From 70de089754c4afa6ee1dd8316940c3f77ef54c5d Mon Sep 17 00:00:00 2001
From: Russell Ballestrini <russell.ballestrini@gmail.com>
Date: Mon, 1 Jun 2026 15:10:13 -0400
Subject: [PATCH] =?UTF-8?q?zebra-spaces:=20log=20out=20button=20next=20to?=
 =?UTF-8?q?=20backup/restore=20=E2=80=94=20wipe=20identity=20+=20generate?=
 =?UTF-8?q?=20fresh?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/zebra-spaces.html | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/web/zebra-spaces.html b/web/zebra-spaces.html
index 2a3acf6..bb37d5c 100644
--- a/web/zebra-spaces.html
+++ b/web/zebra-spaces.html
@@ -213,7 +213,8 @@
   </div>
   <div class="row">
     <button id="btn-vault" class="small">backup / restore key</button>
-    <span class="note">your key lives only in this browser; back it up if you want it on another device or after clearing data.</span>
+    <button id="btn-logout" class="small">log out</button>
+    <span class="note">your key lives only in this browser; back it up if you want it on another device or after clearing data. log out wipes it and generates a fresh identity.</span>
   </div>
   <div id="vault-panel" class="vault-panel hidden">
     <p class="note" style="margin-bottom:0.5rem"><strong>backup</strong> — pick a password; you'll get a text blob to save.</p>
@@ -455,6 +456,22 @@ function setVaultStatus(msg, cls){
 function renderIdentity(){ $('pub-short').textContent = myKeys ? shortHex(myKeys.pubHex) : ''; }
 
 $('btn-vault').addEventListener('click', () => $('vault-panel').classList.toggle('hidden'));
+
+/* log out — destructive: wipes Ed25519 + handle from localStorage and
+ * generates a fresh identity. The booted/blocked window keys off the
+ * pubkey, so logging out is also the escape hatch from a room block.
+ * The user keeps the same browser so we generate a new key right away;
+ * otherwise the page would refuse to enter any space (no identity). */
+$('btn-logout').addEventListener('click', async () => {
+  if (ws){ setStatus('leave the space first','err'); return; }
+  if (!confirm('Log out wipes your identity key from this browser. ' +
+               'If you haven’t backed it up you cannot recover it. Continue?')) return;
+  try { localStorage.removeItem(ID_KEY); localStorage.removeItem(HANDLE_KEY); } catch(_){}
+  myHandle = ''; $('handle').value = '';
+  myKeys = await generateIdentity();
+  renderIdentity();
+  logLine('', 'logged out — fresh identity '+shortHex(myKeys.pubHex));
+});
 $('btn-vault-backup').addEventListener('click', async () => {
   const pw = $('vault-pass').value;
   if (!pw){ setVaultStatus('enter a password first','err'); return; }
@@ -1544,8 +1561,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');
 
 <footer style="margin:2.2rem auto 0;font-size:0.65rem;color:#999;line-height:1.7;word-break:break-all;font-family:monospace">
   <span id="pi-seal" style="color:#777;cursor:default;user-select:none" title="">page integrity</span> &nbsp;·&nbsp; built <span class="stamp-date">2026-06-01</span><br>
-  md5 <span class="stamp-md5">8adeffbcbd77249e26a6bbc8a5f4a57d</span><br>
-  sha256 <span class="stamp-sha">5e664e78df89fd2ba8316356b27a2081e578028e563c936a3180cc8df6bb0691</span><br>
+  md5 <span class="stamp-md5">751ccf227c674271a292fde8951760b7</span><br>
+  sha256 <span class="stamp-sha">19eb0dd6678ad1ff7d3efdcacc16f3df2b307ce277f5c1bef586632c20d127de</span><br>
   <span style="color:#bbb">hashes are of this page with these two fields zeroed — to verify, blank them and re-hash</span><br>
   <span style="color:#bbb">one self-contained file — <strong>save a copy</strong> and verify against these hashes; point at your own servers with ?signal= and ?turncred=, or <a href="host-your-own.html" style="color:#999">host your own community</a></span>
 </footer>