v0.1.8: update-awareness badge + HMAC-signed uploads

Two user-visible additions:

1. Plugin checks GitHub releases on init and shows a green/yellow/red
   banner in SettingsPanel above CONFIGURATION:
     * Current     → "v0.1.8 — up to date" (muted)
     * SlightlyStale (≤2 versions behind) → yellow, "Download update"
     * TooOld     (>2 versions behind) → RED, uploads BLOCKED until
                                          user updates
     * DevBuild    → muted "dev build" (no nag for maintainers)
     * Unknown    → banner hidden (fails OPEN — network outage must
                    not silently brick parse uploads)

   Threshold lives in UpdateChecker.StaleThresholdVersions (=2).
   UploadClient.UpdateStatus gates the upload path. Plugin fires the
   check once per ACT session (no cache — GH 60/h/IP limit is plenty
   for the request volume, and re-checking on each start means the
   banner clears instantly after a user installs an update).

2. Every upload now ships X-Lexicon-Signature = HMAC-SHA256(body,
   api_token) via PayloadSigner. Companion server-side validator in
   the EQ2Lexicon repo (commit 33e48a4) runs in opportunistic mode
   for now so v0.1.7 installs aren't broken during the rollout.

   Threat model documented in PayloadSigner.cs + CLAUDE.md: this
   stops in-flight tampering and replay-with-stolen-token-only
   attacks. It does NOT stop the legitimate token holder from
   signing a forged parse — that's unfixable client-side, real
   integrity has to come from server-side sanity caps.

Implementation notes:

  * New src/Core types are pure + testable; UI assembly stays the
    only place that imports ACT or WinForms.
  * UploadClient.UserAgent now embeds the assembly version
    (EQ2LexiconACTPlugin/0.1.8) so the server can roll out a strict
    HMAC gate once telemetry shows enough 0.1.8+ traffic.
  * 38 new xUnit tests: UpdateChecker (version parsing, status
    matrix, JSON parsing, end-to-end orchestration with stub
    fetcher), PayloadSigner (deterministic HMAC, key sensitivity,
    body sensitivity, RFC 4231 § 4.3 Test Case 2 vector). 110/110.

Lockstep version bump on Core + UI per the project rule.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: VortexUK

CLAUDE.md

@@ -30,7 +30,9 @@ The split also unlocks GitHub Actions CI: the workflow at `.github/workflows/ci.
 | `src/Core/PayloadBuilder.cs` | Pure transform: `EncounterSnapshot` → ingest-JSON dict shape. Owns `OutgoingGroupToSwingType`, `FormatTime` (emits ISO-8601 + Z), `SanitizePayload` (replaces NaN/∞ with 0), and `SerializeJson` (JavaScriptSerializer with an 8 MB ceiling). |
 | `src/Core/Snapshots.cs` | Plain DTOs (`EncounterSnapshot`, `CombatantSnapshot`, `DamageTypeAggregate`, `AttackTypeSnapshot`) that mirror the slice of ACT's data model the payload builder reads. |
 | `src/Core/PluginConfig.cs` | User settings persisted as XML. `Load(path)` and `Save(path)` take the path from the caller (resolved in `Plugin.cs` via `ActHelpers.GetConfigPath()`). API token is DPAPI-encrypted on disk (current-user scope) with a `DPAPI:` prefix; legacy plaintext from v0.1.0–v0.1.4 still loads. |
-| `src/Core/UploadClient.cs` | `HttpClient` wrapper. `TestConnectionAsync` (GET `/api/auth/whoami`), `UploadEncounterAsync` (POST `/api/parses/ingest`). `ValidateServerUrl` rejects non-https except `localhost`/`127.0.0.1`/`[::1]`. |
+| `src/Core/UploadClient.cs` | `HttpClient` wrapper. `TestConnectionAsync` (GET `/api/auth/whoami`), `UploadEncounterAsync` (POST `/api/parses/ingest`). `ValidateServerUrl` rejects non-https except `localhost`/`127.0.0.1`/`[::1]`. Adds `X-Lexicon-Signature` HMAC header to every upload (see PayloadSigner) and blocks uploads when `UpdateStatus.UploadBlocked == true`. |
+| `src/Core/UpdateChecker.cs` | GitHub-releases-feed fetcher + pure version-comparison logic. `Compute(currentVersion, releasedVersions)` returns an `UpdateCheckResult` with `Current`/`SlightlyStale`/`TooOld`/`DevBuild`/`Unknown`. Threshold = `StaleThresholdVersions` (2) — older than that blocks uploads. Failure modes (network down, GH 5xx, rate-limit) all collapse to `Unknown` so the gate fails OPEN. |
+| `src/Core/PayloadSigner.cs` | HMAC-SHA256 of the upload body keyed by the user's API token. See "Payload integrity" below for the threat model and what this does/doesn't defend. |
 | `tests/EQ2Lexicon.ACTPlugin.Tests/` | xUnit project, `net48`. 72 tests. References Core only (UI types aren't testable without ACT). Covers PayloadBuilder, PluginConfig (incl. DPAPI roundtrip), UploadClient (incl. URL validator). Coverage collected via `coverlet.collector`. |
 
