Version and hashes matched to the just-published installer + portable.
The /latest/… redirect will follow within five minutes of the manifest
update landing (dl-latest.sh regenerates the redirect table off
releases-manifest.json on a cron).
Home page: How it works, Source and Pantheon were in the topnav next
to cross-site tabs. Moved them plus Sign in and Verify into an overlay
sidebar on the left edge — same shape as Sirius.X and Theseus.X —
pointer-events:none, opacity 0.35 by default, hover brightens with a
blurred backdrop, active section painted acid green,
IntersectionObserver replaced with scroll-position tracking so the
final section still activates when the reader hits the page end.
Topnav collapses to the site tabs the header still owns: Hephaestus.X ·
Docs · Explore repos · Sign in.
Docs page: the two-column grid with an inline .toc left column has
been swapped for the same overlay rail. The 13 chapter titles now sit
at the left edge, keep their numbered mono prefix via CSS counter,
and stay legible under the semi-transparent hover backdrop. Content
column is centred at 820px so the reading axis is on the middle of
the viewport rather than shifted right by a sidebar. Icon rail at
64px on medium; sidebar hidden altogether on mobile because there is
no room for a 13-item rail.
A BCH-priced offer is a signed transaction with a fixed amount, so a
seller who wants "$500" had to relist whenever the rate moved. The new
USD mode moves the certificate into a small CashScript covenant
(contracts/usd-listing.cash). Anyone may buy it by paying the seller
target_cents / price, where the price comes from a message signed by the
gateway's oracle key — the median of five exchanges the site already
uses. The payout is clamped to a floor/ceiling band the seller sets, and
the seller can reclaim the certificate at any time.
What the chain can and cannot enforce, stated plainly in the contract and
the UI: script can require a transaction to be mined no earlier than a
time, never no later, so a quote cannot expire on-chain. The band is the
guarantee, and quotes are bound to the listing's outpoint so cancelling
and relisting voids every quote ever issued. An offline libauth VM test
covers list, buy, underpayment, foreign-listing quotes, forged quotes,
band clamping, cancel and a non-seller cancel; on chipnet aloevera.test
was listed at $0.30, bought by a second wallet for 119,090 sat at
$251.91, listed again by the new owner and cancelled.
Gateway: GET /api/price/oracle[?txid=] serves the oracle public key and
per-listing signed quotes; the key lives in oracle.key beside the
gateway, never in the repo. POST /api/market accepts kind "usd" after
reproducing the redeem script from the stated terms and finding the
certificate in that covenant; such listings are pruned once the covenant
output is spent; DELETE accepts the listing's seller while the index
shows the covenant as holder.
Dashboard: the Sell tab has "Price is fixed in: US dollars / BCH", a
band control with the resulting BCH range, and cancel through the
covenant. Market: USD listings show the dollar price, today's BCH
equivalent and the band; buying fetches a quote and completes the
covenant spend. Studio no longer sends a needless UPD when the registry
view is stale, and missing files on a name now get a real 404 page.
Canonical silentmode.st URLs no longer carry a trailing slash (/tools, not
/tools/). nginx (tracked now in VPS/SilentMode/silentmode-st.nginx) 301s
the old form and serves <dir>/index.html; sub-sites deployed from other
repos with relative asset paths (deviant, sirius-x, theseus-x, hephaestus.x,
fly.x, code) keep their directory URLs. Every page's internal links are
now site-root-relative, which resolves correctly both at /x on nginx and
under the BNS gateway's injected <base href="/bns/silentmode.bch/"> — the
old ../x/ links were already broken on the gateway route.
/theseus becomes the Silent Mode-headered Theseus page (what it is, what's
inside, Windows + Android downloads with manifest hashes, verify), linking
out to the sovereign theseus.x whose VPS mirror moves to /theseus-x/, the
same split as /sirius vs /sirius-x/. /tools is repurposed as the overview:
every site, the on-chain twins, the other clients (relay, Firefox, the
standalone Ariadne Resolver) and the machine endpoints. The old tools page
carried stale APK and resolver hashes; the new pages use the manifest's,
verified against the files on dl.silentmode.st.
scripts/serve-site.mjs mirrors the nginx rules for local preview.
Same class of bug as the Sirius .X space on theseus.x: .topnav .brand
carries display:inline-flex + gap:6px, and the mark, brand span and
".X" tail were three separate flex items so the browser drew a 6px gap
between each. Wrapped the mark and the label in two spans so the flex
gap only applies once, between mark and label, and "Hephaestus.X"
renders as one word.
theseus.x, sirius.x and hephaestus.x had a 1px border-bottom under the
sticky/fixed topnav that read as a visible separator between the
navigation and the page. The topnav's own translucent-blur backdrop is
enough of a distinction already — the line is redundant and, on the
theseus.x sidebar layout, made the top of the sidebar look like it was
overhanging the header.
theseus.x tabs also had a "Sirius .X" gap because the topnav <a> is a
flex container and the icon + "Sirius" text + ".X" span were three
flex items with a 6px gap between each. Wrapping the label in one
<span> collapses the gap to a single space between icon and label.
Sidebar border-right and mobile bottom-bar border-top also dropped —
the panel tint carries the boundary; a hard line was too heavy.
