v0.0.45 - Release: nested bookmark tree view with HMAC d tags, bookmarks toolbar, tarball cleanup trap, install next-steps fix

.gitignore

@@ -7,6 +7,13 @@ sovereign_browser
 *.dll
 build/
 
+# release tarballs (created by increment_and_push.sh -r, cleaned up by trap)
+*.tar.gz
+
+# compiled test binaries
+tests/test_bookmarks_tree
+tests/test_nostr_url
+
 # editor / OS
 *.swp
 .DS_Store

README.md

@@ -96,6 +96,58 @@ Working browser with a broad feature set:
 See [`docs/webkit-poc-findings.md`](docs/webkit-poc-findings.md) for the
 friction report from the POC phase.
 
+## Install
+
+One-command install on Debian 13 (trixie) or similar (x86_64, WebKitGTK 4.1):
+
+```bash
+curl -fsSL https://git.laantungir.net/laantungir/sovereign_browser/raw/branch/master/install.sh | bash
+```
+
+This downloads and runs [`install.sh`](install.sh), which:
+
+1. Installs runtime dependencies via `apt` (WebKitGTK 4.1, libsoup, curl, etc.)
+2. Installs **Tor** via `apt` (used for `.onion` routing)
+3. Builds and installs **FIPS** from source with `CAP_NET_ADMIN` (used for `.fips` mesh routing)
+4. Downloads the latest prebuilt `sovereign_browser` binary from the [Gitea releases](https://git.laantungir.net/laantungir/sovereign_browser/releases) (falls back to a source build if no binary is available)
+5. Installs a `sovereign-browser` wrapper command to `/usr/local/bin`
+
+After install, start the browser with:
+
+```bash
+sovereign-browser start --login-method generate
+```
+
+### Install options
+
+```bash
+# Non-root install to a user-writable prefix
+curl -fsSL <url> | INSTALL_PREFIX=$HOME/.local bash -s -- --yes
+
+# Force a source build instead of downloading the prebuilt binary
+curl -fsSL <url> | bash -s -- --build-from-source
+
+# Review the script before running it
+curl -fsSL <url> -o install.sh
+less install.sh
+bash install.sh
+```
+
+Run `bash install.sh --help` for the full option list.
+
+### What the install requires
+
+| Requirement | Why |
+|---|---|
+| Debian 13+ / Ubuntu 24.04+ (WebKitGTK 4.1) | The browser is dynamically linked against `libwebkit2gtk-4.1` |
+| x86_64 | Prebuilt binary is x86-64; arm64 needs `--build-from-source` |
+| `sudo` / root | For `apt install`, `setcap` on the FIPS binary, and writing to `/usr/local` |
+| Internet access | To download the binary, apt packages, and the FIPS source |
+
+Tor and FIPS are **installed by default** (not optional). If either is absent at runtime the browser degrades gracefully — clearnet still works, `.onion`/`.fips` show an error page — but the installer sets them up so everything works out of the box.
+
+---
+
 ## Build
 
 Requires Debian 13 (trixie) or similar with WebKitGTK 4.1 dev headers:

VERSION

@@ -1 +1 @@
-0.0.35
+0.0.45

increment_and_push.sh

@@ -27,6 +27,22 @@ print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1" >&2; }
 print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1" >&2; }
 print_error()   { echo -e "${RED}[ERROR]${NC} $1" >&2; }
 
+# --- Cleanup trap -------------------------------------------------------
+# Any temp files registered here are removed on exit, including when the
+# script is interrupted (Ctrl+C) or aborted by `set -e`. This prevents
+# leftover sovereign_browser-*.tar.gz files from accumulating in the
+# project root when a release run is interrupted.
+CLEANUP_FILES=()
+cleanup_on_exit() {
+    for f in "${CLEANUP_FILES[@]}"; do
+        [[ -n "$f" && -f "$f" ]] && rm -f "$f"
+    done
+}
+trap cleanup_on_exit EXIT INT TERM
+register_cleanup() {
+    [[ -n "$1" ]] && CLEANUP_FILES+=("$1")
+}
+
 # --- Config -------------------------------------------------------------
 
 # Gitea repo for release uploads (derived from the origin remote).
@@ -354,6 +370,10 @@ if [[ "$RELEASE_MODE" == true ]]; then
 
     local_tarball=""
     local_tarball=$(create_source_tarball || true)
+    # Register the tarball for cleanup so it's removed on exit even if a
+    # later step fails or the script is interrupted. The trap also catches
+    # the case where create_gitea_release aborts via `set -e`.
+    register_cleanup "$local_tarball"
 
     release_id=""
     release_id=$(create_gitea_release || true)
@@ -362,8 +382,8 @@ if [[ "$RELEASE_MODE" == true ]]; then
         upload_release_assets "$release_id" "$BIN_NAME" "$local_tarball"
     fi
 
-    # Clean up the tarball (the binary is gitignored already).
-    [[ -n "$local_tarball" && -f "$local_tarball" ]] && rm -f "$local_tarball"
+    # The tarball is removed by the cleanup_on_exit trap registered above,
+    # so no manual rm is needed here. The binary is gitignored already.
 
     print_success "Release flow completed: $NEW_VERSION"
 else

install.sh

@@ -5,7 +5,8 @@ set -euo pipefail
 #
 # Installs:
 #   * apt runtime deps (WebKitGTK 4.1, libsoup-3, tor, build toolchain)
-#   * FIPS (built from source from https://github.com/jmcorgan/fips) with CAP_NET_ADMIN
+#   * FIPS prebuilt binary from GitHub releases (source-build fallback via
+#     --build-fips-from-source) with CAP_NET_ADMIN
 #   * sovereign_browser prebuilt binary from Gitea releases (source-build fallback)
 #   * a `sovereign-browser` wrapper that detaches the GUI
 #
@@ -20,18 +21,22 @@ set -euo pipefail
 
 GITEA_API="https://git.laantungir.net/api/v1/repos/laantungir/sovereign_browser"
 GITEA_DOWNLOAD_BASE="https://git.laantungir.net/laantungir/sovereign_browser/releases/download"
-FIPS_REPO="https://github.com/jmcorgan/fips.git"
 SB_REPO="https://git.laantungir.net/laantungir/sovereign_browser.git"
+FIPS_GITHUB_API="https://api.github.com/repos/jmcorgan/fips/releases/latest"
+FIPS_REPO="https://github.com/jmcorgan/fips.git"
 INSTALL_PREFIX="${INSTALL_PREFIX:-/usr/local}"
 BIN_NAME="sovereign_browser"
 
 # Runtime apt packages (non-dev). git/build-essential/pkg-config are included
 # because they're needed for the FIPS source build and the source-build fallback.
 APT_PACKAGES=(
-    libwebkit2gtk-4.1-0 libsoup-3.0-0 libqrencode0 libsqlite3-0
-    libsecp256k1-1 libssl3 libcurl4 zlib1g
+    libwebkit2gtk-4.1-0 libsoup-3.0-0 libqrencode4 libsqlite3-0
+    libsecp256k1-2 libssl3t64 libcurl4t64 zlib1g
     tor git build-essential pkg-config
+    libcap2-bin
 )
+# libclang-dev is only needed when building FIPS from source (bindgen).
+APT_PACKAGES_FIPS_SOURCE=(libclang-dev)
 
 # --- Output helpers ------------------------------------------------------
 
@@ -75,21 +80,27 @@ Usage: curl -fsSL <url> | bash
    or: ./install.sh [options]
 
 Options:
-  --build-from-source    Build from source instead of downloading prebuilt binary
-  --prefix <dir>         Install prefix (default: /usr/local)
-  --yes                  Skip confirmation prompts
-  -h, --help             Show this help
+  --build-from-source          Build sovereign_browser from source instead of
+                              downloading the prebuilt binary
+  --build-fips-from-source    Build FIPS from source (cargo) instead of
+                              downloading the prebuilt binary. Slower; needs
+                              libclang-dev (auto-installed).
+  --prefix <dir>               Install prefix (default: /usr/local)
+  --yes                        Skip confirmation prompts
+  -h, --help                   Show this help
 EOF
 }
 
 # --- Args ----------------------------------------------------------------
 
 BUILD_FROM_SOURCE=false
+BUILD_FIPS_FROM_SOURCE=false
 ASSUME_YES=false
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
         --build-from-source) BUILD_FROM_SOURCE=true; shift ;;
+        --build-fips-from-source) BUILD_FIPS_FROM_SOURCE=true; shift ;;
         --prefix) INSTALL_PREFIX="${2:-}"; shift 2 ;;
         --yes|-y) ASSUME_YES=true; shift ;;
         -h|--help) show_usage; exit 0 ;;
@@ -163,12 +174,131 @@ install_deps() {
 }
 
 # --- FIPS ----------------------------------------------------------------
+#
+# FIPS is a Rust project (https://github.com/jmcorgan/fips). It publishes
+# prebuilt release tarballs on GitHub Releases containing the `fips` binary
+# plus tools (fipsctl, fipstop) and systemd units. We download the prebuilt
+# x86_64 Linux tarball by default — much faster than a cargo build.
+#
+# With --build-fips-from-source, we instead clone the repo and run
+# `cargo build --release` (requires Rust 1.94.1+ via rustup, and libclang-dev
+# for the rustables/bindgen nftables bindings).
+
+# Download the prebuilt FIPS tarball from GitHub Releases and extract the
+# `fips` binary. Outputs a stable binary path on stdout (the file is copied
+# to a caller-managed temp file so it survives after this function returns).
+# Returns non-zero on failure so the caller can fall back to a source build.
+download_fips_prebuilt() {
+    print_info "Querying GitHub for latest FIPS release..."
+    local api_json tag asset_url
+    if ! api_json="$(curl -fsSL "$FIPS_GITHUB_API" 2>/dev/null)"; then
+        print_warning "Could not reach FIPS GitHub releases API."
+        return 1
+    fi
+    tag="$(printf '%s' "$api_json" | grep -oE '"tag_name"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/')"
+    if [[ -z "$tag" ]]; then
+        print_warning "Could not parse tag_name from FIPS GitHub release JSON."
+        return 1
+    fi
+    # Find the linux-x86_64 tarball asset URL.
+    asset_url="$(printf '%s' "$api_json" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]*linux-x86_64\.tar\.gz"' | head -1 | sed -E 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/')"
+    if [[ -z "$asset_url" ]]; then
+        print_warning "No linux-x86_64 tarball found in FIPS release $tag."
+        return 1
+    fi
+
+    # Use a temp dir for download + extraction. We do NOT use a RETURN trap
+    # here because the caller needs to copy the binary out after this
+    # function returns — a RETURN trap would delete the file first. Instead
+    # we copy the binary to a stable temp file and clean up the extraction
+    # dir ourselves before returning.
+    local tmp fips_bin stable
+    tmp="$(mktemp -d -t fips_dl.XXXXXX)"
+    print_info "Downloading FIPS prebuilt binary: $asset_url"
+    if ! curl -fsSL -o "$tmp/fips.tar.gz" "$asset_url"; then
+        rm -rf "$tmp"
+        print_warning "FIPS tarball download failed."
+        return 1
+    fi
+    if ! tar -xzf "$tmp/fips.tar.gz" -C "$tmp" 2>/dev/null; then
+        rm -rf "$tmp"
+        print_warning "FIPS tarball extraction failed."
+        return 1
+    fi
+    # The tarball extracts to fips-<ver>-linux-x86_64/fips
+    fips_bin="$(find "$tmp" -type f -name fips 2>/dev/null | head -1 || true)"
+    if [[ -z "$fips_bin" ]] || ! file "$fips_bin" 2>/dev/null | grep -qi ELF; then
+        rm -rf "$tmp"
+        print_warning "FIPS tarball did not contain an ELF 'fips' binary."
+        return 1
+    fi
+    # Copy to a stable path so the caller can access it after we clean up
+    # the extraction dir. mktemp gives a file the caller can rm later.
+    stable="$(mktemp -t fips_binary.XXXXXX)"
+    cp -f "$fips_bin" "$stable"
+    chmod +x "$stable"
+    rm -rf "$tmp"
+    printf '%s' "$stable"
+}
+
+# --- Rust toolchain (only for --build-fips-from-source) ------------------
+
+FIPS_MIN_RUST_MAJOR=1
+FIPS_MIN_RUST_MINOR=94
+
+rust_version_ok() {
+    command -v cargo >/dev/null 2>&1 || return 1
+    local ver
+    ver="$(cargo --version 2>/dev/null | grep -oE 'cargo [0-9]+\.[0-9]+\.' | head -1 | sed 's/cargo //; s/\.$//')" || return 1
+    [[ -z "$ver" ]] && return 1
+    local major minor
+    major="${ver%%.*}"
+    minor="${ver#*.}"
+    [[ "$major" -gt "$FIPS_MIN_RUST_MAJOR" ]] && return 0
+    [[ "$major" -eq "$FIPS_MIN_RUST_MAJOR" && "$minor" -ge "$FIPS_MIN_RUST_MINOR" ]] && return 0
+    return 1
+}
+
+ensure_rust() {
+    if rust_version_ok; then
+        print_info "Rust toolchain OK ($(cargo --version))."
+        return 0
+    fi
+
+    if command -v cargo >/dev/null 2>&1; then
+        print_warning "Installed cargo ($(cargo --version)) is older than FIPS requires (1.94.1+). Installing a newer toolchain via rustup."
+    else
+        print_info "No cargo found. Installing Rust toolchain via rustup."
+    fi
+
+    local rustup_init
+    rustup_init="$(mktemp -t rustup-init.XXXXXX)"
+    if ! curl -fsSL --proto '=https' --tlsv1.2 -o "$rustup_init" https://sh.rustup.rs; then
+        rm -f "$rustup_init"
+        die "Failed to download rustup installer."
+    fi
+    if ! sh "$rustup_init" -y --profile minimal >/dev/null 2>&1; then
+        rm -f "$rustup_init"
+        die "rustup installation failed."
+    fi
+    rm -f "$rustup_init"
+    # shellcheck disable=SC1091
+    . "$HOME/.cargo/env" 2>/dev/null || true
+    export PATH="$HOME/.cargo/bin:$PATH"
+
+    if ! rust_version_ok; then
+        die "Rust toolchain installed but cargo still reports an insufficient version. FIPS requires 1.94.1+."
+    fi
+    print_success "Rust toolchain installed: $(cargo --version)."
+}
+
+# Build FIPS from source via cargo. Outputs the binary path on stdout.
+build_fips_from_source() {
+    print_info "Building FIPS from source ($FIPS_REPO)..."
+    ensure_rust
 
-install_fips() {
-    print_info "Building and installing FIPS from $FIPS_REPO (required, not optional)..."
     local tmp
     tmp="$(mktemp -d)"
-    # Register cleanup for this temp dir (in addition to the global trap).
     trap "rm -rf '$tmp' 2>/dev/null || true" RETURN
 
     if ! git clone --depth 1 "$FIPS_REPO" "$tmp/fips"; then
@@ -176,40 +306,52 @@ install_fips() {
     fi
 
     local fips_dir="$tmp/fips"
-    local built=false
-
-    if [[ -x "$fips_dir/build.sh" ]]; then
-        print_info "FIPS: running ./build.sh"
-        if ( cd "$fips_dir" && ./build.sh ); then built=true; fi
+    print_info "FIPS: running cargo build --release (this can take several minutes)..."
+    if ! ( cd "$fips_dir" && cargo build --release ); then
+        die "cargo build --release failed for FIPS. FIPS is required."
     fi
 
-    if ! $built && [[ -f "$fips_dir/Makefile" ]]; then
-        print_info "FIPS: running make"
-        if ( cd "$fips_dir" && make ); then built=true; fi
-    fi
-
-    if ! $built && [[ -f "$fips_dir/CMakeLists.txt" ]]; then
-        print_info "FIPS: running cmake"
-        if ( cd "$fips_dir" && cmake -B build && cmake --build build ); then built=true; fi
-    fi
-
-    if ! $built; then
-        die "Could not build FIPS (no build.sh, Makefile, or CMakeLists.txt succeeded). FIPS is required."
-    fi
-
-    # Locate the built fips binary.
     local fips_bin=""
-    for cand in "$fips_dir/fips" "$fips_dir/build/fips" "$fips_dir/build/src/fips"; do
+    for cand in \
+        "$fips_dir/target/release/fips" \
+        "$fips_dir/target/x86_64-unknown-linux-gnu/release/fips"; do
         if [[ -x "$cand" ]] && file "$cand" 2>/dev/null | grep -qi ELF; then
             fips_bin="$cand"
             break
         fi
     done
     if [[ -z "$fips_bin" ]]; then
-        # Last resort: search for any executable named fips.
-        fips_bin="$(find "$fips_dir" -type f -name fips -executable 2>/dev/null | head -1 || true)"
+        fips_bin="$(find "$fips_dir/target" -type f -name fips -executable 2>/dev/null | head -1 || true)"
     fi
     [[ -n "$fips_bin" ]] || die "FIPS build succeeded but no 'fips' binary was found."
+    printf '%s' "$fips_bin"
+}
+
+install_fips() {
+    print_info "Installing FIPS (required, not optional)..."
+
+    # If source build was requested, install the extra build-time apt deps.
+    if $BUILD_FIPS_FROM_SOURCE; then
+        print_info "Installing FIPS source-build deps (libclang-dev for bindgen)..."
+        local sudo_cmd=""
+        if [[ $EUID -ne 0 ]]; then sudo_cmd="sudo"; fi
+        $sudo_cmd apt-get install -y "${APT_PACKAGES_FIPS_SOURCE[@]}" >/dev/null 2>&1 || true
+    fi
+
+    local fips_bin=""
+    if $BUILD_FIPS_FROM_SOURCE; then
+        fips_bin="$(build_fips_from_source)"
+    else
+        if ! fips_bin="$(download_fips_prebuilt)"; then
+            print_warning "Prebuilt FIPS unavailable — falling back to source build."
+            # Install source-build deps on the fallback path too.
+            local sudo_cmd=""
+            if [[ $EUID -ne 0 ]]; then sudo_cmd="sudo"; fi
+            $sudo_cmd apt-get install -y "${APT_PACKAGES_FIPS_SOURCE[@]}" >/dev/null 2>&1 || true
+            fips_bin="$(build_fips_from_source)"
+        fi
+    fi
+    [[ -n "$fips_bin" && -x "$fips_bin" ]] || die "FIPS binary not available."
 
     local prefix_bin="$INSTALL_PREFIX/bin"
     local SUDO
@@ -218,6 +360,10 @@ install_fips() {
     $SUDO cp -f "$fips_bin" "$prefix_bin/fips"
     $SUDO chmod +x "$prefix_bin/fips"
     print_success "FIPS binary installed to $prefix_bin/fips"
+    # Clean up the temp binary (download_fips_prebuilt copies to a stable
+    # mktemp file; build_fips_from_source uses a RETURN-trapped dir so its
+    # output is already gone, but rm -f is safe on either).
+    rm -f "$fips_bin" 2>/dev/null || true
 
     # setcap for CAP_NET_ADMIN (needed to create a TUN interface in managed mode).
     local setcap_cmd=""
@@ -231,7 +377,6 @@ install_fips() {
         if $setcap_cmd cap_net_admin+ep "$prefix_bin/fips" 2>/dev/null; then
             print_success "FIPS granted CAP_NET_ADMIN."
         else
-            # setcap exists but failed — try with sudo explicitly.
             if $SUDO setcap cap_net_admin+ep "$prefix_bin/fips" 2>/dev/null; then
                 print_success "FIPS granted CAP_NET_ADMIN."
             else
@@ -413,18 +558,29 @@ main() {
     local method="prebuilt binary from Gitea"
     $BUILD_FROM_SOURCE && method="source build from $SB_REPO"
 
