theseus-site/index.html
Local Dev 33de2b009f Ship Theseus 0.3.18 b751b5de (add-on updates land + signed endpoint + tab-flash + screenshot fix + Ariadne installer)
Setup    b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54
Portable 8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7

Five theseus fixes since 0.3.16:

e90062a - Bundled add-on updates now actually land. seedBundledAddons()
previously copied a bundled add-on only when its target folder was
missing, so the 0.3.14 screenshot editor never reached machines that
already had an older screenshot/ folder from a previous run — Theseus
quietly kept using the stale copy. The seeder now compares bundled and
on-disk addon.json versions and reseeds with a timestamped backup
under <userData>/addons-backups/<id>-<oldver>-<timestamp>/.

ecfd481 + 6117429 - Signed add-on update endpoint, à la Firefox XPI.
An add-on can now advertise an updateURL in its addon.json and be
republished at any time without waiting for a Theseus release. The
client fetches, verifies an Ed25519 signature over
"silentmode.addon-update-v1|<id>|<version>|<tarball-sha256>",
downloads the tarball, verifies the hash, and stages the new copy
under <userData>/addons-updates-staged/ for promotion on next launch.
Dormant in this build — the shipped addon-update-pubkeys.js is empty,
so checkAndStageUpdates() short-circuits and makes no outbound
requests; the feature activates when an operator ceremonies a key in
and ships a follow-up release with the pubkey baked in. Operator
tooling in scripts/generate-update-keypair.mjs and
scripts/sign-addon-update.mjs; full brief in docs/ADDON-UPDATES.md.
End-to-end verified against a local HTTP server: sign, serve, fetch,
verify, download, extract, stage, promote, backup — plus signature
tamper, wrong pubkey, sha256 tamper, and empty-pubkey short-circuit
all rejected as expected. 15/15 checks pass.

bfe5132 - Tab-switch flash is gone. Two independent causes: (a) tab
views were created without an explicit background color, so the first
frame after setVisible(true) showed whatever was underneath the view
until the page painted; a solid theme-tracking ground fills the gap.
(b) setActive iterated tabs in list order, so if the outgoing tab
came before the incoming in the array, the loop hid the outgoing
first and left one frame where no tab was visible; the incoming is
now shown before any hides.

a5a667d - Screenshot toolbar-menu captures no longer come out blank.
The click handler dispatched capture synchronously while the native
Menu.popup window was still on top, marking the tab view occluded and
letting WebContents.capturePage() snapshot a stale/empty compositor
frame at the correct dimensions (which the existing 0x0 retry
couldn't detect). Dispatch now runs from the popup's close callback
after a 120ms settle so the parent window is foreground and the
compositor is live at capture time.

a5a667d also - Ariadne — Install / Update / Uninstall alongside Turn
on / off. The Ariadne toggle card in Settings > Registries grows
three lifecycle actions. Install and Update run the bundled
AriadneResolver-Setup-<ver>.exe silently and elevated (/VERYSILENT
/SUPPRESSMSGBOXES /NORESTART — one UAC prompt, no wizard); Update is
only visible when the bundled version is newer than what's installed.
Uninstall reads Inno's QuietUninstallString from HKLM registry and
runs it elevated. Status surfaces installed version + bundled version
so the user can see what's on disk vs what would land next; buttons
disable during work and refresh after both success and failure so the
UI never lies.

