        const cached = await store.match(key);
+        if (cached) return cached;
+      } catch {
+        store = null;
+      }
+
+      const response = await load(mxc);
+      if (response.ok && store) {
+        try {
+          await store.put(key, response.clone());
+        } catch {
+          return response;
+        }
+      }
+      return response;
+    })();
+    pending.set(mxc, request);
+    try {
+      return (await request).clone();
+    } finally {
+      if (pending.get(mxc) === request) pending.delete(mxc);
+    }
+  };
+}

Modified file: web/src/lib/commands.ts+16 additions−2 deletions@@ -8,6 +8,7 @@ export interface ParsedCommand {
 export const COMMANDS = [
   'me',
   'notice',
+  'sticker',
   'msg',
   'join',
   'leave',
@@ -76,6 +77,7 @@ export function splitTarget(args: string, people: Person[]): Target {
 export const COMMAND_USAGE: Record<CommandName, string> = {
   me: '<action>',
   notice: '<text>',
+  sticker: '<sticker name>',
   msg: '<user> [message]',
   join: '<room>',
   leave: '',
@@ -102,6 +104,18 @@ export function commandQueryAt(text: string, caret: number): string | null {
   return match ? match[1].toLowerCase() : null;
 }
 
-export function matchCommands(prefix: string): CommandName[] {
-  return COMMANDS.filter((name) => name.startsWith(prefix));
+export function matchCommands(query: string): CommandName[] {
+  const q = query.toLowerCase();
+  return COMMANDS.flatMap((name, order) => {
+    if (name.startsWith(q)) return [{ name, score: -1, order }];
+    let previous = -1;
+    let score = 0;
+    for (const letter of q) {
+      const index = name.indexOf(letter, previous + 1);
+      if (index < 0) return [];
+      score += index - previous - 1;
+      previous = index;
+    }
+    return [{ name, score, order }];
+  }).sort((a, b) => a.score - b.score || a.order - b.order).map(({ name }) => name);
 }

Modified file: web/src/lib/discord-markdown.d.ts+2

@@ -4,4 +4,6 @@ declare module '@cloudrac3r/discord-markdown' {

44 export type MarkdownNode = SingleASTNode;

55 export const rules: Record<string, ParserRule>;

66 export const markdownEngine: Pick<typeof import('simple-markdown'), 'parserFor' | 'sanitizeUrl'>;

7+ const markdown: { rules: typeof rules; markdownEngine: typeof markdownEngine };

8+ export default markdown;

79 }

Modified file: web/src/lib/markdown.ts+3 additions−1 deletions@@ -1,7 +1,9 @@
-import { markdownEngine, rules, type MarkdownNode } from '@cloudrac3r/discord-markdown';
+import markdown, { type MarkdownNode } from '@cloudrac3r/discord-markdown';
 import type { Emote } from './emotes';
 import type { Mention } from './mentions';
 
+const { markdownEngine, rules } = markdown;
+
 function escapeHtml(text: string): string {
   return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }

Added file: web/src/lib/pack-clone.ts+7

@@ -0,0 +1,7 @@

1+import type { ImagePack, PackImage } from './types';

2+

3+export type CloneSource =

4+ | { kind: 'pack'; pack: ImagePack }

5+ | { kind: 'image'; pack: ImagePack; image: PackImage }

6+ | { kind: 'sticker'; room_id: string; event_id: string; body: string };

