Works fully offline
The headline: Instbyte no longer needs the internet for anything. Its whole promise is "LAN-first, no cloud" — this release makes that actually true, even on fully air-gapped networks.
Full offline operation
Markdown rendering, syntax highlighting, and QR-code generation previously loaded from external CDNs and a third-party QR service - so on a no-internet network they silently broke. All of it is now bundled and served locally:
Markdown (marked) served from the app itself
Syntax highlighting (highlight.js) bundled locally, covering every language the app supports
QR "Join" code now generated in your browser — no external service, no network call
Nothing reaches outside your network anymore. A guard test enforces this going forward so a CDN dependency can't creep back in.
Security & correctness hardening
Broadcast ownership — only the person who started a broadcast can end it. Previously any connected user could end anyone's broadcast.
Constant-time passphrase check — passphrase comparison is now timing-safe, closing a theoretical timing side-channel.
Cache-busting fixed — stale asset version tags meant browsers could serve old client code after an upgrade; now bumped correctly so updates land immediately.
Under the hood
Removed dead code, tidied a few rough edges. npm publishing now uses trusted publishing (OIDC) with provenance — releases are cryptographically attested as built from this repo.
Upgrade with npx instbyte@latest or pull the latest Docker image.