The home / new-tab page declared no icon, so those tabs sat blank in the
strip; the compass mark is now inline in home.html as a data: URI (no file
path, no network). The silentmode.st copy of the Theseus page pointed its
icon at /assets/favicon.svg, which only exists on theseus.x — page-relative
now, so the tab shows the mark there too.
Anyone who owns a BCDN name can now publish a Theseus extension, and every
Theseus can install it with the publisher's signature verified locally.
Gateway (Argus/src/gateway/public-gateway.mjs):
PUT /api/ext/<name>/<id>/<version> takes the gzipped tar, checks two BCH
message signatures against the name's current NFT owner (one authorises
the upload, one is stored in the channel), inspects the package
(addon.json at the root, id/version/main match, 8 MB cap), enforces
first-publisher ownership of an id and monotonic versions, and writes the
tarball, the extension's updates.json and community/catalog.json to Sia.
GET /api/ext/catalog reads the catalog back with CORS.
Theseus:
lib/publisher-sig.mjs recovers the signer of a channel entry; main.js
compares it with the publisher name's owner from Theseus's own chain
index before installing or updating, so neither the relay nor a tampered
catalog can pass off code under a trusted name. addon-updater.js gains
installCommunity() and accepts publisher-signed entries in the regular
update check (operator Ed25519 entries unchanged). Settings › Extensions
shows the community catalog with Install / Update; Settings › Plug-ins
links to theseus.x/plug-ins.
theseus.x:
/plug-ins/ is a separate page for the first-party plug-ins (Aegis,
Ariadne's Thread) with live versions and hashes; /extensions/ lists the
bundled extensions, the community catalog, and how to build and publish;
/extensions/publish/ signs and uploads a package in the browser with the
wallet that holds the publisher's name (session helper + wallet bundle
copied alongside).
Section covers both paths — Forgejo GUI and curl/git/docker CLI — so the
heading now reflects that. Anchor #sessions preserved so external links
still work. Follow-up to 980fbd4.
Parallel session assumed (a) Forgejo usernames can't contain dots, and (b) a
wallet mnemonic has to be pasted into a browser to sign in. Both wrong — the
docs now show that.
- §4 gets an 'Allowed characters' subsection listing what Forgejo actually
accepts (letters, digits, hyphens, underscores, dots). game.x works as-is
as a username or an org name.
- New §12 'Working with other sessions' — the wallet-vs-PAT split, a full
five-step recipe for delegating a namespace to a parallel session
(create org / bootstrap user / add to Owners / mint PAT / clone+push),
a scriptable programmatic sign-in template so mnemonics never touch a
browser, and a scope-per-session-shape table.
- TOC + §13 (Help+source) renumbered.
Parallel session had to synthesize two things the page should have handed
them upfront. Fixing that:
- §11 (Gotchas) now links from each entry to its full-recipe section:
HTTPS+PAT → §5+§6, em-dash mojibake → §8, admin-rename → §4. New leading
entry explicitly separates 'PAT vs wallet passphrase' since it's the most
common wallet-flow confusion.
- §7 (Container registry) gets a 'Worked example: publish an app's backend as
an image' subsection — Node/alpine Dockerfile + build+push pair, so the
next reader doesn't have to compose it from the Log-in and Push blocks.
Follow-up to cc544c8.
/docs/ covers sign-in flow, rename, repos, PATs, container registry, API,
storage layout, self-hosting, and known gotchas — 12 sections with a
sticky TOC on the left. Any session (human or LLM) hitting hephaestus.x
now has a one-shot map of the forge.
Landing footer replaced with a four-column layout (Product / Source+spec
/ Pantheon + brand) matching the docs page, with a mono bottom bar. Topnav
gets a Docs link between How-it-works and Source.
Until now only the gateway, Theseus and the desktop reader applied the
TLD co-sign rule; phones and the Windows resolver still admitted every
registration under a cosign or hidden TLD, so the network disagreed
about which names exist. Both shipped builds now carry the rule.
Android 0.19: the JSON helpers in the new TLD-map code used throwing
getters inside methods that do not declare the checked exception, which
javac rejected under the real build (the earlier compile check ran
without -bootclasspath and stopped at the aapt R errors first). Switched
to the non-throwing opt* forms. Release-signed with the existing key.
Resolver 0.1.3: no source change beyond the resolver library already
committed; the installer picks up the source tree, so this is a version
bump and a rebuild.
Manifest, releases page, tools page and theseus page point at the new
files; dl.silentmode.st/latest redirects regenerated.
Two gaps the owner panel left open. First, a hidden TLD was only a UI
gate: anyone could still broadcast a REG under it and every indexer
admitted it. Second, there was no way to sell a name without trusting
the other side.
Co-sign rule (consensus, applied in lockstep by bns.js and
resolver-web.js): a REG under a TLD whose records at that height say
policy "cosign" or hidden 1 is indexed only if the transaction carries
the TLD's own certificate. The certificate can only be spent by the
owner's key and is re-issued to them in the same transaction, so it is
a co-signature nobody can forge and nothing is consumed. The TLD map
now keeps the TUPD timeline so policy is evaluated at the REG height.
