Home page's search-box placeholder was hardcoded "Search the web
(DuckDuckGo)", but the browser's default engine has been Startpage
for a while and any user can switch to another in Settings. The
"DuckDuckGo" claim then contradicted the actual engine that would
run the query (main.js routes through settings.searchEngine).
Fix: placeholder starts as plain "Search the web" and populates on
load with "Search the web with <engine.name>" via a new
window.home.getEngines() IPC (reuses the existing search-engines
handler). Silently no-ops if the preload isn't bound.
Also swapped the never-fires no-preload fallback URL from
duckduckgo.com to startpage.com so it matches Theseus's own default.
Setup 4830da019914019c5d3575420b490a278bc3ba63606680f84c30d58de5ff9500
Portable 1ef76b5b0fae9ac5a201956f6f3da55b1f1ceec8a035cc0d498147a210491b5f
One theseus change since 0.3.18:
7672ce0 - Signed add-on update endpoint activates. The Silent Mode
operator Ed25519 pubkey (generated 2026-09-07,
732b1263a236b0030383a2376597cfa43c3624b3ca2912a46134f8f2a06e6012)
is baked into addon-update-pubkeys.js, so on every boot Theseus polls
each installed add-on's updateURL 30 s in, verifies the signed
updates.json against the pubkey, and stages any newer signed version
under <userData>/addons-updates-staged/ for promotion on the next
launch. Verification, backup, and promotion mechanics unchanged from
0.3.18. The screenshot add-on already advertises
https://addons.silentmode.st/screenshot/updates.json; publishing a
signed entry there is what activates real updates. No entry is
published yet, so this build's boot-time fetch fails silently until
the operator lands the first signed payload via
scripts/sign-addon-update.mjs.
3be152a - Also in this ship: package-lock.json resynced with
package.json. The 0.3.18 ship inadvertently committed WIP dependency
additions (bitcoinjs-lib, bip32, bip39, ecpair,
@bitcoinerlab/secp256k1) via git commit -o's file-scoped semantics
without a matching lock update. Fresh clones now build cleanly with
npm ci. Deps are unused by shipped code at this time but ride along
in node_modules — installer size grew ~400 KB.
Deployed. Verified LIVE 0.3.19.
The 0.3.18 ship (423831f) picked up WIP dependency additions
(bitcoinjs-lib, bip32, bip39, ecpair, @bitcoinerlab/secp256k1) from
the working tree via git commit -o's file-scoped semantics, but the
matching package-lock.json update was left uncommitted. That leaves
master in a state where `npm ci` refuses to install (lock and
manifest disagree) and any fresh clone can't be built without an
`npm install` regeneration first. Committing the in-tree lock puts
them back in sync.
Populates addon-update-pubkeys.js with the Silent Mode ops Ed25519
pubkey generated 2026-09-07. From this build forward, Theseus polls
each installed add-on's updateURL 30 s after boot, verifies the
signed updates.json, and stages any newer version for promotion on
the next launch. The screenshot add-on's addon.json already
advertises https://addons.silentmode.st/screenshot/updates.json;
publishing a signed entry there (via scripts/sign-addon-update.mjs
with the ops private key) is what activates real updates.
No updates.json is published yet, so the client's boot-time fetch
will 404/DNS-fail silently until the operator lands the first signed
entry.
Setup b751b5deea997bb7e0e894104dcb7411358728987196cb610f316edacaf9be54
Portable 8a258f29c62a03b745e93ea0265285e6d5df38d4f25cdbdadc20b4d2a54b97d7
Five theseus fixes since 0.3.16:
e90062a - Bundled add-on updates now actually land. seedBundledAddons()
previously copied a bundled add-on only when its target folder was
missing, so the 0.3.14 screenshot editor never reached machines that
already had an older screenshot/ folder from a previous run — Theseus
quietly kept using the stale copy. The seeder now compares bundled and
on-disk addon.json versions and reseeds with a timestamped backup
under <userData>/addons-backups/<id>-<oldver>-<timestamp>/.
ecfd481 + 6117429 - Signed add-on update endpoint, à la Firefox XPI.
An add-on can now advertise an updateURL in its addon.json and be
republished at any time without waiting for a Theseus release. The
client fetches, verifies an Ed25519 signature over
"silentmode.addon-update-v1|<id>|<version>|<tarball-sha256>",
downloads the tarball, verifies the hash, and stages the new copy
under <userData>/addons-updates-staged/ for promotion on next launch.
Dormant in this build — the shipped addon-update-pubkeys.js is empty,
so checkAndStageUpdates() short-circuits and makes no outbound
requests; the feature activates when an operator ceremonies a key in
and ships a follow-up release with the pubkey baked in. Operator
tooling in scripts/generate-update-keypair.mjs and
scripts/sign-addon-update.mjs; full brief in docs/ADDON-UPDATES.md.
End-to-end verified against a local HTTP server: sign, serve, fetch,
verify, download, extract, stage, promote, backup — plus signature
tamper, wrong pubkey, sha256 tamper, and empty-pubkey short-circuit
all rejected as expected. 15/15 checks pass.
bfe5132 - Tab-switch flash is gone. Two independent causes: (a) tab
views were created without an explicit background color, so the first
frame after setVisible(true) showed whatever was underneath the view
until the page painted; a solid theme-tracking ground fills the gap.