-    cat >&2 <<EOF
-${BLUE}[INFO]${NC} sovereign_browser will be installed:
-${BLUE}[INFO]${NC}   Install prefix : $INSTALL_PREFIX
-${BLUE}[INFO]${NC}   Binary method  : $method
-${BLUE}[INFO]${NC}   FIPS           : built from source ($FIPS_REPO), CAP_NET_ADMIN set
-${BLUE}[INFO]${NC}   Tor            : apt package 'tor'
-${BLUE}[INFO]${NC}   apt deps       : ${APT_PACKAGES[*]}
-EOF
+    local fips_method="prebuilt binary from GitHub releases"
+    $BUILD_FIPS_FROM_SOURCE && fips_method="source build ($FIPS_REPO, cargo)"
+
+    # Use print_info so colors render via `echo -e` (a plain `cat` heredoc
+    # would print the literal \033 escape sequences).
+    print_info "sovereign_browser will be installed:"
+    print_info "  Install prefix : $INSTALL_PREFIX"
+    print_info "  Binary method  : $method"
+    print_info "  FIPS           : $fips_method, CAP_NET_ADMIN set"
+    print_info "  Tor            : apt package 'tor'"
+    print_info "  apt deps       : ${APT_PACKAGES[*]}"
 
     if ! $ASSUME_YES; then
-        echo -e "${YELLOW}[WARNING]${NC} This will run apt-get install (sudo) and clone/build FIPS. Continue? [y/N] " >&2
-        read -r reply || reply=""
+        print_warning "This will run apt-get install (sudo) and clone/build FIPS. Continue? [y/N]"
+        # Read from /dev/tty, not stdin: in `curl | bash` mode stdin is the
+        # curl pipe (the script text), so a plain `read` would hit EOF and
+        # abort immediately. /dev/tty is the user's terminal.
+        if [[ -r /dev/tty ]]; then
+            read -r reply < /dev/tty || reply=""
+        else
+            # No tty available (e.g. non-interactive CI) — require --yes.
+            die "No tty available for confirmation. Re-run with --yes to skip prompts."
+        fi
         reply="${reply:-n}"
         if [[ ! "${reply,,}" =~ ^y(es)?$ ]]; then
             die "Aborted by user."
@@ -450,8 +606,9 @@ EOF
     print_success "sovereign_browser installed."
     cat >&2 <<EOF
 ${GREEN}[SUCCESS]${NC} Next steps:
-  Run:        sovereign-browser start --login-method generate
-  Or:         sovereign-browser start --login-method generate --url https://example.com
+  Run:        sovereign-browser
+  Or:         sovereign-browser --login-method generate
+  Or:         sovereign-browser --login-method generate --url https://example.com
   Data dir:   ~/.sovereign_browser/
   Logs:       sovereign-browser log
   Stop:       sovereign-browser stop

plans/bookmarks-tree-view.md

@@ -0,0 +1,261 @@
+# Plan: Nested Bookmark Tree View + Bookmarks Toolbar
+
+## Goal
+
+1. Support **nested folders** for bookmarks (e.g. `Work/Projects/Secret`) while staying fully NIP-51 kind 30003 compliant.
+2. Render the [`sovereign://bookmarks`](www/bookmarks.html:1) page as an **expandable/collapsible tree view**.
+3. Add a **bookmarks toolbar** (a horizontal bar of folder/bookmark buttons) below the URL bar in [`tab_manager.c`](src/tab_manager.c:2564).
+
+## NIP-51 Compliance + Privacy — How Nesting Works
+
+NIP-51 kind 30003 is parameterized replaceable: each event has a `d` tag that is an **opaque identifier string** used by relays to decide which event replaces which. We need the `d` tag to be:
+
+1. **Opaque** — relays must not learn the folder path (e.g. `Work/Projects/Secret`), because that leaks the user's organizational structure.
+2. **Deterministic** — the same path must always produce the same `d` so re-publishing replaces the prior event instead of accumulating duplicates.
+
+Encryption (NIP-4 or NIP-44) cannot satisfy (2): both use a random IV/nonce per call, so encrypting the same plaintext twice yields different ciphertexts. That would break NIP-33 replaceability.
+
+The right tool is a **MAC**: `d = HMAC-SHA256(key, path)` is deterministic and one-way. The HMAC key is derived from the user's Nostr privkey so it is per-user, never published, and automatically available on every device the user logs in on:
+
+```
+hmac_key = HMAC-SHA256(privkey_hex, "sovereign-browser/bookmarks-folder-id-v1")
+d        = HMAC-SHA256(hmac_key, path)   → 64 hex chars
+```
+
+### Event layout (one per folder)
+
+```
+{
+  "kind": 30003,
+  "pubkey": "<user pubkey hex>",
+  "tags":  [["d", "<HMAC-SHA256(hmac_key, path) hex>"]],
+  "content": "<NIP-44 encrypted JSON>",
+  ...
+}
+```
+
+The NIP-44 encrypted `content` plaintext is:
+
+```json
+{"path": "Work/Projects/Secret", "bookmarks": [
+  ["bookmark", "https://example.com", "Example", 1690000000]
+]}
+```
+
+The real path lives **inside the encrypted content** — relays see only the HMAC hash and opaque ciphertext. The `d` tag is used by relays purely for replaceability; the client never interprets it.
+
+### Tree reconstruction (client-side)
+
+1. Fetch all `kind=30003` events for the user's pubkey.
+2. For each event: NIP-44 decrypt the content, read `path` from the plaintext JSON.
+3. Split `path` on `/` and walk/create the trie (`node_ensure_path`).
+4. Attach the decrypted `bookmarks` array to that leaf node.
+
+Intermediate (empty) folders are represented by empty-bookmarks events for that path, so folder state — including empty folders — is preserved across devices.
+
+### Why this is safe and nostr-ish
+- The `d` tag is defined by NIP-33 as an arbitrary string identifier; a 64-char hex HMAC fits cleanly.
+- Content encryption (NIP-44 self-to-self) is unchanged from the existing implementation in [`src/bookmarks.c`](src/bookmarks.c:163).
+- HMAC-SHA256 is a one-line standard primitive; the key is derived from the user's Nostr privkey, so no extra credentials are needed.
+- Relays learn nothing about folder names, structure, or even folder count (they see only opaque hashes).
+- Existing flat directories (no slashes) load as root-level folders — no migration needed for the in-memory model. Legacy events with plaintext `d = "General"` will be detected on load (HMAC hex strings are 64 chars of `[0-9a-f]`; legacy names are not), decrypted, and re-published in the new HMAC-`d` format; the old events get a kind 5 deletion.
+
+```mermaid
+flowchart TD
+    A["kind 30003 events in SQLite/relays"] --> B["NIP-44 decrypt each content"]
+    B --> C["Read path from plaintext JSON"]
+    C --> D["Split path on / to get segments"]
+    D --> E["Build trie of folders via node_ensure_path"]
+    E --> F["Attach decrypted bookmarks to leaf node"]
+    F --> G["Render tree on sovereign://bookmarks page"]
+    G --> H["User adds/moves/renames/deletes"]
+    H --> I["Compute HMAC d tag for affected path(s)"]
+    I --> J["NIP-44 encrypt new content and publish kind 30003"]
+    I --> K["Emit kind 5 deletion for old d tags if renamed/moved/deleted"]
+```
+
+---
+
+## Implementation
+
+### 1. Data model — [`src/bookmarks.h`](src/bookmarks.h:36) / [`src/bookmarks.c`](src/bookmarks.c:32)
+
+The in-memory model changes from a flat `bookmark_dir_t[]` to a **tree**.
+
+#### New struct
+
+```c
+typedef struct bookmark_node {
+    char                *name;     /* last segment of path, e.g. "Secret" */
+    char                *path;     /* full path, e.g. "Work/Projects/Secret" */
+    bookmark_t          *bookmarks;
+    int                  bookmark_count;
+    struct bookmark_node *children; /* array of child nodes */
+    int                  child_count;
+    int                  child_cap;
+} bookmark_node_t;
+```
+
+The root is a single `bookmark_node_t` with `name = ""`, `path = ""`, no bookmarks, and children = top-level folders.
+
+#### New / changed API
+
+Keep the existing public functions working (they now operate on paths, not flat names):
+
+- `bookmarks_add(const char *path, const char *url, const char *title)` — `path` may contain slashes; intermediate nodes are created as empty events if they don't exist.
+- `bookmarks_remove(const char *path, const char *url)`
+- `bookmarks_move(const char *from_path, const char *url, const char *to_path)`
+- `bookmarks_create_dir(const char *path)` — publishes an empty kind 30003 event with `d = HMAC-SHA256(hmac_key, path)`.
+- `bookmarks_rename_dir(const char *old_path, const char *new_path)` — re-publishes the moved subtree: for the renamed node and every descendant, publish a new event with the new HMAC `d` tag and a kind 5 deletion for the old HMAC `d` tag.
+- `bookmarks_delete_dir(const char *path, int move_to_general)` — recursively delete the subtree (kind 5 deletion for each HMAC `d` tag in the subtree); optionally move bookmarks to `General`.
+- `const bookmark_node_t *bookmarks_get_root(void)` — returns the root node for traversal (replaces `bookmarks_get_dirs`).
+- `const bookmark_node_t *bookmarks_find(const char *path)` — lookup by path.
+
+#### Internal helpers
+
+- `static bookmark_node_t *node_find_child(bookmark_node_t *parent, const char *name)`
+- `static bookmark_node_t *node_ensure_path(bookmark_node_t *root, const char *path)` — walks/creates the trie.
+- `static void node_free(bookmark_node_t *node)` — recursive free.
+- `static void compute_hmac_key(unsigned char out[32])` — `HMAC-SHA256(privkey, "sovereign-browser/bookmarks-folder-id-v1")`. The privkey is obtained from the signer (add a `nostr_signer_get_privkey_hex` accessor if not already present, or compute the HMAC inside the signer to avoid exposing the raw privkey).
+- `static char *path_to_d_tag(const char *path)` — `HMAC-SHA256(hmac_key, path)` → 64-char hex string. Caller frees.
+- `static int publish_path(const char *path)` — replaces `publish_directory`; builds `d = path_to_d_tag(path)`, encrypts `{"path": path, "bookmarks": [...]}` with NIP-44, signs, publishes, stores in SQLite.
+- `static int delete_event_for_path(const char *path)` — publishes a kind 5 deletion event referencing the kind 30003 event for `d = path_to_d_tag(path)`.
+
+#### Loading
+
+`bookmarks_init` already iterates all kind 30003 events for the pubkey. Change the loop to:
+1. Read the `d` tag.
+2. If the `d` tag is **not** 64 hex chars (i.e. a legacy plaintext directory name), treat it as a legacy event: decrypt content as the old flat `[[bookmark,...]]` array, use the `d` tag string as the path, then re-publish in the new HMAC-`d` format and emit a kind 5 deletion for the old event id.
+3. If the `d` tag **is** 64 hex chars, decrypt the content and read `path` from the plaintext JSON `{"path": ..., "bookmarks": [...]}`.
+4. `node_ensure_path(root, path)`.
+5. Load bookmarks into that leaf.
+
+### 2. JSON endpoint — [`src/nostr_bridge.c`](src/nostr_bridge.c:3715) `handle_bookmarks_list_json`
+
+Change the JSON shape from a flat `dirs[]` array to a nested `tree` object:
+
+```json
+{
+  "have_signer": true,
+  "tree": {
+    "name": "",
+    "path": "",
+    "bookmarks": [],
+    "children": [
+      { "name": "General", "path": "General", "bookmarks": [...], "children": [] },
+      { "name": "Work",    "path": "Work",    "bookmarks": [], "children": [
+        { "name": "Projects", "path": "Work/Projects", "bookmarks": [...], "children": [] }
+      ]}
+    ]
+  }
+}
+```
+
+Add a small recursive helper `node_to_json(const bookmark_node_t *node, cJSON *parent)`.
+
+### 3. Web UI — [`www/bookmarks.html`](www/bookmarks.html:1), [`www/bookmarks.js`](www/bookmarks.js:1), [`www/bookmarks.css`](www/bookmarks.css:1)
+
+#### HTML
+- Replace the flat `#bm-list` div with a `<div id="bm-tree">` container.
+- Add an "Add Folder" button next to "Add Bookmark" that prompts for a path (with a parent-picker).
+- Add a path breadcrumb / parent selector in the add form.
+
+#### JS
+- `renderTree(data.tree)` — recursively render nested `<ul class="tree-node">` with:
+  - A folder row: expand/collapse caret, folder icon, name, count, "Add Bookmark Here", "New Subfolder", "Rename", "Delete" buttons.
+  - A bookmark list under the folder (collapsible).
+- State: keep a `Set` of expanded paths in `localStorage` so expand state persists.
+- Clicking a folder caret toggles `expanded` class on the child `<ul>`.
+- "New Subfolder" prompts for a name and navigates to `sovereign://bookmarks/createdir?name=<parent_path>/<new_name>`.
+- "Move" action on each bookmark: prompt for destination path, navigate to `sovereign://bookmarks/move?from=<dir>&to=<new_dir>&url=<url>`.
+- "Add Bookmark Here" pre-fills the add form's directory field with the folder's path.
+
+#### CSS
+- Add `.tree-node`, `.tree-children`, `.caret`, `.caret.expanded`, `.folder-row`, `.folder-icon` rules to [`www/bookmarks.css`](www/bookmarks.css:1).
+- Caret uses a CSS triangle that rotates 90° when expanded.
+- Indent `.tree-children` by `20px` per level.
+- Reuse existing `.bm`, `.btn`, `.btn-del` classes for bookmark rows and buttons.
+
+### 4. Bookmarks toolbar — [`src/tab_manager.c`](src/tab_manager.c:2564)
+
+Add a **bookmarks toolbar** below the URL toolbar. This is a horizontal `GtkBox` that shows buttons for the bookmarks in a configurable "Bookmarks Bar" folder (default path: `Bookmarks Bar`), plus a dropdown for any folders.
+
+#### Layout
+
+```
+[ hamburger ][back][fwd][refresh][ === URL entry === ][bookmark btn]
+[ 📁 Bookmarks Bar: ][example.com][nostr.com][▾ Folders ▾]
+[ ============ WebKitWebView ============ ]
+```
+
+#### Implementation
+
+1. In `tab_create()`, after packing `toolbar` into `tab->page`, create:
+   ```c
+   tab->bookmark_bar = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 4);
+   gtk_widget_set_margin_top(tab->bookmark_bar, 2);
+   gtk_widget_set_margin_bottom(tab->bookmark_bar, 2);
+   gtk_widget_set_margin_start(tab->bookmark_bar, 4);
+   gtk_widget_set_margin_end(tab->bookmark_bar, 4);
+   gtk_box_pack_start(GTK_BOX(tab->page), tab->bookmark_bar, FALSE, FALSE, 0);
+   ```
+2. Add a `GtkToggleButton` "Bookmarks Bar" toggle (icon `user-bookmarks-symbolic`) on the left of the URL toolbar that shows/hides `tab->bookmark_bar` (persist visibility in settings).
+3. `bookmark_bar_refresh(tab)` — clears and repopulates `tab->bookmark_bar`:
+   - Looks up the "Bookmarks Bar" node via `bookmarks_find("Bookmarks Bar")`.
+   - For each bookmark in that node, adds a `GtkButton` labeled with the bookmark title (or URL). Clicking loads the URL in `tab->webview`.
+   - For each child folder, adds a `GtkMenuButton` with a popover listing that folder's bookmarks (and subfolders, one level deep).
+4. Call `bookmark_bar_refresh(tab)` after: tab creation, `bookmarks_add`/`remove`/`move`/`delete_dir` (via a global "bookmarks changed" notification — see below).
+5. Add a "Bookmark this page to Bookmarks Bar" quick action: right-click on the bookmark button → menu item "Add to Bookmarks Bar" that calls `bookmarks_add("Bookmarks Bar", url, title)` directly without the directory picker dialog.
+
+#### Cross-tab refresh
+
+Bookmarks can change from any tab (or from relay fetch). Add a lightweight notification:
+- `bookmarks_subscribe_changed(void (*cb)(void *user_data), void *user_data)` in [`src/bookmarks.h`](src/bookmarks.h:51).
+- `tab_manager.c` registers a callback on startup that iterates all open tabs and calls `bookmark_bar_refresh(tab)` for each.
+- `bookmarks_add`/`remove`/`move`/`create_dir`/`delete_dir`/`rename_dir` and the relay-fetch load path invoke the registered callbacks after mutating state.
+
+### 5. Routes — [`src/nostr_bridge.c`](src/nostr_bridge.c:3993)
+
+Existing routes already accept `dir=` query params. They continue to work — `dir` is now interpreted as a **path** (URL-encoded, may contain `%2F`). Add one new route:
+
+- `sovereign://bookmarks/move?from=<path>&to=<path>&url=<url>` — calls `bookmarks_move`.
+
+Update `handle_bookmarks_add`/`delete`/`createdir`/`deletedir` to pass the path straight through to the renamed API functions (no behavioral change beyond accepting slashes).
+
+### 6. History filter — [`src/history.c`](src/history.c:27)
+
+Already excludes `sovereign://bookmarks/{add,delete,createdir,deletedir}`. Add `sovereign://bookmarks/move` to the skip list.
+
+### 7. Tests
+
+- Add `tests/test_bookmarks_tree.c` (or extend existing tests) covering:
+  - `node_ensure_path` creates intermediate nodes.
+  - `path_to_d_tag` is deterministic (same path + key → same hex) and 64 hex chars.
+  - `path_to_d_tag` is opaque (different paths → uncorrelated hashes; no prefix leakage).
+  - `bookmarks_add("Work/Projects/Secret", ...)` publishes an event whose `d` tag is `HMAC-SHA256(hmac_key, "Work/Projects/Secret")` (not the plaintext path) and whose decrypted content contains `"path": "Work/Projects/Secret"`.
+  - `bookmarks_rename_dir("Work", "Personal")` re-publishes `Personal`, `Personal/Projects`, `Personal/Projects/Secret` (new HMAC `d` tags, new encrypted content) and emits kind 5 deletions for the old HMAC `d` tags.
+  - `bookmarks_delete_dir("Work", 0)` emits kind 5 deletions for the whole subtree's HMAC `d` tags.
+  - Loading a mix of events with HMAC `d` tags reconstructs the tree from the decrypted `path` field, not from the `d` tag.
+  - Legacy event with plaintext `d = "General"` is detected, loaded, re-published with an HMAC `d` tag, and the old event is marked for kind 5 deletion.
+- Manual test: `./browser.sh restart --login-method generate --url sovereign://bookmarks` and exercise the tree UI.
+
+---
+
+## Migration
+
+Existing flat directories (no slashes) load as root-level folders — no migration needed. The "General" default folder continues to work as a root node.
+
+## Files touched
+
+| File | Change |
+|------|--------|
+| [`src/bookmarks.h`](src/bookmarks.h:1) | Replace `bookmark_dir_t` with `bookmark_node_t`; tree API; change callback. |
+| [`src/bookmarks.c`](src/bookmarks.c:1) | Rewrite in-memory model as a trie; path-based publish/delete; rename/delete recursion. |
+| [`src/nostr_bridge.c`](src/nostr_bridge.c:3715) | `handle_bookmarks_list_json` emits nested `tree`; add `move` route. |
+| [`www/bookmarks.html`](www/bookmarks.html:1) | Tree container, folder add form. |
+| [`www/bookmarks.js`](www/bookmarks.js:1) | Recursive `renderTree`, expand/collapse, move dialog. |
+| [`www/bookmarks.css`](www/bookmarks.css:1) | Tree node / caret / indentation styles. |
+| [`src/tab_manager.c`](src/tab_manager.c:2564) | Bookmarks toolbar widget, refresh on change. |
+| [`src/history.c`](src/history.c:27) | Skip `sovereign://bookmarks/move`. |
+| `tests/test_bookmarks_tree.c` | New test for tree operations. |
+| [`plans/bookmarks-tree-view.md`](plans/bookmarks-tree-view.md:1) | This plan. |