 ## Versioning + releases
@@ -106,6 +108,38 @@ Dependabot (`.github/dependabot.yml`) opens weekly PRs for NuGet packages in the
 
 See the audit findings + fixes in commits `9eb39e0` (v0.1.4) and `5f9e11a` (v0.1.5).
 
+## Payload integrity (HMAC, v0.1.8+)
+
+Every upload includes an `X-Lexicon-Signature` header: HMAC-SHA256 of the request body, keyed by the user's API token. Implementation in `src/Core/PayloadSigner.cs`. The server in the [EQ2Lexicon](https://github.com/VortexUK/EQ2Lexicon) repo re-computes the HMAC from the body + the token the Bearer header resolved to, and compares with constant-time equality.
+
+**What this defends**:
+
+- Casual payload tampering by a user editing JSON in a debugging proxy and replaying.
+- An attacker who somehow MITMs a TLS session and tries to mutate the body in flight.
+- An attacker who steals only the token (e.g. via a hypothetical XSS on the site) still needs to know the HMAC scheme to forge a valid request — small but non-zero friction.
+
+**What this does NOT defend**:
+
+- The legitimate holder of an API token can sign anything — they have the key. Forging a fake parse for *yourself* is unfixable client-side. Real integrity has to come from server-side sanity checks (DPS-vs-level caps, encounter duration plausibility, cross-validation between multiple plugin uploads of the same encounter).
+- A determined user who runs the DLL through `dnSpy`/`ILSpy` can read the signing code; the algorithm is intentionally not a secret.
+
+**Why key = API token, not an embedded shared secret**: no new secret to manage / rotate / leak. The token is already in memory. We get a per-user key as a side effect, which means cross-user replay also doesn't work.
+
+**Rollout coordination with the server**: ship the server's signature validator in *opportunistic* mode first (validate only if header present, reject only if validation fails) so existing v0.1.7 installs keep uploading. Flip to *strict* mode (require the header) once telemetry shows ≥98% of uploads carry it — pulled from the `User-Agent` header which UploadClient sets to `EQ2LexiconACTPlugin/<assembly version>`.
+
+## Update awareness (v0.1.8+)
+
+The plugin fetches `https://api.github.com/repos/VortexUK/EQ2LexiconACTPlugin/releases` once per ACT session, compares the assembly version to the published tags, and:
+
+- Shows a green/yellow/red banner above the Configuration card in SettingsPanel (`SetUpdateStatus`).
+- Blocks uploads when the installed version is more than `UpdateChecker.StaleThresholdVersions` (=2) releases behind. Block lives in `UploadClient.UploadEncounterAsync` — see `UpdateStatus.UploadBlocked`.
+
+Failure modes (offline, GitHub 5xx, rate-limit, malformed JSON) all collapse to `UpdateStatus.Unknown`, which intentionally **fails open** — uploads still proceed. A GitHub incident must not silently brick every user's parse upload.
+
+`Compute()` returns `DevBuild` when the local version is strictly greater than the latest published tag (i.e. you bumped `<Version>` but haven't tagged yet) — UI shows a muted "dev build" label so maintainers don't get nagged about their own un-released version.
+
+No caching of the GitHub response — request volume is at most a handful per user per day, well under the unauthenticated 60/h/IP limit, and re-fetching on every ACT start means a user who just installed an update sees the banner clear instantly after restarting ACT.
+
 ## ACT API gotchas worth remembering
 