(b) setActive iterated tabs in list order, so if the outgoing tab
came before the incoming in the array, the loop hid the outgoing
first and left one frame where no tab was visible; the incoming is
now shown before any hides.
a5a667d - Screenshot toolbar-menu captures no longer come out blank.
The click handler dispatched capture synchronously while the native
Menu.popup window was still on top, marking the tab view occluded and
letting WebContents.capturePage() snapshot a stale/empty compositor
frame at the correct dimensions (which the existing 0x0 retry
couldn't detect). Dispatch now runs from the popup's close callback
after a 120ms settle so the parent window is foreground and the
compositor is live at capture time.
a5a667d also - Ariadne — Install / Update / Uninstall alongside Turn
on / off. The Ariadne toggle card in Settings > Registries grows
three lifecycle actions. Install and Update run the bundled
AriadneResolver-Setup-<ver>.exe silently and elevated (/VERYSILENT
/SUPPRESSMSGBOXES /NORESTART — one UAC prompt, no wizard); Update is
only visible when the bundled version is newer than what's installed.
Uninstall reads Inno's QuietUninstallString from HKLM registry and
runs it elevated. Status surfaces installed version + bundled version
so the user can see what's on disk vs what would land next; buttons
disable during work and refresh after both success and failure so the
UI never lies.
Deployed. Verified LIVE 0.3.18.
Extends the Ariadne toggle card in Settings > Registries with the three
lifecycle actions the user asked for:
- Install: runs the bundled AriadneResolver-Setup-<ver>.exe silently
and elevated (/VERYSILENT /SUPPRESSMSGBOXES /NORESTART). Single UAC
prompt, no wizard.
- Update: same installer, run over the top. Inno Setup detects the
matching AppId and upgrades in place. Only shown when the bundled
version is newer than what's installed.
- Uninstall: reads Inno's QuietUninstallString from
HKLM\...\Uninstall\{7E7A5F1C-...}_is1 and runs it elevated with
/VERYSILENT /SUPPRESSMSGBOXES /NORESTART.
Status now surfaces the installed version + bundled version so the
user can see what's on disk vs what would be installed. Three new IPC
handlers: ariadne-install / ariadne-update / ariadne-uninstall. Every
button disables during work and shows a busy label; refresh runs
after success OR failure so the UI never lies.
Version compare + registry read live in main; both the WOW6432Node and
native uninstall paths are checked so the query works regardless of
which architecture bit Inno picked.
An end-to-end drive of the update flow against a local HTTP server hit
two Windows-only tar quirks that a first-cut MVP wouldn't catch:
1. Git-Bash tar (MSYS2), which comes first on PATH when Git-for-Windows
is installed, treats drive-letter paths as `host:file` remote-archive
syntax. Sidestepped with --force-local (also silently accepted by
Win10's built-in bsdtar and by GNU tar).
2. Even with --force-local, MSYS2's argv-conversion layer mangles
backslashes in Windows paths, so `C:\Users\...\tmp\dir` arrives at
tar as `C:\Users...\dir` and it can't open the path. Passing
forward-slash paths (`C:/Users/.../tmp/dir`) dodges the mangler;
bsdtar and GNU tar accept them as-is.
3. sign-addon-update.mjs was tar'ing the addon directory as a subfolder
(`screenshot/addon.json` inside the archive), so the client
extracted to `<tmp>/screenshot/` and then failed the id+version
re-check because addon.json wasn't at the root. Now the signer
tars the CONTENTS of the addon dir via `tar -C <addon-dir> .`, so
entries live at the archive root where the client expects them.
All three surfaced from `scratchpad/decoupling-test/run-test.mjs`, which
now walks the full path — sign, serve, fetch, verify, download,
extract, stage, promote, backup — plus three signature-tamper negatives
and the empty-pubkey short-circuit. 15/15 checks pass.
Two independent causes of the flash the user reported when clicking
between tabs (and when opening Settings, which is just another tab):
1) Every tab view was created without an explicit backgroundColor.
Electron's default is transparent, which means the first frame after
setVisible(true) shows whatever is underneath the view — black, or
the just-hidden previous tab — until the page paints. Set a solid
ground that tracks the system theme (#0b0e14 dark / #ffffff light)
so the first-paint gap is invisible.
2) setActive iterated tabs and toggled visibility in list order. If
the currently-active tab came before the new active in the array,
the loop hid the active one first and showed the new one later,
leaving one frame where no tab was visible. Reverse: show the new
target FIRST, then hide the rest. Compositor always has at least
one tab view up during the switch.
Decouples bundled-add-on updates from Theseus releases. An add-on
whose addon.json declares an updateURL can be republished at any time
without shipping a new Theseus installer; existing installs pick it up
on the next boot's +30 s background check.
Client flow (main-process only, no UI touchpoints in this commit):
initAddons()
├── promoteStagedUpdates() # promote signed stage if newer
├── seedBundledAddons() # bundle wins over on-disk if newer
└── AddonHost.discoverAndActivate()
30 s later:
└── checkAndStageUpdates() # fetch, verify, download, stage
Signature: Ed25519 over
"silentmode.addon-update-v1|<id>|<version>|<tarball-sha256>",
verified against a hardcoded set of operator pubkeys living in
addon-update-pubkeys.js. Domain-separated so the operator key can't
be tricked into signing a message with a different purpose. Empty
pubkey array is the shipping default — checkAndStageUpdates() then
short-circuits and no outbound requests are made, which is the safe
posture until the operator ceremonies a key in.
