Every card that has a signed update channel now carries the two
buttons a reader actually needs — "Install in Theseus" (a
theseus://extensions/install/<id> deep link that main.js already
intercepts via will-navigate, popping the native install-consent
dialog and verifying the operator signature before any bytes hit
addons/) and "Download tarball" (direct .tar.gz link for sideloaders
and archivists). A one-line update hint below the buttons points at
the signed updates.json and notes SHA-256 verification, so the whole
install-and-then-update path fits inside the card.
Applies to Screenshot and PDF Editor. Notepad and Translate ship
inside every Theseus build and have no separate channel yet — those
carry a plain "Ships with Theseus — appears under Settings ›
Extensions on first launch" note in the same slot so the layout
stays consistent across bundled entries.
The download hrefs default to the current versioned tarball on the
navigate.st gateway and get rewritten to the newest entry from the
signed updates.json when the fetch succeeds (new data-live="download"
setter on the manifest-fill script) so the button never points at a
stale version.
Cloning the forge repo on Windows and running the suite there turned up two
things a checkout inside the monorepo could never show, because this working
copy has core.autocrlf=false.
Git on Windows defaults to autocrlf=true, so a fresh clone gets CRLF. For
most files that is cosmetic. For shell scripts it is not: install.sh copied
from such a clone onto a server fails with `bash: \r: command not found`,
which tells the person almost nothing about what is wrong. And a
CRLF-rewritten .patch file is no longer the bytes `patch` was given.
.gitattributes now pins eol=lf for the scripts, the container inputs and the
source, and marks *.patch as binary so nothing rewrites it at all.
tools/refresh-patches.sh --check also compares with --strip-trailing-cr, so
a clone made before this landed reports honestly instead of claiming the
patch record has drifted when it has not. A check that cries wolf is a check
somebody switches off.
- Settings > Extensions: the Community list showed an entry even for
extensions already listed above under Installed, so docx-editor
appeared twice as soon as it landed in the gateway catalog. The
render now filters out any catalog item whose id is installed —
the Installed list handles updates via the poll + "Check for
updates" button, so the Community list only needs to surface
things you don't have. Empty-state copy branches on whether the
catalog is empty vs "everything is installed".
- theseus.x/extensions catalog renderer accepts data:image/... icons
in addition to emoji, so an extension whose manifest.icon is an
SVG data URI (pdf-editor, docx-editor) renders as an <img> instead
of the raw URI text.
- Static PDF Editor entry on that page now uses the same inline SVG
badge the browser dock renders.
The extensions page could only hand out tarballs; installing meant going
to Settings › Extensions › Community and finding the entry again. Pages
now get window.bcnr.installExtension(id) and Theseus intercepts
theseus://extensions/install/<id> links (page clicks, target=_blank and
the address bar). The page only names a catalog id: Theseus fetches the
catalog and package itself, asks in a native dialog the page cannot draw
over, verifies the publisher signature against the name's current owner
and activates the add-on — the same path a Settings install takes. One
prompt at a time; an already-installed version says so instead of
offering a no-op update.
The site shows the button inside Theseus (feature-detected on the
bridge), a "update Theseus" hint on older builds and a download hint in
other browsers.
The topnav had both the Theseus.X brand mark and a "Home" link that
went to the same place — clicking either landed on the same page. The
brand mark is universally understood as the home affordance, so the
Home tab was just chrome noise between the mark and Plug-ins. Removed
across the home, Plug-ins and Extensions pages so the tab strip reads
as three distinct destinations instead of two-plus-a-repeat.
Two first-party extensions shipped without ever appearing on the
catalog page. Added:
📄 PDF Editor — bundled, full-tab PDF reader/annotator (highlight,
mark up, reorder/rotate/drop pages, fill forms, save a new copy;
annotations written as real PDF content). Opens from the toolbar
menu and from the "Open PDF in editor" right-click on any link.
📝 Word editor — .docx open/edit/save in a full Theseus tab.
Ribbon-style formatting, tables, lists, images and links;
headers, footers, footnotes, page setup and the document's own
styles are preserved through a round-trip. Listed as a community
extension (Settings › Extensions › Community); channel path
mirrors the addon.json updateURL (extensions/community/docx-editor).
Both cards carry data-ext hooks so the manifest-fill script picks up
version + tarball + sha256 from a signed updates.json when the
channel is published — for now the baked-in 0.1.0 is the fallback.
