diff --git a/docs/changelog/v1.13.00.md b/docs/changelog/v1.13.00.md index 5f38cbd568..d98be693d9 100644 --- a/docs/changelog/v1.13.00.md +++ b/docs/changelog/v1.13.00.md @@ -4,9 +4,10 @@ Highlights: - Adds an **in-app Browser for Nostr web clients**, with support for **Nostr Web Apps (NIP-5D napplets)** and **static websites (NIP-5A nSites)**. They run in a - keyless sandbox that can never touch your private key — every signature, - payment, or data read needs your explicit approval. "Log in with Amethyst" - lets Nostr web apps sign in as you. + keyless sandbox that can never touch your private key. Payments always prompt + with the amount shown; signing and data access are permission-gated, with the + scope you choose when you connect. "Log in with Amethyst" lets Nostr web apps + sign in as you. - Adds **Communities (Concord)**: a new end-to-end-encrypted communities protocol with channels, invites, roles, moderation, and full history — browsable and chattable from Messages. @@ -16,10 +17,11 @@ Highlights: - Adds a **Remote Signer (NIP-46)**: for the first time, other apps and websites can sign through Amethyst — with informed, per-account consent — whether your key lives in Amethyst or on an external signer like Amber. Also adds a - **Privacy Lock** that gates your Messages behind a password or biometric. + **Privacy Lock** on Desktop that gates the Messages and Wallet columns behind + a password. - Adds **relay login permissions (NIP-42)**: when a relay asks you to - authenticate, choose Once / Always / Never per relay, with one-tap trust for - your follows' relays. + authenticate, choose Once / Always / Never per relay, with one-tap rules to + trust relays used by people you follow. - Adds **NIP-29 Groups**: relay-hosted group chat with subgroups, custom roles, invite links, threads, and pinned messages. - Redesigns the **Messages inbox**: groups community and group channels with @@ -34,6 +36,20 @@ Highlights: options that flow through buttons, badges, and highlights. - Adds **proof-of-work (NIP-13)** publishing and **negentropy (NIP-77)** sync. +## Upgrading + +- Web apps, napplets and nSites now get **separate storage per account** — + cookies, logins and site data no longer leak between the accounts on your + device. Existing sites are signed out once as a result; signing back in stores + the session under the account you are using, and switching away and back keeps + it. +- Permissions you granted to web apps are likewise **per account** now, so each + app asks once more under each account you use it with. A permission granted by + one account no longer applies to the others. +- Apps connected through the remote signer (NIP-46) now **ask before signing a + relay login** (NIP-42) instead of approving it automatically under the + "Let's be reasonable" trust level. + ## New Features ### Web Apps, Sites & the Browser @@ -43,8 +59,8 @@ Highlights: cannot reach your private key, storage, or data. - Adds an in-app Browser — a drawer entry and pinnable bottom-bar tab — with an omnibox address bar, autocomplete, history, favorites, recents, and captured - favicons. The trusted app draws the address bar so a page can never spoof its - URL. + favicons. The address bar is drawn by Amethyst, never by the page, so its URL + cannot be spoofed. - Adds "Log in with Amethyst": nSites open with a NIP-07 `window.nostr` provider, so standard Nostr web apps can sign in and request signatures as your active account — consent-gated, sign-only, and scoped per site. @@ -53,7 +69,7 @@ Highlights: badges) — every capability brokered and permission-gated (once / this session / always). - Pins favorite web apps to the bottom bar as embedded, swap-in-place tabs that - stay warm and show the app's own icon. + stay warm between visits. - Discovers web apps: the empty browser suggests a curated list plus nSites and napplets published by people you follow, and profiles gain an "Apps & Sites" tab. @@ -79,7 +95,9 @@ Highlights: - Groups channels by community in Messages with last-message, unread counts, facepiles, and live typing. - Adds moderation: ban/unban with read-time enforcement, role grants, a "Make - admin" toggle, and a full member roster. + admin" toggle, and a full member roster. A ban hides a member's posts for + everyone else; removing their access to the community's keys takes a + Refounding. - Backfills channel history across epochs, paging back to the true start of a channel. - Surfaces Concord replies and reactions on the Notifications tab with a @@ -92,7 +110,8 @@ Highlights: - Reads code with branch/tag switching, file search, image preview, commit history, syntax highlighting, and word-level diff highlighting. - Reviews patches and pull requests with computed diffs and status actions; PR - updates surface on the repo screen. + updates surface on the repo screen. The code browser needs a repository with an + http(s) clone URL. - Manages issues: Issues and Patches & PRs tabs split by open/closed, issue labels with filtering, and a full-screen New Issue composer. - Edits a repository announcement from