7+

Added file: web/src/lib/pack-preferences-model.ts+81 additions@@ -0,0 +1,81 @@
+import type { ImagePack, QuickReaction } from './types';
+
+export type DisabledPackImages = Record<string, string[]>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function setOwn<T>(record: Record<string, T>, key: string, value: T): void {
+  Object.defineProperty(record, key, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true
+  });
+}
+
+function hasOwn(record: object, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(record, key);
+}
+
+export function parseDisabledPackImages(raw: unknown): DisabledPackImages {
+  if (!isRecord(raw) || !isRecord(raw['disabled'])) return {};
+  const disabled: DisabledPackImages = {};
+  for (const [packId, rawShortcodes] of Object.entries(raw['disabled'])) {
+    if (!Array.isArray(rawShortcodes)) continue;
+    const seen = new Set<string>();
+    const shortcodes = rawShortcodes.filter((value): value is string => {
+      if (typeof value !== 'string' || value.length === 0 || seen.has(value)) return false;
+      seen.add(value);
+      return true;
+    });
+    if (shortcodes.length > 0) setOwn(disabled, packId, shortcodes);
+  }
+  return disabled;
+}
+
+export function imageEnabled(disabled: DisabledPackImages, packId: string, shortcode: string): boolean {
+  return !hasOwn(disabled, packId) || !disabled[packId].includes(shortcode);
+}
+
+export function withImageEnabled(
+  disabled: DisabledPackImages,
+  packId: string,
+  shortcode: string,
+  enabled: boolean
+): DisabledPackImages {
+  const current = hasOwn(disabled, packId) ? disabled[packId] : [];
+  const nextShortcodes = enabled
+    ? current.filter((item) => item !== shortcode)
+    : current.includes(shortcode) ? [...current] : [...current, shortcode];
+  if (nextShortcodes.length === current.length && nextShortcodes.every((item, index) => item === current[index])) {
+    return disabled;
+  }
+  const next = { ...disabled };
+  if (nextShortcodes.length === 0) delete next[packId];
+  else setOwn(next, packId, nextShortcodes);
+  return next;
+}
+
+export function enabledPacks(packs: ImagePack[], disabled: DisabledPackImages): ImagePack[] {
+  return packs.map((pack) => ({
+    ...pack,
+    images: pack.images.filter((image) => imageEnabled(disabled, pack.id, image.shortcode))
+  }));
+}
+
+export function enabledQuickReactions(
+  quick: QuickReaction[],
+  packs: ImagePack[],
+  disabled: DisabledPackImages
+): QuickReaction[] {
+  const hidden = new Set<string>();
+  const enabled = new Set<string>();
+  for (const pack of packs) {
+    for (const image of pack.images) {
+      (imageEnabled(disabled, pack.id, image.shortcode) ? enabled : hidden).add(image.reaction_key);
+    }
+  }
+  return quick.filter((reaction) => !hidden.has(reaction.key) || enabled.has(reaction.key));
+}

Added file: web/src/lib/pack-preferences.ts+61 additions@@ -0,0 +1,61 @@
+import { get, writable } from 'svelte/store';
+import { getAccountData, setAccountData } from './api';
+import { parseDisabledPackImages, withImageEnabled } from './pack-preferences-model';
+import type { DisabledPackImages } from './pack-preferences-model';
+
+const EVENT_TYPE = 'dev.malice.pack_preferences';
+
+export const disabledPackImages = writable<DisabledPackImages>({});
+
+let loadGeneration = 0;
+let accountGeneration = 0;
+let pendingSaves = 0;
+let persistedPreferences: DisabledPackImages = {};
+let saveQueue: Promise<void> = Promise.resolve();
+
+export async function loadPackPreferences(): Promise<void> {
+  if (pendingSaves > 0) return;
+  const generation = ++loadGeneration;
+  const epoch = accountGeneration;
+  try {
+    const preferences = parseDisabledPackImages(await getAccountData(EVENT_TYPE));
+    if (generation !== loadGeneration || epoch !== accountGeneration || pendingSaves > 0) return;
+    persistedPreferences = preferences;
+    disabledPackImages.set(preferences);
+  } catch {}
+}
+
+export function setPackImageEnabled(packId: string, shortcode: string, enabled: boolean): Promise<void> {
+  const previous = get(disabledPackImages);
+  const next = withImageEnabled(previous, packId, shortcode, enabled);
+  if (next === previous) return Promise.resolve();
+
+  const epoch = accountGeneration;
+  loadGeneration += 1;
+  pendingSaves += 1;
+  disabledPackImages.set(next);
+
+  const save = saveQueue.then(async () => {
+    if (epoch !== accountGeneration) return;
+    await setAccountData(EVENT_TYPE, { disabled: next });
+    if (epoch === accountGeneration) persistedPreferences = next;
+  });
+  saveQueue = save.catch(() => undefined);
+  return save.catch((error: unknown) => {
+    if (epoch === accountGeneration && get(disabledPackImages) === next) {
+      loadGeneration += 1;
+      disabledPackImages.set(persistedPreferences);
+    }
+    throw error;
+  }).finally(() => {
+    if (epoch === accountGeneration) pendingSaves -= 1;
+  });
+}
+
+export function resetPackPreferences(): void {
+  accountGeneration += 1;
+  loadGeneration += 1;
+  pendingSaves = 0;
+  persistedPreferences = {};
+  disabledPackImages.set({});
+}