Deployed. Verified LIVE 0.3.18.
2026-09-07 23:50:52 +02:00

296 lines
15 KiB
HTML

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>theseus.x — the browser that speaks Bitcoin Cash names</title>
<meta name="description" content="Theseus Navigator: a Chromium-based browser with native Bitcoin Cash name resolution built in. No OS-level daemon, no DNS shim, no root-store install. Windows + Android.">
<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
<link rel="mask-icon" href="/assets/favicon.svg" color="#d6ff3d">
<meta property="og:type" content="website">
<meta property="og:site_name" content="theseus.x">
<meta property="og:title" content="theseus.x — the browser that speaks Bitcoin Cash names">
<meta property="og:description" content="Native .bch / BCNR resolution in a Chromium browser. No daemon, no root-store install. Windows + Android.">
<meta property="og:url" content="https://theseus.x/">
<meta property="og:image" content="https://theseus.x/assets/logo.svg">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="theseus.x — the browser that speaks Bitcoin Cash names">
<meta name="twitter:description" content="Native BCNR resolution in a Chromium browser. No daemon, no root-store install.">
<style>
:root{
--bg:#0b0e14; --panel:#141a24; --panel2:#18202c; --line:rgba(255,255,255,.09);
--ink:#e7eaf1; --mut:#8b98a9; --dim:#5e6678; --acid:#d6ff3d;
--chain:#d6ff3d; --sia:#b39ddb; --srv:#4fd1a5; --ok:#4fd1a5; --warn:#ffc75f;
}
*{box-sizing:border-box}
html{scroll-behavior:smooth}
body{margin:0;background:radial-gradient(1100px 560px at 50% -12%,#16202e,var(--bg));
color:var(--ink);font:16px/1.65 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;min-height:100vh}
a{color:var(--acid)}
.wrap{max-width:980px;margin:0 auto;padding:0 1.2rem}
.topnav{position:sticky;top:0;z-index:20;display:flex;gap:2px;align-items:center;flex-wrap:wrap;
padding:10px 1.2rem;background:rgba(11,14,20,.82);backdrop-filter:blur(10px);
border-bottom:1px solid var(--line)}
.topnav .brand{font-weight:600;color:var(--ink);text-decoration:none;margin-right:14px;font-size:15px;letter-spacing:.2px;display:flex;align-items:center;gap:8px}
.topnav .brand .g{color:var(--acid)}
.topnav .brand svg{width:20px;height:20px}
.topnav a{color:var(--mut);text-decoration:none;padding:6px 12px;border-radius:8px;font-size:14px}
.topnav a:hover{color:var(--ink);background:var(--panel)}
.topnav a.here{color:var(--acid);background:rgba(214,255,61,.08)}
.topnav a.get{margin-left:auto;background:rgba(214,255,61,.10);color:var(--acid);font-weight:500}
.topnav a.get:hover{background:rgba(214,255,61,.18)}
header.hero{text-align:center;padding:5rem 1.2rem 1.5rem}
.mark{display:inline-block}
.mark svg{width:80px;height:80px;filter:drop-shadow(0 4px 24px rgba(214,255,61,.18))}
h1{font-size:clamp(2rem,5.5vw,2.9rem);margin:.9rem 0 .3rem;letter-spacing:-.5px}
h1 .g{color:var(--acid)}
.tag{color:var(--mut);font-size:1.05rem;max-width:660px;margin:0 auto}
.cta{margin-top:1.8rem;display:flex;gap:10px;justify-content:center;flex-wrap:wrap}
.btn{display:inline-block;text-decoration:none;padding:11px 20px;border-radius:10px;background:#4b7bec;color:#fff;font-size:14px;border:none;cursor:pointer;font-family:inherit;transition:filter .1s}
.btn.ghost{background:transparent;border:1px solid var(--line);color:var(--ink)}
.btn.acid{background:var(--acid);color:#0b0e14;font-weight:600}
.btn:hover{filter:brightness(1.12)}
section{padding:2.6rem 0;border-top:1px solid var(--line);margin-top:2.5rem}
section:first-of-type{border-top:none;margin-top:1.5rem}
h2{font-size:1.5rem;margin:0 0 .4rem}
h3{font-size:1.1rem;margin:0 0 .35rem}
.lede{color:var(--mut);margin:0 0 1.6rem;max-width:720px}
.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:14px}
.card{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:18px 20px}
.card h3{margin:0 0 .5rem;display:flex;align-items:center;gap:8px}
.card p{margin:0;color:var(--mut);font-size:14px}
.dot{width:9px;height:9px;border-radius:50%;display:inline-block;flex:none}
.d-chain{background:var(--chain)} .d-sia{background:var(--sia)} .d-srv{background:var(--srv)}
.note{background:var(--panel);border:1px solid var(--line);border-left:3px solid var(--acid);
border-radius:10px;padding:14px 18px;color:var(--mut);font-size:14px;margin-top:1.4rem}
.note.warn{border-left-color:var(--warn)}
.note b{color:var(--ink)}
code,.mono{background:#0e131b;border:1px solid var(--line);border-radius:6px;padding:1px 6px;font-family:ui-monospace,monospace;font-size:13px}
pre{background:#0e131b;border:1px solid var(--line);border-radius:10px;padding:12px 14px;overflow-x:auto;
font-family:ui-monospace,monospace;font-size:12.5px;color:var(--ink);margin:.8rem 0}