plans/fips-management-page.md

@@ -0,0 +1,465 @@
+# FIPS Management Page — `sovereign://fips`
+
+## Goal
+
+A dedicated `sovereign://fips` page for managing the FIPS mesh daemon from
+inside the browser. This is **not** part of the settings page — it's a
+separate status + management page, like a network control panel.
+
+The page lets the user:
+
+1. **See FIPS status** — daemon state, node npub, TUN interface, peer count,
+   tree state, ownership (managed vs attached), error messages.
+2. **See connected peers** — list of peers with their npub, address,
+   transport, and connection state.
+3. **Connect to a peer** — add a new peer by npub + address + transport.
+4. **Disconnect a peer** — remove a peer connection.
+5. **Restart the FIPS service** — stop + start the managed daemon, or
+   re-attach.
+6. **See Tor status** (bonus) — since Tor and FIPS are the two network
+   services, showing both on one "Network" page makes sense. Tor is
+   read-only status (bootstrap progress, SOCKS endpoint); FIPS is
+   interactive management.
+
+This makes `.fips` addresses actually usable: the user can add peers from
+the browser UI instead of dropping to `fipsctl` on the command line.
+
+---
+
+## Current State
+
+### FIPS control API (`src/fips_control.c` / `src/fips_control.h`)
+
+The FIPS daemon exposes a JSON-line control protocol over a Unix socket.
+The browser already has a client:
+
+- [`fips_control_connect()`](src/fips_control.c:30) — open a control
+  connection to the socket.
+- [`fips_control_show_status()`](src/fips_control.c:142) — sends
+  `{"command":"show_status"}`, parses response into `fips_status_t`
+  (npub, peer_count, tun_state, tun_name, daemon state, tree_state,
+  tun_active).
+- [`fips_control_show_peers()`](src/fips_control.c:171) — sends
+  `{"command":"show_peers"}`, returns the `data` field as a JSON string
+  (caller frees). **This is not currently called anywhere** — it exists
+  but is unused.
+- [`fips_control_connect_peer()`](src/fips_control.c:185) — sends
+  `{"command":"connect","params":{"npub":...,"address":...,"transport":...}}`.
+  **Also unused.**
+- [`fips_control_close()`](src/fips_control.c:205) — close the fd.
+
+**Missing from the client:** a `disconnect` peer command. The FIPS daemon
+likely supports `{"command":"disconnect","params":{"npub":...}}` (this
+needs verification against the FIPS daemon's control protocol — see
+`fipsctl` source or `docs/control-api.md` in the FIPS repo). We'll add a
+`fips_control_disconnect_peer()` function.
+
+### Net services layer (`src/net_services.c` / `src/net_services.h`)
+
+- [`net_service_get_status(NET_SERVICE_FIPS)`](src/net_services.c:493)
+  returns a pointer to the global `g_services[NET_SERVICE_FIPS]` struct.
+  The `status.fips` union member has: `peer_count`, `node_npub[80]`,
+  `tree_state[32]`, `tun_active`, `tun_name[16]`, `daemon_state[32]`,
+  `control_socket[512]`.
+- [`fips_poll_cb()`](src/net_services.c:213) polls `show_status` every 2s
+  (managed) or 5s (attached) and updates the struct. It does **not** poll
+  `show_peers` — only the peer *count* is tracked.
+- The service `state` field (`service_state_t`) tracks the lifecycle:
+  `SERVICE_DISABLED`, `DISCOVERING`, `ATTACHING`, `STARTING`,
+  `BOOTSTRAPPING`, `READY`, `STOPPING`, `EXITED`, `FAILED`.
+- `ownership` is `OWNERSHIP_NONE`, `ATTACHED`, or `MANAGED`.
+- `error_msg` holds the failure reason when `state == SERVICE_FAILED`.
+- [`net_service_restart(NET_SERVICE_FIPS)`](src/net_services.c) exists —
+  it disables then re-enables the service.
+
+### sovereign:// page pattern (`src/nostr_bridge.c`)
+
+The existing pages (settings, profile, bookmarks, agents) follow this
+pattern:
+
+1. **HTML page** served from an embedded `www/` file via
+   [`serve_embedded_file()`](src/nostr_bridge.c:132).
+2. **CSS** served from `www/<name>.css`, linked via
+   `<link href="sovereign://fips.css">`.
+3. **JS** served from `www/<name>.js`, loaded via
+   `<script src="sovereign://fips.js">`.
+4. **JSON data endpoints** — `sovereign://fips/status` returns JSON,
+   fetched by the JS on page load and on refresh.
+5. **Action endpoints** — `sovereign://fips/connect?npub=...&address=...&transport=...`
+   performs an action and returns JSON.
+
+The JS uses `XMLHttpRequest` (not `fetch()`) because WebKit's custom
+scheme handler doesn't support `fetch()` reliably for `sovereign://`
+URLs — see the comment at [`nostr_bridge.c:1902`](src/nostr_bridge.c:1902).
+A `sovereignGet()` helper wraps XHR and returns a Promise.
+
+Routing is in the main `bridge_handle_request()` function
+([`nostr_bridge.c:3238`](src/nostr_bridge.c:3238)) — a series of
+`strcmp`/`strncmp` checks on the URI, calling the appropriate handler.
+
+---
+
+## Design
+
+### Page layout
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  FIPS Mesh Network                              [Refresh]   │
+├─────────────────────────────────────────────────────────────┤
+│  ┌─ Status ──────────────────────────────────────────────┐  │
+│  │  State:      Ready  ●                                  │  │
+│  │  Node:       npub1abc...xyz                           │  │
+│  │  TUN:        fips0 (active)                           │  │
+│  │  Peers:      3 connected                               │  │
+│  │  Tree:       healthy                                   │  │
+│  │  Ownership:  managed (spawned by browser)              │  │
+│  │  Control:    ~/.sovereign_browser/fips/control.sock    │  │
+│  │  [Restart Service]                                     │  │
+│  └──────────────────────────────────────────────────────┘  │
+│                                                             │
+│  ┌─ Peers ───────────────────────────────────────────────┐  │
+│  │  npub1def...  203.0.113.5:4242   udp   connected  [✕] │  │
+│  │  npub1ghi...  198.51.100.10:4242 tcp   connected  [✕] │  │
+│  │  npub1jkl...  fd00::1:4242        udp   connecting [✕] │  │
+│  └──────────────────────────────────────────────────────┘  │
+│                                                             │
+│  ┌─ Add Peer ────────────────────────────────────────────┐  │
+│  │  npub:     [npub1...                                  ] │  │
+│  │  address:  [host:port                                 ] │  │
+│  │  transport: [udp ▼]                                    │  │
+│  │  [Connect]                                             │  │
+│  └──────────────────────────────────────────────────────┘  │
+│                                                             │
+│  ┌─ Tor Status (read-only) ──────────────────────────────┐  │
+│  │  State:      Ready  ●                                  │  │
+│  │  Bootstrap:  100%                                      │  │
+│  │  SOCKS:      socks5://127.0.0.1:9050                   │  │
+│  │  Ownership:  attached (system Tor)                     │  │
+│  └──────────────────────────────────────────────────────┘  │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Routing
+
+| URI | Handler | Returns |
+|-----|---------|---------|
+| `sovereign://fips` | serve `www/fips.html` | HTML page |
+| `sovereign://fips.css` | serve `www/fips.css` | CSS |
+| `sovereign://fips.js` | serve `www/fips.js` | JS |
+| `sovereign://fips/status` | `handle_fips_status_json` | JSON: FIPS + Tor status |
+| `sovereign://fips/peers` | `handle_fips_peers_json` | JSON: peer list from `show_peers` |
+| `sovereign://fips/connect?npub=...&address=...&transport=...` | `handle_fips_connect` | JSON: connect result |
+| `sovereign://fips/disconnect?npub=...` | `handle_fips_disconnect` | JSON: disconnect result |
+| `sovereign://fips/restart` | `handle_fips_restart` | JSON: restart result |
+
+### JSON endpoints
+
+#### `sovereign://fips/status`
+
+```json
+{
+  "fips": {
+    "state": "ready",
+    "enabled": true,
+    "ownership": "managed",
+    "node_npub": "npub1abc...",
+    "peer_count": 3,
+    "tun_active": true,
+    "tun_name": "fips0",
+    "tree_state": "healthy",
+    "daemon_state": "running",
+    "control_socket": "~/.sovereign_browser/fips/control.sock",
+    "error": null
+  },
+  "tor": {
+    "state": "ready",
+    "enabled": true,
+    "ownership": "attached",
+    "bootstrap_progress": 100,
+    "socks_endpoint": "socks5://127.0.0.1:9050",
+    "circuit_info": "",
+    "error": null
+  }
+}
+```
+
+When a service is `DISABLED` or `FAILED`, the fields are populated as
+best as possible and `error` holds the failure message.
+
+#### `sovereign://fips/peers`
+
+Returns the raw `show_peers` data from the FIPS daemon (passed through
+as-is, since the format is defined by FIPS):
+
+```json
+{
+  "peers": [
+    {"npub": "npub1def...", "address": "203.0.113.5:4242", "transport": "udp", "state": "connected"},
+    {"npub": "npub1ghi...", "address": "198.51.100.10:4242", "transport": "tcp", "state": "connected"}
+  ]
+}
+```
+
+If FIPS is not ready, returns `{"peers": [], "error": "FIPS not ready"}`.
+
+#### `sovereign://fips/connect`
+
+Query params: `npub`, `address`, `transport` (optional, defaults to
+`udp`).
+
+Returns `{"status": "ok"}` or `{"error": "..."}`.
+
+#### `sovereign://fips/disconnect`
+
+Query params: `npub`.
+
+Returns `{"status": "ok"}` or `{"error": "..."}`.
+
+#### `sovereign://fips/restart`
+
+No params. Calls `net_service_restart(NET_SERVICE_FIPS)`. Returns
+`{"status": "ok"}` (the restart is async — the JS polls
+`sovereign://fips/status` to see when it's ready again).
+
+---
+
+## Changes Required
+
+### 1. Add `fips_control_disconnect_peer()` to `src/fips_control.c` / `.h`
+
+```c
+int fips_control_disconnect_peer(int fd, const char *npub,
+                                 char *error, size_t error_size);
+```
+
+Sends `{"command":"disconnect","params":{"npub":"..."}}`. **Verify the
+exact command name** against the FIPS daemon's control protocol — check
+`fipsctl` source or FIPS `docs/control-api.md`. If the command is
+`disconnect_peer` or `remove_peer`, adjust accordingly.
+
+### 2. Add FIPS route handlers to `src/nostr_bridge.c`
+
+New functions (following the existing handler pattern):
+
+- `handle_fips_status_json(request)` — reads
+  `net_service_get_status(NET_SERVICE_FIPS)` and
+  `net_service_get_status(NET_SERVICE_TOR)`, builds a cJSON object with
+  the fields above, responds as JSON.
+- `handle_fips_peers_json(request)` — opens a control connection to the
+  FIPS socket (from `status.fips.control_socket`), calls
+  `fips_control_show_peers()`, wraps the result in `{"peers": [...]}`,
+  responds as JSON. If FIPS is not ready, returns empty peers + error.
+- `handle_fips_connect(request, query)` — parses `npub`, `address`,
+  `transport` from query string, opens a control connection, calls
+  `fips_control_connect_peer()`, responds as JSON.
+- `handle_fips_disconnect(request, query)` — parses `npub`, opens a
+  control connection, calls `fips_control_disconnect_peer()`, responds
+  as JSON.
+- `handle_fips_restart(request)` — calls
+  `net_service_restart(NET_SERVICE_FIPS)`, responds as JSON.
+
+**Control connection management:** Each action handler opens a fresh
+control connection to the FIPS socket, sends the command, closes the
+connection. This is simpler than reusing the `net_service_t`'s
+`control_fd` (which is owned by the poll callback and may be in use).
+The `fips_control_connect()` call is fast (Unix socket, 500ms timeout).
+
+### 3. Add routing to `bridge_handle_request()` in `src/nostr_bridge.c`
+
+Add a FIPS route block (before the `sovereign://nostr/` catch-all at
+line 3606), following the same pattern as the settings/bookmarks/agents
+blocks:
+
+```c
+/* Route sovereign://fips — FIPS mesh management page. */
+if (strcmp(uri, "sovereign://fips") == 0 ||
+    strncmp(uri, "sovereign://fips?", 18) == 0) {
+    serve_embedded_file(request, "fips.html");
+    return;
+}
+if (strcmp(uri, "sovereign://fips.css") == 0 ||
+    strncmp(uri, "sovereign://fips.css?", 21) == 0) {
+    serve_embedded_file(request, "fips.css");
+    return;
+}
+if (strcmp(uri, "sovereign://fips.js") == 0 ||
+    strncmp(uri, "sovereign://fips.js?", 20) == 0) {
+    serve_embedded_file(request, "fips.js");
+    return;
+}
+if (strcmp(uri, "sovereign://fips/status") == 0 ||
+    strncmp(uri, "sovereign://fips/status?", 25) == 0) {
+    handle_fips_status_json(request);
+    return;
+}
+if (strcmp(uri, "sovereign://fips/peers") == 0 ||
+    strncmp(uri, "sovereign://fips/peers?", 24) == 0) {
+    handle_fips_peers_json(request);
+    return;
+}
+if (strncmp(uri, "sovereign://fips/connect?", 24) == 0) {
+    handle_fips_connect(request, uri + 24);
+    return;
+}
+if (strncmp(uri, "sovereign://fips/disconnect?", 27) == 0) {
+    handle_fips_disconnect(request, uri + 27);
+    return;
+}
+if (strcmp(uri, "sovereign://fips/restart") == 0 ||
+    strncmp(uri, "sovereign://fips/restart?", 26) == 0) {
+    handle_fips_restart(request);
+    return;
+}
+```
+
+### 4. Create `www/fips.html`
+
+The HTML page. Links `fips.css` and `fips.js`. Structure:
+
+- Status section (populated by JS from `sovereign://fips/status`)
+- Peers table (populated by JS from `sovereign://fips/peers`)
+- Add peer form (npub, address, transport dropdown, Connect button)
+- Tor status section (read-only, from the same status JSON)
+- Refresh button (re-fetches status + peers)
+
+Follow the style of `www/settings.html` / `www/bookmarks.html` — use
+`sovereign-base.css` for theme variables, monospace font, dark theme.
+
+### 5. Create `www/fips.css`
+
+Page-specific styles. Import the base theme:
+```css
+@import "sovereign://sovereign-base.css";
+```
+
+Style the status cards, peers table, add-peer form. Match the existing
+sovereign:// page aesthetic.
+
+### 6. Create `www/fips.js`
+
+The page logic:
+
+```javascript
+/* On load: fetch status + peers, populate DOM.
+ * Refresh button: re-fetch.
+ * Connect form: POST to sovereign://fips/connect, then refresh peers.
+ * Disconnect button: GET sovereign://fips/disconnect?npub=..., then refresh.
+ * Restart button: GET sovereign://fips/restart, then poll status.
+ * Auto-refresh: poll sovereign://fips/status every 5s (like the poll cb).
+ */
+```
+
+Use the `sovereignGet()` helper (XHR wrapper) that the other pages use.
+Do NOT use `fetch()` — it doesn't work with `sovereign://` in WebKit.
+
+### 7. Add a link to the FIPS page from the settings page
+
+In `www/settings.html` (or `www/settings.js`), add a link:
+`<a href="sovereign://fips">FIPS Mesh Network</a>` in a "Network"
+section. This makes the page discoverable.
+
+### 8. No Makefile changes needed
+
+The `www/` files are auto-embedded by `embed_web_files.sh` (it globs
+all `*.html`, `*.css`, `*.js` in `www/`). Adding `www/fips.*` files is
+sufficient — no Makefile edit required.
+
+---
+
+## Files
+
+```
+www/
+├── fips.html          # FIPS management page (new)
+├── fips.css           # Page styles (new)
+├── fips.js            # Page logic (new)
+src/
+├── nostr_bridge.c     # Add FIPS route handlers + routing
+├── fips_control.c     # Add fips_control_disconnect_peer()
+├── fips_control.h     # Add disconnect_peer() declaration
+```
+
+---
+
+## Implementation Phases
+
+### Phase 1: Status page (read-only)
+1. Add `handle_fips_status_json()` to `nostr_bridge.c`
+2. Add `sovereign://fips` / `fips.css` / `fips.js` / `fips/status` routes
+3. Create `www/fips.html` / `fips.css` / `fips.js` with status display
+4. Show FIPS state, node npub, TUN, peer count, tree state, ownership
+5. Show Tor status (read-only)
+6. Auto-refresh every 5s
+7. Add link from settings page
+
+### Phase 2: Peer management (interactive)
+1. Add `handle_fips_peers_json()` — call `fips_control_show_peers()`
+2. Add `handle_fips_connect()` — call `fips_control_connect_peer()`
+3. Add `fips_control_disconnect_peer()` to `fips_control.c`
+4. Add `handle_fips_disconnect()` — call `fips_control_disconnect_peer()`
+5. Add peers table + add-peer form + disconnect buttons to the page
+6. Test: connect to a known FIPS peer, verify it appears in the list,
+   verify `.fips` URLs to that peer resolve in the browser
+
+### Phase 3: Service control
+1. Add `handle_fips_restart()` — call `net_service_restart(NET_SERVICE_FIPS)`
+2. Add restart button to the page
+3. Poll status during restart (state transitions: READY → STOPPING →
+   DISCOVERING → STARTING → READY)
+4. Show error messages when state is FAILED
+
+### Phase 4: Polish
+1. Copy-to-clipboard for node npub
+2. QR code for node npub (reuse `sovereign://qr?text=...`)
+3. Bootstrap peer suggestions (if FIPS publishes a test mesh peer list)
+4. Transport auto-detect (try udp, then tcp)
+5. Address book — save known peers in SQLite for re-connecting after
+   restart
+
+---
+
+## Testing
+
+1. Build and start browser
+2. Navigate to `sovereign://fips`
+3. Verify FIPS status shows correctly (state, npub, TUN, peer count)
+4. Verify Tor status shows correctly
+5. Verify auto-refresh updates peer count if peers change
+6. If FIPS is not running:
+   - Verify status shows "disabled" or "failed" with error message
+   - Verify peers list is empty with "FIPS not ready" message
+7. Add a peer:
+   - Enter a known FIPS peer's npub + address + transport
+   - Click Connect
+   - Verify peer appears in the peers list
+   - Verify `http://<peer-npub>.fips/` loads in a tab
+8. Disconnect a peer:
+   - Click the ✕ next to a peer
+   - Verify peer disappears from the list
+9. Restart FIPS:
+   - Click Restart Service
+   - Verify state transitions through stopping → starting → ready
+   - Verify peers reconnect (if persistent) or need re-adding
+
+---
+
+## Open Questions
+
+1. **FIPS disconnect command name** — is it `disconnect`,
+   `disconnect_peer`, or `remove_peer`? Need to check the FIPS daemon's
+   control protocol docs or `fipsctl` source. The `connect` command is
+   confirmed (used in `fips_control_connect_peer`), but `disconnect` is
+   assumed.
+
+2. **Peer persistence** — when the browser restarts the managed FIPS
+   daemon, do peers persist (from `fips.yaml` or the daemon's state), or
+   does the user need to re-add them every time? If non-persistent,
+   Phase 4's "address book" (saving peers in SQLite) becomes more
+   important.
+
+3. **FIPS daemon control protocol docs** — the `show_peers` response
+   format is passed through as-is. We should verify the field names
+   (`npub`, `address`, `transport`, `state`) match what the JS expects.
+   If the format differs, the JS can adapt, but it's better to know
+   upfront.