Modified file: web/src/lib/packs.ts+86 additions−3 deletions@@ -1,5 +1,6 @@
-import type { PackTarget } from './transport';
-import type { ImagePack, ImagePacks, PackImage, PackUsage } from './types';
+import type { CommandRequest, PackTarget } from './transport';
+import type { CloneSource } from './pack-clone';
+import type { ImagePack, ImagePacks, PackImage, PackUsage, RoomSummary } from './types';
 
 export interface PackChoice {
   label: string;
@@ -29,6 +30,37 @@ export function allPacks(packs: ImagePacks): ImagePack[] {
   return out;
 }
 
+export function packsForRoom(
+  packs: ImagePacks,
+  roomId: string | null,
+  rooms: Pick<RoomSummary, 'room_id' | 'parent_spaces' | 'children' | 'space'>[] = []
+): ImagePack[] {
+  const seen = new Set<string>();
+  const out: ImagePack[] = [];
+  const add = (pack: ImagePack) => {
+    if (seen.has(pack.id) || pack.images.length === 0) return;
+    seen.add(pack.id);
+    out.push(pack);
+  };
+  for (const pack of packs.global) if (pack.source === 'User') add(pack);
+  if (roomId) {
+    const visited = new Set<string>();
+    const queue = [roomId];
+    for (const id of queue) {
+      if (visited.has(id)) continue;
+      visited.add(id);
+      for (const pack of packs.rooms[id] ?? []) add(pack);
+      const room = rooms.find((entry) => entry.room_id === id);
+      queue.push(...(room?.parent_spaces ?? []));
+      for (const space of rooms) {
+        if (space.space && space.children.includes(id)) queue.push(space.room_id);
+      }
+    }
+  }
+  for (const pack of packs.global) add(pack);
+  return out;
+}
+
 /** Packs you can write to, with your own pack first even before it exists. */
 export function editableChoices(packs: ImagePacks, roomName: (roomId: string) => string): PackChoice[] {
   const all = allPacks(packs);
@@ -36,7 +68,7 @@ export function editableChoices(packs: ImagePacks, roomName: (roomId: string) =>
   const choices: PackChoice[] = [{ label: user?.display_name ?? 'Your pack', target: { kind: 'user' }, pack: user }];
   for (const pack of all) {
     if (pack.source === 'User' || !pack.editable) continue;
-    choices.push({ label: packLabel(pack, roomName), target: packTarget(pack), pack });
+    choices.push({ label: `${packLabel(pack, roomName)} · ${roomName(pack.source.Room.room_id)}`, target: packTarget(pack), pack });
   }
   return choices;
 }
@@ -49,6 +81,27 @@ export function stickersOf(pack: ImagePack): PackImage[] {
   return pack.images.filter((image) => hasUsage(image, 'Sticker'));
 }
 
+export function reactionShortcode(key: string, shortcode: string | undefined, packs: ImagePack[]): string | undefined {
+  if (!key.startsWith('mxc://')) return undefined;
+  const provided = shortcode?.trim();
+  if (provided) return provided;
+  for (const pack of packs) {
+    const image = pack.images.find((item) => item.reaction_key === key);
+    if (image) return image.shortcode;
+  }
+  return undefined;
+}
+
+export function findSticker(packs: ImagePack[], shortcode: string): { pack: ImagePack; sticker: PackImage } {
+  const name = shortcode.toLowerCase();
+  const matches = packs.flatMap((pack) => stickersOf(pack)
+    .filter((sticker) => sticker.shortcode.toLowerCase() === name)
+    .map((sticker) => ({ pack, sticker })));
+  if (matches.length === 0) throw new Error(`No sticker named ${shortcode} is available in this room`);
+  if (matches.length > 1) throw new Error(`More than one sticker is named ${shortcode}, choose one from the sticker menu`);
+  return matches[0];
+}
+
 /** A shortcode from a file name, unique within `taken`. */
 export function shortcodeFor(filename: string, taken: Set<string>): string {
   const stem = filename.replace(/\.[^.]+$/, '');
@@ -78,6 +131,36 @@ export function packSlug(name: string): string {
   );
 }
 