the repo screen, bookmarks repositories, @@ -104,8 +123,9 @@ Highlights: - Adds Location Channels: geohash-based public rooms that interoperate with BitChat, browsable from a dedicated drawer list and pinnable to the bottom nav. -- Posts under an unlinkable per-area anonymous identity (with an optional - nickname that survives restarts), or opt in to post as your real account. +- Posts under an unlinkable per-area anonymous identity, or opt in to post as + your real account. An optional nickname survives restarts, but it is a single + handle reused in every area — setting one links your posts across areas. - Teleports to any place from a map picker or the feed-filter dialog to read and post to distant rooms, and follows a teleported place to keep its feed. - Reacts, zaps, and replies on location messages, with a "live near you" bubble @@ -126,37 +146,34 @@ Highlights: ### Remote Signer & Security - Lets other apps and websites sign through Amethyst for the first time - (NIP-46): connect by scanning or pasting a `nostrconnect://` code or a - `bunker://` link, and keep signing in the background — whether your key is - stored directly in Amethyst or delegated to an external signer like Amber - (NIP-55). + (NIP-46): connect by scanning or pasting a `nostrconnect://` code, and keep + signing in the background — whether your key is stored directly in Amethyst or + delegated to an external signer like Amber (NIP-55). - Asks for informed consent before authorizing an app — showing its name and icon, which account will sign, the exact permissions, and an event preview — with per-account sheets and one-tap batched approval. - Manages connected apps from a dedicated screen with per-app relay list, live health, time-bound grants, and instant "forget this app". -- Adds a Privacy Lock for Messages (Android and Desktop): gate your DMs behind a - password or biometric, with an inactivity auto-lock and optional preview - redaction. +- Adds a Privacy Lock on Desktop: gate the Messages and Wallet columns behind a + password, with an auto-lock timeout. It is a screen gate, not encryption at + rest — messages continue to sync while it is locked. - Adds interactive relay login prompts (NIP-42): choose Once / Always / Never per relay, with venue-aware prompts for public chats, communities, and live - streams, and one-tap trust for your follows' relays. + streams, and one-tap rules to trust relays used by people you follow. ### Web of Trust (GrapeRank) -- Computes GrapeRank Web-of-Trust scores by crawling the social graph and scoring - every user — now even without a personal account (operator-less mode). -- Crawls followers in reverse (who follows a user) alongside follows-of-follows, - and tracks hop distance and follower count on trust cards. -- Discovers score providers via NIP-85 and fetches follow/profile data through - each author's own outbox relays for fuller coverage. +- Discovers Web-of-Trust score providers via NIP-85 and shows hop distance and + follower count on trust cards. Computing the scores — crawling the social graph, + reverse-follower crawling, and publishing NIP-85 cards — is done by the `amy` + command-line tool, not the app; see the Cli section. ### Publishing & Sync - Adds proof-of-work (NIP-13) publishing: a fire-and-forget mining queue with per-account difficulty and per-category settings, scheduled-post mining, and - per-post overrides, shielded by a foreground service and mined across all - cores. + per-post overrides, shielded by a foreground service and mined across half the + device's cores. - Adds NIP-77 negentropy sync as a first-class capability, with deletion (NIP-09/62) propagation so scoped syncs no longer strand deletions. - Shows PoW mining progress, and surfaces PoW, OpenTimestamps, and location @@ -232,8 +249,8 @@ Highlights: - Adds an HTTP/2 keepalive ping to stop stale-connection image stalls, and trims the image cache and player warm pool under memory pressure. - Hardens the relay client: enforces blocked relays on every REQ/COUNT/publish, - stops re-sending REQs relays refuse, evicts failures on the first strike, and - fixes reconnect backoff on network/transport changes. + backs off from REQs relays repeatedly refuse, drops relays that fail hard + during crawls, and fixes reconnect backoff on network/transport changes. - Fixes nutzap relay routing to receive/advertise on inbox/DM (kind 10019) relays instead of outbox. - Fixes Concord invite handling (revocation, keyless CORD-05, clearer failure @@ -248,8 +265,8 @@ Highlights: main thread. - Serializes account construction so concurrent loaders can't build duplicate accounts. -- Routes Onion-Location through every HTTP client and maps Tor/Arti errors to - accurate SOCKS reply codes. +- Routes Onion-Location through the Android app's HTTP clients and maps Tor/Arti + errors to accurate SOCKS reply codes. - Extracts the rich-text renderer and many event cards (calendar/RSVP, podcast atoms/splits, relay discovery, code snippet, ecash mint, activity, Git diff/status, and more) into shared commons so Desktop and Android render