The IntersectionObserver-based spy only fired when a section entered a
narrow band 40–45% down the viewport. Short sections at the tail of a
page — Operator key and Roadmap on theseus.x/extensions, whatever came
last on the other pages — never made it into that band because the
page runs out of scroll before their top crosses 40%, so their sidebar
links stayed dim no matter how far the reader scrolled.
Rewrote the spy across every page with a sidebar (theseus.x home /
plug-ins / extensions and sirius.x home / tld / theseus / docs / admin
/ brand): it listens to window scroll, picks the last section whose
top has crossed 35% of the viewport, and — when the window is scrolled
to within 4px of the bottom — snaps to the final section regardless of
where its top is. Every link in the rail can now activate.
theseus.x/extensions also had the spy IIFE bundled with the manifest
loader in one <script> block near the middle of the page, so at run
time the parser hadn't yet reached the last three sections and only
Bundled/Community/Build were ever registered. Moved the spy to its own
<script> just before </body> so it sees every section that ships.
The sidebar's body padding-left was pushing the whole page — hero,
cards, footer — to the right of centre, off the axis of the hero
title. Removed the body reserve; the sidebar is now a
pointer-events:none overlay on top of the page. Content wraps back to
the middle of the viewport regardless of sidebar width.
Links float at opacity 0.35 by default so the sidebar reads as chrome
rather than a panel — the section text underneath stays legible. On
hover a link snaps to full opacity, picks up an ink colour and a
subtle blurred backdrop so it doesn't compete with the content. The
active-section link keeps the acid tint at 0.85 and finishes to 1 on
hover. Icon rail and mobile bar unchanged.
Sirius.X: the Theseus tab link in the topnav now reads Theseus.X with
the .X in acid green, matching the naming everywhere else in the
ecosystem.
Sidebar redesign:
- Wide (>1180px): labels only, no icons, no border-left outline, no
background tint on active — just the label going acid green when
the section is in view. Sidebar moved down (+34px top padding) so
the first link doesn't crowd the topnav.
- Medium (720-1180px): icon rail only.
- Mobile (<720px): bottom bar with icons only.
- Background dropped from rgba(.82) to rgba(.42) — the backdrop-blur
already carries the separation, less panel-heavy against the hero.
- "On this page" section header dropped: the sidebar is close enough
to the topnav that the label reads as chrome rather than nav.
- Active state is now colour only (acid on the label); the left
border stripe and highlight background are gone.
Nav path fix (broken link on the silentmode.st mirror):
Root-absolute nav paths like /plug-ins/ resolved to
silentmode.st/plug-ins/ (404) instead of silentmode.st/theseus/plug-ins/
when a reader browsed the fallback mirror. Rewrote every topnav link,
cross-page prose link and favicon href to relative form
(plug-ins/, ../plug-ins/, assets/favicon.svg, …). Works on both the
BCNR name and the silentmode.st/theseus/ mount.
theseus.x, sirius.x and hephaestus.x had a 1px border-bottom under the
sticky/fixed topnav that read as a visible separator between the
navigation and the page. The topnav's own translucent-blur backdrop is
enough of a distinction already — the line is redundant and, on the
theseus.x sidebar layout, made the top of the sidebar look like it was
overhanging the header.
theseus.x tabs also had a "Sirius .X" gap because the topnav <a> is a
flex container and the icon + "Sirius" text + ".X" span were three
flex items with a 6px gap between each. Wrapping the label in one
<span> collapses the gap to a single space between icon and label.
Sidebar border-right and mobile bottom-bar border-top also dropped —
the panel tint carries the boundary; a hard line was too heavy.
Sidebar was drawing above the topnav border line — the sticky topnav
only spanned the content column, so where the sidebar met it a T-shape
break was visible. Topnav is now position:fixed spanning the full page
width, and the sidebar is anchored to var(--tn-h)=52px so it sits
cleanly below the topnav border on all breakpoints.
Also: the sirius.x tab is now capitalised Sirius.X and carries its own
brand mark (the 4-point sparkle from sirius.x's own favicon) so the
tabs read as three named things — Home, Plug-ins, Extensions, Sirius.X
— not one lowercase outlier. A shared .topnav a .g rule paints the .X
suffix acid green.
Sidebar was a small strip in the middle of the page. Now it lives on
the left edge as a proper column, sized to be reachable — 220px full
mode with icon + label per link, on the operator's brand backdrop.
Breakpoints:
>1180px full sidebar, icon + label, "ON THIS PAGE" section header
<=1180px 64px icon rail, labels drop, tooltips on hover
<=720px bottom bar strip, icons only, spans page width
body padding-left carries the sidebar width so the topnav and page
content flow as one column beside the rail — no overlap on any width.