+export function freePackStateKey(packs: ImagePacks, roomId: string, name: string): string {
+  const taken = new Set(allPacks(packs).flatMap((pack) =>
+    pack.source !== 'User' && pack.source.Room.room_id === roomId ? [pack.source.Room.state_key] : []));
+  const base = packSlug(name);
+  let key = base;
+  for (let n = 2; taken.has(key); n += 1) key = `${base}-${n}`;
+  return key;
+}
+
+export function cloneRequest(
+  source: CloneSource,
+  to: PackTarget,
+  usage: PackUsage[],
+  displayName: string | null,
+  destination: ImagePack | null
+): CommandRequest {
+  if (usage.length === 0) throw new Error('Choose at least one use for the copied images');
+  if (source.kind === 'pack') {
+    return { op: 'clone_pack', from_pack: source.pack.id, to, display_name: displayName, usage };
+  }
+  if (source.kind === 'image') {
+    return { op: 'clone_pack_image', from_pack: source.pack.id, shortcode: source.image.shortcode, to, usage };
+  }
+  const taken = new Set(destination?.images.map((image) => image.shortcode) ?? []);
+  return {
+    op: 'clone_sticker', room_id: source.room_id, event_id: source.event_id, to,
+    shortcode: shortcodeFor(source.body || 'sticker', taken), usage
+  };
+}
+
 export interface CloneDestination {
   label: string;
   target: PackTarget;

Modified file: web/src/lib/store.ts+2 additions@@ -8,6 +8,7 @@ import type { SoftLogout } from './api';
 import { isRecord } from './guards';
 import { resetLinkPreviews } from './link-previews';
 import { resetQuickReactions } from './quick-reactions';
+import { resetPackPreferences } from './pack-preferences';
 import {
   EMPTY_IMAGE_PACKS,
   parseEncryptionState,
@@ -97,6 +98,7 @@ export function resetClientState(): void {
   banners.set([]);
   imagePacks.set(EMPTY_IMAGE_PACKS);
   resetQuickReactions();
+  resetPackPreferences();
   resetLinkPreviews();
 }
 

Modified file: web/src/lib/transport.ts+3 additions−3 deletions@@ -62,9 +62,9 @@ export type CommandRequest =
   | { op: 'rename_pack_image'; target: PackTarget; from: string; to: string }
   | { op: 'remove_pack_image'; target: PackTarget; shortcode: string }
   | { op: 'set_pack_enabled'; room_id: string; state_key: string; enabled: boolean }
-  | { op: 'clone_pack_image'; from_pack: string; shortcode: string; to: PackTarget }
-  | { op: 'clone_sticker'; room_id: string; event_id: string; to: PackTarget; shortcode: string }
-  | { op: 'clone_pack'; from_pack: string; to: PackTarget; display_name: string | null }
+  | { op: 'clone_pack_image'; from_pack: string; shortcode: string; to: PackTarget; usage?: PackUsage[] }
+  | { op: 'clone_sticker'; room_id: string; event_id: string; to: PackTarget; shortcode: string; usage?: PackUsage[] }
+  | { op: 'clone_pack'; from_pack: string; to: PackTarget; display_name: string | null; usage?: PackUsage[] }
   | HistoryRepairRequest
   | MentionsRequest;
 

Modified file: web/src/lib/types.ts+1 additions−13 deletions@@ -818,19 +818,7 @@ export function parseImagePacks(raw: unknown): ImagePacks {
   return { global: parsePackList(raw['global']), rooms };
 }
 
