fix(irc): complete SASL PLAIN login over WebSocket (v3.3.3)

The client could connect to Ergo (origin fix deployed) but failed registration
with "You must log in with SASL". Fixes:
- CAP LS: accumulate caps across 302 multiline (use the trailing param, honor the
  `*` continuation) so `sasl` is actually detected.
- CAP ACK: AUTHENTICATE PLAIN whenever sasl is acked (don't gate on a truthy
  password var); send creds, then CAP END only on 903 success.
- SASL failure (902/904/905/906): error + disconnect instead of CAP END (the
  network is SASL-required, so completing registration just gets rejected).
- Connect form now requires a password.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

apps/desktop/extensions/ai-sidebar/chat.js

@@ -87,7 +87,8 @@ async function doConnect() {
     password: $('irc-pass').value,
     channels: $('irc-chans').value.split(/[,\s]+/).filter(Boolean),
   };
-  if (!cfg.nick) { setStatus('Enter your username', 'err'); return; }
+  if (!cfg.nick) { setStatus('Enter your BBS username', 'err'); return; }
+  if (!cfg.password) { setStatus('Enter your IRC password (this network requires SASL login)', 'err'); return; }
   if ($('irc-remember').checked) {
     chrome.storage.local.set({ [STORE_KEY]: cfg });
   }

apps/desktop/extensions/ai-sidebar/irc.js

@@ -52,6 +52,7 @@ export class IrcClient extends EventTarget {
   connect(opts) {
     this.opts = { url: DEFAULT_URL, channels: ['#general'], ...opts };
     this.nick = this.opts.nick;
+    this._caps = new Set();
     this.emit('status', { state: 'connecting' });
     let ws;
     try {
@@ -84,12 +85,18 @@ export class IrcClient extends EventTarget {
       case 'PING': this.send(`PONG :${params[0] || ''}`); break;
       case 'CAP': {
         const sub = params[1];
+        const list = params[params.length - 1] || '';
         if (sub === 'LS') {
-          const offered = (params[2] || '').split(' ');
-          const want = ['sasl', 'server-time', 'message-tags'].filter((c) => offered.includes(c));
-          this.send(`CAP REQ :${want.join(' ')}`);
+          // 302 multiline: a `*` param before the trailing list means more lines.
+          list.split(' ').filter(Boolean).forEach((c) => this._caps.add(c.split('=')[0]));
+          if (params[2] !== '*') {
+            const want = ['sasl', 'server-time', 'message-tags'].filter((c) => this._caps.has(c));
+            if (want.length) this.send(`CAP REQ :${want.join(' ')}`);
+            else this.send('CAP END');
+          }
         } else if (sub === 'ACK') {
-          if ((params[2] || '').includes('sasl') && this.opts.password) this.send('AUTHENTICATE PLAIN');
+          // Authenticate as soon as SASL is acknowledged. CAP END comes after.
+          if (list.includes('sasl')) this.send('AUTHENTICATE PLAIN');
           else this.send('CAP END');
         } else if (sub === 'NAK') {
           this.send('CAP END');
@@ -98,14 +105,15 @@ export class IrcClient extends EventTarget {
       }
       case 'AUTHENTICATE':
         if (params[0] === '+') {
-          const token = btoa(`\0${this.nick}\0${this.opts.password}`);
+          const token = btoa(`\0${this.nick}\0${this.opts.password || ''}`);
           this.send(`AUTHENTICATE ${token}`);
         }
         break;
+      case '900': break; // RPL_LOGGEDIN
       case '903': this.send('CAP END'); break; // SASL success
-      case '904': case '905': // SASL failed
-        this.emit('status', { state: 'error', error: 'Login failed (check username/password)' });
-        this.send('CAP END');
+      case '902': case '904': case '905': case '906': // SASL failed/aborted
+        this.emit('status', { state: 'error', error: 'Login failed — check your username and IRC password.' });
+        this.quit(); // do NOT CAP END; the server requires SASL
         break;
       case '001': // welcome
         this.connected = true;

apps/desktop/extensions/ai-sidebar/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "TronBrowser",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "description": "TronBrowser — privacy-first, AI-native. Branded new tab, private search, CoinPay login, and a bring-your-own-keys AI sidebar.",
   "icons": {
     "16": "icons/icon-16.png",

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/desktop",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "Desktop shell for the TronBrowser Chromium fork",
   "type": "module",

apps/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/docs",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "Documentation site",
   "type": "module",

apps/extensions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/extensions",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "TronBrowser extension store — pay $1, list your MV3 extension (tronbrowser.dev/store)",
   "type": "module",

apps/mobile/app.json

@@ -4,7 +4,7 @@
     "slug": "tronbrowserdev",
     "owner": "profullstack",
     "scheme": "tronbrowser",
-    "version": "3.3.2",
+    "version": "3.3.3",
     "orientation": "portrait",
     "userInterfaceStyle": "dark",
     "platforms": [

apps/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/mobile",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "TronBrowser mobile (Expo / React Native) — Phase 2",
   "type": "module",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/web",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "TronBrowser marketing site + web dashboard",
   "type": "module",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tronbrowser",
-  "version": "3.3.2",
+  "version": "3.3.3",
   "private": true,
   "description": "TronBrowser.dev — open-source, privacy-first, AI-native browser",
   "packageManager": "pnpm@9.12.0",