Payload: gzipped tar, extracted with the system tar (present on
Win10 1803+, macOS, Linux). Path traversal defended by tar's default
refusal of `..` entries; the extracted manifest's id + version are
re-checked against the signed values before staging.
Staged updates go to <userData>/addons-updates-staged/<id>-<version>/.
Promotion into <userData>/addons/<id>/ reuses seedBundledAddons's
backup dance: existing folder moves to
<userData>/addons-backups/<id>-<oldver>-<timestamp>/ so any local
edits survive.
New files:
- addon-updater.js — client
- addon-update-pubkeys.js — hardcoded pubkeys (empty; edit + rebuild to rotate)
- scripts/generate-update-keypair.mjs — one-time keygen
- scripts/sign-addon-update.mjs — operator packager+signer
- docs/ADDON-UPDATES.md — operator brief + threat model
Wired into main.js at boot; screenshot add-on's addon.json advertises
the reference updateURL for when the endpoint goes live.
seedBundledAddons() only copied a bundled add-on when the target folder
was missing, so an updated bundled add-on never landed on any machine
that had ever run Theseus before — the 0.3.14 shipped screenshot editor
would sit in resources/ and be ignored by every dev machine with an
older screenshot/ folder from a previous test.
Compare the bundled addon.json version to the user's on-disk version.
On mismatch, rename the user copy to
<userData>/addons-backups/<id>-<oldver>-<stamp>/ and cp the fresh
bundle in. Backups live outside addonsDir so AddonHost's folder scan
doesn't pick them up as duplicate add-ons under the same manifest id.
Bump screenshot 0.2.0 -> 0.2.1 so the first build carrying this fix
actually reseeds the shipped-0.3.14 editor on existing dev copies.
Users who genuinely fork a bundled add-on should bump their local
version to something different from the bundled one — that keeps them
pinned. Users who edit files without bumping accept upstream updates,
with the timestamped backup as safety net.
Setup f9d0654572e110f6895951dc22ec9fb4549b3a8fb14714770579264b62051259
Portable 7ff7a1501bc7d7407ec0a4974aa26652d6d7ecabcc796584254a8bb463d43b09
Two bundled fixes since 0.3.15:
4f498a1 - Extension dock no longer stacks into a column when dragged
narrow. #extbuttons + .extdock get flex-wrap:nowrap + overflow:hidden;
a second data-extcollapse signal fires when .bar's contents overflow
(alongside the width-based level 3), collapsing the row into the
single 🛡 puzzle button. Hysteresis (cached natural width + 8px slack)
keeps the ResizeObserver from oscillating across the boundary.
e160dac - toolbar-menu popup goes native (Menu.popup from main) so it
escapes the chrome-view height clipping. capturePage retries transient
0x0 results up to 6 times so the screenshot addon doesn't silently
produce a blank PNG right after a navigation.
Deployed. Verified LIVE 0.3.16.
Two follow-ups from the screenshot editor rework (task_b9608dc6):
1) toolbar-menu popup goes native. The DOM popover in chrome.html was
getting clipped by chrome.html's own WebContentsView height and then
covered by the tab view below it. Route through main.js's
Menu.popup() so the menu escapes the chrome-view layering entirely.
Preload exposes toolbarMenuPopup(addonId, rect) + subscribes to
toolbar-menu-closed so chrome can drop the button's "active" tint.
2) capturePage() intermittently returns a 0x0 image on Windows right
after a navigation (view hasn't painted a frame yet). Retry up to
six times with 150 ms between attempts; throw a specific error if
still empty so the addon can surface a real message instead of
silently producing a blank PNG.
Also lands an [addons] openAddonTab log line so the editor tab opening
is easy to trace in main's log.
The extension row was stacking into a column when the user dragged the
URL bar wide enough to squeeze the dock's slot. Two things broken:
1) #extbuttons could wrap: added flex-wrap:nowrap + overflow:hidden so
the buttons never break to a new line. Same for .extdock's own
flex container (nowrap + min-width:0 so it can flex-shrink to zero).
2) Collapse was width-based on .bar only — a window wide enough for
level 0 wouldn't collapse the dock even when the URL-bar override
left extdock with 0 px. Added a second signal:
data-extcollapse="1" fires when .bar's contents overflow their slot
(bar.scrollWidth > bar.clientWidth). Applies alongside the level-3
collapse; either path shows .extmore instead of the row.
Hysteresis to avoid RO loop: while EXPANDED, cache the row's natural
scrollWidth. While COLLAPSED, re-expand only when summing every other
.bar child leaves at least (naturalWidth + 8 px slack) of room. Both
directions verified across URL widths 400/800/1200/1500/reset — the
row expands / collapses at the right thresholds with no oscillation.
Setup 81b6a8d2a64d20641c4cc448d35627fb3c492ea45adb24fa5c41a9f63663dd2d
Portable 47a22d86a08305536b4d80f4072ad38179a4935f303ac31bcd05dba36d5f4d40
One bundled commit since 0.3.14:
6dae15e - Drag handles on the trailing edge of the URL bar + leading
edge of the search box let the user resize live; widths persist as
urlBarWidthPx / searchBoxWidthPx and override the discrete size preset.
