https://gitlab.synchro.net/main/sbbs/-/commit/8d0d5456c03088c564d8c4c1
Modified Files:
docs/v322_new.md exec/websocketservice.js
Log Message:
websocketservice.js: separate the sidecar guarantee from the login policy

-auth did two unrelated jobs, and welding them together made one of
them unusable.

The first is a safety property about the SIDECAR: forward nothing this
instance could not describe. A backend reading the sidecar concludes
from its absence that a connection was made directly to it, and may
extend local trust on that basis, so a failed write has to close the
connection rather than quietly produce one wearing a local client's
clothes. That stays with -auth, which is the name the guarantee earned.

The second is a POLICY about the person: refuse anyone with no web
session. That belongs to the backend, not here. A backend may want
anonymous visitors and have its own idea of how many to allow -- and it
cannot express any of that if this instance turned them away first. It
never saw them. Moving it out is what makes such a setting possible at
all; keeping it as -login is so a backend that wants nobody anonymous
need not implement refusing them.

Neither may become the default. An instance fronting a server that does
its own login carries people who have not logged in yet, because
logging in is what they are connecting to do.

Nothing in the tree passed -auth expecting the login behaviour, so no
caller changes meaning under it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/21ca1caac2cca95180055e92
Modified Files:
docs/v322_new.md exec/webfileindex.ssjs src/sbbs3/js_conio.cpp
Log Message:
conio.init(): accept mode names longer than six characters

The mode argument was read into a 7-byte buffer, so
JSSTRING_TO_STRBUF() truncated every name to six characters before
the first comparison. Four of the eleven accepted names are longer
than that, and none of them could ever match:

conio.init("CURSES_IBM") -> "CURSES", starts plain curses
conio.init("CURSES_ASCII") -> "CURSES", starts plain curses
conio.init("CONIO_FULLSCREEN") -> "CONIO_", Unhandled ciolib mode
conio.init("SDL_FULLSCREEN") -> "SDL_FU", Unhandled ciolib mode

The first two are the worse half: the call succeeds and the caller
gets a different video mode than it asked for, with no diagnostic.
The truncation is visible in the error text of the other two, which
quotes the buffer rather than the argument.

Widen the buffer to 32, and fix the "CURSES_ACSCII" spelling in the
same chain - correct in the enum (CIOLIB_MODE_CURSES_ASCII), in this
function's own jsdocs, and in the equivalent chain in js_uifc.cpp,
misspelled only here. No script can depend on the misspelling: the
truncation made both spellings behave identically.

Also in webfileindex.ssjs, "overlow: auto" is not a CSS property, so
the file table never got its own scrollbar.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net