plans/fips-network-view.md

@@ -0,0 +1,255 @@
+# FIPS Network View — `sovereign://fips/network`
+
+## Goal
+
+Extend the FIPS management page with a "Network" view that shows the
+**entire mesh** as the local node knows it — not just direct peers, but
+every node the daemon has discovered via bloom-filter propagation and
+Nostr discovery. This answers "what can you see on FIPS?" and "can you
+get a view of the entire network?"
+
+## What the FIPS daemon exposes
+
+The FIPS control protocol (verified in `~/lt/fips/src/control/`) has
+these read-only commands relevant to a network view:
+
+| Command | What it returns | Network-view use |
+|---------|----------------|------------------|
+| `show_status` | `estimated_mesh_size` (bloom-union cardinality), `peer_count`, `tree_depth`, `is_root`, `root` | Header summary: "Mesh: ~N nodes, depth D" |
+| `show_peers` | Direct authenticated peers with `npub`, `display_name`, `ipv6_addr`, `connectivity`, `is_parent`, `is_child`, `tree_depth`, `transport_addr`, `transport_type`, MMP metrics | The "direct peers" table (already shown) |
+| `show_tree` | Spanning-tree state: `root`, `root_npub`, `my_node_addr`, `depth`, `parent`, `parent_display_name`, `peers[]` (each with `node_addr`, `display_name`, `depth`, `coords` path, `distance_to_us`) | Tree topology view — local node + 1-hop neighbors with their tree positions |
+| `show_identity_cache` | **All known nodes** in the mesh: `entries[]` with `node_addr`, `npub`, `display_name`, `ipv6_addr`, `last_seen_ms`, `age_ms`, plus `count` and `max_entries` | **The mesh node list** — every node the local daemon has learned about, not just direct peers |
+| `show_bloom` | Per-peer bloom-filter state (filter sequence, estimated counts) | Advanced/debug — shows how node-discovery knowledge propagates |
+| `show_routing` | Coord-cache entries, pending lookups, retries, forwarding counters | Advanced/debug — routing health |
+
+### Key insight: "the entire network" = identity cache + tree
+
+The FIPS daemon does **not** have a "ask peer X what peers it has"
+command. The mesh is observed through two mechanisms:
+
+1. **Bloom filters** — each node broadcasts a bloom filter of node
+   addresses it knows about. The local node unions these to estimate
+   total mesh size (`estimated_mesh_size`) and caches individual node
+   identities it has resolved (`show_identity_cache`).
+
+2. **Spanning tree** — each node declares a parent; the tree
+   coordinates encode paths to the root. `show_tree` gives the local
+   node's tree position and its neighbors' positions.
+
+So "the entire network" as seen from this node is:
+- **`show_identity_cache`** → the set of known nodes (npub, ipv6, name,
+  last-seen). This is the node list for the network view.
+- **`show_tree`** → the local tree topology (who is my parent, who are
+  my children, what is the root, what is the depth).
+- **`show_status.estimated_mesh_size`** → a single estimated total.
+
+We **cannot** build a full graph of who-connects-to-whom from the local
+node's control socket alone — that would require every node to expose
+its peer list, and FIPS doesn't do that (bloom filters propagate
+*existence*, not *adjacency*). What we can show is:
+
+- A **node list** (identity cache) — "these are all the nodes in the
+  mesh that this node knows about."
+- A **tree view** — "this is my position in the spanning tree, my
+  parent, my children, the root."
+- A **mesh summary** — "estimated N nodes total, tree depth D."
+
+## Design
+
+### Page layout
+
+Add a "Network" tab/section to `sovereign://fips` (or a separate
+`sovereign://fips/network` page linked from the main FIPS page).
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  FIPS Mesh Network                              [Refresh]   │
+│  [Status] [Peers] [Network] [Tree]                          │
+├─────────────────────────────────────────────────────────────┤
+│  ┌─ Mesh Summary ────────────────────────────────────────┐  │
+│  │  Estimated mesh size:  47 nodes                       │  │
+│  │  Known nodes (cache):  23                              │  │
+│  │  Tree depth:           4                               │  │
+│  │  Root:                 npub1abc... (laantungir)        │  │
+│  │  Our position:         depth 2, parent npub1def...     │  │
+│  └──────────────────────────────────────────────────────┘  │
+│                                                             │
+│  ┌─ Known Nodes (23) ────────────────────────────────────┐  │
+│  │  npub1abc...  laantungir    fd00::1    2s ago    ●    │  │
+│  │  npub1def...  fips.v0l.io   fd00::2    5s ago    ●    │  │
+│  │  npub1ghi...  —             fd00::3    1m ago    ○    │  │
+│  │  ...                                                   │  │
+│  │  (● = direct peer, ○ = known via discovery only)      │  │
+│  └──────────────────────────────────────────────────────┘  │
+│                                                             │
+│  ┌─ Spanning Tree ───────────────────────────────────────┐  │
+│  │  Root: npub1abc... (laantungir)                        │  │
+│  │  Our parent: npub1def... (fips.v0l.io)                 │  │
+│  │  Our children:                                         │  │
+│  │    npub1jkl...  depth 3  distance 1                    │  │
+│  │    npub1mno...  depth 3  distance 1                    │  │
+│  │  Tree peers (1-hop):                                   │  │
+│  │    npub1abc...  depth 0  root    distance 2            │  │
+│  │    npub1def...  depth 1  parent  distance 1            │  │
+│  └──────────────────────────────────────────────────────┘  │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### New JSON endpoints
+
+| URI | FIPS command | Returns |
+|-----|-------------|---------|
+| `sovereign://fips/network` | `show_status` + `show_identity_cache` + `show_tree` | Combined JSON for the network view |
+| `sovereign://fips/tree` | `show_tree` | Spanning tree JSON (for a dedicated tree tab) |
+
+#### `sovereign://fips/network`
+
+Calls three FIPS commands on a fresh control connection and combines
+the results:
+
+```json
+{
+  "summary": {
+    "estimated_mesh_size": 47,
+    "known_nodes": 23,
+    "max_cache_entries": 256,
+    "tree_depth": 4,
+    "is_root": false,
+    "root_npub": "npub1abc...",
+    "root_display_name": "laantungir",
+    "our_node_addr": "e3da8293e6ea58807bd02b4749824243",
+    "our_parent": "npub1def...",
+    "our_parent_display_name": "fips.v0l.io"
+  },
+  "nodes": [
+    {
+      "node_addr": "e3da8293...",
+      "npub": "npub1abc...",
+      "display_name": "laantungir",
+      "ipv6_addr": "fde3:da82:...",
+      "last_seen_ms": 1784309108403,
+      "age_ms": 2000,
+      "is_direct_peer": true
+    }
+  ],
+  "tree": {
+    "root": "1b4788b7...",
+    "root_npub": "npub1abc...",
+    "is_root": false,
+    "depth": 2,
+    "parent": "9d1192e8...",
+    "parent_display_name": "fips.v0l.io",
+    "peers": [
+      {
+        "node_addr": "1b4788b7...",
+        "display_name": "laantungir",
+        "depth": 0,
+        "distance_to_us": 2
+      }
+    ]
+  }
+}
+```
+
+The `is_direct_peer` flag on each node is computed by cross-referencing
+the identity cache entries against the `show_peers` npub list (so the
+UI can mark direct peers vs. discovery-only nodes).
+
+### Implementation
+
+#### 1. Add `fips_control_show_tree()` and `fips_control_show_identity_cache()` to `src/fips_control.c` / `.h`
+
+These follow the existing `fips_control_show_peers()` pattern — send
+the command, return the `data` field as a JSON string (caller frees):
+
+```c
+char *fips_control_show_tree(int fd, char *error, size_t error_size);
+char *fips_control_show_identity_cache(int fd, char *error, size_t error_size);
+```
+
+#### 2. Add `handle_fips_network_json()` to `src/nostr_bridge.c`
+
+Opens a control connection, calls `show_status`, `show_peers`,
+`show_identity_cache`, and `show_tree`, then combines them into the
+JSON above. The `is_direct_peer` flag is computed by building a set of
+direct-peer npubs from `show_peers` and checking each identity-cache
+entry against it.
+
+#### 3. Add routing for `sovereign://fips/network` and `sovereign://fips/tree`
+
+```c
+if (strcmp(uri, "sovereign://fips/network") == 0 ||
+    strncmp(uri, "sovereign://fips/network?", 26) == 0) {
+    handle_fips_network_json(request);
+    return;
+}
+if (strcmp(uri, "sovereign://fips/tree") == 0 ||
+    strncmp(uri, "sovereign://fips/tree?", 22) == 0) {
+    handle_fips_tree_json(request);
+    return;
+}
+```
+
+#### 4. Add a "Network" tab to `www/fips.html` / `www/fips.js`
+
+Add tab navigation (Status | Peers | Network | Tree) to the page. The
+Network tab fetches `sovereign://fips/network` and renders:
+- Mesh summary card (estimated size, known nodes, depth, root, our
+  position).
+- Known nodes table (npub, name, ipv6, last-seen, direct-peer badge).
+- Spanning tree card (root, parent, children, 1-hop peers with
+  distances).
+
+The Tree tab fetches `sovereign://fips/tree` and renders a more
+detailed tree view (coords paths, declaration sequence).
+
+#### 5. Auto-refresh
+
+The Network tab polls `sovereign://fips/network` every 5s (same as the
+status poll).
+
+## Limitations (what we cannot show)
+
+- **Full adjacency graph** — FIPS doesn't expose "peer X's peer list."
+  Bloom filters propagate node *existence*, not *edges*. To build a
+  full graph, every node would need to expose its peer list (a future
+  FIPS protocol extension), or the browser would need to query each
+  node's control socket individually (not practical across the mesh).
+- **Real-time node join/leave** — the identity cache has `last_seen_ms`
+  and `age_ms`, so we can show staleness, but there's no event stream
+  for join/leave (would need a FIPS control subscription protocol).
+
+## Files
+
+```
+src/
+├── fips_control.c     # Add show_tree(), show_identity_cache()
+├── fips_control.h     # Add declarations
+├── nostr_bridge.c     # Add handle_fips_network_json(), handle_fips_tree_json(), routing
+www/
+├── fips.html          # Add Network + Tree tabs
+├── fips.css           # Tab + network-table styles
+├── fips.js            # Network + tree rendering, tab switching
+```
+
+## Implementation phases
+
+### Phase 1: Network summary + known nodes
+1. Add `fips_control_show_tree()` and `fips_control_show_identity_cache()`
+2. Add `handle_fips_network_json()` combining status + peers + identity cache
+3. Add `sovereign://fips/network` route
+4. Add "Network" tab to the page with mesh summary + known-nodes table
+5. Mark direct peers with a badge
+
+### Phase 2: Spanning tree view
+1. Add `handle_fips_tree_json()` (pass-through of `show_tree`)
+2. Add `sovereign://fips/tree` route
+3. Add "Tree" tab with root, parent, children, 1-hop peers, coords paths
+4. Optional: simple ASCII/indented tree rendering
+
+### Phase 3: Polish
+1. Sort known nodes by last-seen (most recent first)
+2. Color-code staleness (green < 10s, yellow < 1m, gray > 5m)
+3. Click a node to see its detail (ipv6, age, whether direct peer)
+4. Copy-to-clipboard for npub / ipv6
+5. Optional: bloom-filter visualization (advanced/debug tab)

src/agent_login.c

@@ -20,6 +20,7 @@
  * We access it via extern functions that main.c provides.
  */
 extern void app_set_signer(nostr_signer_t *signer, const char *pubkey_hex,
+                           const char *privkey_hex,
                            key_store_method_t method, gboolean readonly);
 extern void app_clear_signer(void);
 extern nostr_signer_t *app_get_signer(void);
@@ -131,13 +132,18 @@ static cJSON *login_local(cJSON *params) {
     if (derive_pubkey_hex(privkey, pubkey_hex) != 0) {
         return make_error("DERIVE_FAILED", "Failed to derive public key");
     }
+    char privkey_hex_out[65];
+    for (int i = 0; i < 32; i++) {
+        snprintf(privkey_hex_out + i * 2, 3, "%02x", privkey[i]);
+    }
+    privkey_hex_out[64] = '\0';
 
     nostr_signer_t *signer = nostr_signer_local(privkey);
     if (signer == NULL) {
         return make_error("SIGNER_FAILED", "Failed to create signer");
     }
 
-    app_set_signer(signer, pubkey_hex, KEY_STORE_METHOD_LOCAL, FALSE);
+    app_set_signer(signer, pubkey_hex, privkey_hex_out, KEY_STORE_METHOD_LOCAL, FALSE);
     nostr_bridge_set_signer(signer, pubkey_hex, FALSE);
 
     g_print("[agent-login] Local key: pubkey=%s\n", pubkey_hex);
@@ -169,13 +175,18 @@ static cJSON *login_generate(cJSON *params) {
     if (nostr_key_to_bech32(privkey, "nsec", nsec) != 0) {
         nsec[0] = '\0';
     }
+    char privkey_hex[65];
+    for (int i = 0; i < 32; i++) {
+        snprintf(privkey_hex + i * 2, 3, "%02x", privkey[i]);
+    }
+    privkey_hex[64] = '\0';
 
     nostr_signer_t *signer = nostr_signer_local(privkey);
     if (signer == NULL) {
         return make_error("SIGNER_FAILED", "Failed to create signer");
     }
 
-    app_set_signer(signer, pubkey_hex, KEY_STORE_METHOD_LOCAL, FALSE);
+    app_set_signer(signer, pubkey_hex, privkey_hex, KEY_STORE_METHOD_LOCAL, FALSE);
     nostr_bridge_set_signer(signer, pubkey_hex, FALSE);
 
     g_print("[agent-login] Generated key: pubkey=%s\n", pubkey_hex);
@@ -206,13 +217,18 @@ static cJSON *login_seed(cJSON *params) {
         snprintf(pubkey_hex + i * 2, 3, "%02x", pubkey[i]);
     }
     pubkey_hex[64] = '\0';
+    char privkey_hex[65];
+    for (int i = 0; i < 32; i++) {
+        snprintf(privkey_hex + i * 2, 3, "%02x", privkey[i]);
+    }
+    privkey_hex[64] = '\0';
 
     nostr_signer_t *signer = nostr_signer_local(privkey);
     if (signer == NULL) {
         return make_error("SIGNER_FAILED", "Failed to create signer");
     }
 
-    app_set_signer(signer, pubkey_hex, KEY_STORE_METHOD_SEED, FALSE);
+    app_set_signer(signer, pubkey_hex, privkey_hex, KEY_STORE_METHOD_SEED, FALSE);
     nostr_bridge_set_signer(signer, pubkey_hex, FALSE);
 
     g_print("[agent-login] Seed phrase: pubkey=%s\n", pubkey_hex);
@@ -254,8 +270,8 @@ static cJSON *login_readonly(cJSON *params) {
         return make_error("MISSING_PARAM", "Provide 'npub' or 'pubkey_hex'");
     }
 
-    /* Read-only: no signer created. */
-    app_set_signer(NULL, pubkey_hex, KEY_STORE_METHOD_READONLY, TRUE);
+    /* Read-only: no signer created. No privkey available. */
+    app_set_signer(NULL, pubkey_hex, NULL, KEY_STORE_METHOD_READONLY, TRUE);
     nostr_bridge_set_signer(NULL, pubkey_hex, TRUE);
 
     g_print("[agent-login] Read-only: pubkey=%s\n", pubkey_hex);
@@ -290,7 +306,13 @@ static cJSON *login_nip46(cJSON *params) {
         return make_error("SIGNER_FAILED", "Failed to create client signer");
     }
 
-    app_set_signer(signer, pubkey_hex, KEY_STORE_METHOD_NIP46, FALSE);
+    /* NIP-46: the client_privkey is a throwaway session key for the bunker
+     * protocol, not the user's identity key. The user's actual signing key
+     * lives on the remote bunker. We do NOT use it for bookmark HMAC d tags
+     * (the bunker signer handles NIP-44 content encryption; d-tag derivation
+     * would require the user's real privkey, which we don't have). Bookmarks
+     * can still be loaded from the db in read-only fashion. */
+    app_set_signer(signer, pubkey_hex, NULL, KEY_STORE_METHOD_NIP46, FALSE);
     nostr_bridge_set_signer(signer, pubkey_hex, FALSE);
 
     g_print("[agent-login] NIP-46: remote signer pubkey=%s\n", pubkey_hex);
@@ -374,7 +396,9 @@ static cJSON *login_nsigner(cJSON *params) {
 
     sigprocmask(SIG_SETMASK, &old_set, NULL);
 
-    app_set_signer(signer, pubkey_hex, KEY_STORE_METHOD_NSIGNER, FALSE);
+    /* n_signer: the privkey never leaves the hardware device, so we can't
+     * derive HMAC d tags client-side. Bookmarks fall back to read-only. */
+    app_set_signer(signer, pubkey_hex, NULL, KEY_STORE_METHOD_NSIGNER, FALSE);
     nostr_bridge_set_signer(signer, pubkey_hex, FALSE);
 
     g_print("[agent-login] n_signer: transport=%s index=%d pubkey=%s\n",

src/bookmarks.h

@@ -1,9 +1,22 @@
 /*
- * bookmarks.h — NIP-44 encrypted Nostr bookmarks with directories
+ * bookmarks.h — NIP-44 encrypted Nostr bookmarks with nested folders
  *
  * Stores bookmarks as NIP-51 kind 30003 (bookmark sets) events, one per
- * directory. Each directory's bookmarks are NIP-44 encrypted (self-to-self)
- * and stored in the event's content field as a JSON tag array.
+ * folder. Folders may be nested arbitrarily (e.g. "Work/Projects/Secret").
+ *
+ * Privacy design:
+ *   - The `d` tag is HMAC-SHA256(hmac_key, path) — a deterministic, opaque
+ *     64-hex-char identifier. Relays learn nothing about folder names or
+ *     structure (not even the folder count). Determinism preserves NIP-33
+ *     replaceability: re-publishing the same path replaces the prior event.
+ *     Encryption (NIP-04 / NIP-44) cannot be used for the `d` tag because
+ *     both use a random IV/nonce per call, which would break replaceability.
+ *   - The real path and the bookmark list live inside the NIP-44 encrypted
+ *     `content` as JSON: {"path": "Work/Projects/Secret", "bookmarks": [...]}
+ *   - The HMAC key is derived from the user's Nostr privkey:
+ *       hmac_key = HMAC-SHA256(privkey_bytes, "sovereign-browser/bookmarks-folder-id-v1")
+ *     It is per-user, never published, and automatically available on every
+ *     device the user logs in on.
  *
  * The bookmarks sync across all devices the user logs in on via the
  * bootstrap relays.
@@ -22,10 +35,15 @@
 extern "C" {
 #endif
 
-#define BOOKMARKS_MAX_PER_DIR  500
-#define BOOKMARKS_DIR_NAME_MAX 128
-#define BOOKMARKS_URL_MAX      2048
-#define BOOKMARKS_TITLE_MAX    256
+#define BOOKMARKS_MAX_PER_NODE  500
+#define BOOKMARKS_NAME_MAX      128
+#define BOOKMARKS_PATH_MAX      1024
+#define BOOKMARKS_URL_MAX       2048
+#define BOOKMARKS_TITLE_MAX     256
+
+/* Label mixed into the HMAC key derivation so d-tag namespaces are isolated
+ * per application and can be rotated independently if ever needed. */
+#define BOOKMARKS_HMAC_KEY_LABEL "sovereign-browser/bookmarks-folder-id-v1"
 
 typedef struct {
     char *url;
@@ -33,70 +51,97 @@ typedef struct {
     long  added;   /* unix timestamp */
 } bookmark_t;
 
-typedef struct {
-    char        name[BOOKMARKS_DIR_NAME_MAX];
-    bookmark_t *bookmarks;
-    int         count;
-} bookmark_dir_t;
+/* A node in the bookmark tree. The root node has name="" and path="".
+ * Each node corresponds to a folder path; bookmarks live at any node. */
+typedef struct bookmark_node {
+    char                *name;     /* last path segment, "" for root */
+    char                *path;     /* full path, "" for root */
+    bookmark_t          *bookmarks;
+    int                  bookmark_count;
+    struct bookmark_node *children; /* array of child nodes */
+    int                  child_count;
+    int                  child_cap;
+} bookmark_node_t;
 
 /*
  * Initialize the bookmarks module. Loads cached bookmarks from the SQLite
  * database and decrypts them using the signer.
  *
- *   signer      — the user's nostr_signer_t (NULL for read-only/no-login)
- *   pubkey_hex  — the user's hex pubkey (64 chars)
+ *   signer       — the user's nostr_signer_t (NULL for read-only/no-login)
+ *   pubkey_hex   — the user's hex pubkey (64 chars) or NULL
+ *   privkey_hex  — the user's hex privkey (64 chars) or NULL. Used to derive
+ *                  the HMAC key for opaque d tags. NULL in read-only mode
+ *                  (existing events can still be loaded from the db, but
+ *                  no new events can be published).
  *
  * Returns 0 on success, -1 on error.
  */
-int  bookmarks_init(nostr_signer_t *signer, const char *pubkey_hex);
+int  bookmarks_init(nostr_signer_t *signer,
+                    const char *pubkey_hex,
+                    const char *privkey_hex);
 