Owners register under their private TLDs with the certificate added
from their own wallet; third parties under a "cosign" TLD build the
full transaction, sign their inputs and queue it at /api/cosign, where
the owner approves it from the dashboard (signCosignRequest refuses to
sign unless the certificate returns to the same locking script).
Marketplace: a listing is the seller's certificate input plus a price
output signed SIGHASH_SINGLE|ANYONECANPAY, stored by the gateway as a
bulletin board (/api/market, verified against the on-chain owner and
pruned when the certificate moves). The buyer completes it in one
transaction, so the seller is paid exactly when the name moves.
Cancelling also spends the certificate once so the offer is void.
Site: market.html, Sell sub-tab and Pending approvals in the portal,
Market link in nav and footer, six dictionaries extended, cache tags
bumped. Verified on chipnet: cosigned.sc registered by a throwaway
wallet through the queue with the .sc certificate back at the owner;
aloevera.test listed and delisted through the API.
Ariadne's resolver-web.js copy and the mobile Bns.java port still need
the co-sign rule; until then they admit REGs this index rejects.
BuiltInWallet.signMessage read `recovery` from libauth's recoverable
signature, but libauth v3 names it `recoveryId`. The flag byte came out as
0, so verifiers recovered the right key only when the true recovery id
happened to be 1. Signed DNS manifests and Studio uploads failed with
"signature does not match current on-chain NFT owner" and a different
derived address each attempt. Read the right field, fail loudly if it is
missing, rebuild the browser bundle and move every importer to the new
bundle URL. Also lands the registrar's signRecordsManifest that the bundle
already shipped.
The tools page and the Theseus page pointed at versioned files; the Theseus
page still linked 0.3.44, archived long ago, and showed 0.0.9 as the latest
version. Both now use the stable /latest/ redirects, and the Theseus page is
rebuilt from the theseus.x source (versions and hashes refreshed from the
releases manifest at load, current values baked in as fallback). The
releases ledger keeps versioned filenames, since each entry pairs a file
with its hash.
Direct answers to the three complaints in one release.
"Doesn't load any results even if I type a keyword" — navigateTo used to
always append .bch to any bare label. So "bitcoin" became
https://bitcoin.bch/ and NXDOMAINed. Now: input with a space, or bare
label with no dot, routes to the user's chosen search engine. Input with
a dot (hello.bch, example.com) stays a URL. Matches Chrome/Firefox
omnibox behaviour exactly.
"Has no check for updates in settings" — new Updates section shows the
installed version + signing-cert SHA-256, with a "Check for updates now"
button that manually polls dl.silentmode.st and toasts the result. If a
newer version exists, the standard silent-prefetch → green-chip → tap-to
-install flow (unchanged from 0.15) kicks in.
"Looks poor compared to a regular browser" — Settings gains three more
sections beyond Resolution / Ariadne's Thread / Maintenance:
- Search: segmented picker for DuckDuckGo (default), Startpage, Brave
Search, Google, Kagi. Persists via SharedPreferences.
- Updates: version + cert + manual check.
- Privacy: "Clear browsing data" — cookies (CookieManager), form data,
cache, per-tab history, all in one tap. Bookmarks + tabs preserved.
- About: silentmode.st/theseus + theseus.x links, brand credit.
serveSettingsPage() signature grew to take (indexerOn, searchKey,
currentVersion) so it can render the current selection + version. Added
searchEngineSegment() helper for the picker layout.
Release: ariadne-v0.17.apk sha256
8a655081782ecc17a50a7fcd67c28625ccb0c905cf6b583bdd703a128b2b9b10
Deployed to dl.silentmode.st + silentmode.bch (Sia mirror). Site pages
bumped: silentmode.st/tools + /releases + /theseus + theseus.x.
Users on 0.15 reported "Ariadne can't open many websites" and "start page
is full of dead links". Two independent stale-data issues, both fixed.
Start page — replaces the featured-hero + beacon-fallback grid with the
same nine curated cards navigate.st serves (hello.bch, siatest.bch,
SilentMode.X, Theseus.X, Sirius.X, Hephaestus.X, Prometheus.X, Helios.X,
Hermes.X). No more auto-iteration over every registered name on the
beacon — which is what was surfacing smtest-dc5563.bch, uitest-e20579.p2p,
qrtest-e21970.nav etc. Added product-role badges (infrastructure /
navigator / registrar / code-host / app-store / search / messaging) with
the same acid/blue/purple/green/gold/pink vocabulary Theseus uses.
Bundled snapshot at app/assets/bns-index.json regenerated from the live
chain via the resolver-web.js buildIndex path. Up from 44 entries to 54,
now including all 13 .x names (was 6 — silentmode.x, theseus.x,
hephaestus.x, prometheus.x, helios.x, hermes.x etc. were entirely
missing). So cold-start resolution finds the .x brands without waiting
for a network trip.
Also regenerated dl.silentmode.st/bns-name-index.json — same 54-entry
JSON. That file hadn't been rebuilt since 2026-08-30 and is what every
client's CDN pull path reads on cold start (mobile, extension, resolver).
There's no timer that regenerates it; scratchpad/build-snapshot.mjs is
the reproducible one-shot: node build-snapshot.mjs <cdn-path>.
