From 20ddf2bf0cedc4a87081b279531aea43cc18cf74 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Tue, 8 Sep 2026 00:09:09 +0200 Subject: [PATCH] Ship Theseus 0.3.19 4830da01 (signed add-on update endpoint now live) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Setup 4830da019914019c5d3575420b490a278bc3ba63606680f84c30d58de5ff9500 Portable 1ef76b5b0fae9ac5a201956f6f3da55b1f1ceec8a035cc0d498147a210491b5f One theseus change since 0.3.18: 7672ce0 - Signed add-on update endpoint activates. The Silent Mode operator Ed25519 pubkey (generated 2026-09-07, 732b1263a236b0030383a2376597cfa43c3624b3ca2912a46134f8f2a06e6012) is baked into addon-update-pubkeys.js, so on every boot Theseus polls each installed add-on's updateURL 30 s in, verifies the signed updates.json against the pubkey, and stages any newer signed version under /addons-updates-staged/ for promotion on the next launch. Verification, backup, and promotion mechanics unchanged from 0.3.18. The screenshot add-on already advertises https://addons.silentmode.st/screenshot/updates.json; publishing a signed entry there is what activates real updates. No entry is published yet, so this build's boot-time fetch fails silently until the operator lands the first signed payload via scripts/sign-addon-update.mjs. 3be152a - Also in this ship: package-lock.json resynced with package.json. The 0.3.18 ship inadvertently committed WIP dependency additions (bitcoinjs-lib, bip32, bip39, ecpair, @bitcoinerlab/secp256k1) via git commit -o's file-scoped semantics without a matching lock update. Fresh clones now build cleanly with npm ci. Deps are unused by shipped code at this time but ride along in node_modules — installer size grew ~400 KB. Deployed. Verified LIVE 0.3.19. --- releases-manifest.json | 8 ++++---- releases/index.html | 12 ++++++------ tools/index.html | 10 +++++----- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/releases-manifest.json b/releases-manifest.json index 68ab9f5..7214ef2 100644 --- a/releases-manifest.json +++ b/releases-manifest.json @@ -35,15 +35,15 @@ { "id": "theseus-navigator", "product": "Theseus Navigator", - "version": "0.3.18", + "version": "0.3.19", "date": "2026-09-07", "platform": "win-x64", "signed": false, "signingAuthority": null, - "changes": "Five theseus fixes since 0.3.16. (1) Bundled add-on updates now actually land: seedBundledAddons() previously copied a bundled add-on only when its target folder was missing, so the 0.3.14 screenshot editor never reached machines that already had an older screenshot/ folder from a previous run. It now compares bundled and on-disk addon.json versions and reseeds with a timestamped backup under /addons-backups/. (2) Signed add-on update endpoint: an add-on can advertise an updateURL and be republished at any time without waiting for a Theseus release. The client fetches, verifies an Ed25519 signature over id|version|sha256, downloads the tarball, and stages the new copy under /addons-updates-staged/ for promotion on next launch. Dormant in this build (no operator pubkey ceremonied in yet) but the mechanism ships ready. (3) Tab-switch flash gone: switching tabs (and opening Settings) no longer flashes a bare compositor frame — tab views now carry an explicit theme-tracking background color, and setActive shows the incoming tab before hiding the outgoing so at least one view is always up. (4) Screenshot toolbar-menu captures no longer come out blank: the click handler was dispatching capture synchronously while the native menu popup was still on top, marking the tab view occluded and letting capturePage snapshot a stale/empty compositor frame. It now dispatches from the popup's close callback after a short settling delay, so the parent window is foreground and the compositor is live at capture time. (5) Ariadne — Install / Update / Uninstall alongside Turn on / off: the Ariadne toggle card in Settings > Registries grows three lifecycle actions. Install and Update run the bundled AriadneResolver installer silently elevated (one UAC prompt, no wizard); Uninstall reads Inno's registered uninstaller and runs it elevated. Install/Update visibility tracks the installed vs bundled version so the user sees what's on disk and what would land next.", + "changes": "One theseus change since 0.3.18: the signed add-on update endpoint is now live — the Silent Mode operator Ed25519 pubkey is baked into this build, so Theseus polls each installed add-on's updateURL 30 s after boot, verifies the signed updates.json, and stages any newer signed version for promotion on the next launch. Verification, backup, and promotion mechanics unchanged from 0.3.18. No signed updates have been published yet, so this build's boot-time fetch will fail silently until the operator lands the first signed entry. Everything from 0.3.18 rides along.", "files": { - "TheseusNavigator-Setup-0.3.18.exe": "b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54", - "TheseusNavigator-0.3.18-portable.exe": "8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7" + "TheseusNavigator-Setup-0.3.19.exe": "4830da019914019c5d3575420b490a278bc3ba63606680f84c30d58de5ff9500", + "TheseusNavigator-0.3.19-portable.exe": "1ef76b5b0fae9ac5a201956f6f3da55b1f1ceec8a035cc0d498147a210491b5f" } } ] diff --git a/releases/index.html b/releases/index.html index 3e0f086..f2ddae0 100644 --- a/releases/index.html +++ b/releases/index.html @@ -49,16 +49,16 @@ mirror cannot change what you check against here.