-export function packsForRoom(packs: ImagePacks, roomId: string | null): ImagePack[] {
-  const seen = new Set<string>();
-  const out: ImagePack[] = [];
-  const add = (pack: ImagePack) => {
-    if (seen.has(pack.id) || pack.images.length === 0) return;
-    seen.add(pack.id);
-    out.push(pack);
-  };
-  for (const pack of packs.global) if (pack.source === 'User') add(pack);
-  if (roomId) for (const pack of packs.rooms[roomId] ?? []) add(pack);
-  for (const pack of packs.global) add(pack);
-  return out;
-}
+export { packsForRoom } from './packs';
 
 export const MAX_QUICK_REACTIONS = 8;
 export interface QuickReaction {

Modified file: web/src/sw.ts+7 additions−10 deletions@@ -1,6 +1,7 @@
 import { statusForKind } from './lib/wire-status';
 import { decodeAttachmentIv, importAttachmentKey, RangeDecryptor } from './lib/media-decrypt';
 import { attachmentContentType } from './lib/media-sniff';
+import { createAvatarLoader } from './lib/avatar-cache';
 
 // Prepended by vite.config.ts's precacheManifestPlugin: every emitted chunk,
 // asset, and the wasm, as root-relative URLs.
@@ -153,7 +154,7 @@ function mediaResponse(reply: MediaReply | null, rangeHeader: string | null, att
   const { body, status, contentRange } = sliceForRange(bytes, rangeHeader);
   const headers = new Headers({
     'Content-Type': reply.content_type ?? 'application/octet-stream',
-    'Cache-Control': 'private, max-age=3600',
+    'Cache-Control': attachment ? 'private, max-age=3600' : 'private, max-age=31536000, immutable',
     'X-Content-Type-Options': 'nosniff'
   });
   if (attachment) {
@@ -434,14 +435,10 @@ async function cacheFirst(request: Request): Promise<Response> {
 }
 
 /** Keyed by mxc alone, so the cached bytes outlive the access token and survive restarts. */
-async function cachedAvatar(request: Request, mxc: string): Promise<Response> {
-  const cache = await caches.open(AVATAR_CACHE);
-  const cached = await cache.match(request);
-  if (cached) return cached;
-  const response = mediaResponse(await requestMedia('avatar', { mxc }), null, false);
-  if (response.ok) void cache.put(request, response.clone());
-  return response;
-}
+const cachedAvatar = createAvatarLoader(
+  async () => caches.open(AVATAR_CACHE),
+  async (mxc) => mediaResponse(await requestMedia('avatar', { mxc }), null, false)
+);
 
 async function networkFirstNavigation(request: Request): Promise<Response> {
   try {
@@ -460,7 +457,7 @@ sw.addEventListener('fetch', (event) => {
   if (url.pathname === '/api/media') {
     const mxc = url.searchParams.get('mxc');
     if (mxc) {
-      event.respondWith(cachedAvatar(event.request, mxc));
+      event.respondWith(cachedAvatar(event.request.url, mxc));
       return;
     }
   }

Added file: web/test/avatar-cache.test.ts+93 additions@@ -0,0 +1,93 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createAvatarLoader, type AvatarCache } from '../src/lib/avatar-cache.ts';
+
+function memoryCache(): AvatarCache & { entries: Map<string, Response> } {
+  const entries = new Map<string, Response>();
+  return {
+    entries,
+    async match(key) {
+      return entries.get(key)?.clone();
+    },
+    async put(key, response) {
+      entries.set(key, response.clone());
+    }
+  };
+}
+
+function image(body = 'avatar', status = 200): Response {
+  return new Response(body, { status, headers: { 'Content-Type': 'image/png' } });
+}
+
+test('avatar cache coalesces simultaneous misses and persists results', async () => {
+  const store = memoryCache();
+  let loads = 0;
+  let release: ((response: Response) => void) | undefined;
+  let signalLoadStarted: (() => void) | undefined;
+  const loadStarted = new Promise<void>((resolve) => (signalLoadStarted = resolve));
+  const loader = createAvatarLoader(async () => store, async () => {
+    loads += 1;
+    signalLoadStarted?.();
+    return new Promise((resolve) => (release = resolve));
+  });
+
+  const first = loader('/api/media?mxc=avatar', 'avatar');
+  const second = loader('/api/media?mxc=avatar', 'avatar');
+  await loadStarted;
+  assert.equal(loads, 1);
+  release?.(image());
+  assert.equal(await (await first).text(), 'avatar');
+  assert.equal(await (await second).text(), 'avatar');
+
+  const nextWorker = createAvatarLoader(async () => store, async () => {
+    loads += 1;
+    return image('unexpected');
+  });
+  assert.equal(await (await nextWorker('/api/media?mxc=avatar', 'avatar')).text(), 'avatar');
+  assert.equal(loads, 1);
+});
+
+test('avatar cache retries unsuccessful responses', async () => {
+  const store = memoryCache();
+  let loads = 0;
+  const loader = createAvatarLoader(async () => store, async () => ++loads === 1 ? image('missing', 404) : image());
+  assert.equal((await loader('/avatar', 'avatar')).status, 404);
+  assert.equal(await (await loader('/avatar', 'avatar')).text(), 'avatar');
+  assert.equal(loads, 2);
+});
+
+test('avatar cache read failures still return the image', async () => {
+  let loads = 0;
+  const cache: AvatarCache = {
+    async match() {
+      throw new Error('read failed');
+    },
+    async put() {}
+  };
+  const loader = createAvatarLoader(async () => cache, async () => {
+    loads += 1;
+    return image();
+  });
+
+  assert.equal(await (await loader('/avatar', 'avatar')).text(), 'avatar');
+  assert.equal(loads, 1);
+});
+
+test('avatar cache write failures still return the image', async () => {
+  let loads = 0;
+  const cache: AvatarCache = {
+    async match() {
+      return undefined;
+    },
+    async put() {
+      throw new Error('write failed');
+    }
+  };
+  const loader = createAvatarLoader(async () => cache, async () => {
+    loads += 1;
+    return image();
+  });
+
+  assert.equal(await (await loader('/avatar', 'avatar')).text(), 'avatar');
+  assert.equal(loads, 1);
+});