-/* Free the in-memory bookmark list. Call at shutdown. */
+/* Free the in-memory bookmark tree. Call at shutdown. */
 void bookmarks_cleanup(void);
 
 /* ── Read access ───────────────────────────────────────────────────── */
 
-/* Get the list of directories (read-only). Returns a pointer to the
- * internal array (valid until the next bookmarks operation). */
-const bookmark_dir_t *bookmarks_get_dirs(int *count_out);
+/* Get the root node of the bookmark tree (read-only). Returns NULL if
+ * bookmarks_init has not been called. The returned pointer is valid until
+ * the next bookmarks mutation. */
+const bookmark_node_t *bookmarks_get_root(void);
 
-/* Get a specific directory by name. Returns NULL if not found. */
-const bookmark_dir_t *bookmarks_get_dir(const char *name);
+/* Find a node by path. Returns NULL if not found. */
+const bookmark_node_t *bookmarks_find(const char *path);
 
-/* ── Write access (requires signer) ────────────────────────────────── */
+/* ── Write access (requires signer + privkey) ──────────────────────── */
 
-/* Add a bookmark to a directory. If the directory doesn't exist, it's
- * created. Updates the in-memory list, re-encrypts, publishes a new
- * kind 30003 event for that directory, and stores in SQLite.
+/* Add a bookmark to a folder path. If the folder (or any intermediate
+ * folder) doesn't exist, it is created. Updates the in-memory tree,
+ * re-encrypts, publishes a new kind 30003 event for that path, and stores
+ * in SQLite.
  *
  * Returns 0 on success, -1 on error. */
-int  bookmarks_add(const char *dir, const char *url, const char *title);
+int  bookmarks_add(const char *path, const char *url, const char *title);
 
-/* Remove a bookmark by URL from a directory.
+/* Remove a bookmark by URL from a folder path.
  * Returns 0 on success, -1 on not found / error. */
-int  bookmarks_remove(const char *dir, const char *url);
+int  bookmarks_remove(const char *path, const char *url);
 
-/* Move a bookmark from one directory to another.
+/* Move a bookmark from one folder to another.
  * Returns 0 on success, -1 on error. */
-int  bookmarks_move(const char *from_dir, const char *url,
-                    const char *to_dir);
+int  bookmarks_move(const char *from_path, const char *url,
+                    const char *to_path);
 
-/* Create a new empty directory. Publishes an empty kind 30003 event.
- * Returns 0 on success, -1 if directory already exists / error. */
-int  bookmarks_create_dir(const char *name);
+/* Create a new empty folder at the given path. Parent folders are created
+ * if missing. Publishes an empty kind 30003 event.
+ * Returns 0 on success, -1 if the folder already exists / error. */
+int  bookmarks_create_dir(const char *path);
 
-/* Delete a directory. If move_to_general is TRUE, bookmarks are moved
- * to "General" before deletion. Publishes a kind 5 deletion event.
+/* Rename a folder. Re-publishes the renamed node and every descendant with
+ * new HMAC d tags and new encrypted content; emits kind 5 deletions for the
+ * old d tags.
  * Returns 0 on success, -1 on error. */
-int  bookmarks_delete_dir(const char *name, int move_to_general);
+int  bookmarks_rename_dir(const char *old_path, const char *new_path);
+
+/* Delete a folder. If move_to_general is TRUE, the folder's bookmarks (and
+ * its descendants' bookmarks) are moved to "General" before deletion.
+ * Emits kind 5 deletion events for every d tag in the subtree.
+ * Returns 0 on success, -1 on error. */
+int  bookmarks_delete_dir(const char *path, int move_to_general);
+
+/* ── Change notification ───────────────────────────────────────────── */
+
+/* Callback invoked after any mutation (add/remove/move/create/rename/delete
+ * and after relay-fetch loads new events). Used by the bookmarks toolbar to
+ * refresh every open tab. */
+typedef void (*bookmarks_changed_cb)(void *user_data);
+
+void bookmarks_subscribe_changed(bookmarks_changed_cb cb, void *user_data);
 
 /* ── Internal (used by relay fetch) ────────────────────────────────── */
 
-/* Load bookmarks for a directory from a decrypted kind 30003 event's
- * content JSON. Called by bookmarks_init and after relay fetch. */
-int  bookmarks_load_dir_from_json(const char *dir_name, const char *json);
-
 /* Store a raw kind 30003 event in the database and decrypt its content
- * into the in-memory list. Called by the relay fetch after login. */
+ * into the in-memory tree. Called by the relay fetch after login. */
 int  bookmarks_store_and_load_event(const void *event_cjson);
 
 #ifdef __cplusplus

src/fips_control.c

@@ -182,6 +182,32 @@ char *fips_control_show_peers(int fd, char *error, size_t error_size) {
     return result;
 }
 
+/* Generic single-command "show_*" that returns the data field as
+ * compact JSON. Used by show_tree and show_identity_cache, which have
+ * the same response shape as show_peers. */
+static char *fips_control_show_generic(int fd, const char *command,
+                                       char *error, size_t error_size) {
+    cJSON *cmd = cJSON_CreateObject();
+    cJSON_AddStringToObject(cmd, "command", command);
+    cJSON *root = request(fd, cmd, error, error_size);
+    cJSON_Delete(cmd);
+    if (!root) return NULL;
+    cJSON *data = cJSON_GetObjectItemCaseSensitive(root, "data");
+    char *printed = data ? cJSON_PrintUnformatted(data) : NULL;
+    char *result = printed ? g_strdup(printed) : NULL;
+    cJSON_free(printed);
+    cJSON_Delete(root);
+    return result;
+}
+
+char *fips_control_show_tree(int fd, char *error, size_t error_size) {
+    return fips_control_show_generic(fd, "show_tree", error, error_size);
+}
+
+char *fips_control_show_identity_cache(int fd, char *error, size_t error_size) {
+    return fips_control_show_generic(fd, "show_identity_cache", error, error_size);
+}
+
 int fips_control_connect_peer(int fd, const char *npub, const char *address,
                               const char *transport,
                               char *error, size_t error_size) {
@@ -202,6 +228,23 @@ int fips_control_connect_peer(int fd, const char *npub, const char *address,
     return 0;
 }
 
+int fips_control_disconnect_peer(int fd, const char *npub,
+                                 char *error, size_t error_size) {
+    if (!npub || !npub[0]) {
+        set_error(error, error_size, "%s", "FIPS peer npub is required");
+        return -1;
+    }
+    cJSON *cmd = cJSON_CreateObject();
+    cJSON_AddStringToObject(cmd, "command", "disconnect");
+    cJSON *params = cJSON_AddObjectToObject(cmd, "params");
+    cJSON_AddStringToObject(params, "npub", npub);
+    cJSON *root = request(fd, cmd, error, error_size);
+    cJSON_Delete(cmd);
+    if (!root) return -1;
+    cJSON_Delete(root);
+    return 0;
+}
+
 void fips_control_close(int *fd) {
     if (fd && *fd >= 0) { close(*fd); *fd = -1; }
 }

src/fips_control.h

@@ -26,9 +26,14 @@ int fips_control_show_status(int fd, fips_status_t *status,
                              char *error, size_t error_size);
 /* Returns the response data as compact JSON. Caller frees with g_free(). */
 char *fips_control_show_peers(int fd, char *error, size_t error_size);
+/* show_tree / show_identity_cache — same contract as show_peers. */
+char *fips_control_show_tree(int fd, char *error, size_t error_size);
+char *fips_control_show_identity_cache(int fd, char *error, size_t error_size);
 int fips_control_connect_peer(int fd, const char *npub, const char *address,
-                              const char *transport,
-                              char *error, size_t error_size);
+                               const char *transport,
+                               char *error, size_t error_size);
+int fips_control_disconnect_peer(int fd, const char *npub,
+                                 char *error, size_t error_size);
 void fips_control_close(int *fd);
 gboolean fips_control_socket_available(const char *socket_path, int timeout_ms);
 

src/history.c

@@ -29,6 +29,8 @@ void history_add_titled(const char *url, const char *title) {
         strncmp(url, "sovereign://bookmarks/delete", 28) == 0 ||
         strncmp(url, "sovereign://bookmarks/createdir", 31) == 0 ||
         strncmp(url, "sovereign://bookmarks/deletedir", 31) == 0 ||
+        strncmp(url, "sovereign://bookmarks/move", 26) == 0 ||
+        strncmp(url, "sovereign://bookmarks/renamedir", 31) == 0 ||
         strncmp(url, "sovereign://qr", 14) == 0 ||
         strncmp(url, "sovereign://nostr/", 18) == 0) {
         return;

src/main.c

@@ -66,6 +66,7 @@
 typedef struct {
     nostr_signer_t      *signer;       /* NULL for read-only mode */
     char                 pubkey_hex[65];
+    char                 privkey_hex[65]; /* in-memory only; for HMAC d-tag derivation */
     key_store_method_t   method;
     gboolean             readonly;     /* TRUE if no signing available */
 } app_state_t;
@@ -81,6 +82,7 @@ static gboolean    g_is_fullscreen = FALSE;  /* track fullscreen state (GTK3 has
 /* ---- App state accessors (used by agent_login.c) ─────────────────── */
 
 void app_set_signer(nostr_signer_t *signer, const char *pubkey_hex,
+                    const char *privkey_hex,
                     key_store_method_t method, gboolean readonly) {
     g_state.signer = signer;
     g_state.method = method;
@@ -89,6 +91,12 @@ void app_set_signer(nostr_signer_t *signer, const char *pubkey_hex,
         strncpy(g_state.pubkey_hex, pubkey_hex, 64);
         g_state.pubkey_hex[64] = '\0';
     }
+    if (privkey_hex && privkey_hex[0]) {
+        strncpy(g_state.privkey_hex, privkey_hex, 64);
+        g_state.privkey_hex[64] = '\0';
+    } else {
+        g_state.privkey_hex[0] = '\0';
+    }
     g_logged_in = TRUE;
 
     /* Update modules that hold a signer reference. */
@@ -112,6 +120,7 @@ void app_clear_signer(void) {
         g_state.signer = NULL;
     }
     g_state.pubkey_hex[0] = '\0';
+    g_state.privkey_hex[0] = '\0';
     g_state.method = KEY_STORE_METHOD_NONE;
     g_state.readonly = FALSE;
     g_logged_in = FALSE;
@@ -313,6 +322,21 @@ void on_menu_agent(GtkMenuItem *item, gpointer data) {
     }
 }
 
+/* The hamburger-menu "FIPS Mesh…" item navigates the active tab to
+ * the sovereign://fips internal page, which renders the FIPS mesh
+ * network status + management UI. */
+void on_menu_fips(GtkMenuItem *item, gpointer data) {
+    (void)item;
+    (void)data;
+
+    tab_info_t *tab = tab_manager_get_active();
+    if (tab && tab->webview) {
+        webkit_web_view_load_uri(tab->webview, "sovereign://fips");
+    } else {
+        tab_manager_new_tab("sovereign://fips");
+    }
+}
+
 /* ---- Keyboard shortcuts --------------------------------------------- *
  * All browser-level shortcuts are configurable via the shortcuts module.
  * The on_key_press handler looks up the action for the pressed key
@@ -490,7 +514,83 @@ static void agent_login_callback(void) {
     g_print("[login] Agent login detected.\n");
 }
 
-/* ---- Window destroy ------------------------------------------------- */
+/* ---- Window close / destroy ----------------------------------------- *
+ * The main window uses a delete-event handler to intercept the window
+ * manager's close request BEFORE the window is destroyed. This lets us
+ * close the main window's tabs cleanly (updating g_tab_count) and keep
+ * the app running if auxiliary windows still have tabs. The app only
+ * quits when the last window is closed (no tabs remain anywhere).
+ *
+ *   delete-event: runs first. Closes all main-window tabs. If aux windows
+ *     still have tabs, returns TRUE to suppress destroy and hides the
+ *     main window. If no tabs remain, returns FALSE to let destroy
+ *     proceed → on_window_destroy → gtk_main_quit().
+ *   destroy: runs only when the app is truly shutting down. Performs
+ *     session save, net_services_shutdown, agent_server_stop, etc.
+ */
+
+/* Guard flag: set while on_window_delete_event is closing the main
+ * window's tabs. Prevents re-entrancy when tab_manager_close_tab()
+ * calls gtk_window_close(g_window) after the last tab is closed, which
+ * would re-emit delete-event. */
+static gboolean g_main_window_closing = FALSE;
+
+static gboolean on_window_delete_event(GtkWidget *widget,
+                                        GdkEvent *event,
+                                        gpointer data) {
+    (void)event;
+    (void)data;
+
+    /* If we're already in the process of closing (re-entrant call from
+     * tab_manager_close_tab → gtk_window_close), let the destroy
+     * proceed. */
+    if (g_main_window_closing) {
+        return FALSE;
+    }
+    g_main_window_closing = TRUE;
+
+    /* Close all tabs that belong to the main window's notebook. We
+     * identify main-window tabs by checking gtk_notebook_page_num on
+     * the main notebook. tab_manager_close_tab handles removing from
+     * the notebook and the g_tabs array. Re-scan each iteration because
+     * closing shifts indices. */
+    for (;;) {
+        gboolean found = FALSE;
+        GtkWidget *main_nb = tab_manager_get_main_notebook();
+        if (main_nb == NULL) break;
+        /* Close from the highest index down so removal doesn't shift
+         * unprocessed indices. Find the highest-index tab in the main
+         * notebook and close it. */
+        for (int i = tab_manager_count() - 1; i >= 0; i--) {
+            tab_info_t *tab = tab_manager_get(i);
+            if (tab == NULL || tab->page == NULL) continue;
+            if (gtk_notebook_page_num(GTK_NOTEBOOK(main_nb),
+                                       tab->page) >= 0) {
+                tab_manager_close_tab(i);
+                found = TRUE;
+                break;
+            }
+        }
+        if (!found) break;
+    }
+
+    /* If auxiliary windows still have tabs, keep the app running.
+     * Suppress the default destroy by returning TRUE, and hide the
+     * main window. The aux windows continue independently. */
+    if (tab_manager_count() > 0) {
+        g_print("[windows] Main window closed but %d tab(s) remain in "
+                "other window(s) — keeping app alive.\n",
+                tab_manager_count());
+        gtk_widget_hide(widget);
+        g_main_window_closing = FALSE;  /* allow re-opening later */
+        return TRUE;  /* suppress destroy */
+    }
+
+    /* No tabs left anywhere — let the destroy proceed, which triggers
+     * on_window_destroy and quits the app. Keep the guard set so any
+     * re-entrant delete-event from the destroy path doesn't re-enter. */
+    return FALSE;
+}
 
 static void on_window_destroy(GtkWidget *widget, gpointer data) {
     (void)widget;
@@ -558,6 +658,10 @@ static int do_login(GtkWindow *parent) {
     g_state.method = result.method;
     strncpy(g_state.pubkey_hex, result.pubkey_hex, 64);
     g_state.pubkey_hex[64] = '\0';
+    /* Carry the privkey (in-memory only) for HMAC d-tag derivation in the
+     * bookmarks module. Empty for readonly / nsigner / nip46 methods. */
+    strncpy(g_state.privkey_hex, result.identity.privkey_hex, 64);
+    g_state.privkey_hex[64] = '\0';
     g_state.readonly = (result.method == KEY_STORE_METHOD_READONLY ||
                         result.method == KEY_STORE_METHOD_NONE);
     g_logged_in = TRUE;
@@ -746,6 +850,8 @@ int main(int argc, char **argv) {
     GtkWidget *window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
     gtk_window_set_title(GTK_WINDOW(window), "sovereign browser " SB_VERSION);
     gtk_window_set_default_size(GTK_WINDOW(window), 1024, 768);
+    g_signal_connect(window, "delete-event",
+                     G_CALLBACK(on_window_delete_event), NULL);
     g_signal_connect(window, "destroy", G_CALLBACK(on_window_destroy), NULL);
     g_signal_connect(window, "key-press-event", G_CALLBACK(on_key_press), NULL);
     g_window = GTK_WINDOW(window);
@@ -850,7 +956,8 @@ int main(int argc, char **argv) {
      * from SQLite and decrypts them. In no-login/read-only mode, the
      * signer is NULL so bookmarks are read-only. */
     bookmarks_init(g_state.signer,
-                   g_state.pubkey_hex[0] ? g_state.pubkey_hex : NULL);
+                   g_state.pubkey_hex[0] ? g_state.pubkey_hex : NULL,
+                   g_state.privkey_hex[0] ? g_state.privkey_hex : NULL);
 
     /* Initialize the NIP-78 settings sync module. In no-login/read-only
      * mode, the signer is NULL so settings are local-only (not synced). */

src/tab_manager.c

@@ -38,6 +38,19 @@ static const char *ci_strstr(const char *haystack, const char *needle) {
     return NULL;
 }
 
+/* Recursively collect all bookmarks in the bookmark tree into a GPtrArray
+ * of `const bookmark_t *` (shallow — pointers are valid until the next
+ * bookmarks mutation). Used by URL completion and the hamburger menu. */
+static void collect_all_bookmarks(const bookmark_node_t *node, GPtrArray *out) {
+    if (node == NULL) return;
+    for (int i = 0; i < node->bookmark_count; i++) {
+        g_ptr_array_add(out, &node->bookmarks[i]);
+    }
+    for (int i = 0; i < node->child_count; i++) {
+        collect_all_bookmarks(&node->children[i], out);
+    }
+}
+
 /* ── External callbacks defined in main.c ─────────────────────────── *
  * These handle identity-related menu actions that need access to the
  * global app_state_t (signer, pubkey, method). main.c owns that state.
@@ -54,6 +67,7 @@ extern void app_menu_about_proxy(GtkMenuItem *item, gpointer data);
 extern void on_menu_settings(GtkMenuItem *item, gpointer data);
 extern void on_menu_profile(GtkMenuItem *item, gpointer data);
 extern void on_menu_agent(GtkMenuItem *item, gpointer data);
+extern void on_menu_fips(GtkMenuItem *item, gpointer data);
 
 /* Key press handler defined in main.c — connected to each webview so
  * keyboard shortcuts are caught before WebKit consumes the event. */
@@ -151,6 +165,10 @@ static GtkWidget   *tab_manager_new_window(const char *url,
 static gboolean     on_notebook_button_press(GtkWidget *widget,
                                               GdkEventButton *event,
                                               gpointer user_data);
+static void         on_new_tab_clicked(GtkButton *btn, gpointer data);
+static void         setup_notebook_action_widgets(GtkWidget *notebook,
+                                                  gboolean is_main);
+static void         track_avatar_image(GtkWidget *image);
 static gboolean     on_window_focus_in(GtkWidget *widget,
                                         GdkEventFocus *event,
                                         gpointer user_data);
@@ -412,28 +430,27 @@ static void rebuild_completion(const char *query, completion_state_t *cs) {
     g_free(titles);
 
     /* ── Direct links from bookmarks ──────────────────────────────── */
-    int dir_count = 0;
-    const bookmark_dir_t *dirs = bookmarks_get_dirs(&dir_count);
+    GPtrArray *bms = g_ptr_array_new();
+    collect_all_bookmarks(bookmarks_get_root(), bms);
     int bookmark_added = 0;
-    for (int d = 0; d < dir_count && bookmark_added < COMPLETION_MAX_DIRECT; d++) {
-        for (int b = 0; b < dirs[d].count && bookmark_added < COMPLETION_MAX_DIRECT; b++) {
-            const bookmark_t *bm = &dirs[d].bookmarks[b];
-            /* Case-insensitive substring search. */
-            if ((bm->url && ci_strstr(bm->url, query)) ||
-                (bm->title && ci_strstr(bm->title, query))) {
-                char *label = url_display_label(bm->url, bm->title);
-                GtkTreeIter iter;
-                gtk_list_store_append(cs->store, &iter);
-                gtk_list_store_set(cs->store, &iter,
-                                   COMPLETION_COL_DISPLAY,    label,
-                                   COMPLETION_COL_URL,        bm->url,
-                                   COMPLETION_COL_IS_DIRECT,  TRUE,
-                                   -1);
-                g_free(label);
-                bookmark_added++;
-            }
+    for (guint i = 0; i < bms->len && bookmark_added < COMPLETION_MAX_DIRECT; i++) {
+        const bookmark_t *bm = (const bookmark_t *)g_ptr_array_index(bms, i);
+        /* Case-insensitive substring search. */
+        if ((bm->url && ci_strstr(bm->url, query)) ||
+            (bm->title && ci_strstr(bm->title, query))) {
+            char *label = url_display_label(bm->url, bm->title);
+            GtkTreeIter iter;
+            gtk_list_store_append(cs->store, &iter);
+            gtk_list_store_set(cs->store, &iter,
+                               COMPLETION_COL_DISPLAY,    label,
+                               COMPLETION_COL_URL,        bm->url,
+                               COMPLETION_COL_IS_DIRECT,  TRUE,
+                               -1);
+            g_free(label);
+            bookmark_added++;
         }
     }
+    g_ptr_array_free(bms, TRUE);
 
