From 033c526206f1dd0bb4ddfab6136b491bcbb4e9f4 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Mon, 7 Sep 2026 23:50:52 +0200 Subject: [PATCH] Ship Theseus 0.3.18 b751b5de (add-on updates land + signed endpoint + tab-flash + screenshot fix + Ariadne installer) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Setup b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54 Portable 8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7 Five theseus fixes since 0.3.16: e90062a - Bundled add-on updates now actually land. seedBundledAddons() previously copied a bundled add-on only when its target folder was missing, so the 0.3.14 screenshot editor never reached machines that already had an older screenshot/ folder from a previous run — Theseus quietly kept using the stale copy. The seeder now compares bundled and on-disk addon.json versions and reseeds with a timestamped backup under /addons-backups/--/. ecfd481 + 6117429 - Signed add-on update endpoint, à la Firefox XPI. An add-on can now advertise an updateURL in its addon.json and be republished at any time without waiting for a Theseus release. The client fetches, verifies an Ed25519 signature over "silentmode.addon-update-v1|||", downloads the tarball, verifies the hash, and stages the new copy under /addons-updates-staged/ for promotion on next launch. Dormant in this build — the shipped addon-update-pubkeys.js is empty, so checkAndStageUpdates() short-circuits and makes no outbound requests; the feature activates when an operator ceremonies a key in and ships a follow-up release with the pubkey baked in. Operator tooling in scripts/generate-update-keypair.mjs and scripts/sign-addon-update.mjs; full brief in docs/ADDON-UPDATES.md. End-to-end verified against a local HTTP server: sign, serve, fetch, verify, download, extract, stage, promote, backup — plus signature tamper, wrong pubkey, sha256 tamper, and empty-pubkey short-circuit all rejected as expected. 15/15 checks pass. bfe5132 - Tab-switch flash is gone. Two independent causes: (a) tab views were created without an explicit background color, so the first frame after setVisible(true) showed whatever was underneath the view until the page painted; a solid theme-tracking ground fills the gap. (b) setActive iterated tabs in list order, so if the outgoing tab came before the incoming in the array, the loop hid the outgoing first and left one frame where no tab was visible; the incoming is now shown before any hides. a5a667d - Screenshot toolbar-menu captures no longer come out blank. The click handler dispatched capture synchronously while the native Menu.popup window was still on top, marking the tab view occluded and letting WebContents.capturePage() snapshot a stale/empty compositor frame at the correct dimensions (which the existing 0x0 retry couldn't detect). Dispatch now runs from the popup's close callback after a 120ms settle so the parent window is foreground and the compositor is live at capture time. a5a667d also - Ariadne — Install / Update / Uninstall alongside Turn on / off. The Ariadne toggle card in Settings > Registries grows three lifecycle actions. Install and Update run the bundled AriadneResolver-Setup-.exe silently and elevated (/VERYSILENT /SUPPRESSMSGBOXES /NORESTART — one UAC prompt, no wizard); Update is only visible when the bundled version is newer than what's installed. Uninstall reads Inno's QuietUninstallString from HKLM registry and runs it elevated. Status surfaces installed version + bundled version so the user can see what's on disk vs what would land next; buttons disable during work and refresh after both success and failure so the UI never lies. Deployed. Verified LIVE 0.3.18. --- package.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index cc04977..6d9c083 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "theseus-navigator", - "version": "0.3.16", + "version": "0.3.18", "description": "Theseus Navigator — a browser that follows the thread. By Silent Mode, a Deviant project.", "author": "Silent Mode", "main": "main.js", @@ -11,9 +11,14 @@ "dist": "electron-builder --win nsis portable" }, "dependencies": { + "@bitcoinerlab/secp256k1": "^1.2.0", "@noble/curves": "^2.0.1", "@noble/hashes": "^2.0.1", "@scure/bip32": "^2.0.1", + "bip32": "^4.0.0", + "bip39": "^3.1.0", + "bitcoinjs-lib": "^6.1.7", + "ecpair": "^2.1.0", "fetch-socks": "^1.3.3", "nostr-tools": "^2.10.4", "psl": "^1.15.0",