Sites updated in the same commit (all four surfaces need to advertise the
same version — silentmode.st/tools + /releases + /theseus + theseus.x
were still linking 0.15). APK also mirrored to bns/silentmode/ so
silentmode.bch/ariadne-v0.16.apk serves the same bytes.
Release: ariadne-v0.16.apk sha256
fa58aa7642319faaa6b23f0f0a46c0adad2ce1f3c5957f4d527ac09241b76574
Old links pointed users at ariadne-v0.11.apk from three separate pages
while the in-app auto-updater was already pulling 0.15. New downloaders
got 4 versions behind.
- site-theseus-x/index.html — v0.11 → v0.15, hash updated, meta noting
in-app auto-update. Sia-uploaded to bns/theseus/ so theseus.x reflects
it now.
- site/releases/index.html — bumps the Ariadne row from 0.11 to 0.15
with the new hash and a release note covering the DOWNLOADING/READY/
RETRY chip states shipped in 0.15.
- site/tools/index.html — same v0.11 → v0.15 bump. Also retitled from
"Theseus — Silent Mode" / "Theseus — the browsers" to "Tools — Silent
Mode" / "Silent Mode tools" because the page actually lists every
client (Theseus Win + Android, Ariadne extension, navigate.st relay,
Ariadne standalone Windows resolver) — a tools directory, not a
Theseus-dedicated page. Intro now points at /theseus/ for the
dedicated Theseus landing.
- site/theseus/ NEW — clearnet mirror of theseus.x. Same page, retitled
"Theseus Navigator — Silent Mode" with canonical URL pointing at
silentmode.st/theseus/. Users on the resolver reach theseus.x for the
same content trustlessly; the /theseus/ path is the always-reachable
fallback with a real cert. Also pushes the APK itself to
bns/silentmode/ so silentmode.bch/ariadne-v0.15.apk works too
(dl.silentmode.st and silentmode.bch now serve the same bytes with
identical SHA-256).
Silent-background prefetch was already the model in 0.12+, but the chip
showed the same "▲ 0.14" text whether the download was running, done, or
failed. Users had no way to know they'd get "Install now" instead of
"Download & install" until they tapped.
Chip is now a small state machine driven off UpdateInstaller.Progress:
- DOWNLOADING — muted amber pill, text "▲ 0.15 · 45%" ticking live from
onProgress. Tap = "Downloading in the background, tap again when green."
- READY — green pill, "▲ Install 0.15". A brief toast fires on state entry
so the user sees the prefetch just completed. Tap = short confirmation
dialog, then straight to the platform package installer.
- RETRY — appears when the prefetch fails. One tap re-runs prefetch and
the chip returns to DOWNLOADING.
The confirmation dialog now spells out that Android replaces Ariadne in
place and reopens on the new version — matches Android's actual behaviour.
saveSession() runs before launchInstall so the newly-launched v0.15
restores tabs cleanly.
Dead code drop: promptToUpdate + downloadThenInstall (the old on-demand
progress-dialog path) — the state machine handles both silent and
tap-first flows.
Release: ariadne-v0.15.apk sha256
35532e596ec43a2da0cf49496640c72972321f5a44fa2e16d259d281a021b425
Deployed to dl.silentmode.st; site/releases-manifest.json bumped.
Browsers held a stale shared.css (no Cache-Control on .css, weeks-old
Last-Modified → long heuristic freshness), so the .brand .logo rule added
on 2026-09-07 never applied for returning visitors and the brand wrapped
onto its own nav row on every page except Hephaestus. All 13 pages now
link shared.css?v=YYYYMMDD; bump it on every shared.css change (GOTCHAS).
d78dd6d turned /sirius/ into a redirect to /sirius-x/, so the Sirius nav tab
left the shared header and dropped visitors into the sovereign Sirius.X site.
Per user: /sirius/ is the subdirectory page with the common header; Sirius.X
stays the sovereign registrar. Restored the page from 944080d and pointed
every register CTA at /sirius-x/#search-input, with a note listing the
mirror, gateway and native sirius.x URLs. register.html keeps its redirect.
Answers a community question ("how would one run this if it's not on GitHub?")
by putting the source repo front and centre, plus a runnable docker-compose
recipe for self-hosting.
- Palette + typography (Fraunces / DM Sans / JetBrains Mono / Ubuntu) and
layout (topnav, radial-stack background, .card, .steps, .verify, .note)
aligned with site-sirius-x. Adds js/theme.js (copied from sirius-x) for
the Fraunces↔Ubuntu font toggle.
- Sticky topnav: brand, section links, Explore repos, wallet dropdown at right.
- Hero: "The forge on Bitcoin Cash" — BCH-green accent, matched serif hierarchy.
- New "See the source. Verify the deploy." section — three cards for the repo,
auth-proxy, and PROTOCOL.md; below that a docker-compose run-your-own recipe
with git clone + cp .env.example + docker compose up.
- Pantheon and Verify-against-the-chain sections mirror Sirius.X's structure so
the seven .x pillars feel like one product.
