From ee2175f565d9551b81f6f045ef9c85f7c60ba93f Mon Sep 17 00:00:00 2001
From: user <user@rpios.local>
Date: Sat, 21 Feb 2026 00:45:45 +0100
Subject: [PATCH] fix: block direct NICK from clients, require bouncer command

Clients sending /nick are intercepted with a NOTICE pointing them
to /msg *bouncer NICK <network> <nick> instead. Prevents unmanaged
nick changes that bypass the bouncer's identity tracking.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/bouncer/client.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/bouncer/client.py b/src/bouncer/client.py
index ec13f3b..948b5dc 100644
--- a/src/bouncer/client.py
+++ b/src/bouncer/client.py
@@ -112,6 +112,15 @@ class Client:
         if msg.command == "QUIT":
             return
 
+        # Block direct NICK -- must go through /msg *bouncer NICK <network> <nick>
+        if msg.command == "NICK":
+            self._send_msg(IRCMessage(
+                command="NOTICE",
+                params=[self._nick, "Use /msg *bouncer NICK <network> <nick>"],
+                prefix="*bouncer!bouncer@bouncer",
+            ))
+            return
+
         # Intercept bouncer control commands
         if msg.command == "PRIVMSG" and len(msg.params) >= 2:
             target = msg.params[0].lower()