Modified file: web/test/commands.test.ts+11 additions−1 deletions@@ -12,10 +12,12 @@ const people = [
 test('parses a leading command and leaves text alone', () => {
   assert.deepEqual(parseCommand('/kick  Bob  being rude '), { name: 'kick', args: 'Bob  being rude' });
   assert.deepEqual(parseCommand('/leave'), { name: 'leave', args: '' });
+  assert.deepEqual(parseCommand('/sticker party_parrot'), { name: 'sticker', args: 'party_parrot' });
   assert.equal(parseCommand('hello /kick'), null);
   assert.equal(parseCommand('//kick bob'), null);
   assert.equal(unescapeCommand('//kick bob'), '/kick bob');
   assert.equal(isKnownCommand('kick'), true);
+  assert.equal(isKnownCommand('sticker'), true);
   assert.equal(isKnownCommand('shrug'), false);
 });
 
@@ -34,5 +36,13 @@ test('a leading slash word opens the command list', async () => {
   assert.equal(commandQueryAt('/', 1), '');
   assert.equal(commandQueryAt('/kick bob', 9), null);
   assert.equal(commandQueryAt('hi /ki', 6), null);
-  assert.deepEqual(matchCommands('un'), ['unban', 'unmute', 'unignore']);
+  assert.deepEqual(matchCommands('un').slice(0, 3), ['unban', 'unmute', 'unignore']);
+  assert.equal(matchCommands('in')[0], 'invite');
+  assert.ok(matchCommands('in').includes('disinvite'));
+  assert.deepEqual(matchCommands('stk'), ['sticker']);
+  assert.equal(matchCommands('avatar')[0], 'roomavatar');
+  assert.deepEqual(matchCommands('STK'), ['sticker']);
+  assert.deepEqual(matchCommands('zz'), []);
+  assert.deepEqual(matchCommands('kk'), ['kick']);
+  assert.deepEqual(matchCommands('kkk'), []);
 });