- Browse repos link fixed to be absolute (https://code.silentmode.st/explore/repos)
so it works through navigate.st gateway too, not just BCNR-aware browsers.
hephaestus/index.html inlines its own nav CSS instead of loading shared.css,
so the injected logo SVG had no size rule and rendered at 300x150, pushing
the brand onto its own row. Added the three .logo rules to its inline style.
tools/ and releases/ were parked during the 0.3.18 ship; now carry the same
inline logo and Open Graph tags as the rest of the site.
install.ps1 root-cause fix
- Every `& $node ... 2>&1` had been tripping PS 5.1's "$ErrorActionPreference=Stop +
native-command stderr = terminating error" quirk. Trap-and-log added in 0.1.1 EXPOSED
the bug (0.1.0 died at the exact same line -- silently). 0.1.2 routes both node calls
through a new Invoke-NodeCapture helper that uses Start-Process
-RedirectStandardOutput/Error to file, so PS 5.1 never touches the streams.
Multi-source TLD cascade with on-disk cache
- -Indexer now accepts a comma-separated list; default "https://navigate.st,https://silentmode.st".
- Cascade (first hit wins): indexer[s] HTTPS -> local cache
(C:\ProgramData\Ariadne\tlds-cache.json) -> electrum WSS (fetchTldList / legacy
fetchBcnrTlds) -> bundled ariadne.config.json snapshot -> bootstrap [bch].
- Authoritative fetches (indexer or electrum) refresh the cache. Second install on a
machine that has ever succeeded before is instant + always works offline.
- Per-source deadlines kept tight (5s for indexer HTTPS) so a slow source can't stall
the install.
Upgrade over live install
- .iss CurStepChanged(ssInstall) stops "BNS Resolver Daemon" + "BNS Sia Bridge" via
schtasks + 1.5s pause before file replacement. Fixes "DeleteFile failed; code 5.
Access is denied" on runtime\node.exe when upgrading a machine where the daemon is
currently running.
CA import
- Switched Import-Certificate -CertStoreLocation Cert:\... to direct X509Store('Root',
'LocalMachine').Add(). Cert: PSDrive is not always loaded in -NoProfile elevated
shells, which had broken the standalone unblock scripts.
Verified end-to-end on this box: silent install -> exit 0, clean install.log,
BNS Resolver Daemon running, 127.0.0.1:53 open, 9 NRPT rules (all TLDs including .bch),
coinspectrum.bch resolves system-wide, tlds-cache.json populated.
Deployed
- dl.silentmode.st/AriadneResolver-Setup-0.1.2.exe
- s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.2.exe
- silentmode.st + navigate.st/bns/silentmode.bch manifests advertise 0.1.2
- sha256 5a2c9e4f3c5e1a162008641019f5ffc35968751c0440f94d3c5fe67aafb8cc5e
Local Dev <noreply@localhost>
Bookmarks (A1). ⭐ button in the address row toggles the current URL;
long-press opens the list; a Your-bookmarks section appears above Featured
on the start page. Storage in filesDir/bookmarks.json, plain JSON,
most-recent first.
Undo close tab (A2). Floating pill "Tab closed · UNDO" for 5s after any
closeTab; tap UNDO → reopen in a new tab.
Long-press link menu (A3). WebView.HitTestResult drives an Open in new tab
/ Copy link / Share link sheet; no JavaScript injection.
Downloads (A5). WebView.setDownloadListener wired to Android's system
DownloadManager. Files land in the public Downloads dir with the platform
notification. URLUtil.guessFileName picks the name.
Pull-to-refresh (A4). New PullWebView subclasses WebView with hand-rolled
overscroll detection; a gold chip fades in (pull to reload → release to
reload) as the user drags. No AndroidX SwipeRefreshLayout dependency.
Share-target intent (A6). Manifest gains SEND text/plain and VIEW
http/https filters. urlFromIntent() feeds the payload through newTab (which
inherits navigateTo's .bch shortcut and .bch.bch collapse from 0.12).
Address bar polish (B2/B3/B5). Idle display strips https:// + trailing /
(focus regains restore the full URL, select-all). Long-press copies. A
compound-drawable ic_close × appears while focused + non-empty; tap clears.
Branded splash (E1). New SplashTheme + splash_background paint the Ariadne
mark on #0B0F1A during cold start; MainActivity.onCreate swaps to
AriadneTheme before layout.
Build: d8 classes.dex step ran over Windows's 32k command-line limit; now
Push-Locations into build/classes and passes relative paths.
Release: ariadne-v0.14.apk sha256
0deace437ccde7709cd21486c9b7b37b2a57463cead79b75672d974d3e5b11b0
site/releases-manifest.json bumped. Steps in RELEASE-HANDOFF-v0.14.md.
Start page grows a Theseus-style hero: big Ariadne mark, tagline, search
input that navigates the tab. Section header separates hero from the
featured-card grid. New ariadne-search:// scheme handled in
MainActivity.handleChoice routes submissions through navigateTo (so it
inherits the .bch shortcut and .bch.bch collapse from 0.12).
Tab strip auto-hides while there's only one tab — Chrome pattern, reclaims
~44dp of top chrome for the common case. A compact tab-count button now
lives in the address row (always visible, gold when many tabs), tapping it
opens a lightweight tab switcher (title + active-mark + New tab item).
Address bar polish: 15px → 16sp text, focus outline in gold via
StateListDrawable, slightly taller padding (48dp touch target).