/* Downloads: platform cards */
.plats{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-top:1rem}
@media (max-width:720px){.plats{grid-template-columns:1fr}}
.plat{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:20px 22px}
.plat .lbl{color:var(--acid);font:600 11px/1 system-ui;letter-spacing:.22em;text-transform:uppercase}
.plat h3{margin:.4rem 0 .3rem;font-size:1.15rem}
.plat p{margin:0;color:var(--mut);font-size:13.5px}
.plat .meta{color:var(--dim);font-size:12px;margin-top:.6rem}
.plat .btns{margin-top:.9rem;display:flex;gap:8px;flex-wrap:wrap}
.plat .btns .btn{padding:9px 16px;font-size:13.5px}
.plat .hashes{margin-top:.9rem;padding-top:.7rem;border-top:1px solid var(--line);font-size:11.5px;color:var(--dim)}
.plat .hashes .h{display:flex;gap:8px;flex-wrap:wrap;align-items:baseline;margin-top:4px}
.plat .hashes .h b{color:var(--mut);font-weight:600;min-width:70px}
.plat .hashes code{font-family:ui-monospace,monospace;font-size:10.5px;color:#c9d4e3;word-break:break-all;background:transparent;border:none;padding:0}
footer{color:var(--dim);font-size:12.5px;margin:3rem 0 2rem;text-align:center}
footer a{color:var(--mut)}
</style>
</head>
<body>
<nav class="topnav">
<a class="brand" href="/">
<svg viewBox="0 0 64 64" aria-hidden="true">
<rect width="64" height="64" rx="12" fill="#0b0e14"/>
<path d="M32 6 L38 32 L26 32 Z" fill="#e04e4e"/>
<path d="M38 32 L32 58 L26 32 Z" fill="#d6ff3d"/>
<path d="M6 32 L32 27 L58 32 L32 37 Z" fill="#d6ff3d" opacity=".55"/>
<circle cx="32" cy="32" r="3" fill="#0b0e14"/>
</svg>
<span>theseus<span class="g">.x</span></span>
</a>
<a href="#what">What it is</a>
<a href="#features">Features</a>
<a href="#download">Download</a>
<a href="#verify">Verify</a>
<a href="https://sirius.x/" title="Register a BCNR name">sirius.x</a>
<a class="get" href="#download">Get Theseus</a>
</nav>
<header class="hero">
<div class="mark">
<svg viewBox="0 0 64 64" aria-hidden="true">
<rect width="64" height="64" rx="12" fill="#0b0e14"/>
<path d="M32 6 L38 32 L26 32 Z" fill="#e04e4e"/>
<path d="M38 32 L32 58 L26 32 Z" fill="#d6ff3d"/>
<path d="M6 32 L32 27 L58 32 L32 37 Z" fill="#d6ff3d" opacity=".55"/>
<circle cx="32" cy="32" r="3" fill="#0b0e14"/>
</svg>
</div>
<h1>Theseus <span class="g">Navigator</span></h1>
<p class="tag">A Chromium-based browser that resolves Bitcoin&nbsp;Cash names on the
device itself. No OS-level daemon, no DNS shim, no root-store install. Type
<code>silentmode.bch</code>, get the on-chain answer, see which registry &amp;
which storage served it.</p>
<div class="cta">
<a class="btn acid" href="#download">Download for Windows</a>
<a class="btn ghost" href="#download">Android APK</a>
<a class="btn ghost" href="#what">How it works</a>
</div>
</header>
<div class="wrap">
<section id="what">
<h2>What it is</h2>
<p class="lede">Theseus is a browser built around the assumption that names should
be resolved by the person using them, not by an intermediary. It ships an
embedded resolver (Ariadne) that watches the Bitcoin Cash chain directly and answers
name lookups locally — the app <i>is</i> both the browser and the resolver.
Every page carries a badge showing which registry produced the record
(BCNR, ICANN) and which backend served the bytes (on-chain, Sia, direct IP,
or a plain HTTPS fallback).</p>
<div class="grid">
<div class="card">
<h3><span class="dot d-chain"></span> On-chain first</h3>
<p>Every dotted host is asked of BCNR before anything else. If the chain
answers, that answer wins — no matter what any DNS operator says. If
BCNR has no record, Theseus falls through to the clearnet.</p>
</div>
<div class="card">
<h3><span class="dot d-sia"></span> Trust one thing</h3>
<p>The app is the trust boundary. No daemon, no root cert, no proxy in the
middle. Uninstall it and BCNR is gone from that machine — nothing lingers
in the OS.</p>
</div>
<div class="card">
<h3><span class="dot d-srv"></span> Warm from the first click</h3>
<p>A bundled beacon snapshot loads before the first navigation can fire; a
background delta refresh keeps the index current every 30&nbsp;s; a Sia
snapshot pull on boot catches long-idle installs up in one HTTP call.</p>
</div>
</div>
</section>
<section id="features">
<h2>What's inside</h2>
<p class="lede">Everything a mainstream browser has, plus what the chain enables.</p>
<div class="grid">
<div class="card">
<h3>Native BCNR</h3>
<p>Type a name, get the on-chain record. <code>h</code> serves from the chain,
<code>s3</code> from Sia storage, <code>ip</code> direct-connects, <code>u</code>
redirects. TLS fingerprint pinning against the on-chain <code>tls</code> record
for <code>ip</code> hops.</p>