Also fixes the sliding bug the user just flagged: capping the URL bar
via Settings > Appearance was letting the download / extension /
Theseus buttons pack next to the URL bar, sliding leftward. Adding
margin-right: auto to the capped .urlwrap absorbs the slack so the
right group stays pinned to the right edge. Verified via CDP: logo's
rightGap stays at 10px across default / compact / urlBarWidthPx=500 /
reset.
Deployed. Verified LIVE 0.3.15.
Two fixes bundled:
1) Right-side items (download, extension dock, Theseus button) no longer
slide leftward when the URL bar is capped. Added margin-right: auto
to .urlwrap under every capped state (data-urlsize=medium/compact
and the new data-urlwidth override) so the leftover flex space sits
AFTER the URL bar, keeping the right group pinned to the right edge.
Verified: logo's gap from bar's right edge stays at 10px across
default / urlBarSize=compact / urlBarWidthPx=500 / reset.
2) Drag handles for live resize. A 6-px col-resize strip sits on the
trailing edge of .urlwrap and the leading edge of .searchbox; a
pointerdown/move/up dance updates the width live via a CSS custom
property and persists to settings on release. Two new keys:
- urlBarWidthPx (0-1800, 0 = follow size preset)
- searchBoxWidthPx (0-800, 0 = follow size preset)
When either is non-zero, the corresponding CSS override wins over
the discrete size preset. Preload gets setSetting so the drag can
push the persistent value from chrome.
Visual affordance: handles are transparent by default, gain a faint
acid tint on hover and while dragging.
Setup 238f0b81afd93d7cef80b9403edef1dc3e1d4c1bf29e29a498115e1185ce1db8
Portable d8877e696ad6425aa6d56cb796048702cfb37b40ff539a8c1af0d08d0a31870c
Three bundled fixes since 0.3.13:
- (Aegis multi-chain wallet, cherry-picked from claude/sleepy-maxwell-251ee6
worktree) — bchwallet add-on turns into a chain-agnostic wallet
manager with BCH + Tron mainnet + Tron Nile testnet; addon id stays
"bchwallet" so vault-derive paths + legacy BCH funds are untouched.
Dapp bridge on any https page exposes window.tronWeb / window.tronLink
matching TronLink chain ids so Tron dapps just work.
- 3d3dfe5 — Screenshot addon reworked: dock icon opens a small
toolbar-menu (Visible / Full page / Region…) instead of a sidebar
panel; captures open in a full browser tab with an editor
(crop / arrow / rect / circle / freehand / text / blur / undo / save /
copy). Two new addon-host capabilities land: toolbar-menu + open-tab.
- dd31b88 — Light-mode --acid went from #4d7300 → #3a5c00 (~7:1 on
white), and the missed addon panels (bchwallet, siawallet,
screenshot editor.css) got their overrides so nothing resolves to
the bright #d6ff3d anymore.
Note on Nile testing: the code paths verified via a running instance —
dock shows 🛡 Wallet, chain picker "🟨 BCH — main ▾" is present. Live
Nile send requires a vault + testnet TRX from nileex.io/join/getJoinPage.
Deployed. Verified LIVE 0.3.14.
Reworks the screenshot addon into the flow the user asked for: the
dock icon opens a small dropdown menu (Visible viewport / Full page /
Region…) instead of the sidebar picker, and each capture opens a
full browser tab hosting an editor.
Two new addon-host capabilities land alongside:
- toolbar-menu: the addon declares an icon + item list in its manifest;
the chrome dock renders a button that, on click, opens a small menu
and dispatches the selection to the addon via addon-menu-select IPC.
- open-tab: api.openTab(path) opens a browser tab whose URL is the
addon's local file. Origin-gated per addon; the editor uses a
dedicated addon-tab-preload for its main → renderer bridge.
Editor page (editor.html/js/css):
- Crop, arrow, rectangle, circle, freehand pen, text, blur
- Colour swatches (red / yellow / acid / white / black), 3 stroke widths
- Undo/redo command stack, zoom controls
- Save PNG (goes through the download pipeline, chip picks it up)
- Copy to clipboard via ClipboardItem
Previous #4d7300 (0.3.10) was still too light against actual white
backgrounds — several tint fills (rgba(214,255,61,X)) and unpatched
addon panels were making the effective color feel bright green. Two
fixes bundled:
1) Bump --acid in every top-level page's light-media block from
#4d7300 to #3a5c00 — same hue, ~7:1 contrast on #ffffff (was ~5.5:1).
2) Add the missing light-media --acid override to the addon panels
that were still resolving to #d6ff3d: bchwallet/panel.html,
siawallet/panel.html, and screenshot/editor.css (was #b4e024, now
#3a5c00 to match).
Dark mode unchanged. Tint fills (rgba backgrounds at low alpha) still
stay as-is — at 8–15% opacity the specific hue barely matters and the
darker foreground now dominates.
Setup 7d88e4c46b02448e40d6075d10f2c6688c6d60c5a9ec41b9cbcb7684f131d6e1
Portable 5a4bcc6abb21c23729d79dd600142df4f171cc3d6bf71716dae1c802ac10e48f
Bundled since 0.3.12:
1514793 - Settings > Registries gets an on/off toggle for Ariadne's
Thread (system-wide BCDN resolver for non-Theseus browsers). Query is
silent Get-ScheduledTask; toggle spawns elevated PowerShell (UAC once
per action). Three states: running / stopped / not-installed.
b16f0a1 - New BCDN 'p' record type in Argus record-picker + Theseus
serving. Reverse-proxies an upstream URL under a BCDN name, keeping
the BCDN name in the address bar; uses upstream's own DNS + public
CA + Host header (unlike 'ip' which pins IP + on-chain TLS fingerprint).