Bottom navbar: ⟳ reload → ⌂ home (the actually-missing action); Reload
moves into the overflow ⋮ menu as the first item.
Motion: 150ms alpha crossfade on tab switch; :active card scale on the
start page.
Release: ariadne-v0.13.apk sha256
aab1f1e1aa4654c6d2d21ee09e3067d8344697609900d6ccdbd082af95dc9ddc
site/releases-manifest.json bumped. Steps in RELEASE-HANDOFF-v0.13.md.
Fixes the compounding-suffix bug (cards linked to hello.bch.bch, then
hello.bch.bch.bch on subsequent loads): the bundled BNS index stores names
TLD-qualified (hello.bch), so the card generator no longer appends '.bch'
a second time. Featured hero lookup is now TLD-agnostic (matches by
label). navigateTo defensively collapses repeated TLD suffixes so old
bookmarks and any address-bar text with .bch.bch survive gracefully.
Start page redesigned to match TheseusNavigator/home.html: provenance
badges (on-chain / sia / server / proxy / redirect / registry), editorial
one-liner descriptions on hero cards, acid-accent .tld suffix, richer
typography.
Auto-update: on launch the app polls dl.silentmode.st/releases-manifest.json,
finds the ariadne-android entry, shows a chip when newer, silently prefetches
the APK to filesDir/updates/, verifies SHA-256 against the manifest, then
offers a one-tap Install prompt via a plain-Java UpdateFileProvider (no
AndroidX). Hash mismatch deletes the file and reports the failure — never
spawns the installer on a truncated payload (per hash-verify rule in
CLAUDE.md).
New: UpdateInstaller, UpdateFileProvider. UpdateCheck now returns filename +
sha256 + changelog. AndroidManifest: REQUEST_INSTALL_PACKAGES + provider.
Release: ariadne-v0.12.apk sha256
89c4cc28d068d2f6962a9788bf671c6f017f27fb8502f3beef8312eb7d7924f4
site/releases-manifest.json bumped. Steps in RELEASE-HANDOFF-v0.12.md.
Every outbound request now advertises the Google Chrome brand in the
sec-ch-ua client-hint family alongside Chromium — same technique Brave,
Vivaldi and Opera use to stay off Cloudflare Bot Fight Mode's naughty
list. Fixes whybitcoincash.com and every other CF-fronted site that was
returning 503 to Theseus while curl got 200. Values come from
process.versions.chrome so nothing straddles.
Installer: 6dd510184a3c1488ac93b7fd0194ddd239fe4e31083705afcc3c7bde0f530107
Portable: 346be24804db0d8a00cd76a2c89cd3bd2b9af17e5505b25ec326f30c3ceec6ad
Toolbar drag handle clamps to a 30% share floor for both the address
bar and the search bar; search min-width bumped to 180px so the
'Search' placeholder always fits; 10px margin between the search bar
and the trailing dock.
Bookmark brand-case for .x names now uses a canonical map so all-caps
sources come out correctly: SILENTMODE.X → SilentMode.X,
silentmode.x → SilentMode.X, GAME.X → Game.X, coinspectrum.x →
CoinSpectrum.X.
Installer: 678a598c52cf3e86686241633d99cf49bcbc6509d893a93af4ba3336712e5e23
Portable: 718ce35606cb15e6a3333704f1b4e0999e488048eb2c4f1bbff2896ffcc7124c
theseus.x → Theseus.X, deviant.x → Deviant.X, sirius.x → Sirius.X.
Already-all-caps names (GAME.X, SILENTMODE.X) keep their form.
Non-.x titles untouched. Applied after the descriptor trim from
0.3.41 so a saved 'theseus.x — the browser…' also comes out
'Theseus.X'.
Installer: 65d467c4b065b5726f33fc7fe7c0626d0d4289eecbfadae5d3625bdf1adf2ec3
Portable: 4466de982c29d7f4028be2d8e9fd9956714ff1a27b2aff8f4cc80f03f84c4a7c
Right-click on a tab no longer opens a DOM menu that grows the chrome
view. New IPC 'tab-context-menu-popup' builds an OS-native Menu (same
pattern the add-on dock dropdowns use) and pops it at the click point,
floating above every WebContentsView — no layout change, no gap
between the toolbar and the tab body.
Bookmark chips now a uniform 150 × 28 px cell, 12.5 px text, 14 px
favicon. Chip labels trim descriptors after a whitespace-flanked
em/en-dash/hyphen: 'GAME.X — Bitcoin Cash game platform' renders as
'GAME.X'. Full title stays on hover. 'Foo-Bar' comes through intact.
Installer: 22cff863ee44e6bdc17c612f0b7a37dc855328985b1bc564bd730867326a9892
Portable: ef1931dee9f0bee9d4ac0d4a4c014788da18a267297763d9d2a1c5515156ad03
install-update-now now spawns setup with ['/S', '--force-run'] so
Theseus comes back on its own after the silent install completes.
The 0.3.31 rewrite had dropped --force-run under the (correct)
observation that /S alone installs cleanly on our NSIS config; the
user reported the missing post-install relaunch after the
0.3.37 → 0.3.39 auto-update went smoothly but left them looking for
the Start-menu shortcut. --force-run is electron-builder's convention
for auto-launching the app after silent install and puts the flow
back to feel like a one-click restart.