Added file: web/test/pack-preferences.test.ts+67 additions@@ -0,0 +1,67 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { enabledPacks, enabledQuickReactions, imageEnabled, parseDisabledPackImages, withImageEnabled } from '../src/lib/pack-preferences-model.ts';
+
+const image = (shortcode: string) => ({
+  shortcode,
+  media_id: `mxc://x/${shortcode}`,
+  reaction_key: `mxc://x/${shortcode}`,
+  body: null,
+  mimetype: null,
+  width: null,
+  height: null,
+  usage: ['Sticker' as const]
+});
+
+const pack = {
+  id: 'pack-a',
+  display_name: 'Pack A',
+  avatar: null,
+  attribution: 'source',
+  source: 'User' as const,
+  images: [image('one'), image('two')],
+  editable: true,
+  enabled_everywhere: false
+};
+
+test('disabled image preferences parse only safe nonempty string lists', () => {
+  const raw = JSON.parse('{"disabled":{"pack-a":["one","one","",2,null],"empty":[],"wrong":"one","__proto__":["hidden"],"constructor":["other"]}}');
+  const parsed = parseDisabledPackImages(raw);
+  assert.deepEqual(parsed, JSON.parse('{"pack-a":["one"],"__proto__":["hidden"],"constructor":["other"]}'));
+  assert.equal(Object.getPrototypeOf(parsed), Object.prototype);
+  assert.equal(({} as Record<string, unknown>)['hidden'], undefined);
+  assert.deepEqual(parseDisabledPackImages(null), {});
+  assert.deepEqual(parseDisabledPackImages({ disabled: [] }), {});
+});
+
+test('image preference updates are immutable and remove empty pack entries', () => {
+  const original = { 'pack-a': ['one'] };
+  const disabled = withImageEnabled(original, 'pack-a', 'two', false);
+  assert.deepEqual(original, { 'pack-a': ['one'] });
+  assert.deepEqual(disabled, { 'pack-a': ['one', 'two'] });
+  assert.notEqual(disabled, original);
+  assert.equal(imageEnabled(disabled, 'pack-a', 'two'), false);
+
+  const enabled = withImageEnabled(disabled, 'pack-a', 'two', true);
+  const cleared = withImageEnabled(enabled, 'pack-a', 'one', true);
+  assert.deepEqual(cleared, {});
+  assert.equal(imageEnabled(cleared, 'pack-a', 'one'), true);
+});
+
+test('enabled packs filter hidden images while preserving metadata and source input', () => {
+  const disabled = { 'pack-a': ['one'] };
+  const source = [pack];
+  const result = enabledPacks(source, disabled);
+  assert.deepEqual(result[0], { ...pack, images: [image('two')] });
+  assert.notEqual(result, source);
+  assert.notEqual(result[0], pack);
+  assert.notEqual(result[0].images, pack.images);
+  assert.deepEqual(pack.images.map((item) => item.shortcode), ['one', 'two']);
+});
+
+test('personal hiding prunes quick reactions while preserving enabled copies and unrelated keys', () => {
+  const quick = [{ key: 'mxc://x/one', shortcode: 'one' }, { key: '👍', shortcode: 'thumbsup' }];
+  assert.deepEqual(enabledQuickReactions(quick, [pack], { 'pack-a': ['one'] }), [quick[1]]);
+  assert.deepEqual(enabledQuickReactions(quick, [pack, { ...pack, id: 'pack-b' }], { 'pack-a': ['one'] }), quick);
+  assert.deepEqual(enabledQuickReactions(quick, [], {}), quick);
+});

Modified file: web/test/packs.test.ts+57 additions−1 deletions@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { clonePackDestinations, editableChoices, packSlug, shortcodeFor, stickersOf } from '../src/lib/packs.ts';
+import { clonePackDestinations, cloneRequest, editableChoices, findSticker, freePackStateKey, packsForRoom, packSlug, reactionShortcode, shortcodeFor, stickersOf } from '../src/lib/packs.ts';
 
 const image = (shortcode: string, usage: ('Emoticon' | 'Sticker')[]) => ({
   shortcode,
@@ -36,6 +36,23 @@ test('stickers include images with no usage of their own', () => {
   assert.deepEqual(stickersOf(roomPack('s', true)).map((i) => i.shortcode), ['a', 'c']);
 });
 