Placed after 'ip' in the apex chain, suppressed under subdomain
inheritance so a 'p' name doesn't silently proxy every subdomain.
cfec253 - Argus registrar gains buildTldRegistrationTx + TLD_BEACON +
normalizeTld exports for minting per-TLD certificates per the TLD-
registry design.
bbfc05c - Bundled Screenshot add-on: capture-tab capability + sidebar
launcher for visible / full page / region modes; saves to Downloads.
Follow-up task_b9608dc6 will rework this into a full-tab editor.
Deployed. Verified LIVE 0.3.13.
New card under Settings > Registries: shows whether the system-wide
resolver daemon is running, stopped, or not installed on this machine,
and lets the user turn it on/off without opening the installer.
Ariadne runs as two elevated Windows Scheduled Tasks ("BNS Resolver
Daemon" + "BNS Sia Bridge"). Toggling requires admin — main spawns an
elevated PowerShell (Start-Process -Verb RunAs) that UAC-prompts once
per action, then re-queries state. Query is unelevated
Get-ScheduledTask so status checks are silent.
Three surfaced states:
running - "every browser on this machine resolves BCDN names"
stopped - "only Theseus resolves BCDN names; other browsers won't"
not-installed - link to silentmode.st/tools to grab the standalone installer
Theseus's own resolver is unaffected either way — it lives in-process
and doesn't depend on Ariadne. This toggle only controls what non-
Theseus browsers on the same box can resolve.
New capture-tab capability on the addon-host, and the screenshot add-on
uses it to expose three modes in a sidebar launcher panel:
- Visible viewport: Electron's WebContents.capturePage() on the active tab
- Full scrollable page: temp-resize the tab view to document.scrollHeight,
capturePage, restore
- Region: preload overlays a translucent selection div, tracks mousedown /
move / up, sends the rect back; main takes the visible capture and
crops via nativeImage.crop({x,y,width,height})
Saves land in the user's Downloads folder via session.downloadURL — same
pipeline as any file download, so the download chip picks them up.
Filename: theseus-screenshot-<host>-<ISO date>.png. JPEG option for
smaller files.
A follow-up task (task_b9608dc6) reworks this to open captures in a
full-tab editor with crop / draw / annotate / undo / copy-to-clipboard
instead of the current bare launcher.
New record kind alongside h / s3 / ip / u: `p` reverse-proxies the
request to a full upstream URL while keeping the BNS host in the
address bar. Unlike `ip` (which pins the upstream to a raw IP + on-chain
TLS fingerprint), `p` uses the upstream's own DNS + public CA cert and
sends `Host:` of the upstream so vhost-based origins answer correctly.
Argus (record-picker.js):
- Placed AFTER `ip` in the apex chain: a name carrying both keeps its
existing pinned-IP behavior; names with only `p` get honored instead
of falling through to `u` and 302-ing away.
- Not applied to subdomain inheritance — `p` is single-URL by intent,
and inheriting through a subdomain would silently mangle the target.
Theseus (main.js serveBns):
- Fetches the upstream (path prefix from the `p` URL is preserved) and
returns the response body/status/content-type verbatim. Provenance
label "mirror" appears in the source badge.
Tests: record-picker.test.mjs covers `p`-only, `p`+ip precedence, and
the subdomain-suppression rule.
Setup a28b4d2be705069f35fa21c5c3e008627661b6173d1eb3014d001eb81c72761e
Portable 5dab9a17818d263706704ab867b6ab9743c2606eb60e2391d0e00a78604cd26b
Two bundled fixes since 0.3.11:
e7dfa46 - At responsive level 3 the collapsed extension button was a
generic 🧩 puzzle piece. Swap it for the first registered extension's
own icon (📝 / ₿ / Ⓢ / whatever ships first). Puzzle piece stays as the
empty-state fallback when no addons are registered. Click still opens
the same dropdown of all installed extensions.
95cc2c7 - Remove the redundant 32-px extension picker strip that
sidebar-preload.js was injecting at the top of every add-on panel.
The toolbar extension dock is the canonical switcher now; doubling
that inside the sidebar just wasted vertical space and made narrow
panels cramped. Every panel reclaims its top 33px.
Deployed. Verified LIVE 0.3.12.
Every add-on panel was carrying a 32-px tab bar at the top listing every
registered extension. That existed before the toolbar extension dock
landed — now that the dock (per-extension buttons + puzzle dropdown at
narrow widths) is the canonical switcher, doubling that inside the
sidebar just wasted vertical space and made narrow panels feel cramped.
Drops installPickerStrip() from sidebar-preload.js and the invocation
from the DOMContentLoaded handler. The body-padding style that made
room for the strip goes with it, so panels reclaim their top 33px.
Resize grip on the left edge stays — unrelated feature.
No panel HTML depends on the strip's padding — the wallets, notepad,
relay, siawallet, and screenshot addon all start their own body flow
from 0. Nothing else to change.