Installer: 8ebde5f307995a364283234078db9e66bc770dcd8f3c559513be1200ea0e8d56
Portable: d14e4cbd8f2e8202f9842c7b7d8e60aa2eb5fe6c57bec1d4f7ffdeef79592331
Bundled release covering three improvements from this session:
DevTools dock — new Settings > General > Developer tools with
three radio choices: Bottom panel (default, Chrome-style), Right
sidebar, Two sidebars. F12 handler reads settings.devToolsDock on
each open so the choice applies instantly.
Scrollbars — every scroll surface Theseus owns (tabs, chrome,
sidebar, popovers, add-on panels) uses a subtle neutral-grey track
and a BCH-green #0AC18E thumb. Modern scrollbar-color on <html>
plus ::-webkit- overrides for width, radius and hover.
captureTab full-page — before Page.captureScreenshot the code now
runs Emulation.setDeviceMetricsOverride to widen the viewport to
the window's content width, so an open sidebar can't clip the
screenshot. Restores metrics in finally.
Installer: c95019b4d3f2a386816caa5323e9aa2de68919d2419367b926eecd93f97c278c
Portable: ed4eb27cdf539d85cf36373744ef9a41510dc2035541a7bf7445f074c6688579
Two independent drag handles replaced with ONE between the URL bar
and the search bar. Zero-sum: bigger URL bar = smaller search bar,
and vice versa. Fixed items (nav, Downloads, extension dock, ⛓ logo)
stay put — .urlwrap + .bardrag + .searchbox now share a .urlsearch
flex container between them, so the drag never displaces anything
outside it.
Verified via static render in the browser pane:
url=default → 60/40 split (533 / 317 px at 1280 total)
url=700px → search shrinks to 157px
url=300px → search grows to 539px
narrow window (data-responsive=1+) → search bar + drag handle
both display:none, URL bar grows to fill
Installer: 0b44b6175a286b6bf7710000a60f54d28e2c3ce061dc852f366f1011ac786d05
Portable: 3599d3df7a0d8a3c8df1f34ab777068c3ef400ca1b88cfdaff6e41a7964730c3
New sidebar tab between Privacy and Extensions groups the two long
system-scoped cards that used to live at the bottom of General:
- Ariadne's Thread (system-wide resolver, install / update / on-off)
- Aegis (built-in wallet, OTA-updated)
General now stops at the collision-policy block. Plug-ins clusters
components that live alongside Theseus with their own lifecycle
controls, which is what those two already are — the shape was hiding
inside a general-purpose bucket.
Ariadne status re-polls on every tab visit (avoids stale "checking…"
after a background poll finished while another section was open).
Aegis card loads on page-init and its "Check for updates" button
stays user-initiated — we don't want a network request every time
the user opens the tab.
Installer: 48a46e503af63d2c6867d4fce9069aae07433e5eb4560d14687e196a6622c55e
Portable: 0525a5a4b6e7f2fc6f53fe005aafaafe783d20cb6db08a97fea9ae68ef520969
Version bump only, no code changes. Published to prove the just-shipped
0.3.34 install can auto-update itself using the reverted-to ["/S"]
spawn code.
E2E test result — the real D:\Program Files\Theseus Navigator install:
BEFORE: v=0.3.34, hash e59d6da2..., mtime 09/08 22:02:46
AFTER: v=0.3.35, hash 420b7320..., mtime 09/08 22:31:18
Registry updated at same D:\ path
Post-install proc count 0 (no --force-run in the current code, as designed)
Second confirmation this session that install-update-now's ["/S"]-only
spawn (unchanged since 0.3.1) does the right thing against a real
install at a path with spaces.
Installer: 4a7bd82f30a00a6795670d0a48cf590832fd077d84726966d8fbea04fc23be1b
Portable: 138c03ad21cb6fb2a6a7f89cc726adee618622c11eb58177857fa24afa955e47
Same content as the 0.3.31 rewrite, published under 0.3.34 so existing
0.3.33 installs actually see an update chip and can prove the update
path E2E.
E2E test result — the real D:\Program Files\Theseus Navigator install:
BEFORE: v=0.3.33, hash 312cd15b..., mtime 09/08 19:53:04
AFTER: v=0.3.34, hash e59d6da2..., mtime 09/08 22:02:46
Registry updated to point at same D:\ path
Auto-launched via --force-run (23 procs)
Confirms: the earlier "silent no-op" observations were transient
(most likely stale APP_GUID mutex from an orphaned setup process),
not a systemic bug. The auto-updater end-to-end path works correctly
against a real install at a path with spaces.
Installer: 50e1c97dc80c0a19f94a3489abeea30d220d4619959671eedabca796d36c4477
Portable: a75fa06af0d22c936d0ecf74a60b8d71ddc065b38a9df130be5850d75532165a
Same 0.3.31 version, new binary. Rewrites the shipped 0.3.31 with:
- light-mode chrome strip retuned to soft neutral grey
- bookmark chips shrunk to 130px + draggable to reorder
- light-mode Tor + Theseus (⛓ logo) chips from illegible dark navy
to #eef1f5 with dark ink
- updater hash-verifies downloaded setup .exe against manifest
before arming Install (catches truncated payloads Electron
silently reports as "completed")
- install-update-now spawn flags left at /S alone — the D:\Program
Files silent-no-op symptom is not addressed by any flag combo
Existing 0.3.31 installs won't see an update chip (version compare
returns false). Fresh downloads from dl.silentmode.st get the new
binary. 0.3.32-0.3.34 binaries + manifest entries stay deleted from
the previous revert.