 - `ActGlobals.charName` returns the string `"YOU"` for EQ2 — useless. Use `ActHelpers.GetLoggingCharacterName()` instead (parses the log filename).

src/Core/EQ2Lexicon.ACTPlugin.Core.csproj

@@ -18,7 +18,7 @@
       Build metadata is mirrored from the UI csproj so this assembly's
       version tracks the user-facing plugin version.
     -->
-    <Version>0.1.7</Version>
+    <Version>0.1.8</Version>
     <Company>EQ2 Lexicon</Company>
     <Product>EQ2 Lexicon Uploader (Core)</Product>
     <Description>Pure payload / config / HTTP layer shared by EQ2Lexicon.ACTPlugin.</Description>

src/Core/PayloadSigner.cs

@@ -0,0 +1,83 @@
+using System;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace EQ2Lexicon.ACTPlugin
+{
+    /// <summary>
+    /// HMAC-SHA256 over the upload body, keyed by the user's API token.
+    /// The signature is sent as the <c>X-Lexicon-Signature</c> header and
+    /// the server recomputes + compares with constant-time equality.
+    ///
+    /// ── What this defends ───────────────────────────────────────────────
+    /// The intended threat is "casual payload tampering" — a user (or a
+    /// MITM with the user's TLS session somehow) editing the JSON between
+    /// what the plugin built and what the server stored, hoping to inflate
+    /// their numbers. With HMAC the server can detect that the body
+    /// changed after the holder of the API token signed it.
+    ///
+    /// ── What this does NOT defend ───────────────────────────────────────
+    /// The legitimate holder of an API token can sign ANY payload — they
+    /// have the key. So this does not, and cannot, prevent a determined
+    /// user from forging a parse for themselves. Real integrity has to
+    /// come from server-side sanity checks (cap-vs-level checks, encounter
+    /// duration plausibility, cross-validation against other parses of the
+    /// same encounter, etc.) which live in the EQ2 Lexicon repo.
+    ///
+    /// Choosing the API token as the HMAC key (rather than an embedded
+    /// per-plugin secret) means:
+    ///   - No secret to manage / rotate / leak via DLL disassembly.
+    ///   - Tampering by someone who steals only the token still requires
+    ///     them to recompute the signature using the protocol described
+    ///     here — small extra friction over "just curl with Bearer".
+    ///   - The plugin holds the API token in memory already, so no new
+    ///     attack surface is added.
+    /// </summary>
+    public static class PayloadSigner
+    {
+        /// <summary>
+        /// HTTP header name used to ship the signature to the server.
+        /// Centralised here so plugin + server tests can reference the
+        /// same string and a rename can't desync.
+        /// </summary>
+        public const string SignatureHeaderName = "X-Lexicon-Signature";
+
+        /// <summary>
+        /// Compute the HMAC-SHA256 of <paramref name="body"/> keyed by
+        /// <paramref name="apiToken"/>. Returns a lower-case hex string.
+        /// </summary>
+        /// <exception cref="ArgumentException">
+        /// Thrown when <paramref name="apiToken"/> is empty/whitespace.
+        /// Caller MUST have validated the token before reaching here;
+        /// signing with an empty key would produce a misleadingly
+        /// authoritative-looking signature.
+        /// </exception>
+        public static string Sign(string body, string apiToken)
+        {
+            if (string.IsNullOrWhiteSpace(apiToken))
+                throw new ArgumentException("API token is required to sign the payload.", nameof(apiToken));
+
+            var keyBytes = Encoding.UTF8.GetBytes(apiToken);
+            var bodyBytes = Encoding.UTF8.GetBytes(body ?? "");
+            using (var hmac = new HMACSHA256(keyBytes))
+            {
+                var hash = hmac.ComputeHash(bodyBytes);
+                return BytesToHex(hash);
+            }
+        }
+
+        /// <summary>
+        /// Lowercase-hex with no separator. Standard format for sig headers
+        /// (matches what e.g. GitHub uses for `X-Hub-Signature-256`).
+        /// </summary>
+        private static string BytesToHex(byte[] bytes)
+        {
+            var sb = new StringBuilder(bytes.Length * 2);
+            for (int i = 0; i < bytes.Length; i++)
+            {
+                sb.Append(bytes[i].ToString("x2"));
+            }
+            return sb.ToString();
+        }
+    }
+}