At responsive level 3 the dock folds into a single button; that button
was a generic 🧩 puzzle piece. Swap it for the first registered
extension's own icon (📝, ₿, Ⓢ, whatever ships first in the panels
list), with the puzzle piece staying as the empty-state fallback if
no addons are registered yet. Clicking still opens the same dropdown
of all installed extensions, so no functional change — just the
button reads as "the extension you're most likely to want" instead of
a generic marker.
Setup b08530a69d47c2525a2238bd35542d141c4cf2be09f61f7b6d9bb08166f606cf
Portable b67387c85f6d37df2d2c2055a1773954a2e9019d3d567943d8ed5a39e9ee53a9
One bundled fix since 0.3.10:
beca0fa - A ResizeObserver on .bar sets data-responsive to one of four
levels based on width. CSS reacts: search box auto-hides at level 1,
Theseus button collapses to just the gear icon at level 2, and the
extension dock folds into a single 🧩 puzzle button opening a dropdown
of installed extensions at level 3. User's explicit Address bar /
Search box size settings still win at wide widths.
Deployed. Verified LIVE 0.3.11.
A ResizeObserver on .bar sets data-responsive to one of four levels
based on width, and CSS reacts:
0 (>=1050px) wide — everything visible (default)
1 ( >=820px) tight — auto-hide the search box, URL min-width drops
2 ( >=620px) narrow — Theseus button collapses to just the gear
3 ( <) xnarrow — extension dock collapses to a single 🧩 button
that opens a dropdown listing every registered
panel (icon + name), click to open the sidebar
Puzzle dropdown reuses the same open/close pattern as the existing
bookmarks menu — click outside to dismiss, click a row to open (or
close if it's already the active panel). User's explicit
Settings > Address bar size / Search box size still win when the
toolbar is wide enough for them; responsive collapse only forces
extra hides at the tighter widths.
Verified on a running instance across 5 widths (1200/900/700/500/400):
each breakpoint flips exactly the elements it should.
Setup d9801fe6a1ea7d54132db36b2c78311cd5c77912618687fb9cf6476ce75a97f9
Portable ff6ea386752fb3ceeb9d5f385258a6f01f7266c2509f4670419ce6e44e24d442
One bundled fix since 0.3.9:
d1f3347 - The brand acid green (#d6ff3d) was ~1.3:1 contrast on
#ffffff / #f6f8fb, so it went nearly invisible any time the user
flipped Settings > Theme to Light. Every chrome page (chrome, home,
settings, error, approval, messages) now overrides --acid to #4d7300
in its prefers-color-scheme: light block — same hue family, ~5.5:1
on white. Also added the missing --acid: #d6ff3d declaration to
chrome.html's :root (was relying on var(--acid, #d6ff3d) fallbacks,
so the light override couldn't bind). Verified live via CDP.
Deployed: scp + sia-upload of both trees. Verified LIVE 0.3.10.
Two background tasks in progress (screenshot extension, Aegis
multiwallet + Tron/Nile) will land in a later release.
#d6ff3d on a #ffffff / #f6f8fb background sits at ~1.3:1 contrast — the
acid green went almost invisible any time the user flipped Settings >
Theme to light. Override --acid to #4d7300 in every chrome page's
prefers-color-scheme: light block. Same hue family, ~5.5:1 contrast
on white, still reads as the same brand color.
Also: chrome.html was missing --acid: #d6ff3d in :root entirely (every
site used var(--acid, #d6ff3d) fallbacks). Adding the real declaration
means the light override can actually take effect.
Files touched: chrome.html, home.html, settings.html, error.html,
approval.html, messages.html. downloads.html is a dark-only overlay
(hardcoded), collision.html already had a proper light-mode --bcdn.
Tint fills (rgba(214,255,61,X) at low alpha) stay as-is — the specific
hue barely matters through 8% opacity.
Verified live via CDP: getComputedStyle(--acid) returned #d6ff3d in
dark, #4d7300 after cfg.set('theme','light').
Setup cc676e62057b42c1e1221f0e9b69a55806bab90259bbbb4e6eb64701ab3d420a
Portable 1ab811f7edba74220b452763ee0f3329ba91d84c834d3e38be6426de0b04f1c7
Two changes since 0.3.8:
f1d117e - .extbtn was display:grid, which is block-level, so multiple
extension buttons inside #extbuttons stacked vertically. Switch to
inline-grid — same icon-centering, no forced line break between
siblings. Verified on a running instance: all 4 dock buttons at the
same y-coordinate.
(this commit) - Remove the static Aegis ₿ placeholder button and its
handler. Redundant now that the real bchwallet addon ships in the box
and registers its own dock entry. Also flip the dock-hidden logic to
disappear entirely on a fresh install with no add-ons registered, so
the toolbar doesn't carry an empty slot for users who never install
one.
Deployed: scp + sia-upload of both trees. Verified LIVE 0.3.9.
.extbtn had display:grid, which is block-level by default. Multiple
buttons inside #extbuttons stacked vertically because each was a block.
Switch to inline-grid — same centering behaviour for the icon inside
the button, no forced line break between siblings. Verified on a
running instance: all 4 buttons render at the same y-coordinate with
strictly increasing x.
Second bundled wallet, same shape as bchwallet:
- keys: api.vault.derive("siawallet/mainnet/0") as the seed for walletd's
KeyFromSeed(seed, index) (blake2b(seed||index) -> ed25519); addresses are
standard unlock hashes, so a future walletd seed import yields the same
addresses. Seed and keys live in memory only.
