Hardens the LINE bridge against WASM-side crypto panics that crash the bridge process (issue #168 "Failed to decrypt the data: data authentication failure") and adds richer logging for group-decrypt failures. All six WASM crypto entry points most likely to fault on bad inputs are now wrapped in panic-recovery shims that surface the fault as a normal Go error, so the bridge keeps running and the message is reported as undecryptable instead of taking down the goroutine. Also merges main and rewires opType plumbing so the new structured group-decrypt logs work in both the live and backfill paths.

• Add ltsmPanicError plus six *PanicSafe wrappers in pkg/runner.go around E2EEKey.exportKey, E2EEChannel.unwrapGroupSharedKey, E2EEChannel.encryptV1, E2EEChannel.encryptV2, E2EEChannel.decryptV1, and E2EEChannel.decryptV2; recovery runs under the caller's already-held r.mu lock and converts panics to errors.
• Route LoginUnwrapKeyChain, ChannelUnwrapGroupSharedKey, ChannelEncryptV1, ChannelEncryptV2, ChannelDecryptV1, and ChannelDecryptV2 through the new wrappers so panics on either send or receive (or login keychain unwrap) no longer crash the bridge.
• Add e2eeChunkLengths / groupDecryptLogContext helpers in pkg/connector/handle_message.go to standardize group-decrypt failure logs with msg_id, chat_mid, from/to, to_type, op_type, content_type, chunk metadata, optional e2ee_version, and decoded sender_key_id/group_key_id.
• Emit a new Warn log when DecryptGroupMessage still fails after the group-key refresh retry (previously silent).
• Merge main and thread opType through decryptMessageBody so the new group-decrypt log context compiles in the post-merge layout; the backfill path in FetchMessages derives opType from msg.From == lc.Mid (matching the existing pattern in backfillRecentMessages).

• The group-decrypt failure logs add Int("key_id", gkID/keyID) at the call site and then groupDecryptLogContext adds Int("group_key_id", ...) from the same msg.Chunks[len-1], so each failure log carries the same value under two field names. Drop one or the other for cleaner logs. (fixed by commit 3d67fcc)
• Panic recovery is decrypt-only: ChannelEncryptV1 (pkg/runner.go:531) and ChannelEncryptV2 (pkg/runner.go:561) still invoke r.rt.E2EEChannel* directly, so the same class of WASM fault on the outbound path will continue to crash the bridge. Consider wrapping the encrypt fallbacks in matching *PanicSafe helpers. (fixed by commit 3d67fcc)
• LoginUnwrapKeyChain at pkg/runner.go:355 still calls r.rt.E2EEKeyExportKey(keyPtr) directly, so a WASM panic during keychain export on login can still crash the bridge. Route it through the new exportE2EEKeyPanicSafe wrapper for consistent coverage. (fixed by commit 3d67fcc)
• Storing goKeys from a WASM-unwrapped group shared key contradicts the Runner struct comment (pkg/runner.go:30-34) that says WASM-unwrapped keys do not have raw private keys due to SKB; if that comment is still accurate, the 32-byte export will silently build an incorrect pure-Go channel in ChannelCreate and produce wrong plaintexts. Either update the comment to reflect that ChannelUnwrapGroupSharedKey now populates goKeys, or drop the new export-and-store branch. (fixed by commit 3d67fcc)

Build 1.25 • → Autofix

• go build -v ./... fails after the PR is merged onto main with four undefined: opType errors in pkg/connector/handle_message.go. Main extracted decryption logic into decryptMessageBody(msg, portalIDStr) which has no opType parameter, so the PR's groupDecryptLogContext(..., opType) calls no longer compile after the merge.

Lint with 1.25 • → Autofix

• Same root cause as Build 1.25 — the pre-commit Go hooks (go vet, staticcheck) cannot run on a package that fails to compile due to the undefined: opType errors introduced by the merge with main.

build-docker • → Autofix

• docker build runs go build -o matrix-line ./cmd/matrix-line inside the Alpine builder stage and fails with the same four undefined: opType errors in pkg/connector/handle_message.go for the same merge-conflict reason.

Summary by CodeRabbit

• Bug Fixes

  • Improved stability and crash-resilience for encrypted group message operations by converting internal panics into handled errors and updating fallback paths; decryption now considers message direction during backfill.

• Chores

  • Standardized and enriched diagnostic logging for group decryption, including chunk/metadata summaries and conditional key identifiers to aid troubleshooting.

Walkthrough

Adds panic-safe wrappers around LTSM/WASM E2EE operations and standardizes structured zerolog context for group decryption error logs; replaces ad-hoc logs with a single helper while preserving existing control flow.

Changes

E2EE Group Decryption Safety and Observability

🎯 4 (Complex) | ⏱️ ~45 minutes

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}