Theseus Extensions

Signed over-the-air update endpoint for Theseus's bundled add-ons. Every entry is Ed25519-signed by the Silent Mode operator, verified on the device before install. No cert authority, no app-store gatekeeper.

Available extensions

What ships inside Theseus today. Versions and hashes on this page are read from each add-on's signed updates.json when the page loads, so they match what the browser would install. First-party components show up under Settings › Plug-ins in Theseus, everything else under Settings › Extensions.

🛡️ Aegis current 0.6.21

Multi-chain wallet (BCH, BTC, TRX, ETH, SOL, SC, DGB) derived from your Theseus vault, with a dApp bridge for the pages you visit. Bundled; updates over this signed channel and through the panel's own "Stage → Restart" flow.
Plug-in · Settings › Plug-ins ·
Signed update manifest — SHA-256 verified before install
updates.jsontheseus.x/extensions/aegis/updates.json
Tarballaegis-0.6.21.tar.gz
sha256—

📸 Screenshot current 0.6.5

Capture the current tab — visible viewport, entire scrollable page, or a rectangle you draw. The capture opens in a full-tab editor: crop, annotate, line tool, resizable text, redact, save.
Extension · Settings › Extensions ·
Signed update manifest — SHA-256 verified before install
updates.jsontheseus.x/extensions/screenshot/updates.json
Tarballscreenshot-0.6.5.tar.gz
sha25687ae730d329ff9f552bbf513efba19bd14bb016bb90e24f7b62868434dadda60

📝 Notepad bundled 0.1.0

Right-sidebar notes. Text lives on this machine only and autosaves as you type.
Extension · Settings › Extensions · no update channel yet — ships with each Theseus release.
Installing something else. An extension is a folder with an addon.json. Drop it into the extensions directory (Settings › Extensions › Open extensions folder), press Reload, and it is live. Extensions run with full app access — treat one like an unsigned executable and load only what you trust.

How updates work

Same mechanism a Firefox XPI update uses, cut down to what a name-native browser needs.

  1. Every 30 seconds after boot Theseus fetches updates.json for each installed add-on that declares an updateURL in its manifest.
  2. Each entry carries an Ed25519 signature over silentmode.addon-update-v1|<id>|<version>|<sha256>. Theseus verifies against a small set of operator public keys baked into the build. Unsigned or badly-signed entries are dropped silently.
  3. If a signed version beats what's installed, Theseus downloads the tarball, re-checks its sha256, and stages the new copy under <userData>/addons-updates-staged/<id>-<version>/.
  4. On the next Theseus launch, promoteStagedUpdates moves the staged copy into addons/<id>/. Any prior copy is renamed to addons-backups/<id>-<oldver>-<timestamp>/ so hand-edits survive.
  5. Settings › Extensions has a Check for updates button and shows what is staged; first-party plug-ins (Aegis) can also stage and restart from their own panel.

Operator key

The Ed25519 public key baked into Theseus 0.3.19+. Rotation is by adding a new pubkey and shipping a Theseus release that carries both, then a follow-up release removing the old — during the overlap, entries can be signed by either.

732b1263a236b0030383a2376597cfa43c3624b3ca2912a46134f8f2a06e6012

Generated 2026-09-07. Held offline by the Silent Mode operator.

Roadmap

The endpoint is generic — any bundled add-on can advertise an updateURL. Concrete next-steps: