Parse and render the Podcasting-2.0 show fields the kind:30078 metadata carries
beyond the basics:
quartz:
- Extend PodcastShow with author, categories, funding URLs, explicit, complete
and copyright as interface defaults — so NIP-F4 (kind:10154) needs no change
and just returns empties, while Podcasting-2.0 overrides them.
- Podcasting20PodcastMetadata now parses categories, funding[], copyright,
type, complete, locked, email and guid from the JSON content (value/V4V is
still skipped). Covered by expanded tests incl. an all-absent default case.
amethyst:
- Rebuild the podcast metadata card: an author byline, tinted pills for
Completed / Explicit / genre categories, a prominent filled "Support the show"
button opening the funding URL, clickable website chips with a globe icon, and
a subtle copyright footer — all Material3, no new icons/font subset needed.
Read-only. New strings: podcast_explicit/completed/premium/support_show/by_author.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Trailers were parsed and cached but invisible. Surface them:
- PodcastTrailerListItem: a compact trailer row with a "Trailer" badge (and
season, when present) that plays the media through the shared episode audio
player via PodcastAudio. Used both on the show page and as the inline
renderer (NoteCompose dispatches kind:30055 to it).
- OnePodcastEpisodesFeedFilter now also pulls kind:30055 trailers for the
show's pubkey; PodcastScreen renders trailer rows distinctly from episodes
and excludes them from the header's episode count.
- FilterOnePodcast requests the show author's full output — adds kind:30054
(a pre-existing gap) and kind:30055 alongside the NIP-F4 kinds.
Two new strings (podcast_trailer, podcast_trailer_season). Read-only; trailers
stay scoped to the show page and aren't mixed into the global episodes feed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Closes the read path for podstr-style podcast shows so they arrive proactively
instead of only rendering when already cached.
makePodcastsFilter now emits two REQs: the existing NIP-F4 kind:10154 shows plus
a kind:30078 REQ constrained to `#d=["podcast-metadata"]` (the app-data kind is
overloaded, so the d-tag constraint is mandatory). To carry that constraint, an
optional `additionalTags` map is threaded through every topNav podcast
subassembly variant (authors, follows, muted-authors, global, hashtag, geohash,
all-communities, single-community); variants that already pin their own tags
(#t/#g/#a) merge it via the new mergeFilterTags helper. The default is null, so
episode and NIP-F4 REQs are byte-identical to before.
Covered by MergeFilterTagsTest.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Companion to the episode merge: unify show-level metadata across both drafts.
quartz:
- Add a spec-neutral PodcastShow interface (title/image/description/websites).
- NIP-F4 PodcastMetadataEvent (kind:10154) implements it directly.
- Add Podcasting20PodcastMetadata, a read-only view over a kind:30078 NIP-78
app-data event with d="podcast-metadata" whose channel fields live in a JSON
content blob (lenient parse; unknown keys like value/funding/categories are
ignored). resolvePodcastShow()/isPodcastShowEvent() adapt either kind.
amethyst:
- PodcastsFeedFilter merges kind:10154 with kind:30078 (d="podcast-metadata"),
both from LocalCache.addressables, gated by isPodcastShowEvent so the 30078
scan ignores unrelated app-data.
- RenderPodcastMetadata renders via PodcastShow; NoteCompose dispatches a
podcast-metadata app-data note to it and keeps the text fallback otherwise.
Read support only. The kind:30078 metadata still needs a d-constrained relay
subscription to arrive proactively — that touches the topNav subassembly
plumbing and is left as the remaining step; shows already in cache merge and
render today.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Wire kind:30054 (and kind:30055 trailers) end-to-end so Podcasting-2.0
episodes appear alongside NIP-F4 kind:54 episodes in one list:
- LocalCache consumes both new kinds as addressable replaceables.
- PodcastEpisodesFeedFilter and OnePodcastEpisodesFeedFilter now merge
kind:54 (LocalCache.notes) with kind:30054 (LocalCache.addressables),
gating on the shared PodcastEpisode interface.
- The episode renderer, compact list row, and inline audio player read
through PodcastEpisode / PodcastAudio, so one render path serves both
kinds; NoteCompose dispatches kind:30054 to it.
- Relay subscriptions request kind:30054 alongside kind:54.
Read support only — Amethyst still publishes NIP-F4.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Amethyst's podcast support (NIP-F4) and derekross/podstr use incompatible
identity models: NIP-F4 makes each podcast its own keypair with regular
kind:54 episodes, while the Podcasting-2.0 draft signs editable, addressable
kind:30054 episodes with the human creator's key. The two cannot share a wire
kind, but a client can still render them in one list.
Add the Podcasting-2.0 episode (kind:30054) and trailer (kind:30055) event
classes plus their tags, and introduce a spec-neutral `PodcastEpisode`
abstraction (with `PodcastAudio`) that both kind:54 and kind:30054 implement.
Feeds and UI can now depend on the shared interface and surface both kind sets
in a single, ordered podcast/episode list. NIP-F4 remains Amethyst's publish
format; this only adds read/parse support for the Podcasting-2.0 kinds.
Register both new kinds in EventFactory and KindNames. Covered by round-trip,
spec-example-JSON, and a unified-list test proving both kinds flow through the
shared abstraction.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JGa1EM5KWyDo1o5Yr6sS18
Add a new top-level feed for NIP-34 Git repository announcements
(kind 30617), mirroring the Pictures/Videos/Workouts feeds.
- GitRepositoriesFeedFilter scans LocalCache addressables for kind 30617
- Full top-nav filter support (follows, authors, global, hashtag,
geohash, communities, muted) via a per-relay sub-assembler set
- Wired into AccountFeedContentStates, the relay subscription
coordinator, bottom-bar preloaders, navigation, drawer and the
persisted per-feed follow-list setting
- Reuses the shared RenderGitRepositoryEvent card via the standard feed
render path, enriched with topic chips and a personal-fork badge
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GS371vPHy3PhMfQyeAHmZC
Adds androidx.compose.runtime:runtime-tracing and tracing-perfetto so
recompositions show up as named slices in Perfetto system traces — the
tool used to attribute the cold-start feed first-paint cost to specific
composables. debugImplementation only (not shipped); all Apache-2.0.
Usage (runtime-enable broadcast) documented inline.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The debug-only MemoryUsageChip ("X/YMB" top-bar indicator, gated on
isDebug) polls collectMemorySnapshot() every 2s from a produceState
block, which runs on the main thread. That reads coil3.disk.DiskLruCache
.size(), a @Synchronized call. On cold start the Coil disk cache holds
that monitor for several seconds (journal init + the burst of image
writes from the initial relay event flood), so the UI thread blocked
inside size() — the "Loading account" frame couldn't repaint until it
returned. Profiling showed a single ~8s render frame and the UI thread
"blocking from coil3.disk.DiskLruCache.size()".
Collect the snapshot via withContext(Dispatchers.IO) so the synchronized
read blocks a background thread instead of the UI. The "Loading account"
stall on cold start drops from ~15-20s to ~5s. Debug-only path, so this
never affected release builds.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Some codec failures never surface as a PlaybackException: a software HEVC
decoder that can't keep up (e.g. iPhone-recorded hvc1 video on a device
without a HEVC hardware decoder) just parks the player in STATE_BUFFERING
forever — the buffer fills to the LoadControl cap, the playhead never leaves
0, and no error is ever raised. WatchPlaybackErrors only listened for
onPlayerErrorChanged, so the existing RenderPlaybackError "Open in browser"
overlay never showed and the user stared at a blank buffering box.
Add a decode-stall watchdog that polls the controller and synthesizes a
PlaybackException (ERROR_CODE_DECODING_FORMAT_UNSUPPORTED) once the player
sits in STATE_BUFFERING, wanting to play, with >=2s of media buffered ahead
(decoder is fed, not network-starved) yet a frozen playhead for 8s. The
buffer-ahead guard distinguishes a hung decoder from genuine network
starvation, whose buffer is depleted and so is never flagged.
Recovery is automatic: the overlay clears on the STATE_READY transition and,
belt-and-suspenders, the watchdog drops it the instant the playhead advances
again — so a slow device that eventually decodes "just plays." Also narrow
the recovery-clear to STATE_READY only (clearing on STATE_BUFFERING would
wipe the synthetic error instantly) and clear on onMediaItemTransition so a
pooled player starting a new video resets cleanly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pinned web apps in the bottom nav warm reliably because EmbeddedTabFactory
only needs their URL, but a pinned nsite/napplet (FavoriteApp.NostrApp) could
not warm: favorites store only a kind:pubkey:dtag coordinate, and nothing
pulled that addressable manifest into LocalCache until the user opened the
napplet/nsite discovery screen. So embedParams() returned null and the
EmbeddedTabPreloader gave up.
Add FavoriteAppManifestPreloader, mounted once in the logged-in shell
(independent of the API-30 embedded-surface gate, since the full-screen
launcher benefits too). For each NostrApp favorite it drives the existing
EventFinder (via observeNote) to fetch the manifest's coordinate into
LocalCache, so the preloader and launcher can resolve it.
Also cache the resolved manifest event JSON device-locally in
FavoriteAppsRegistry (a second DataStore key, same single-key shape as the
favorites list) and seed LocalCache from it when relays stay silent shortly
after launch, so a pinned nsite/napplet resolves instantly and offline on the
next cold start. The cached copy is re-verified (wasVerified=false) before it
enters the cache, and refreshed whenever a newer manifest arrives.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LroBCry1UiXWf9Y4fk4b9h
The per-account ViewModelStore was managed by a hand-rolled registry
(StoreOwnerRegistry + ScopedViewModelStoreOwner + a RememberObserver) that
tracked configuration changes manually. Its own TODO admitted it could not
clear a store detached around a configuration change, so AccountViewModels
(and their child ViewModels, feed states and relay subscriptions) leaked and
stayed active after switching accounts.
Replace the whole registry with androidx.lifecycle 2.11's
rememberViewModelStoreOwner (already on the classpath at 2.11.0). The owner is
keyed by the account public key via key(): while an account stays logged in
the owner survives recompositions and configuration changes (it is parented to
the Activity's LocalViewModelStoreOwner); when the account changes the previous
owner leaves the composition and its ViewModelStore is cleared immediately.
Deletes ~95 lines of lifecycle plumbing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0154te1AiD1Ykz1HCa8ao2Vo
Bugs / inconsistencies found while reviewing the branch for merge:
- dependenciesInfo comment falsely claimed Play "still derives this data
server-side, nothing is lost." Not true: includeInBundle=false means the
.aab carries no dependency metadata, so Play Console's dependency-insights /
SDK-vulnerability alerts go unpopulated (uploads still succeed). Corrected
the comment and the BUILDING.md framing (it called the blob "the one
remaining blocker" when the Arti .so was the bigger one).
- Version-bump workflow was broken: the README told you to run
`build-arti.sh --clean` to refresh Cargo.lock, but the build is now --locked
(fails on a stale lock) and the clone moved to the canonical /tmp path. Added
a dedicated `--regen-lock` mode (clone + cargo generate-lockfile, no NDK
needed) and pointed the docs at it. Verified it reproduces the committed lock
byte-for-byte.
- verify-reproducible.sh: new helper that builds twice and diffs to prove
byte-for-byte reproducibility; uses portable sha256 (sha256sum/shasum) and
plain `sort` so it runs on macOS too.
- README verify recipe referenced paths that only resolved from the repo root
while telling you to cd into tools/arti-build — replaced with the helper.
- rust-toolchain.toml listed four Android targets but only two ABIs ship a
.so; trimmed to match (check_prerequisites adds any other on the fly).
- BUILDING.md: documented that the bundled Arti .so is reproducible-from-source
and that secp256k1/webrtc are version-pinned Maven prebuilts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JtjUcSjjpu4auFndw1QKeU
Continues moving genuinely platform-agnostic leaves out of the :amethyst app
module so they compile once in :commons instead of across all six app variants.
Moved (no Android coupling, no foundation deps):
- ui/layouts/DisappearingBarState, DisappearingBarNestedScroll, PaddingMerge
-> commons commonMain (com.vitorpamplona.amethyst.commons.ui.layouts)
- ui/components/UrlPreviewState
-> commons jvmAndroid (it references commons.preview.UrlInfoItem, which
lives in the jvmAndroid source set)
Consumers (incl. the existing DisappearingBar*Test unit tests, which stay in
:amethyst and now import from commons) updated to the new packages. No behavior
change.
Verified: :commons, :amethyst compilePlayDebugKotlin + compilePlayDebugUnitTest,
and :desktopApp:compileKotlin build clean; spotless applied.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNKcfjNszUZPQShYJjfmnf
Empirical finding: with the toolchain pin, locked deps, and
--remap-path-prefix all in place, two host builds of libarti_android.so at
the *same* path are byte-for-byte identical, but two builds at *different*
paths still differ — not in any embedded string (no path leaks into the
binary) but in the order rustc lays out functions/data, which it derives
from the real on-disk artifact paths. --remap-path-prefix only rewrites
embedded strings, not that internal ordering.
So compile in a fixed location (/tmp/amethyst-arti-build, overridable via
ARTI_REPRO_DIR) in both build-arti.sh and build-arti-host.sh. Any checkout
then produces matching bytes, which is what lets F-Droid / a verifier build
at the same canonical path and reproduce the shipped .so. This mirrors how
Rust libraries are reproduced elsewhere (F-Droid builds Rust at a fixed
path too).
Corrects the README, which previously implied path remapping alone gave
path-independent output.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JtjUcSjjpu4auFndw1QKeU
Merges nostr proposal e283c388 into main (replaces the closed e05208d9 with a
minimal guard). Adding/scanning your own read-only npub for a pubkey you already
hold the nsec for no longer downgrades the signing account — on Android it
wiped cached lists + disabled notifications, on desktop it orphaned the key.
Guarded at the single persistence point on each platform; desktop regression
test verified failing without the guard.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The libarti_android.so shipped in the APK is the one binary we compile
ourselves, and it was the remaining blocker to a verifiable build: a Rust
cdylib is only reproducible when the compiler, the dependency graph, and the
embedded build paths are all pinned. None were.
Pin all three:
- rust-toolchain.toml pins rustc (rustup auto-installs it + the Android
targets), so codegen is stable across machines.
- Cargo.lock is now generated and committed (501 packages); both build
scripts run `cargo --locked` so transitive versions can't drift.
- repro-env.sh (sourced by build-arti.sh and build-arti-host.sh) rewrites
host-specific absolute paths with --remap-path-prefix, disables incremental
compilation, and sets a fixed SOURCE_DATE_EPOCH derived from the Arti tag.
With these, an independent rebuild of the pinned tag reproduces the committed
.so bit-for-bit, which is what lets F-Droid / Zapstore verify it from source
instead of trusting a prebuilt blob. README documents the pins and a
two-path build-and-diff verification recipe.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JtjUcSjjpu4auFndw1QKeU
Accounts dedup by npub (= pubkey), so adding/scanning your own read-only npub for
a pubkey you already hold the nsec for would overwrite the signing account:
- Android: setDefaultAccount rewrote the per-npub file from fresh read-only
settings — wiping the account's cached follow/relay/mute lists and flipping
hasPrivKey off, which silently disables its push notifications (every
notification path early-returns on !hasPrivKey). The account looked lost ("can't
post anymore") even though the nsec survived on disk.
- Desktop: saveCurrentAccount overwrote signerType to ViewOnly, orphaning the
stored key and routing every later switch through loadReadOnlyAccount.
Guard the downgrade at the single persistence point on each platform: when the
account being made current is read-only and a SIGNING account already exists for
the same pubkey, keep the signing account and switch to it instead. A signing
account already subsumes a read-only one, so this loses nothing.
- Android LocalPreferences.setDefaultAccount now returns the settings that
actually became current; AccountSessionManager.loginAndStartUI shows that.
- Desktop AccountManager.saveCurrentAccount reuses switchAccount() to reload the
signing account. Covered by a regression test (verified failing without the
guard).
This replaces the closed proposal e05208d9, which solved the same underlying bug
with a much heavier accountId rework (separate npub/nsec switcher entries — a
niche feature) that itself shipped a logout(deleteKey=true) data-loss bug.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Render the repository screen's Issues and Patches & PRs tabs with a
lightweight one-line-per-item row (author picture, name, NIP-05, subject,
time, status pill and the shared 3-dot options) instead of the full
NoteCompose renderer, which is tuned for items shown inside a regular
feed. Injected via RefresheableFeedView's existing onLoaded slot, so the
feed filters and status-split view models are untouched.
The rows reuse and re-layer the same gating NoteCompose applies — event
loading (WatchNoteEvent), mute/block/report hiding
(CheckHiddenFeedWatchBlockAndReport) and the long-press quick-action menu
— so blocked authors and reported items are hidden here exactly as
elsewhere. No body or media is rendered, so sensitive content never
reaches this list.
Adds GitPatchEvent.subject(), which parses the patch title from the
git-format-patch Subject header (stripping the [PATCH n/m] prefix and
unfolding continuation lines), with unit tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013gs6pxiq58X18Fkz9wdZhU
Merges nostr proposal 488e8447 (v2) into main: adds `amy namecoin resolve`
+ `amy namecoin servers` (stateless ElectrumX Namecoin resolution over the
quartz NamecoinNameResolver). The v2 revision fixes the `--server` override to
reuse the shared NamecoinSettings.parseServerString so it keeps
usePinnedTrustStore=true (self-signed Namecoin servers otherwise fail TLS),
plus strict --timeout parsing and accurate docs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
First Tier A slice of the UI/components extraction. Moves the genuinely
platform-agnostic leaf composables — those with zero :amethyst
dependencies and no Android coupling — from the app module into the
shared :commons KMP module (commonMain):
ClickableTexts, ForwardingPainter, GenericLoadable, GlowingCard,
LoadingAnimation, TranslationConfig, ZonedSwipeModifier (~616 LOC)
These now live under com.vitorpamplona.amethyst.commons.ui.components and
compile once in :commons (cacheable, incremental) instead of being part
of every one of the six :amethyst variant compilations (play/fdroid ×
debug/release/benchmark). That shrinks the app-module Kotlin compilation
unit — the root cause of the CI Kotlin-daemon OOM — rather than renting
headroom with heap flags.
Consumers updated to import from the new package; no behavior change.
Verified: :commons, :amethyst compile{Play,Fdroid}DebugKotlin, and
:desktopApp:compileKotlin all build clean; spotless applied.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNKcfjNszUZPQShYJjfmnf
`amy namecoin resolve --server` hand-rolled its own ElectrumX server-string
parser that constructed `ElectrumxServer(host, port, useSsl)` and left
`usePinnedTrustStore` at its `false` default. The Namecoin ElectrumX servers
use self-signed certs, so a TLS connection with the default system trust
manager fails the handshake — meaning `--server electrumx.testls.space:50002`
could not connect even though that exact host resolves fine via the default
list. It also duplicated logic already in `commons`, violating the cli
thin-assembly-layer rule.
Delegate each comma-separated entry to the shared
`NamecoinSettings.parseServerString` (the same parser the Android/Desktop
Settings use), so the CLI inherits both the `host:port[:tcp]` syntax and
`usePinnedTrustStore = true`. The README claim that it "reuses the same …
pinned trust store as the apps" is now actually true for `--server` overrides.
Also: reject a non-integer `--timeout` as bad_args instead of silently
falling back to the default, and document exit code 2 + the `host:port[:tcp]`
syntax accurately.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add Namecoin NIP-05 resolution to the amy CLI as a stateless verb
group, matching the Android and Desktop apps' resolution surface.
amy namecoin resolve IDENT [--server URL[,URL]] [--timeout SECS]
amy namecoin servers
IDENT accepts the same shapes the apps accept: raw `d/` / `id/`
names, bare `.bit` domains, and `alice@example.bit` NIP-05-style
local-parts. Output is the resolved Nostr pubkey + relay list (+ the
resolved Namecoin name + matched local-part) as machine-readable
JSON (with `--json`) or human-readable text.
The verb is stateless — no account, no `~/.amy/`, no relays — so it
dispatches alongside `decode`/`encode`/`verify`/`nip`/`kind` before
account resolution and the secret store.
Zero new logic in cli/: the implementation is a thin command-file
wrapper around quartz's existing `NamecoinNameResolver` +
`ElectrumXClient` + the canonical `DEFAULT_ELECTRUMX_SERVERS` set
the apps already ship with, including the pinned trust store for
the self-signed Namecoin ElectrumX ecosystem.
amy is headless so no UI piece is wired in. The `--server` flag
accepts `host`, `host:port`, `tcp://`, `tls://`, `ssl://` per entry
(defaults to TLS on 50002); empty / malformed entries fail with
`bad_args` rather than silently using the default set, so a fat-
fingered override can't go unnoticed.
Outcomes from `NamecoinResolveOutcome` map to amy error codes:
Success -> emit JSON, exit 0
NameNotFound -> error not_found
NoNostrField -> error no_nostr_field
MalformedRecord -> error malformed_record (+ namecoin_name extra)
ServersUnreachable-> error servers_unreachable
InvalidIdentifier -> error invalid_identifier
Timeout -> error timeout
Smoke-tested end-to-end on macOS arm64 against the live ElectrumX
fleet:
$ amy --json namecoin resolve d/testls
{"identifier":"d/testls","namecoin_name":"d/testls",
"local_part":"_","pubkey":"460c25e6…","relays":[]}
$ amy namecoin servers
count: 6
servers:
- host: electrumx.testls.space
port: 50002
tls: yes
…
No new runtime deps. The "no Compose UI in the amy image" CI
assertion still passes — `NamecoinNameResolver` + `ElectrumXClient`
are pure JVM (kotlinx.coroutines + kotlinx.serialization, both
already on the CLI classpath via :quartz).
Tests: the resolver, ElectrumX client, identifier parser, and the
default server set already have JVM tests under
`quartz/src/jvmTest/.../namecoin/` — no new core code in this PR,
so the existing coverage applies. CLI verbs are exercised via the
shell harnesses in `cli/tests/`; a Namecoin harness fits the same
pattern but isn't included here.
Parity matrix in `cli/ROADMAP.md` flags `name_history` and the
Namecoin Core JSON-RPC backend as pending separate PRs — both
already exist on Android and Desktop but aren't on upstream main
yet (open PRs against this repo carry them).
Within the repository route's Issues and Patches & PRs tabs, add an
Open / Closed & Resolved segmented selector so items are partitioned by
their latest NIP-34 status. Open covers no-status, open (1630) and draft
(1633); Closed & Resolved covers closed (1632) and applied/merged (1631).
The feed filters now take a showClosed flag and consult GitStatusIndex.
Because a status event (kinds 1630-1633) doesn't mutate the issue/patch
note, the additive feed update can't move an item between buckets on its
own, so each view model watches GitStatusIndex.latestByTarget and forces
a full re-partition whenever it changes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013gs6pxiq58X18Fkz9wdZhU
Merges nostr proposal ae364d99 into main: adds Namecoin (.bit) name
resolution to the desktop home-tab search bar (desktopApp FeedScreen.kt).
Network IO runs off the UI thread, stale lookups cancel via effect re-keying,
and it reuses the shared NamecoinNameResolver. (Nit deferred: extract a shared
rememberNamecoinResolution helper to de-dup with SearchScreen.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a `.claude/skills/ngit-pr` skill and a pointer from CLAUDE.md so
agents know how to create, review, revise, and merge PRs in this repo.
This repo can publish a PR two ways and the difference is easy to get
wrong: a GitHub remote (canonical `main`, normal `gh` flow) and a
git-over-nostr remote (`ngit`, where PRs are nostr proposals on
gitworkshop.dev and a push fans out to GitHub + the GRASP servers).
The skill identifies remotes by URL (names vary per clone; a collaborator
may have only one), explains which path to use, and documents the
three-mains alignment gate (GitHub vs the lagging nostr `main` vs local
`main`) that the nostr create/revise/merge flows all depend on — the
thing that otherwise causes rejected pushes and revisions that never
appear on gitworkshop.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merges nostr proposal e5865428 (v2) into main:
- fix(tor): wire Onion-Location interceptors into every OkHttp client
(onionCache made non-nullable; OnionInterceptorWiringTest)
- refactor(napplet): route blob fetches through the shared OkHttpClientFactory
- fix(napplet): route brokered resource fetches by the applet's own Tor mode
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The consolidation passed `useProxy = true` for every brokered `resource.bytes`
fetch, forcing them through Tor whenever Tor was active — regardless of the
napplet/nSite's actual network mode. That overrides the user's explicit choice:
an nSite running in "open web" mode would still have its blob fetches tunneled,
inconsistent with how its own WebView page loads.
The authoritative per-applet preference already exists main-side in
NappletNetworkRegistry.useTor(coordinate) (locked napplets pinned to Tor;
nSites follow the persisted per-site toggle, which relaunches on change) — the
same source NappletLauncher reads to set the WebView proxy. Thread the calling
applet's coordinate through NappletResourceGateway.fetch so the broker can
resolve it, and pick the shared client with
getHttpClient(useProxy = NappletNetworkRegistry.useTor(coordinate)). This
mirrors the host's own `effectiveProxy = if (useTor) proxyPort else -1` exactly,
so a brokered fetch now routes like the applet's page.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The t4 onion-location proposal hand-wired OnionLocationInterceptor +
OnionUrlRewriteInterceptor into NappletResourceFetcher's private,
torPort-keyed OkHttpClient. That reached onion-routing parity but
duplicated the exact wiring OkHttpClientFactory already does, and the
private client still missed the local Blossom cache redirect, the shared
connection pool / HTTP-2 keepalive, and SurgeDns.
Inject the app-wide client instead: NappletResourceFetcher now takes a
() -> OkHttpClient and the broker supplies
`okHttpClients.getHttpClient(useProxy = true)` — the same DualHttpClientManager
path the image pipeline uses. Behavior-preserving for Tor (proxied when
Tor is active, clearnet when not) and, since these are sha256 blobs, the
shared Blossom-cache redirect is now a feature, not a loss. Drops the
private client + its cache and the hand-wired interceptors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pins the Onion-Location interceptor wiring introduced in #3368 across
every OkHttp client the app builds and closes two gaps the audit
surfaced:
* OkHttpClientFactory.onionCache was nullable with a null default.
A future call site constructing the factory without explicitly
passing the cache would silently disable onion-routing for the
entire HTTP role (image, upload, money, NIP-05, preview, push).
Tightened to required (matches DualHttpClientManagerForRelays).
* NappletResourceFetcher built a raw OkHttpClient with no interceptors.
Napplet HTTPS / blossom fetches over Tor would hit clearnet exit
nodes even when the destination advertised an onion. Wired through
the app-wide OnionLocationCache so a hint learned anywhere in the
app applies, and vice versa.
ElectrumX is intentionally excluded: it uses raw Socket/SSLSocket,
not OkHttp, so the Onion-Location HTTP header does not apply. Tor
routing for ElectrumX continues to go through the Tor-aware
SocketFactory plus the Namecoin _tor field on the record (a
stronger, blockchain-anchored trust path than a passive HTTP hint).
IsEmulator is made null-safe (each Build.* field coalesced to "") so
unit tests can stand up the affected classes without NPEing on the
JVM default-values stub of android.os.Build.
New OnionInterceptorWiringTest (11 cases) covers:
* locationInterceptor records the header under the clearnet host
(HTTPS path and WebSocket 101 upgrade)
* locationInterceptor with no header writes nothing
* rewriteInterceptor passes through unknown hosts
* rewriteInterceptor https -> https.onion preserves scheme
* rewriteInterceptor https -> http.onion downgrades safely
* rewriteInterceptor passes through unparseable cache values
* cache round-trip and shared-instance invariant
* compile-time pin that both classes remain okhttp3.Interceptor
Build:
./gradlew --no-daemon spotlessCheck OK
TZ=UTC ./gradlew --no-daemon :amethyst:testPlayDebugUnitTest 763 tests, 0 failures
./gradlew --no-daemon :commons:verifyKmpPurity :quartz:verifyKmpPurity OK
Claude
Vitor PamplonaandGitHub
vitorpamplonaandgithub-actions[bot]
roguehashrate
mstrofnoneandVitor Pamplona