     /* ── Domain heuristic ─────────────────────────────────────────── *
      * If the query has no spaces and no dots, offer to navigate directly
@@ -905,8 +922,66 @@ static void on_favicon_changed(WebKitWebView *webview, GParamSpec *pspec,
  * If the navigation action is a link click with a target that would open
  * a new view (WEBKIT_NAVIGATION_TYPE_LINK_CLICKED with a non-current
  * browser action), we open a new tab and ignore the default decision.
+ *
+ * URL rewriting (fips://, nostr:, .onion → tor://) is deferred to an idle
+ * callback. Calling webkit_web_view_load_uri() synchronously from inside
+ * the decide-policy handler starts a new navigation while WebKit is still
+ * processing the current policy decision — this re-entrancy crashes
+ * WebKitGTK with a segfault, most reliably when the webview is freshly
+ * created (e.g. a new tab opened for an onion link). By ignoring the
+ * current decision first and scheduling the redirect for the next idle
+ * tick, the policy decision completes cleanly before the new navigation
+ * begins.
  */
 
+typedef struct {
+    WebKitWebView *webview;
+    char          *uri;        /* URL to load via webkit_web_view_load_uri */
+    char          *html;       /* HTML to load via webkit_web_view_load_html (mutually exclusive with uri) */
+    char          *base_uri;   /* base URI for load_html */
+} deferred_nav_t;
+
+static gboolean deferred_nav_idle(gpointer user_data) {
+    deferred_nav_t *nav = (deferred_nav_t *)user_data;
+    if (nav == NULL) return G_SOURCE_REMOVE;
+
+    /* The webview may have been destroyed between scheduling the idle and
+     * running it (e.g. the user closed the tab). Guard with WEBKIT_IS_WEB_VIEW. */
+    if (nav->webview && WEBKIT_IS_WEB_VIEW(nav->webview)) {
+        if (nav->html != NULL) {
+            webkit_web_view_load_html(nav->webview, nav->html,
+                                      nav->base_uri ? nav->base_uri : "about:blank");
+        } else if (nav->uri != NULL) {
+            webkit_web_view_load_uri(nav->webview, nav->uri);
+        }
+    }
+
+    g_clear_object(&nav->webview);
+    g_free(nav->uri);
+    g_free(nav->html);
+    g_free(nav->base_uri);
+    g_free(nav);
+    return G_SOURCE_REMOVE;
+}
+
+/* Schedule a load_uri on the next idle tick. Takes ownership of `uri`. */
+static void defer_load_uri(WebKitWebView *webview, char *uri) {
+    deferred_nav_t *nav = g_new0(deferred_nav_t, 1);
+    nav->webview = g_object_ref(webview);
+    nav->uri = uri;  /* takes ownership */
+    g_idle_add(deferred_nav_idle, nav);
+}
+
+/* Schedule a load_html on the next idle tick. Takes ownership of `html`
+ * and `base_uri`. */
+static void defer_load_html(WebKitWebView *webview, char *html, char *base_uri) {
+    deferred_nav_t *nav = g_new0(deferred_nav_t, 1);
+    nav->webview = g_object_ref(webview);
+    nav->html = html;        /* takes ownership */
+    nav->base_uri = base_uri; /* takes ownership */
+    g_idle_add(deferred_nav_idle, nav);
+}
+
 static gboolean on_decide_policy(WebKitWebView *webview,
                                   WebKitPolicyDecision *decision,
                                   WebKitPolicyDecisionType type,
@@ -931,9 +1006,11 @@ static gboolean on_decide_policy(WebKitWebView *webview,
     if (uri && strncmp(uri, "fips://", 7) == 0) {
         char *normalized = normalize_fips_url(uri);
         if (normalized) {
-            webkit_web_view_load_uri(webview, normalized);
-            g_free(normalized);
+            /* Ignore the current decision first, then defer the redirect
+             * to the next idle tick to avoid re-entrant navigation inside
+             * the decide-policy handler (which segfaults WebKitGTK). */
             webkit_policy_decision_ignore(decision);
+            defer_load_uri(webview, normalized);  /* takes ownership */
             return TRUE;
         }
     }
@@ -944,19 +1021,19 @@ static gboolean on_decide_policy(WebKitWebView *webview,
         strncmp(uri, "nostr://", 8) != 0) {
         nostr_entity_type_t entity_type = nostr_url_detect(uri);
         if (entity_type == NOSTR_ENTITY_NSEC) {
-            webkit_web_view_load_html(webview,
+            char *html = g_strdup(
                 "<!doctype html><meta charset=\"utf-8\"><title>Private key blocked</title>"
-                "<h1>Navigation blocked</h1><p>Nostr private keys cannot be opened or navigated to.</p>",
-                "nostr://blocked-private-key");
+                "<h1>Navigation blocked</h1><p>Nostr private keys cannot be opened or navigated to.</p>");
+            char *base_uri = g_strdup("nostr://blocked-private-key");
             webkit_policy_decision_ignore(decision);
+            defer_load_html(webview, html, base_uri);  /* takes ownership */
             return TRUE;
         }
 
         char *normalized = nostr_url_normalize(uri);
         if (normalized) {
-            webkit_web_view_load_uri(webview, normalized);
-            g_free(normalized);
             webkit_policy_decision_ignore(decision);
+            defer_load_uri(webview, normalized);  /* takes ownership */
             return TRUE;
         }
     }
@@ -967,9 +1044,8 @@ static gboolean on_decide_policy(WebKitWebView *webview,
     const char *tor_rest = NULL;
     if (uri && uri_is_http_onion(uri, &tor_rest)) {
         char *tor_url = g_strdup_printf("tor://%s", tor_rest);
-        webkit_web_view_load_uri(webview, tor_url);
-        g_free(tor_url);
         webkit_policy_decision_ignore(decision);
+        defer_load_uri(webview, tor_url);  /* takes ownership */
         return TRUE;
     }
 
@@ -1120,6 +1196,13 @@ static GtkWidget *tab_manager_new_window(const char *url,
     gtk_notebook_set_show_border(GTK_NOTEBOOK(notebook), FALSE);
     gtk_notebook_set_show_tabs(GTK_NOTEBOOK(notebook), TRUE);
 
+    /* New-tab button + avatar as notebook action widgets, same as the
+     * main window. The new-tab button is wired to THIS notebook so tabs
+     * open in this window, not the main window. is_main=FALSE so a
+     * separate avatar image is created and tracked (the global g_avatar
+     * stays pointing at the main window's image). */
+    setup_notebook_action_widgets(notebook, FALSE);
+
     /* Build a window-level GtkPaned: left = sidebar container, right =
      * notebook. The sidebar is per-window (not per-tab), so it persists
      * across tab switches within this window. Hidden by default. */
@@ -1992,57 +2075,39 @@ static void on_bookmarks_menu_show(GtkWidget *menu, gpointer user_data) {
     }
     g_list_free(children);
 
-    /* Get current bookmarks. */
-    int dir_count = 0;
-    const bookmark_dir_t *dirs = bookmarks_get_dirs(&dir_count);
+    /* Get current bookmarks (flattened from the tree). */
+    GPtrArray *bms = g_ptr_array_new();
+    collect_all_bookmarks(bookmarks_get_root(), bms);
 
-    int total_bookmarks = 0;
-    for (int i = 0; i < dir_count; i++) {
-        total_bookmarks += dirs[i].count;
-    }
-
-    if (total_bookmarks == 0) {
+    if (bms->len == 0) {
         GtkWidget *empty = gtk_menu_item_new_with_label("(no bookmarks)");
         gtk_widget_set_sensitive(empty, FALSE);
         gtk_menu_shell_append(GTK_MENU_SHELL(menu), empty);
     } else {
-        /* Show bookmarks grouped by directory (up to 15 total). */
+        /* Show up to 15 bookmarks (flattened tree order). */
         int shown = 0;
-        for (int i = 0; i < dir_count && shown < 15; i++) {
-            const bookmark_dir_t *dir = &dirs[i];
-            if (dir->count == 0) continue;
-
-            /* Directory label (non-clickable). */
-            char label[160];
-            snprintf(label, sizeof(label), "— %s —", dir->name);
-            GtkWidget *dir_item = gtk_menu_item_new_with_label(label);
-            gtk_widget_set_sensitive(dir_item, FALSE);
-            gtk_menu_shell_append(GTK_MENU_SHELL(menu), dir_item);
-
-            for (int j = 0; j < dir->count && shown < 15; j++) {
-                const bookmark_t *bm = &dir->bookmarks[j];
-                /* Use the title if available, otherwise the URL. */
-                const char *label_text = bm->title[0] ? bm->title : bm->url;
-                char short_label[80];
-                if (strlen(label_text) > 75) {
-                    snprintf(short_label, sizeof(short_label), "%.72s...",
-                             label_text);
-                } else {
-                    snprintf(short_label, sizeof(short_label), "%s",
-                             label_text);
-                }
-                GtkWidget *bm_item = gtk_menu_item_new_with_label(short_label);
-                gtk_widget_set_tooltip_text(bm_item, bm->url);
-                /* Store the URL in a g_strdup'd string attached to the item. */
-                char *url_copy = g_strdup(bm->url);
-                g_signal_connect_data(bm_item, "activate",
-                    G_CALLBACK(on_bookmark_item_clicked), url_copy,
-                    (GClosureNotify)closure_notify_g_free, 0);
-                gtk_menu_shell_append(GTK_MENU_SHELL(menu), bm_item);
-                shown++;
+        for (guint i = 0; i < bms->len && shown < 15; i++) {
+            const bookmark_t *bm = (const bookmark_t *)g_ptr_array_index(bms, i);
+            const char *label_text = (bm->title && bm->title[0]) ? bm->title : bm->url;
+            char short_label[80];
+            if (strlen(label_text) > 75) {
+                snprintf(short_label, sizeof(short_label), "%.72s...",
+                         label_text);
+            } else {
+                snprintf(short_label, sizeof(short_label), "%s",
+                         label_text);
             }
+            GtkWidget *bm_item = gtk_menu_item_new_with_label(short_label);
+            gtk_widget_set_tooltip_text(bm_item, bm->url);
+            char *url_copy = g_strdup(bm->url);
+            g_signal_connect_data(bm_item, "activate",
+                G_CALLBACK(on_bookmark_item_clicked), url_copy,
+                (GClosureNotify)closure_notify_g_free, 0);
+            gtk_menu_shell_append(GTK_MENU_SHELL(menu), bm_item);
+            shown++;
         }
     }
+    g_ptr_array_free(bms, TRUE);
 
     gtk_menu_shell_append(GTK_MENU_SHELL(menu),
                           gtk_separator_menu_item_new());
@@ -2055,9 +2120,21 @@ static void on_bookmarks_menu_show(GtkWidget *menu, gpointer user_data) {
     gtk_widget_show_all(menu);
 }
 
+/* Recursively collect all folder paths in the bookmark tree into `out`.
+ * The root node itself is skipped (its path is ""). */
+static void collect_folder_paths(const bookmark_node_t *node, GPtrArray *out) {
+    if (node == NULL) return;
+    for (int i = 0; i < node->child_count; i++) {
+        const bookmark_node_t *child = &node->children[i];
+        g_ptr_array_add(out, g_strdup(child->path));
+        collect_folder_paths(child, out);
+    }
+}
+
 /* Called when the bookmark button (toolbar) is clicked.
- * Shows a dialog to pick or create a directory, then bookmarks the
- * current page. */
+ * Shows a dialog to pick or create a folder path, then bookmarks the
+ * current page. The picker lists all existing folder paths (including
+ * nested ones like "Work/Projects") and lets the user type a new path. */
 static void on_bookmark_clicked(GtkButton *btn, gpointer user_data) {
     (void)btn;
     tab_info_t *tab = (tab_info_t *)user_data;
@@ -2080,7 +2157,7 @@ static void on_bookmark_clicked(GtkButton *btn, gpointer user_data) {
     const gchar *title = webkit_web_view_get_title(tab->webview);
     if (title == NULL) title = "";
 
-    /* Build the directory picker dialog. */
+    /* Build the folder picker dialog. */
     GtkWidget *dialog = gtk_dialog_new_with_buttons(
         "Bookmark Page", g_window,
         GTK_DIALOG_MODAL | GTK_DIALOG_DESTROY_WITH_PARENT,
@@ -2104,22 +2181,24 @@ static void on_bookmark_clicked(GtkButton *btn, gpointer user_data) {
     gtk_widget_set_halign(lbl, GTK_ALIGN_START);
     gtk_box_pack_start(GTK_BOX(content), lbl, FALSE, FALSE, 8);
 
-    /* Directory combo box. */
-    GtkWidget *dir_label = gtk_label_new("Directory:");
+    /* Folder combo box (with entry so the user can type a new path). */
+    GtkWidget *dir_label = gtk_label_new("Folder path:");
     gtk_widget_set_halign(dir_label, GTK_ALIGN_START);
     gtk_box_pack_start(GTK_BOX(content), dir_label, FALSE, FALSE, 4);
 
     GtkWidget *combo = gtk_combo_box_text_new_with_entry();
-    int dir_count = 0;
-    const bookmark_dir_t *dirs = bookmarks_get_dirs(&dir_count);
-    for (int i = 0; i < dir_count; i++) {
-        gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo),
-                                        dirs[i].name);
-    }
-    /* Default to "General" if it exists, otherwise the first directory. */
+    GPtrArray *paths = g_ptr_array_new();
+    const bookmark_node_t *root = bookmarks_get_root();
+    collect_folder_paths(root, paths);
     int default_idx = 0;
-    for (int i = 0; i < dir_count; i++) {
-        if (strcmp(dirs[i].name, "General") == 0) { default_idx = i; break; }
+    for (guint i = 0; i < paths->len; i++) {
+        const char *p = (const char *)g_ptr_array_index(paths, i);
+        gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo), p);
+        /* Default to "Bookmarks Bar" (always visible in the toolbar) so
+         * new users don't have to know the exact folder name. Fall back
+         * to "General" if "Bookmarks Bar" isn't present for some reason. */
+        if (strcmp(p, "Bookmarks Bar") == 0) default_idx = (int)i;
+        else if (strcmp(p, "General") == 0 && default_idx == 0) default_idx = (int)i;
     }
     gtk_combo_box_set_active(GTK_COMBO_BOX(combo), default_idx);
     gtk_box_pack_start(GTK_BOX(content), combo, FALSE, FALSE, 4);
@@ -2132,34 +2211,33 @@ static void on_bookmark_clicked(GtkButton *btn, gpointer user_data) {
 
     gint response = gtk_dialog_run(GTK_DIALOG(dialog));
     if (response == GTK_RESPONSE_ACCEPT) {
-        /* Get the selected/entered directory name. */
-        const char *dir_name = gtk_combo_box_text_get_active_text(
+        const char *path = gtk_combo_box_text_get_active_text(
             GTK_COMBO_BOX_TEXT(combo));
-        if (dir_name == NULL || dir_name[0] == '\0') {
-            dir_name = "General";
-        }
+        if (path == NULL || path[0] == '\0') path = "General";
 
-        char *dir_copy = g_strdup(dir_name);
+        char *path_copy = g_strdup(path);
         char *url_copy = g_strdup(url);
         char *title_copy = g_strdup(title);
 
-        /* Add the bookmark. This encrypts and publishes in the caller's
-         * thread — for now that's the main thread (the publish is
-         * synchronous and may block briefly). A future improvement would
-         * run this in a background thread. */
-        int rc = bookmarks_add(dir_copy, url_copy, title_copy);
+        int rc = bookmarks_add(path_copy, url_copy, title_copy);
         if (rc == 0) {
             g_print("[bookmarks] Bookmarked '%s' to '%s'\n", url_copy,
-                    dir_copy);
+                    path_copy);
         } else {
             g_printerr("[bookmarks] Failed to bookmark (no signer?)\n");
         }
 
-        g_free(dir_copy);
+        g_free(path_copy);
         g_free(url_copy);
         g_free(title_copy);
     }
 
+    /* Free the paths array. */
+    for (guint i = 0; i < paths->len; i++) {
+        g_free(g_ptr_array_index(paths, i));
+    }
+    g_ptr_array_free(paths, TRUE);
+
     gtk_widget_destroy(dialog);
 }
 
@@ -2295,6 +2373,11 @@ static GtkWidget *build_hamburger_menu(tab_info_t *tab) {
                      G_CALLBACK(on_menu_agent), g_window);
     gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_agent);
 
+    GtkWidget *item_fips_page = gtk_menu_item_new_with_label("FIPS Mesh…");
+    g_signal_connect(item_fips_page, "activate",
+                     G_CALLBACK(on_menu_fips), g_window);
+    gtk_menu_shell_append(GTK_MENU_SHELL(menu), item_fips_page);
+
     GtkWidget *item_settings = gtk_menu_item_new_with_label("Settings…");
     g_signal_connect(item_settings, "activate",
                      G_CALLBACK(on_menu_settings), g_window);
@@ -2403,6 +2486,150 @@ static GtkWidget *tab_find_notebook(GtkWidget *page) {
     return NULL;
 }
 