</div>
<div class="card">
<h3>window.bcnr API</h3>
<p>Every page can call <code>window.bcnr.resolveName(…)</code>,
<code>isRegistered(…)</code>, <code>getBcnrTlds()</code>, and
<code>getRecordVersion(…)</code>. dApps don't need to ship their own resolver.</p>
</div>
<div class="card">
<h3>Password manager</h3>
<p>Local vault, deterministic derivation from a BIP-39 seed. Same seed on a
different device produces the same passwords. Autofill on demand — never
watches the page for you.</p>
</div>
<div class="card">
<h3>Tor toggle</h3>
<p>One click routes everything through a bundled Tor client — pluggable
transports included for hostile networks. Off by default; nothing is
proxied without your say-so.</p>
</div>
<div class="card">
<h3>Anti-fingerprinting</h3>
<p>Timezone / locale / language / geolocation can be shown, hidden, spoofed
with a plausible decoy, or set manually. Media-device labels blanked by
default so <code>enumerateDevices</code> can't leak an audiooutput ID.</p>
</div>
<div class="card">
<h3>Privacy by default</h3>
<p>Cookies, cache, storage, and history clear on quit unless you opt in.
Camera and microphone denied by default. WebRTC IP policy set to
public-only.</p>
</div>
<div class="card">
<h3>System-wide, optional</h3>
<p>Theseus's resolver is in-process by default — nothing else on the
machine is touched. The Windows installer offers <b>Ariadne's Thread</b>
as a recommended-on checkbox: one click also installs a system-wide
resolver so Chrome, Edge, and every other browser resolve BCNR too.
Uninstalling Theseus asks whether to remove it. Skip the checkbox and
Theseus is still fully self-contained.</p>
</div>
<div class="card">
<h3>Small, auditable</h3>
<p>Under 100 MB, Electron + a few kilobytes of BCNR glue. Source at
<a href="https://silentmode.st/">silentmode.st</a>. Reproducible builds
with <code>SOURCE_DATE_EPOCH</code>.</p>
</div>
</div>
</section>
<section id="download">
<h2>Download</h2>
<p class="lede">Latest is <b>0.0.9</b>. Windows installer + portable, and an
Android build (Ariadne mobile — same brand, phone form factor).</p>
<div class="plats">
<div class="plat">
<div class="lbl">Desktop · Windows 64-bit</div>
<h3>Theseus for Windows</h3>
<p>Full-window desktop browser with Tor toggle and the multi-source BNS
warm-start.</p>
<div class="meta">v0.3.18 · installer ~118 MB (bundles Ariadne's Thread) · portable ~117 MB · unsigned</div>
<div class="btns">
<a class="btn acid" href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.18.exe">Installer</a>
<a class="btn ghost" href="https://dl.silentmode.st/TheseusNavigator-0.3.18-portable.exe">Portable .exe</a>
</div>
<div class="hashes" id="hashes-win">
<div class="h"><b>Installer</b><code>b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54</code></div>
<div class="h"><b>Portable</b><code>8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7</code></div>
</div>
</div>
<div class="plat">
<div class="lbl">Mobile · Android 5.0+ (API 21)</div>
<h3>Ariadne for Android</h3>
<p>Phone-sized browser with tap-to-verify provenance — the block and
transaction behind each name are one tap away.</p>
<div class="meta">v0.11 · ~124 KB · self-signed release key</div>
<div class="btns">
<a class="btn acid" href="https://dl.silentmode.st/ariadne-v0.11.apk">Download APK</a>
</div>
<div class="hashes" id="hashes-android">
<div class="h"><b>APK</b><code>03c95832c16cc4763acaadbf328caa7d4bd05fc7c2994f6997a79cc6890bca44</code></div>
<div class="h"><b>Signing key</b><code>46ebbbe5dc73148d66410fd0337b1e6683472128c983e8e2578200b9e3ca548c</code></div>
</div>
</div>
</div>
<div class="note"><b>Nothing is signed by an authority your device trusts</b>
— by design. Verify the SHA-256 below before running. The machine-readable
manifest is at
<a href="https://dl.silentmode.st/releases-manifest.json">releases-manifest.json</a>.</div>
</section>
<section id="verify">
<h2>Verify what you downloaded</h2>
<p class="lede">The hashes above are the same ones published at
<a href="https://silentmode.bch/releases/">silentmode.bch/releases</a> (Sia
mirror, name-anchored) and inside the on-chain
<code>releases.silentmode.bch</code> pointer. Three independent surfaces —
they should all agree.</p>
<pre>Windows PowerShell:
Get-FileHash TheseusNavigator-Setup-0.0.9.exe -Algorithm SHA256
macOS / Linux:
sha256sum TheseusNavigator-Setup-0.0.9.exe
Expected:
5452a34f211176cf04b7ea77a70fb838f0031b6ea0faed2cd270eae989b20c60</pre>
</section>
<footer>
<p>theseus.x is a BCNR name resolving to a Sia-hosted static site.
Source and issues: <a href="https://silentmode.st/">silentmode.st</a>.
Alpha software on a test network.</p>
</footer>
</div>
</body>
</html>