- lib/sia.js: Sia binary encoder, StandardUnlockHash, address checksum,
v2 InputSigHash ("sia/sig/input|" + replay byte 2 + transaction
semantics), transaction weight, walletd JSON. Address hashing and the
sighash were verified against real mainnet v2 transactions (signatures
from block 591853 verify under this implementation).
- lib/walletd.js: address-scoped walletd HTTP client (tip, fee, balance,
outputs with proofs, events, broadcast). The node URL is a user setting
with no default; hosted providers embed the access key in the path, so
only the origin is ever displayed or logged.
- lib/wallet.js: gap-limit discovery via events, mature/immature balance,
history deltas from v1/v2/foundation/miner events, largest-first
selection with change to the current address, fee = walletd rate x
weight x 1-3 multiplier, broadcast with the outputs' basis. A signed tx
built here was accepted structurally by a live walletd (rejected only
for the stub key not owning the parent).
- panel: Receive (QR), Send, History, Settings (node URL, derivation info,
seed reveal behind approval, connected sites); gates for locked vault,
no vault, no node URL.
- window.siacoin dapp bridge: getAddress (rememberable), signAndSend with
100/1,000/10,000 SC allowances, signMessage (ed25519 over blake2b-256 of
the message) — same approval and permission rules as the BCH wallet.
Setup b2b7819e7a5f1ae1aa7ac79dd8e150f7c11f238eb3ab98a53fae51186dd4dc5b
Portable c971931f380245e44064720b132859917039488c12e0f654a2eeb406cf465d37
Bundled fixes since 0.3.7:
b649398 - User-resizable address bar + search box. Settings > Appearance >
Toolbar now offers urlBarSize (wide/medium/compact) and searchBoxSize
(hidden/compact/normal/wide). Applied as data-attrs on .bar so the flex
basis of .urlwrap and the width of .searchbox swap live. Motivation:
the per-extension dock (0.3.7) needs room to grow as users install more.
Settings-set broadcasts settings-update to chrome so resizing is instant
without a relaunch.
ab87576 - F12 / Ctrl+Shift+I opens Chromium DevTools on the active tab
in a detached window. Wired in the same before-input-event handler that
owns reload / sidebar shortcuts. Always targets the active tab
regardless of which view received the keystroke.
Deployed: scp + sia-upload of both trees. Verified LIVE 0.3.8.
VPS archive step 7: 0.3.6 pair moved to Sia dl-archive/, only 0.3.7 +
0.3.8 remain on /opt/silent-mode/dl/ (per shipping-mirrors memory).
Two new settings under Settings > Appearance > Toolbar:
urlBarSize: wide (default) | medium | compact
searchBoxSize: hidden | compact | normal (default) | wide
Applied as data-attrs on the .bar element in chrome.html; CSS switches
the flex-basis of .urlwrap and the width of .searchbox. min-width on
.urlwrap guards against squeezing the URL invisible.
Settings-set now broadcasts settings-update to the chrome renderer, so
resizing takes effect live without a relaunch. Same channel is exposed
for future chrome-side settings.
Motivation: the extension dock grew a per-addon button per install, and
the URL bar (flex:1) had been eating all the remaining space. Users who
want more room for extensions can now shrink or hide the search box and
cap the URL bar width.
The packaged build stripped the native app menu, which took Chromium's
default DevTools accelerators with it. Wire the two everyone expects —
F12 and Ctrl+Shift+I — in the same before-input-event handler that
already owns reload / sidebar shortcuts. Always target the active tab
regardless of which view received the keystroke (chrome, overlay, tab)
so debugging is consistent with every other browser. Detach mode keeps
the tools out of the tab strip.
Setup 37fd8db5388cc2486b48d282bf38e1d5b18a40de5b7319950edcc412f3ddb683
Portable befab4c21ef78d7c92eb7d399e163d3e53e202a0bda9fe95f8d8db916db2e242
Bundled fixes since 0.3.6:
1026b08 - Per-extension toolbar dock: replaces the single sidebarbtn with
one button per registered addon sidebar-panel. Notepad (📝) and Silent
Mode Relay (🌐) appear automatically from their manifest icons; a static
Aegis Wallet placeholder (₿) marks the upcoming built-in BCH wallet.
Click a live button → open the sidebar on that panel, click active →
collapse. Preload adds openSidebar(panelId) / closeSidebar() wrappers.
622aaee - Right-click "Search for '<selection>'" in the page context
menu. Uses SEARCH() so it honours the current default engine, opens in
a new foreground tab, and truncates the label at 40 chars.
Deployed: scp + sia-upload of both trees. Verified LIVE 0.3.7.
Ops note: silentmode.st /var/log had grown to 6GB (journal + rotated
syslog), which broke the first portable upload. Vacuumed journal to
500M cap; ~5.9G free after cleanup. Old Theseus builds not touched.
Replaces the single sidebarbtn with a dock that renders one button per
registered addon sidebar-panel. Each button shows the panel's icon
(the emoji from its manifest) and opens the sidebar on that panel.
Clicking the currently-active button collapses the sidebar; clicking a
different one swaps the visible panel. Notepad (📝) and Silent Mode
Relay (🌐) appear automatically because they already register panels.