+/* ── Bookmarks toolbar ─────────────────────────────────────────────── */
+
+/* Forward decl — defined below tab_create. */
+static void on_bookmark_bar_clicked(GtkButton *btn, gpointer user_data);
+static void bookmark_bar_refresh(tab_info_t *tab);
+static void bookmark_bar_refresh_all(void *user_data);
+static int   g_bookmark_bar_subscribed = 0;
+
+/* Click handler for a bookmark button in the bar. user_data is the URL
+ * (g_strdup'd; freed via g_object_set_data_full destroy notify). */
+static void on_bookmark_bar_clicked(GtkButton *btn, gpointer user_data) {
+    (void)btn;
+    const char *url = (const char *)user_data;
+    if (url == NULL || url[0] == '\0') return;
+
+    /* Find the tab that owns this button by walking the bar's parent. */
+    GtkWidget *bar = gtk_widget_get_parent(GTK_WIDGET(btn));
+    if (bar == NULL) return;
+    GtkWidget *page = gtk_widget_get_parent(bar);
+    if (page == NULL) return;
+
+    tab_info_t *target = NULL;
+    for (int i = 0; i < g_tab_count; i++) {
+        if (g_tabs[i] && g_tabs[i]->page == page) {
+            target = g_tabs[i];
+            break;
+        }
+    }
+    if (target == NULL || target->webview == NULL) return;
+
+    webkit_web_view_load_uri(target->webview, url);
+    if (target->url_entry) {
+        gtk_entry_set_text(GTK_ENTRY(target->url_entry), url);
+    }
+}
+
+/* Recursively add a folder's bookmarks (and one level of subfolders as
+ * GtkMenuButton popovers) to a container. */
+static void bookmark_bar_add_folder(GtkWidget *container,
+                                     const bookmark_node_t *node) {
+    if (node == NULL) return;
+
+    /* Bookmarks in this folder. */
+    for (int i = 0; i < node->bookmark_count; i++) {
+        const bookmark_t *bm = &node->bookmarks[i];
+        const char *label = (bm->title && bm->title[0]) ? bm->title : bm->url;
+        GtkWidget *btn = gtk_button_new_with_label(label);
+        gtk_button_set_relief(GTK_BUTTON(btn), GTK_RELIEF_NONE);
+        gtk_widget_set_tooltip_text(btn, bm->url);
+        char *url_copy = g_strdup(bm->url);
+        g_object_set_data_full(G_OBJECT(btn), "bm-url", url_copy,
+                               (GDestroyNotify)g_free);
+        g_signal_connect(btn, "clicked",
+                         G_CALLBACK(on_bookmark_bar_clicked), url_copy);
+        gtk_box_pack_start(GTK_BOX(container), btn, FALSE, FALSE, 0);
+    }
+
+    /* Subfolders as menu buttons with popover menus. */
+    for (int i = 0; i < node->child_count; i++) {
+        const bookmark_node_t *child = &node->children[i];
+        GtkWidget *menu = gtk_menu_new();
+
+        /* Add the subfolder's bookmarks to the menu. */
+        for (int j = 0; j < child->bookmark_count; j++) {
+            const bookmark_t *bm = &child->bookmarks[j];
+            const char *label = (bm->title && bm->title[0]) ? bm->title : bm->url;
+            GtkWidget *item = gtk_menu_item_new_with_label(label);
+            char *url_copy = g_strdup(bm->url);
+            g_object_set_data_full(G_OBJECT(item), "bm-url", url_copy,
+                                   (GDestroyNotify)g_free);
+            /* We need the tab to load into; defer to click handler which
+             * finds the tab from the menu's toplevel. For simplicity, use
+             * the same on_bookmark_bar_clicked — it walks parents. */
+            g_signal_connect(item, "activate",
+                             G_CALLBACK(on_bookmark_bar_clicked), url_copy);
+            gtk_menu_shell_append(GTK_MENU_SHELL(menu), item);
+        }
+        /* Recurse one level deeper for sub-subfolders (as submenus). */
+        for (int j = 0; j < child->child_count; j++) {
+            const bookmark_node_t *grand = &child->children[j];
+            GtkWidget *submenu = gtk_menu_new();
+            for (int k = 0; k < grand->bookmark_count; k++) {
+                const bookmark_t *bm = &grand->bookmarks[k];
+                const char *label = (bm->title && bm->title[0]) ? bm->title : bm->url;
+                GtkWidget *item = gtk_menu_item_new_with_label(label);
+                char *url_copy = g_strdup(bm->url);
+                g_object_set_data_full(G_OBJECT(item), "bm-url", url_copy,
+                                       (GDestroyNotify)g_free);
+                g_signal_connect(item, "activate",
+                                 G_CALLBACK(on_bookmark_bar_clicked), url_copy);
+                gtk_menu_shell_append(GTK_MENU_SHELL(submenu), item);
+            }
+            GtkWidget *sub_item = gtk_menu_item_new_with_label(child->children[j].name);
+            gtk_menu_item_set_submenu(GTK_MENU_ITEM(sub_item), submenu);
+            gtk_menu_shell_append(GTK_MENU_SHELL(menu), sub_item);
+        }
+
+        GtkWidget *mb = gtk_menu_button_new();
+        gtk_button_set_label(GTK_BUTTON(mb), child->name);
+        gtk_menu_button_set_popup(GTK_MENU_BUTTON(mb), menu);
+        gtk_widget_set_tooltip_text(mb, child->path);
+        gtk_box_pack_start(GTK_BOX(container), mb, FALSE, FALSE, 0);
+    }
+}
+
+/* Refresh a single tab's bookmark bar from the current bookmark tree. */
+static void bookmark_bar_refresh(tab_info_t *tab) {
+    if (tab == NULL || tab->bookmark_bar == NULL) return;
+
+    /* Clear existing children. */
+    GList *children = gtk_container_get_children(GTK_CONTAINER(tab->bookmark_bar));
+    for (GList *l = children; l != NULL; l = l->next) {
+        gtk_widget_destroy(GTK_WIDGET(l->data));
+    }
+    g_list_free(children);
+
+    /* Look up the "Bookmarks Bar" folder. It always exists in memory
+     * (bookmarks_init ensures it), but may be empty until the user adds
+     * bookmarks to it. Show a friendly hint in that case. */
+    const bookmark_node_t *bar_node = bookmarks_find("Bookmarks Bar");
+    if (bar_node == NULL || (bar_node->bookmark_count == 0 && bar_node->child_count == 0)) {
+        GtkWidget *hint = gtk_label_new(
+            "Bookmarks Bar is empty — bookmark a page and choose \"Bookmarks Bar\" as the folder");
+        gtk_widget_set_sensitive(hint, FALSE);
+        gtk_widget_set_margin_start(hint, 4);
+        gtk_box_pack_start(GTK_BOX(tab->bookmark_bar), hint, FALSE, FALSE, 0);
+        gtk_widget_show_all(tab->bookmark_bar);
+        return;
+    }
+
+    bookmark_bar_add_folder(tab->bookmark_bar, bar_node);
+    gtk_widget_show_all(tab->bookmark_bar);
+}
+
+/* Callback invoked by bookmarks_subscribe_changed: refresh every open tab. */
+static void bookmark_bar_refresh_all(void *user_data) {
+    (void)user_data;
+    for (int i = 0; i < g_tab_count; i++) {
+        if (g_tabs[i] != NULL) {
+            bookmark_bar_refresh(g_tabs[i]);
+        }
+    }
+}
+
 static tab_info_t *tab_create(const char *url) {
     const browser_settings_t *s = settings_get();
 
@@ -2596,6 +2823,18 @@ static tab_info_t *tab_create(const char *url) {
                      G_CALLBACK(on_bookmark_clicked), tab);
     gtk_box_pack_start(GTK_BOX(toolbar), bookmark_btn, FALSE, FALSE, 0);
 
+    /* Bookmarks toolbar — a horizontal bar below the URL toolbar showing
+     * buttons for the bookmarks in the "Bookmarks Bar" folder, plus
+     * GtkMenuButton popovers for subfolders. Refreshed whenever bookmarks
+     * change (see bookmark_bar_refresh_all via bookmarks_subscribe_changed). */
+    tab->bookmark_bar = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 4);
+    gtk_widget_set_margin_top(tab->bookmark_bar, 2);
+    gtk_widget_set_margin_bottom(tab->bookmark_bar, 2);
+    gtk_widget_set_margin_start(tab->bookmark_bar, 4);
+    gtk_widget_set_margin_end(tab->bookmark_bar, 4);
+    gtk_box_pack_start(GTK_BOX(tab->page), tab->bookmark_bar, FALSE, FALSE, 0);
+    bookmark_bar_refresh(tab);
+
     /* Ensure the webview expands vertically to fill the available space.
      * Without this, WebKitGTK may only allocate 1px of height on some
      * display servers, resulting in a blank page. */
@@ -2650,6 +2889,50 @@ static tab_info_t *tab_create(const char *url) {
 
 static GtkWidget *g_avatar = NULL;
 
+/* List of all avatar GtkImage widgets across all windows. When the
+ * avatar picture is downloaded, every image in this list is updated so
+ * auxiliary windows show the same avatar as the main window. The main
+ * window's g_avatar is also kept in this list. */
+static GSList *g_avatar_images = NULL;
+
+/* Track all avatar images so they can all be updated when the picture
+ * arrives. Adds the image to the global list. */
+static void track_avatar_image(GtkWidget *image) {
+    if (image == NULL) return;
+    g_avatar_images = g_slist_prepend(g_avatar_images, image);
+    /* Sink a ref so the image stays alive for the list even if the
+     * button is destroyed before the list is cleaned up. The list is
+     * never freed during the app lifetime (avatars persist for the
+     * whole session), so this is a small intentional leak that avoids
+     * dangling pointers in the download callback. */
+    g_object_ref_sink(G_OBJECT(image));
+}
+
+/* Update every tracked avatar image with the given pixbuf. Used by the
+ * avatar download idle callback so all windows' avatars stay in sync. */
+static void set_all_avatar_pixbufs(GdkPixbuf *pixbuf) {
+    for (GSList *l = g_avatar_images; l != NULL; l = l->next) {
+        GtkWidget *img = GTK_WIDGET(l->data);
+        if (img && GTK_IS_IMAGE(img) && pixbuf) {
+            /* Each image needs its own pixbuf reference. */
+            GdkPixbuf *copy = g_object_ref(pixbuf);
+            gtk_image_set_from_pixbuf(GTK_IMAGE(img), copy);
+            g_object_unref(copy);
+        }
+    }
+}
+
+/* Reset every tracked avatar image to the default icon. */
+static void set_all_avatar_icons(const char *icon_name) {
+    for (GSList *l = g_avatar_images; l != NULL; l = l->next) {
+        GtkWidget *img = GTK_WIDGET(l->data);
+        if (img && GTK_IS_IMAGE(img)) {
+            gtk_image_set_from_icon_name(GTK_IMAGE(img), icon_name,
+                                         GTK_ICON_SIZE_BUTTON);
+        }
+    }
+}
+
 /* Scale a pixbuf to fill the given size, center-cropping to preserve
  * aspect ratio (like CSS object-fit: cover), then round the corners
  * to match the button's border-radius. Returns a new pixbuf (caller
@@ -2718,11 +3001,12 @@ typedef struct {
     int  size;
 } avatar_fetch_t;
 
-/* Idle callback to set the avatar pixbuf on the widget. */
+/* Idle callback to set the avatar pixbuf on every tracked avatar image
+ * (main window + all auxiliary windows) so they all stay in sync. */
 static gboolean avatar_set_pixbuf_idle(gpointer data) {
     GdkPixbuf *pixbuf = (GdkPixbuf *)data;
-    if (g_avatar && pixbuf) {
-        gtk_image_set_from_pixbuf(GTK_IMAGE(g_avatar), pixbuf);
+    if (pixbuf) {
+        set_all_avatar_pixbufs(pixbuf);
         g_object_unref(pixbuf);
     }
     return G_SOURCE_REMOVE;
@@ -2776,20 +3060,14 @@ static gpointer avatar_fetch_thread_v2(gpointer data) {
  * Called from main.c after login. */
 void tab_manager_set_avatar(const char *pubkey_hex) {
     if (g_avatar == NULL || pubkey_hex == NULL || pubkey_hex[0] == '\0') {
-        if (g_avatar) {
-            gtk_image_set_from_icon_name(GTK_IMAGE(g_avatar),
-                                          "avatar-default-symbolic",
-                                          GTK_ICON_SIZE_BUTTON);
-        }
+        set_all_avatar_icons("avatar-default-symbolic");
         return;
     }
 
     /* Query the kind 0 profile from SQLite. */
     cJSON *kind0 = db_get_latest_event(pubkey_hex, 0);
     if (kind0 == NULL) {
-        gtk_image_set_from_icon_name(GTK_IMAGE(g_avatar),
-                                      "avatar-default-symbolic",
-                                      GTK_ICON_SIZE_BUTTON);
+        set_all_avatar_icons("avatar-default-symbolic");
         return;
     }
 
@@ -2808,9 +3086,7 @@ void tab_manager_set_avatar(const char *pubkey_hex) {
     cJSON_Delete(kind0);
 
     if (picture == NULL) {
-        gtk_image_set_from_icon_name(GTK_IMAGE(g_avatar),
-                                      "avatar-default-symbolic",
-                                      GTK_ICON_SIZE_BUTTON);
+        set_all_avatar_icons("avatar-default-symbolic");
         return;
     }
 
@@ -2842,8 +3118,81 @@ static void on_avatar_clicked(GtkButton *btn, gpointer data) {
 
 static void on_new_tab_clicked(GtkButton *btn, gpointer data) {
     (void)btn;
-    (void)data;
-    tab_manager_new_tab(NULL);
+    GtkWidget *nb = GTK_WIDGET(data);
+    /* If a specific notebook was passed (the button sits in an auxiliary
+     * window's tab strip), direct the new tab into that notebook by
+     * setting g_target_notebook for the duration of the call. Otherwise
+     * fall back to the active window's notebook. */
+    if (nb != NULL) {
+        g_target_notebook = nb;
+        tab_manager_new_tab(NULL);
+        g_target_notebook = NULL;
+    } else {
+        tab_manager_new_tab(NULL);
+    }
+}
+
+/* ── Notebook action-widget setup ─────────────────────────────────── *
+ * Adds the new-tab button (right end) and avatar button (left end) as
+ * GtkNotebook action widgets, plus the right-click context-menu handler.
+ * Used by both the main window's notebook (tab_manager_init) and each
+ * auxiliary window's notebook (tab_manager_new_window) so every window
+ * has a working new-tab button that opens tabs in THAT window.
+ *
+ *   notebook: the GtkNotebook to attach the action widgets to
+ *   is_main:  TRUE for the main window — the avatar image is stored in
+ *             the global g_avatar (so tab_manager_set_avatar can find it
+ *             by legacy reference). For auxiliary windows, a separate
+ *             image is created and tracked in g_avatar_images so it
+ *             still gets updated when the picture arrives.
+ */
+static void setup_notebook_action_widgets(GtkWidget *notebook, gboolean is_main) {
+    g_return_if_fail(notebook != NULL && GTK_IS_NOTEBOOK(notebook));
+
+    /* Right-click / middle-click context menu on the tab strip. */
+    gtk_widget_add_events(notebook, GDK_BUTTON_PRESS_MASK);
+    g_signal_connect(notebook, "button-press-event",
+                     G_CALLBACK(on_notebook_button_press), NULL);
+
+    /* New-tab button at the end of the tab strip. Pass the notebook as
+     * user_data so the button opens the tab in THIS notebook, not just
+     * whatever window happens to be active. */
+    GtkWidget *new_btn = gtk_button_new();
+    gtk_button_set_relief(GTK_BUTTON(new_btn), GTK_RELIEF_NONE);
+    gtk_button_set_image(GTK_BUTTON(new_btn),
+        gtk_image_new_from_icon_name("tab-new-symbolic",
+                                      GTK_ICON_SIZE_BUTTON));
+    gtk_widget_set_tooltip_text(new_btn, "New tab (Ctrl+T)");
+    g_signal_connect(new_btn, "clicked",
+                     G_CALLBACK(on_new_tab_clicked), notebook);
+    gtk_widget_show_all(new_btn);
+    gtk_notebook_set_action_widget(GTK_NOTEBOOK(notebook), new_btn,
+                                    GTK_PACK_END);
+
+    /* User avatar at the start (far left) of the tab strip. The main
+     * window's image is stored in g_avatar for backward compatibility;
+     * auxiliary windows get their own image, tracked in g_avatar_images
+     * so all windows' avatars update together. */
+    GtkWidget *avatar_img = gtk_image_new_from_icon_name(
+        "avatar-default-symbolic", GTK_ICON_SIZE_BUTTON);
+    if (is_main) {
+        g_avatar = avatar_img;
+    }
+    track_avatar_image(avatar_img);
+
+    GtkWidget *avatar_btn = gtk_button_new();
+    gtk_button_set_relief(GTK_BUTTON(avatar_btn), GTK_RELIEF_NORMAL);
+    gtk_button_set_image(GTK_BUTTON(avatar_btn), avatar_img);
+    gtk_widget_set_tooltip_text(avatar_btn, "Your profile");
+    gtk_widget_set_valign(avatar_btn, GTK_ALIGN_CENTER);
+    gtk_widget_set_margin_start(avatar_btn, 4);
+    gtk_widget_set_name(avatar_btn, "avatar-btn");
+    gtk_widget_set_size_request(avatar_btn, 28, 28);  /* fixed square, matches hamburger */
+    g_signal_connect(avatar_btn, "clicked",
+                     G_CALLBACK(on_avatar_clicked), NULL);
+    gtk_widget_show_all(avatar_btn);
+    gtk_notebook_set_action_widget(GTK_NOTEBOOK(notebook), avatar_btn,
+                                    GTK_PACK_START);
 }
 
 /* ── Public API ───────────────────────────────────────────────────── */
@@ -2854,6 +3203,14 @@ void tab_manager_init(GtkContainer      *parent,
     g_ctx    = ctx;
     g_window = window;
 
+    /* Subscribe to bookmark changes so every open tab's bookmark bar
+     * refreshes when bookmarks are added/moved/deleted/loaded. Registered
+     * once here; the callback iterates all open tabs. */
+    if (!g_bookmark_bar_subscribed) {
+        bookmarks_subscribe_changed(bookmark_bar_refresh_all, NULL);
+        g_bookmark_bar_subscribed = 1;
+    }
+
     g_notebook = gtk_notebook_new();
     /* Disable scrolling so tabs share the available width evenly instead
      * of showing a scrollbar when there are many tabs. */
@@ -2861,48 +3218,8 @@ void tab_manager_init(GtkContainer      *parent,
     gtk_notebook_set_show_border(GTK_NOTEBOOK(g_notebook), FALSE);
     gtk_notebook_set_show_tabs(GTK_NOTEBOOK(g_notebook), TRUE);
 
-    /* Connect button-press on the notebook to handle right-click context
-     * menus on tabs. This is more reliable than connecting to individual
-     * tab label child widgets, because GtkNotebook intercepts button
-     * presses on tabs for tab switching before they reach the label's
-     * children. */
-    gtk_widget_add_events(g_notebook, GDK_BUTTON_PRESS_MASK);
-    g_signal_connect(g_notebook, "button-press-event",
-                     G_CALLBACK(on_notebook_button_press), NULL);
-
-    /* New-tab button as an action widget at the end of the tab strip. */
-    GtkWidget *new_btn = gtk_button_new();
-    gtk_button_set_relief(GTK_BUTTON(new_btn), GTK_RELIEF_NONE);
-    gtk_button_set_image(GTK_BUTTON(new_btn),
-        gtk_image_new_from_icon_name("tab-new-symbolic",
-                                      GTK_ICON_SIZE_BUTTON));
-    gtk_widget_set_tooltip_text(new_btn, "New tab (Ctrl+T)");
-    g_signal_connect(new_btn, "clicked", G_CALLBACK(on_new_tab_clicked), NULL);
-    gtk_widget_show_all(new_btn);
-    gtk_notebook_set_action_widget(GTK_NOTEBOOK(g_notebook), new_btn,
-                                    GTK_PACK_END);
-
-    /* User avatar as an action widget at the start (far left) of the
-     * tab strip. Uses a GtkButton with GTK_RELIEF_NORMAL to match the
-     * hamburger menu button's visible border. margin_start matches the
-     * toolbar's left margin (4px) so the avatar's left edge aligns
-     * horizontally with the hamburger button's left edge.
-     * The inner GtkImage (g_avatar) is updated via tab_manager_set_avatar(). */
-    g_avatar = gtk_image_new_from_icon_name("avatar-default-symbolic",
-                                             GTK_ICON_SIZE_BUTTON);
-    GtkWidget *avatar_btn = gtk_button_new();
-    gtk_button_set_relief(GTK_BUTTON(avatar_btn), GTK_RELIEF_NORMAL);
-    gtk_button_set_image(GTK_BUTTON(avatar_btn), g_avatar);
-    gtk_widget_set_tooltip_text(avatar_btn, "Your profile");
-    gtk_widget_set_valign(avatar_btn, GTK_ALIGN_CENTER);
-    gtk_widget_set_margin_start(avatar_btn, 4);
-    gtk_widget_set_name(avatar_btn, "avatar-btn");
-    gtk_widget_set_size_request(avatar_btn, 28, 28);  /* fixed square, matches hamburger */
-    g_signal_connect(avatar_btn, "clicked",
-                     G_CALLBACK(on_avatar_clicked), NULL);
-    gtk_widget_show_all(avatar_btn);
-    gtk_notebook_set_action_widget(GTK_NOTEBOOK(g_notebook), avatar_btn,
-                                    GTK_PACK_START);
+    /* New-tab button + avatar as notebook action widgets. */
+    setup_notebook_action_widgets(g_notebook, TRUE);
 
     /* CSS: remove internal padding from both buttons so their contents
      * fill edge-to-edge. Force both to a fixed square size (28x28) and
@@ -3128,6 +3445,14 @@ int tab_manager_count(void) {
     return g_tab_count;
 }
 