-

Theseus Navigator 0.3.18

-
Windows 64-bit · unsigned · 2026-09-07 · Add-on updates actually land + signed update endpoint + tab-flash gone + screenshot no longer blank + Ariadne Install/Update/Uninstall — Five theseus fixes since 0.3.16. (1) seedBundledAddons() previously copied a bundled add-on only when its target folder was missing, so the 0.3.14 screenshot editor never reached machines that already had an older screenshot/ folder from a previous run. It now compares bundled and on-disk addon.json versions, backs the user copy up to addons-backups/<id>-<oldver>-<timestamp>/ on mismatch, and drops the fresh bundle in. (2) Add-ons can now advertise an updateURL and be republished at any time without waiting for a Theseus release. The client fetches, verifies an Ed25519 signature over id|version|sha256, downloads the tarball, and stages the new copy for promotion on next launch. Dormant in this build (no operator pubkey ceremonied in) but the mechanism ships ready. (3) The tab-switch flash is gone — tab views now carry an explicit theme-tracking background color and setActive shows the incoming tab before hiding the outgoing. (4) Screenshot toolbar-menu captures no longer come out blank: the click handler was dispatching capture synchronously while the native menu popup was still on top, so Chromium's occlusion tracker marked the tab view hidden and capturePage snapshotted a stale/empty compositor frame. Dispatch now runs from the popup's close callback after a short settle. (5) Ariadne toggle card in Settings > Registries grows Install / Update / Uninstall alongside Turn on / off — Install and Update run the bundled Ariadne installer silently elevated; Uninstall runs Inno's registered uninstaller. Everything from 0.3.16 rides along.
+

Theseus Navigator 0.3.19

+
Windows 64-bit · unsigned · 2026-09-08 · Signed add-on update endpoint is now live — The Silent Mode operator Ed25519 pubkey is baked into this build, so Theseus polls each installed add-on's updateURL 30 s after boot, verifies the signed updates.json, and stages any newer signed version for promotion on the next launch. Verification, backup, and promotion mechanics unchanged from 0.3.18. No signed updates have been published yet, so this build's boot-time fetch will fail silently until the operator lands the first signed entry. Everything from 0.3.18 rides along.
-
TheseusNavigator-Setup-0.3.18.exe — installer
- b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54 +
TheseusNavigator-Setup-0.3.19.exe — installer
+ 4830da019914019c5d3575420b490a278bc3ba63606680f84c30d58de5ff9500
-
TheseusNavigator-0.3.18-portable.exe — portable
- 8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7 +
TheseusNavigator-0.3.19-portable.exe — portable
+ 1ef76b5b0fae9ac5a201956f6f3da55b1f1ceec8a035cc0d498147a210491b5f
diff --git a/tools/index.html b/tools/index.html index d716f75..cb580d3 100644 --- a/tools/index.html +++ b/tools/index.html @@ -110,15 +110,15 @@

for Windows

Full-window desktop browser with Tor toggle and search bar. macOS and Linux not yet packaged.

-
v0.3.18 · installer ~118 MB (with Ariadne's Thread) · portable ~117 MB · unsigned
+
v0.3.19 · installer ~118 MB (with Ariadne's Thread) · portable ~117 MB · unsigned
- Installer - Portable .exe + Installer + Portable .exe
SHA-256 — verify before running
-
Installerb751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54
-
Portable8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7
+
Installer4830da019914019c5d3575420b490a278bc3ba63606680f84c30d58de5ff9500
+
Portable1ef76b5b0fae9ac5a201956f6f3da55b1f1ceec8a035cc0d498147a210491b5f