+test('custom reaction nicknames fall back to known packs without changing the reaction key', () => {
+  const packs = [roomPack('mine', true)];
+  assert.equal(reactionShortcode('mxc://x/a', undefined, packs), 'a');
+  assert.equal(reactionShortcode('mxc://x/a', ' preferred ', packs), 'preferred');
+  assert.equal(reactionShortcode('mxc://x/unknown', undefined, packs), undefined);
+  assert.equal(reactionShortcode('👍', 'thumbsup', packs), undefined);
+});
+
+test('sticker commands resolve names without matching emoticons or choosing ambiguous stickers', () => {
+  const pack = roomPack('s', true);
+  assert.equal(findSticker([pack], 'A').sticker.shortcode, 'a');
+  assert.equal(findSticker([pack], 'c').pack, pack);
+  assert.throws(() => findSticker([pack], 'b'), /No sticker named b/);
+  assert.throws(() => findSticker([pack], 'missing'), /No sticker named missing/);
+  assert.throws(() => findSticker([pack, roomPack('other', false)], 'a'), /More than one sticker/);
+});
+
 test('your pack is always a destination, then editable room packs only', () => {
   const packs = { global: [], rooms: { '!r:x': [roomPack('mine', true), roomPack('theirs', false)] } };
   const choices = editableChoices(packs, () => 'Room');
@@ -43,3 +60,42 @@ test('your pack is always a destination, then editable room packs only', () => {
   const dests = clonePackDestinations(roomPack('Fancy Pack', false), [{ room_id: '!d:x', name: 'Dest' }], () => 'Room');
   assert.deepEqual(dests[1].target, { kind: 'room', room_id: '!d:x', state_key: 'fancy-pack' });
 });
+
+test('new pack names avoid existing keys without changing merge destinations', () => {
+  const packs = { global: [], rooms: { '!r:x': [roomPack('cats', true), roomPack('cats-2', true)] } };
+  assert.equal(freePackStateKey(packs, '!r:x', 'Cats'), 'cats-3');
+  assert.equal(freePackStateKey(packs, '!other:x', 'Cats'), 'cats');
+  const destination = editableChoices(packs, () => 'Room')[1];
+  const request = cloneRequest({ kind: 'pack', pack: roomPack('source', false) }, destination.target, ['Sticker', 'Emoticon'], null, destination.pack);
+  assert.deepEqual(request, { op: 'clone_pack', from_pack: 'room:!r:x:source', to: destination.target, display_name: null, usage: ['Sticker', 'Emoticon'] });
+});
+
+test('image and event clones keep explicit usage and event names avoid collisions', () => {
+  const pack = roomPack('source', false);
+  const to = { kind: 'user' as const };
+  assert.deepEqual(cloneRequest({ kind: 'image', pack, image: pack.images[1] }, to, ['Sticker'], null, null), {
+    op: 'clone_pack_image', from_pack: pack.id, shortcode: 'b', to, usage: ['Sticker']
+  });
+  const source = { kind: 'sticker' as const, room_id: '!r:x', event_id: '$event', body: 'a' };
+  assert.deepEqual(cloneRequest(source, to, ['Sticker', 'Emoticon'], null, pack), {
+    op: 'clone_sticker', room_id: '!r:x', event_id: '$event', shortcode: 'a_2', to, usage: ['Sticker', 'Emoticon']
+  });
+  assert.throws(() => cloneRequest(source, to, [], null, pack), /at least one use/);
+});
+
+test('channel packs include all ancestor spaces once and do not cross to unrelated spaces', () => {
+  const local = roomPack('local', false);
+  const parent = { ...roomPack('parent', false), id: 'space-pack' };
+  const ancestor = { ...roomPack('ancestor', false), id: 'ancestor-pack' };
+  const unrelated = { ...roomPack('unrelated', false), id: 'unrelated-pack' };
+  const global = { ...roomPack('global', false), id: 'global-pack' };
+  const packs = { global: [global, parent], rooms: { '!r:x': [local], '!s:x': [parent], '!a:x': [ancestor], '!u:x': [unrelated] } };
+  const rooms = [
+    { room_id: '!r:x', parent_spaces: ['!s:x'], children: [], space: false },
+    { room_id: '!s:x', parent_spaces: ['!a:x'], children: ['!r:x'], space: true },
+    { room_id: '!a:x', parent_spaces: ['!s:x'], children: ['!s:x'], space: true },
+    { room_id: '!u:x', parent_spaces: [], children: [], space: true }
+  ];
+  assert.deepEqual(packsForRoom(packs, '!r:x', rooms).map((pack) => pack.id), [local.id, parent.id, ancestor.id, global.id]);
+  assert.deepEqual(packsForRoom(packs, '!r:x', [{ ...rooms[0], parent_spaces: [] }, ...rooms.slice(1)]).map((pack) => pack.id), [local.id, parent.id, ancestor.id, global.id]);
+});

malice

Commit 132eeceeb362

Commit `132eeceeb362`