Also lands a static Aegis Wallet placeholder button (₿) next to the
live ones, styled as .soon so it reads as coming-soon. It'll come out
once the addon registers a real panel.
Preload adds openSidebar(panelId) and closeSidebar() wrappers around
the existing sidebar-open / sidebar-close IPC handlers.
The dapp send approval gains an "Afterwards" dropdown: ask every time, or
allow up to 0.001 / 0.01 / 0.1 BCH more without asking. The allowance is
stored as permissions[origin].sendTx {capSats, usedSats}; sends within the
remainder go through silently and draw it down, a larger request re-prompts
(showing what is left) and the choice made there replaces the allowance.
No unlimited option. Settings > Connected sites shows the remaining budget
and Revoke clears it. Message signing still asks every time.
Host: approvalModal accepts `select` {id, label, options}; a chosen value
comes back as "+<id>=<value>" and is validated against the offered options.
Adds a "Search for '<selection>'" item to the page context menu when
the user right-clicks with text selected. Uses SEARCH() so it honours
whichever engine the user has picked (Startpage default, or their own
via the picker), opens in a new foreground tab so the current page
isn't lost, and truncates the label at 40 chars so a long selection
doesn't stretch the menu. Ampersands in the label are doubled so
Chromium doesn't eat them as accelerator markers.
wallet-inject.js runs in the isolated world of https://*.x pages and exposes
window.bitcoincash { isTheseus, version, network, getAddress, signAndSend,
signMessage }. Every call is routed page -> addon-page-msg -> activate()
handler -> approval overlay showing the requesting origin:
- getAddress: approval with an "always allow" checkbox; grants persist in
api.storage.permissions and are listed/revocable under Settings.
- signAndSend / signMessage: approval on every call, never remembered.
signMessage returns a BIP-137 recoverable signature (verified offline).
- one pending approval per origin; page-facing errors never echo balance.
Host fix: the inject IPC assigned event.returnValue twice, so pages always
got an empty script list.
Send tab: recipient (cashaddr or legacy, testnet rejected), amount with
BCH/sat toggle and Max, 1-5 sat/B fee slider, live fee/total preview via
planSend. Sending goes plan -> approval-modal (To/Amount/Fee/Total) ->
ECDSA DER + SIGHASH_ALL|FORKID -> blockchain.transaction.broadcast, then
shows the txid with an explorer link. Confirmed coins are spent before
unconfirmed; dust change folds into the fee. Verified end to end against a
fake Fulcrum: broadcast tx re-parsed, sighash recomputed, signature checks.
Manifest declaring sidebar-panel, vault-derive, page-inject (https://*.x)
and approval-modal; registers the Wallet sidebar panel. Shows up in
Settings > Extensions and opens from the sidebar.
Three opt-in capabilities for add-ons, plus the plumbing they need:
- vault-derive: api.vault.derive("<id>/<path>") resolves once the password
vault is unlocked with a 32-byte HKDF child of the vault root under
"silentmode/addons/<path>". Path must start with the add-on id.
- page-inject: manifest "page-inject" {preload, origins}; a session-wide
preload asks main (sync, against the committed URL) which add-on bridges
apply and runs them in the isolated world with a scoped `theseus` object.
- approval-modal: api.approvalModal({title, body, origin, rows, actions,
checkbox}) shows a consent overlay over the tab area (approval.html);
resolves to the picked action id, "cancel", or "<id>+<checkbox>".
- api.onMessage/emit + window.silentmode.invoke/on for panel <-> activate()
messaging; page bridges use addon-page-msg, gated by tab + origin match.
- api.require so add-ons can share Theseus's dependency tree.
Setup e2a30a3b280448f8eb6e08efd21e208022b2a37cef14a72076b3f32b7a2fc529
Portable eca7cf3347a958307b8e2ba4f6266c81f8ec691b0c98ed6e24fdd70e65723b1e
Bundled fixes since 0.3.5:
d3c3298 - Chrome-view gap root cause: body no longer inherits the chrome
view's height, so document.body.scrollHeight now measures actual content
and syncHeight can shrink chrome back after a menu close. The growing
blank strip above the page is gone (was previously ratcheting to the
260px clamp on every menu open).
1b4a3c3 - Bookmarks: favicons on every row (backfilled on revisit for
older entries) + Edit title actually works via an in-page modal (Electron
BrowserViews disable window.prompt, which is why the previous menu item
silently did nothing).
952bf5f - Tab tooltip on hover shows title + URL, the way Chrome/Firefox
do it. Uses the url field already present in the per-tab payload.
f591475 - Error page gets a first-class "You appear to be offline" kind
that fires when navigator.onLine is false — no more false "not registered"
verdicts when you're just disconnected. Plus a "did you mean" row that
suggests near-match BCNR names (Levenshtein ≤ 2, same TLD) from the warm
shared index — no network required, works offline. Click a suggestion
to retry with the original path preserved.
b9d70e4 - 750ms self-heal on chrome-view height as belt-and-suspenders
for any future overlay path that bypasses closeAllMenus.
Deployed: scp + sia-upload of both trees. Verified LIVE 0.3.6.
Every .tab now carries a native title="<title>\n<url>" so hovering the
tab shows the page's own title and the URL (the way Chrome/Firefox do
it). Uses the url already present in the per-tab payload emitTabs sends;
no extra IPC.