Home has 4 icons (What it is / Features / Download / Verify), Plug-ins
has 3 (Aegis / Ariadne's Thread / vs extensions), Extensions has 6
(Bundled / Community / Build & publish / Updates / Operator key /
Roadmap).
The top nav was a mix of anchor links (#what, #features, #verify) and
site tabs (/plug-ins/, /extensions/). Sub-pages dropped the anchor-only
items, so the header visibly reshuffled between pages — clicking a tab
looked like a partial page break, not a navigation.
Top nav is now the same five items on every page: brand → Theseus.X,
Home / Plug-ins / Extensions / sirius.x / Get Theseus. Section anchors
moved to a fixed left sidebar (position: fixed, sits outside the
centered content column, hidden below 1180-1200px). IntersectionObserver
highlights the current section in acid green as the reader scrolls.
Sub-pages get their own left sidebar for the sections they actually
contain (Plug-ins: 3; Extensions: 6), so the pattern is consistent
across the site instead of home-only.
Brand text bumped to capital T + capital X.
Anyone who owns a BCDN name can now publish a Theseus extension, and every
Theseus can install it with the publisher's signature verified locally.
Gateway (Argus/src/gateway/public-gateway.mjs):
PUT /api/ext/<name>/<id>/<version> takes the gzipped tar, checks two BCH
message signatures against the name's current NFT owner (one authorises
the upload, one is stored in the channel), inspects the package
(addon.json at the root, id/version/main match, 8 MB cap), enforces
first-publisher ownership of an id and monotonic versions, and writes the
tarball, the extension's updates.json and community/catalog.json to Sia.
GET /api/ext/catalog reads the catalog back with CORS.
Theseus:
lib/publisher-sig.mjs recovers the signer of a channel entry; main.js
compares it with the publisher name's owner from Theseus's own chain
index before installing or updating, so neither the relay nor a tampered
catalog can pass off code under a trusted name. addon-updater.js gains
installCommunity() and accepts publisher-signed entries in the regular
update check (operator Ed25519 entries unchanged). Settings › Extensions
shows the community catalog with Install / Update; Settings › Plug-ins
links to theseus.x/plug-ins.
theseus.x:
/plug-ins/ is a separate page for the first-party plug-ins (Aegis,
Ariadne's Thread) with live versions and hashes; /extensions/ lists the
bundled extensions, the community catalog, and how to build and publish;
/extensions/publish/ signs and uploads a package in the browser with the
wallet that holds the publisher's name (session helper + wallet bundle
copied alongside).
- Address bar: the chrome view keeps document.activeElement on the URL
input after the user clicks into the page (focus moved to the tab's own
view), and the "don't clobber typed text" guard then froze the bar until
something blurred the field. The guard now requires real focus
(document.hasFocus()), and the field is blurred when the view loses focus.
- Tab strip: rebuilt with innerHTML on every tabs event, which recreated
every favicon <img> — a blink on the other tabs whenever one tab loaded,
reloaded or changed title — and dropped drag state mid-gesture. Elements
are now keyed by tab id (chips by group colour), updated in place, and
moved into order; the strip is never rebuilt.
- Settings › Extensions links to theseus.x/extensions. That page now has a
card per bundled add-on with the current signed version, tarball and
hash read from each add-on's updates.json at load (it still claimed
Screenshot 0.2.4 while the channel serves 0.6.5).
Signed OTA update for the file:// origin fix — this is the first
add-on release that ships without a Theseus release beside it.
Existing 0.3.27 installs will pick 0.2.4 up on the next boot's
30-second poll, or immediately via Settings > Extensions > Check
for updates.
Adds site-theseus-x/extensions/index.html: a public-facing description
of the signed add-on update endpoint (screenshot 0.2.3 currently, more
add-ons as they gain an updateURL). Same visual language as the
theseus.x home page — sticky topnav with the mark, hero, per-extension
cards with the SHA-256 verify block, an operator-key panel, and a
Firefox-XPI-style flow description. Roadmap section flags on-BCNR
pubkey publication and multi-sig as the next security steps.
Content is served from s3://bns/theseus/extensions/index.html; the
Sia autosync mirrors it, so the theseus.x resolver reaches it at
https://navigate.st/bns/theseus.x/extensions/. Landing at
https://theseus.x/extensions on installs whose OS resolver knows the
.x TLD (Ariadne's Thread users, or Theseus's own resolver on internal
navigations).
The specific screenshot 0.2.3 entry it advertises is already live at
https://navigate.st/bns/theseus.x/extensions/screenshot/updates.json;
this page just documents it.