Installer: cc6459665539f0524659b91863548b2cbbb5c9494609b06bd8696267bee1b7c7
Portable: 6e59ede8060fb4d163ba921a99e0f10bc70570da4da58d2da9e7af5093c1c21a
Bundled revert of six commits:
9bacdcb Ship 0.3.34
aef7864 0.3.34 UI (grey chrome, DnD bookmarks, chip colors)
c2da8bb Ship 0.3.33
9b92224 fix(updater) verify SHA-256
4e932e0 Ship 0.3.32
4e695c4 fix(updater) --updated flag
Reason: the real-install E2E test (turn N-1) showed silent update
against the user's custom D:\Program Files\Theseus Navigator location
returns exit 0 without upgrading anything — every flag combination
tried (/S alone, --updated /S --force-run, /S /currentuser,
/S /D=<install>) exits successfully and no files change. The 0.3.32
flag fix and 0.3.33 hash-verify fix were defensive improvements but
did not address the actual "browser vanished" symptom, and 0.3.34
inherits the same broken silent-update path so its UI improvements
never reach anyone still on 0.3.33+ with a non-default install path.
Rolling manifest back to 0.3.31 so the update chip stops appearing on
installs that can't complete the update. Users on the default
%LOCALAPPDATA%\Programs\theseus-navigator location are unaffected —
0.3.31 is still their canonical shipped version.
package.json reset to 0.3.31 explicitly (git revert stopped one bump
short on the merged diff).
Screenshot 0.3.0 (8ca5ac3) preserved — unrelated parallel work.
Chrome strip retuned in light mode: --bg #e6e8ec, inactive tab
#f2f4f7, active tab #ffffff. Flat white tabs disappeared into light
Windows title bars; the current-tab pop is preserved.
Bookmark chips: 130px max-width, 11px text, 12px favicon, 22px row.
~40% more saved pages fit. Drag-reorder chips with left/right-half
convention matching the tab strip; new bookmark-move IPC splices the
list, missing entries and self-drops are no-ops.
Tor + Theseus (⛓ logo) chips in light mode: from illegible
white-on-#253A49 (at 12-13px) to #eef1f5 with #253A49 ink.
.tor.connecting/.on keep amber/purple hue in light fills.
First release that will also E2E-test 0.3.33's SHA-256 verify: a
running 0.3.33 discovering 0.3.34 will hash-check the fetched .exe
against this manifest before arming Install.
Installer: 2cccaa5ec5eb94fd14fca383f54539109beba00aa727cfded4389123697e1dbe
Portable: 3d196863e2ba9ec9925859700de6f984a47ff54a5d06e28bbe4d309e91701e29
Companion to 0.3.32's --updated /S --force-run flag fix. Closes the
download-side of the same "browser vanished after auto-update" class:
The in-app updater's DownloadItem `done` handler marked
updateDownloadState="ready" on any completed state, no hash check
against the manifest. If the download completed short (bad
Content-Length, CDN cache truncation, mid-stream TLS reset the
runtime swallowed as "completed"), install-update-now spawned half
a setup binary — NSIS integrity check failed silently, uninstaller
had already wiped the app, and Theseus was gone.
Now the completion handler streams the saved file through
crypto.createHash("sha256"), compares to updateAvailable.setupHash
from the manifest (already captured in checkForUpdate), refuses to
arm install on mismatch, deletes the corrupt file, and marks the
fetch failed so the next check picks up a fresh copy. Same paranoid
pattern the Ariadne addon updater has used all along.
Installer: fa51ccdfee0cdd0356eae356a16d07213781d2a660d12ac10117b5c9b7e023b5
Portable: 1b44ac282b4b3313ceb0e1d898d596999cf4b04368d501573510d1a7236a68d9
Escapes the 0.3.31 update-loop bug: the in-app updater ran the NSIS
setup with just /S, which on our oneClick:false + perMachine:false
+ allowToChangeInstallationDirectory:true config silently ran the
uninstaller (wiping the install dir and the registry install-path
entry) and then bailed out of the wizard install phase for lack of
UI to pick a target dir. Browser disappeared with nothing to click
on next boot.
0.3.32 spawns setup with --updated /S --force-run — electron-builder's
auto-update-mode signal to reuse the registry install path and skip
the uninstaller rerun.
Users stuck on 0.3.31 have to manually download 0.3.32 from
dl.silentmode.st to break out; %APPDATA%\theseus-navigator\ (vault,
addons, settings) survived the uninstall untouched.
Installer: 1f81fc45e5faf104e9a3630d97b1ea23098e80c63c9101be1a1fe53cd054a31a
Portable: 34a550631a978e084f3d1875215c1ea0e65c5d75ed5fad123753b81a76a2990e
