The top nav was a mix of anchor links (#what, #features, #verify) and
site tabs (/plug-ins/, /extensions/). Sub-pages dropped the anchor-only
items, so the header visibly reshuffled between pages — clicking a tab
looked like a partial page break, not a navigation.
Top nav is now the same five items on every page: brand → Theseus.X,
Home / Plug-ins / Extensions / sirius.x / Get Theseus. Section anchors
moved to a fixed left sidebar (position: fixed, sits outside the
centered content column, hidden below 1180-1200px). IntersectionObserver
highlights the current section in acid green as the reader scrolls.
Sub-pages get their own left sidebar for the sections they actually
contain (Plug-ins: 3; Extensions: 6), so the pattern is consistent
across the site instead of home-only.
Brand text bumped to capital T + capital X.
Anyone who owns a BCDN name can now publish a Theseus extension, and every
Theseus can install it with the publisher's signature verified locally.
Gateway (Argus/src/gateway/public-gateway.mjs):
PUT /api/ext/<name>/<id>/<version> takes the gzipped tar, checks two BCH
message signatures against the name's current NFT owner (one authorises
the upload, one is stored in the channel), inspects the package
(addon.json at the root, id/version/main match, 8 MB cap), enforces
first-publisher ownership of an id and monotonic versions, and writes the
tarball, the extension's updates.json and community/catalog.json to Sia.
GET /api/ext/catalog reads the catalog back with CORS.
Theseus:
lib/publisher-sig.mjs recovers the signer of a channel entry; main.js
compares it with the publisher name's owner from Theseus's own chain
index before installing or updating, so neither the relay nor a tampered
catalog can pass off code under a trusted name. addon-updater.js gains
installCommunity() and accepts publisher-signed entries in the regular
update check (operator Ed25519 entries unchanged). Settings › Extensions
shows the community catalog with Install / Update; Settings › Plug-ins
links to theseus.x/plug-ins.
theseus.x:
/plug-ins/ is a separate page for the first-party plug-ins (Aegis,
Ariadne's Thread) with live versions and hashes; /extensions/ lists the
bundled extensions, the community catalog, and how to build and publish;
/extensions/publish/ signs and uploads a package in the browser with the
wallet that holds the publisher's name (session helper + wallet bundle
copied alongside).
- Address bar: the chrome view keeps document.activeElement on the URL
input after the user clicks into the page (focus moved to the tab's own
view), and the "don't clobber typed text" guard then froze the bar until
something blurred the field. The guard now requires real focus
(document.hasFocus()), and the field is blurred when the view loses focus.
- Tab strip: rebuilt with innerHTML on every tabs event, which recreated
every favicon <img> — a blink on the other tabs whenever one tab loaded,
reloaded or changed title — and dropped drag state mid-gesture. Elements
are now keyed by tab id (chips by group colour), updated in place, and
moved into order; the strip is never rebuilt.
- Settings › Extensions links to theseus.x/extensions. That page now has a
card per bundled add-on with the current signed version, tarball and
hash read from each add-on's updates.json at load (it still claimed
Screenshot 0.2.4 while the channel serves 0.6.5).
Signed OTA update for the file:// origin fix — this is the first
add-on release that ships without a Theseus release beside it.
Existing 0.3.27 installs will pick 0.2.4 up on the next boot's
30-second poll, or immediately via Settings > Extensions > Check
for updates.
Adds site-theseus-x/extensions/index.html: a public-facing description
of the signed add-on update endpoint (screenshot 0.2.3 currently, more
add-ons as they gain an updateURL). Same visual language as the
theseus.x home page — sticky topnav with the mark, hero, per-extension
cards with the SHA-256 verify block, an operator-key panel, and a
Firefox-XPI-style flow description. Roadmap section flags on-BCNR
pubkey publication and multi-sig as the next security steps.
Content is served from s3://bns/theseus/extensions/index.html; the
Sia autosync mirrors it, so the theseus.x resolver reaches it at
https://navigate.st/bns/theseus.x/extensions/. Landing at
https://theseus.x/extensions on installs whose OS resolver knows the
.x TLD (Ariadne's Thread users, or Theseus's own resolver on internal
navigations).
The specific screenshot 0.2.3 entry it advertises is already live at
https://navigate.st/bns/theseus.x/extensions/screenshot/updates.json;
this page just documents it.
