Only bitcoincash: was being stripped; bchtest: (chipnet) addresses ended up
producing preferred_username="bch_bchtest:qzew3dqcsj0g" — Forgejo rejected
that with "name is invalid ... must be valid alpha or numeric or dash(-_)
or dot characters" because of the colon, callback 500'd, session never
finished. Regex-strip any [a-z]+: prefix so all three prefix families
(bitcoincash, bchtest, bchreg) produce clean usernames.
Verified end-to-end with a Node smoke test signing a real chipnet challenge
with the main wallet from Argus/wallets.json:
bchtest:qzew3dqcsj0guwe5y3uxf9q2xs5ajgy9lca4z093cu
→ bch_qzew3dqcsj0guwe5y3ux (auto-provisioned in Forgejo)
→ 303 to dashboard, session live.
Site:
- Rename the "Tools" nav label to "Theseus" on every subpage. URL slug
/tools/ is kept intact so bookmarks and cross-links survive; the page's
own title + h1 rename to Theseus; homepage product card retitled.
- Remove the /tlds/ self-nav entry so its 7-item header matches every
other subpage (was 8 items, causing the same "header rearranges" glitch
Hephaestus had before).
Auth-proxy (fixes reported by a concurrent session working with a chipnet
wallet):
- verify.ts now auto-detects the CashAddr prefix (bitcoincash, bchtest,
bchreg) instead of hardcoding "bitcoincash". Chipnet wallets sign the
same message with the same key but display bchtest: addresses; the old
code compared their claim against a re-encoded bitcoincash: version and
always rejected. Same key material, different envelope.
- /challenge accepts any of the three known prefixes at the input gate.
- /verify accepts an optional `state` param in the request body — used as
a fallback if the challenge record didn't carry one (which happens when
a scripted caller runs the /verify step without passing state through
/challenge). Ensures RFC 6749 §4.1.2 compliance: the OAuth callback URL
always echoes state when the client provided one.
Behind Caddy's /auth/* → auth-proxy rewrite, absolute fetch('/challenge')
resolved to origin root and hit Forgejo instead of the auth-proxy, so every
real user got "challenge request failed" when clicking sign-in.
Same root cause as the earlier fix for the CSS/JS asset paths — relative
paths work under both direct (:4000) and prefixed (/auth/) mounts.
Add Hephaestus/caddy/Caddyfile - Caddy reverse-proxies both containers on
{$SITE_HOSTNAME} (from docker-compose .env): /auth/* -> auth-proxy:4000 with
the prefix stripped, / -> forgejo:3000 with a 2GB body cap for git push, LFS,
and release uploads. HTTPS via automatic Lets Encrypt (HTTP-01 on :80); SSH
git access stays on 2222 outside Caddy.
docker-compose.yml wires the new caddy service alongside the two existing
containers; auth-proxy/src/index.ts gets the minor upstream adjustment so
paths line up after Caddy strips the /auth prefix.
Broad-scope commit sweeping in work from parallel sessions plus this session's
dev-only utilities. No single unifying theme — this is the "commit everything
that's ready" pass. Grouped by area below.
AriadneResolver / mobile
* Small updates to BchFetcher, Bns, MainActivity, AriadneVpnService, and the
Android manifest — from a parallel mobile-resolver session.
* AriadneResolver/mobile/webpreview/ — new local dev webview (index.html +
server.mjs) for iterating on the mobile UI without a device.
Email / SnappyMail
* Email/snappymail-plugin/silentmode-addresses — new SnappyMail plugin
(README, CSS, PHP entry, JS) for surfacing @silentmode.st address
management inside the webmail UI.
Hephaestus (Forgejo + auth-proxy)
* auth-proxy/src/oidc.ts + docker-compose.yml updates.
* scripts/bootstrap-auth.sh — idempotent script that registers the wallet
auth-proxy as Forgejo's OIDC provider after `docker compose up -d`. All
secrets read from .env — no literals in the script.
TheseusNavigator / dev tools
* dev/list-tlds.mjs — enumerate every registered BNS name grouped by TLD via
our own indexer.
* dev/show-tlds-bch.mjs — dump the full records payload of the legacy
tlds.bch name (kept as a diagnostic for the list-in-one-NFT era).
Deviant sites + brand
* site/deviant/ — new microsites (anthemus, potidaea, brand, mindmap, main
index) plus the full brand kit under site/deviant/brand/ (logos, icons,
palette, social exports as SVG source + PNG renders).
* site-sirius-x/portal.html — updates.
Coordination
* _coordination/sessions/mobile-resolver.md — parallel-session notes.
Deliberately excluded from this commit:
* scratchpad/ — this session's temp drafts (Sia doc mockups, tlds UPD payloads).
* TheseusNavigator/_prev/ — ~372 MB of prior release binaries; belongs in
a separate artefacts store, not the git tree. Add to .gitignore next pass.