+/* Return the main window's notebook widget. Used by main.c's
+ * delete-event handler to identify which tabs belong to the main window
+ * (vs auxiliary windows) when closing the main window but keeping aux
+ * windows alive. */
+GtkWidget *tab_manager_get_main_notebook(void) {
+    return g_notebook;
+}
+
 void tab_manager_set_title(int index, const char *title) {
     if (index < 0 || index >= g_tab_count) return;
     tab_info_t *tab = g_tabs[index];
@@ -3198,10 +3523,31 @@ void tab_manager_open_in_new_window(int index) {
     if (index < 0 || index >= g_tab_count) return;
     tab_info_t *tab = g_tabs[index];
     if (tab == NULL) return;
-    /* Open the tab's current URL in a new window. Pass the active
-     * webview as the related view so the new window shares the
-     * WebProcess. */
-    tab_manager_new_window(tab->current_url, tab->webview);
+
+    /* Capture the URL before opening the new window — the original tab
+     * will be closed below, which frees the tab_info_t. */
+    char url_buf[TAB_URL_MAX];
+    snprintf(url_buf, sizeof(url_buf), "%s", tab->current_url);
+
+    /* Open the URL in a new window. Pass the original tab's webview as
+     * the related view so the new window shares the WebProcess. The new
+     * window takes its own ref on the related view, so it's safe to
+     * close the original tab afterwards. */
+    GtkWidget *new_wv = tab_manager_new_window(url_buf, tab->webview);
+    if (new_wv == NULL) {
+        /* New window creation failed — keep the original tab open so the
+         * user doesn't lose the page. */
+        return;
+    }
+
+    /* Close the original tab — "Open in New Window" moves the tab to a
+     * new window rather than duplicating it. The index may have shifted
+     * if tab_manager_new_window added tabs to the array, so re-resolve
+     * the tab's current index by pointer. */
+    int cur_index = tab_array_find(tab);
+    if (cur_index >= 0) {
+        tab_manager_close_tab(cur_index);
+    }
 }
 
 void tab_manager_new_window_blank(void) {

src/tab_manager.h

@@ -29,6 +29,7 @@ typedef struct {
     GtkWidget     *title_label;  /* child of tab_label */
     GtkWidget     *favicon;      /* favicon image in tab_label */
     GtkWidget     *refresh_btn;  /* toolbar reload/stop button (per-tab) */
+    GtkWidget     *bookmark_bar; /* bookmarks toolbar (below URL toolbar) */
     gboolean       refresh_shows_stop; /* cached visual state, avoids redundant updates */
     char           current_url[TAB_URL_MAX];
     char           title[TAB_TITLE_MAX];
@@ -208,6 +209,14 @@ WebKitWebView *tab_manager_get_main_webview(void);
  */
 gboolean tab_manager_sidebar_visible(void);
 
+/*
+ * Returns the main window's GtkNotebook widget. Used by main.c's
+ * delete-event handler to identify which tabs belong to the main window
+ * (vs auxiliary windows) when closing the main window but keeping aux
+ * windows alive.
+ */
+GtkWidget *tab_manager_get_main_notebook(void);
+
 /*
  * Re-hide the sidebar container after gtk_widget_show_all(window).
  * Call this in main.c after show_all so the sidebar (which is packed

src/version.h

@@ -11,9 +11,9 @@
 #ifndef SOVEREIGN_BROWSER_VERSION_H
 #define SOVEREIGN_BROWSER_VERSION_H
 
-#define SB_VERSION         "v0.0.35"
+#define SB_VERSION         "v0.0.45"
 #define SB_VERSION_MAJOR   0
 #define SB_VERSION_MINOR   0
-#define SB_VERSION_PATCH   35
+#define SB_VERSION_PATCH   45
 
 #endif /* SOVEREIGN_BROWSER_VERSION_H */

tests/test_bookmarks_tree.c

@@ -0,0 +1,144 @@
+/*
+ * test_bookmarks_tree.c — unit tests for the bookmark tree/HMAC d-tag logic
+ *
+ * Tests the pure pieces that don't require a signer, database, or relay
+ * connection:
+ *   - HMAC-SHA256 d-tag derivation is deterministic (same key + path → same hex)
+ *   - HMAC-SHA256 d-tag derivation is opaque (different paths → uncorrelated)
+ *   - is_hmac_d_tag correctly distinguishes 64-hex HMAC tags from legacy
+ *     plaintext directory names
+ *
+ * The full trie operations (add/remove/move/rename/delete) require a signer
+ * and database, so they are exercised via the browser's MCP tools at runtime
+ * rather than in this unit test.
+ *
+ * Build (standalone, links against nostr_core_lib):
+ *   cc -std=c99 -Wall -Wextra -g -I./nostr_core_lib \
+ *     tests/test_bookmarks_tree.c \
+ *     nostr_core_lib/libnostr_core_x64.a \
+ *     -lsecp256k1 -lssl -lcrypto -lm -o tests/test_bookmarks_tree
+ *   ./tests/test_bookmarks_tree
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "../nostr_core_lib/nostr_core/nostr_core.h"
+
+static int failures = 0;
+static int passes   = 0;
+
+#define CHECK(cond, msg) do { \
+    if (cond) { passes++; } \
+    else { failures++; fprintf(stderr, "FAIL: %s\n", msg); } \
+} while (0)
+
+/* Mirror of BOOKMARKS_HMAC_KEY_LABEL in src/bookmarks.c. */
+#define LABEL "sovereign-browser/bookmarks-folder-id-v1"
+
+/* Mirror of path_to_d_tag + compute_hmac_key in src/bookmarks.c. */
+static char *path_to_d_tag(const unsigned char *privkey, const char *path) {
+    unsigned char hmac_key[32];
+    if (nostr_hmac_sha256(privkey, 32,
+                          (const unsigned char *)LABEL, strlen(LABEL),
+                          hmac_key) != 0) {
+        return NULL;
+    }
+    unsigned char mac[32];
+    if (nostr_hmac_sha256(hmac_key, 32,
+                          (const unsigned char *)path, strlen(path),
+                          mac) != 0) {
+        return NULL;
+    }
+    char *hex = malloc(65);
+    if (hex == NULL) return NULL;
+    nostr_bytes_to_hex(mac, 32, hex);
+    hex[64] = '\0';
+    return hex;
+}
+
+/* Mirror of is_hmac_d_tag in src/bookmarks.c. */
+static int is_hmac_d_tag(const char *s) {
+    if (s == NULL || strlen(s) != 64) return 0;
+    for (const char *p = s; *p; p++) {
+        if (!((*p >= '0' && *p <= '9') || (*p >= 'a' && *p <= 'f')))
+            return 0;
+    }
+    return 1;
+}
+
+int main(void) {
+    /* Use a fixed test privkey (32 bytes of 0x01..0x20). */
+    unsigned char privkey[32];
+    for (int i = 0; i < 32; i++) privkey[i] = (unsigned char)(i + 1);
+
+    /* ── Determinism: same path → same d tag ────────────────────────── */
+    char *d1 = path_to_d_tag(privkey, "Work/Projects/Secret");
+    char *d2 = path_to_d_tag(privkey, "Work/Projects/Secret");
+    CHECK(d1 != NULL, "path_to_d_tag returned NULL");
+    CHECK(d2 != NULL, "path_to_d_tag returned NULL (2nd call)");
+    CHECK(d1 && d2 && strcmp(d1, d2) == 0,
+          "Same path should produce the same d tag (determinism)");
+    free(d1);
+    free(d2);
+
+    /* ── Opaqueness: different paths → different d tags ─────────────── */
+    char *da = path_to_d_tag(privkey, "Work");
+    char *db = path_to_d_tag(privkey, "Work/Projects");
+    char *dc = path_to_d_tag(privkey, "Personal");
+    CHECK(da && db && strcmp(da, db) != 0,
+          "Different paths should produce different d tags (no prefix leakage)");
+    CHECK(da && dc && strcmp(da, dc) != 0,
+          "Different paths should produce different d tags (2)");
+    /* The d tag should NOT contain the plaintext path. */
+    CHECK(da && strstr(da, "Work") == NULL,
+          "d tag should not leak the plaintext path");
+    CHECK(db && strstr(db, "Work") == NULL,
+          "d tag should not leak the plaintext path (child)");
+    free(da);
+    free(db);
+    free(dc);
+
+    /* ── d tag is 64 lowercase hex chars ────────────────────────────── */
+    char *d = path_to_d_tag(privkey, "General");
+    CHECK(d != NULL, "path_to_d_tag returned NULL for General");
+    CHECK(d && strlen(d) == 64, "d tag should be 64 hex chars");
+    CHECK(d && is_hmac_d_tag(d), "d tag should pass is_hmac_d_tag");
+    free(d);
+
+    /* ── is_hmac_d_tag distinguishes legacy names ───────────────────── */
+    CHECK(is_hmac_d_tag("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
+          "64 lowercase hex should be recognized as an HMAC d tag");
+    CHECK(!is_hmac_d_tag("General"),
+          "Legacy plaintext 'General' should NOT be recognized as an HMAC d tag");
+    CHECK(!is_hmac_d_tag("Work/Projects"),
+          "Legacy plaintext path with slash should NOT be recognized as an HMAC d tag");
+    CHECK(!is_hmac_d_tag(""),
+          "Empty string should NOT be recognized as an HMAC d tag");
+    CHECK(!is_hmac_d_tag(NULL),
+          "NULL should NOT be recognized as an HMAC d tag");
+    /* Uppercase hex is not produced by nostr_bytes_to_hex (lowercase), so
+     * treat it as non-HMAC (legacy). */
+    CHECK(!is_hmac_d_tag("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"),
+          "Uppercase hex should NOT be recognized as an HMAC d tag (we emit lowercase)");
+
+    /* ── Different privkeys → different d tags for the same path ────── */
+    unsigned char privkey2[32];
+    for (int i = 0; i < 32; i++) privkey2[i] = (unsigned char)(255 - i);
+    char *e1 = path_to_d_tag(privkey, "General");
+    char *e2 = path_to_d_tag(privkey2, "General");
+    CHECK(e1 && e2 && strcmp(e1, e2) != 0,
+          "Different privkeys should produce different d tags for the same path");
+    free(e1);
+    free(e2);
+
+    /* ── Empty path is allowed (root) ───────────────────────────────── */
+    char *root_d = path_to_d_tag(privkey, "");
+    CHECK(root_d != NULL, "path_to_d_tag should handle empty path");
+    CHECK(root_d && strlen(root_d) == 64,
+          "Empty path d tag should still be 64 hex chars");
+    free(root_d);
+
+    printf("bookmarks tree tests: %d passed, %d failed\n", passes, failures);
+    return failures == 0 ? 0 : 1;
+}

www/bookmarks.css

@@ -4,5 +4,68 @@
  * sovereign://sovereign-base.css. */
 @import url("sovereign://sovereign-base.css");
 
-/* Bookmarks-specific tweaks (most layout is already in base .bm/.form/.dir-header). */
-#bm-dir { min-width: 160px; }
+/* ── Tree view ─────────────────────────────────────────────────────── */
+
+.tree-node {
+  margin: 2px 0;
+}
+
+.folder-row {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 6px 0;
+  border-bottom: 1px solid var(--border);
+  flex-wrap: wrap;
+}
+
+.caret {
+  display: inline-block;
+  width: 14px;
+  cursor: pointer;
+  user-select: none;
+  color: var(--primary);
+  font-size: 10px;
+  transition: transform 0.15s ease;
+  transform: rotate(0deg);
+  flex-shrink: 0;
+}
+
+.caret.expanded {
+  transform: rotate(90deg);
+}
+
+.folder-icon {
+  font-size: 16px;
+  flex-shrink: 0;
+}
+
+.folder-name {
+  font-weight: bold;
+  color: var(--primary);
+  flex-shrink: 0;
+}
+
+.folder-actions {
+  display: flex;
+  gap: 6px;
+  margin-left: auto;
+  flex-wrap: wrap;
+}
+
+/* Smaller buttons in folder actions so the row stays compact. */
+.folder-actions .btn {
+  padding: 3px 10px;
+  font-size: 11px;
+  margin-left: 0;
+}
+
+.tree-children {
+  border-left: 1px dashed var(--border);
+  padding-left: 4px;
+}
+
+/* Reuse .bm / .bm-title / .bm-url / .bm-meta / .actions / .btn / .btn-del
+ * from the base theme for bookmark rows. */
+
+#bm-path, #new-path { min-width: 200px; }

www/bookmarks.html

@@ -19,17 +19,17 @@
     <div class="form">
       <input type="text" id="bm-url" placeholder="URL" size="40">
       <input type="text" id="bm-title" placeholder="Title" size="25">
-      <select id="bm-dir"></select>
+      <input type="text" id="bm-path" placeholder="Folder path (e.g. Work/Projects)" size="25">
       <button class="btn" onclick="addBookmark()">Add</button>
     </div>
     <div class="form">
-      <input type="text" id="new-dir" placeholder="New directory name" size="25">
-      <button class="btn" onclick="createDir()">Create Directory</button>
+      <input type="text" id="new-path" placeholder="New folder path (e.g. Work/Projects/Secret)" size="35">
+      <button class="btn" onclick="createDir()">Create Folder</button>
     </div>
   </div>
 
   <h2>Bookmarks</h2>
-  <div id="bm-list"></div>
+  <div id="bm-tree"></div>
 
   <script src="sovereign://bookmarks.js"></script>
 </body>

www/bookmarks.js

@@ -1,8 +1,13 @@
 /* Bookmarks page — sovereign://bookmarks
  *
- * Fetches the bookmark directory list from sovereign://bookmarks/list
- * (JSON) and renders it. Add/delete/create-dir use the existing
- * sovereign://bookmarks/{add,delete,createdir,deletedir} endpoints.
+ * Fetches the bookmark tree from sovereign://bookmarks/list (JSON) and
+ * renders it as an expandable/collapsible tree. Folders may be nested
+ * arbitrarily (e.g. "Work/Projects/Secret"). Add/delete/create/move/rename
+ * use the sovereign://bookmarks/{add,delete,createdir,deletedir,move,renamedir}
+ * endpoints.
+ *
+ * Expand/collapse state is persisted in localStorage so the user's
+ * expanded folders survive page reloads.
  */
 function sovereignGet(url) {
   return new Promise(function(resolve, reject) {
@@ -24,75 +29,237 @@ function esc(s) {
   return d.innerHTML;
 }
 
-function renderBookmarks(data) {
+/* ── Expand/collapse state (persisted in localStorage) ─────────────── */
+
+var EXPANDED_KEY = 'sovereign_bookmarks_expanded';
+function getExpanded() {
+  try {
+    var raw = localStorage.getItem(EXPANDED_KEY);
+    return raw ? JSON.parse(raw) : {};
+  } catch (e) { return {}; }
+}
+function setExpanded(path, isExpanded) {
+  var state = getExpanded();
+  if (isExpanded) state[path] = true;
+  else delete state[path];
+  try { localStorage.setItem(EXPANDED_KEY, JSON.stringify(state)); }
+  catch (e) { /* ignore quota errors */ }
+}
+
+/* ── Tree rendering ────────────────────────────────────────────────── */
+
+function renderTree(data) {
   var haveSigner = !!data.have_signer;
   document.getElementById('readonly-note').style.display =
     haveSigner ? 'none' : '';
   document.getElementById('add-form').style.display =
     haveSigner ? '' : 'none';
 
-  /* Populate the directory <select> for the add form. */
-  var sel = document.getElementById('bm-dir');
-  sel.innerHTML = '';
-  (data.dirs || []).forEach(function(d) {
-    var opt = document.createElement('option');
-    opt.value = d.name;
-    opt.textContent = d.name;
-    sel.appendChild(opt);
-  });
-
-  var c = document.getElementById('bm-list');
-  var dirs = data.dirs || [];
-  if (dirs.length === 0) {
+  var c = document.getElementById('bm-tree');
+  var tree = data.tree;
+  if (!tree || !tree.children || tree.children.length === 0) {
     c.innerHTML =
       '<p class="empty">No bookmarks yet. Click the bookmark button ' +
       'in the toolbar to save a page.</p>';
     return;
   }
 
-  var html = '';
-  dirs.forEach(function(dir) {
-    html += '<div class="dir-header"><h3>' + esc(dir.name) +
-            ' (' + dir.count + ')</h3>';
-    if (haveSigner && dir.name !== 'General') {
-      var enc = encodeURIComponent(dir.name);
-      html += ' <a class="btn btn-del" href="sovereign://bookmarks/deletedir?dir=' +
-              enc + '" onclick="return confirm(\'Delete directory "' +
-              esc(dir.name) + '"? Bookmarks will be moved to General.\')">Delete Dir</a>';
-    }
-    html += '</div>';
-
-    if (dir.count === 0) {
-      html += '<p class="empty">(empty)</p>';
-    } else {
-      (dir.bookmarks || []).forEach(function(bm) {
-        var urlEnc = encodeURIComponent(bm.url);
-        var dirEnc = encodeURIComponent(dir.name);
-        var title = bm.title && bm.title.length ? bm.title : '(untitled)';
-        html += '<div class="bm"><div>';
-        html += '<div class="bm-title">' + esc(title) + '</div>';
-        html += '<div><a class="bm-url" href="' + esc(bm.url) + '">' +
-                esc(bm.url) + '</a></div>';
-        html += '<div class="bm-meta">Added: ' + esc(bm.added) + '</div></div>';
-        html += '<div class="actions">';
-        html += '<a class="btn" href="' + esc(bm.url) + '">Open</a>';
-        if (haveSigner) {
-          html += ' <a class="btn btn-del" href="sovereign://bookmarks/delete?dir=' +
-                  dirEnc + '&url=' + urlEnc +
-                  '" onclick="return confirm(\'Delete this bookmark?\')">Delete</a>';
-        }
-        html += '</div></div>';
-      });
-    }
+  c.innerHTML = '';
+  (tree.children || []).forEach(function(child) {
+    c.appendChild(renderNode(child, haveSigner, 0));
   });
-  c.innerHTML = html;
 }
 
+function renderNode(node, haveSigner, depth) {
+  /* A folder row + its bookmark list + its children (recursive). */
+  var expandedState = getExpanded();
+  var isExpanded = !!expandedState[node.path];
+
+  var wrap = document.createElement('div');
+  wrap.className = 'tree-node';
+
+  /* Folder row. */
+  var row = document.createElement('div');
+  row.className = 'folder-row';
+
+  var caret = document.createElement('span');
+  caret.className = 'caret' + (isExpanded ? ' expanded' : '');
+  caret.textContent = '\u25B6';  /* right-pointing triangle */
+  caret.onclick = function() {
+    var nowExpanded = caret.classList.toggle('expanded');
+    childList.style.display = nowExpanded ? '' : 'none';
+    setExpanded(node.path, nowExpanded);
+  };
+  row.appendChild(caret);
+
+  var icon = document.createElement('span');
+  icon.className = 'folder-icon';
+  icon.textContent = '\u{1F4C1}';  /* folder emoji */
+  row.appendChild(icon);
+
+  var name = document.createElement('span');
+  name.className = 'folder-name';
+  name.textContent = node.name + ' (' + node.count + ')';
+  row.appendChild(name);
+
+  /* Per-folder actions. */
+  var actions = document.createElement('span');
+  actions.className = 'folder-actions';
+  if (haveSigner) {
+    var addHere = document.createElement('a');
+    addHere.className = 'btn';
+    addHere.href = '#';
+    addHere.textContent = 'Add Here';
+    addHere.onclick = function(e) {
+      e.preventDefault();
+      document.getElementById('bm-path').value = node.path;
+      document.getElementById('bm-url').focus();
+    };
+    actions.appendChild(addHere);
+
+    var newSub = document.createElement('a');
+    newSub.className = 'btn';
+    newSub.href = '#';
+    newSub.textContent = 'New Subfolder';
+    newSub.onclick = function(e) {
+      e.preventDefault();
+      var sub = prompt('New subfolder name under "' + node.path + '/":');
+      if (sub && sub.trim()) {
+        var newPath = node.path + '/' + sub.trim();
+        location.href = 'sovereign://bookmarks/createdir?name=' +
+                        encodeURIComponent(newPath);
+      }
+    };
+    actions.appendChild(newSub);
+
+    if (node.path !== 'General' && node.path !== 'Bookmarks Bar') {
+      var rename = document.createElement('a');
+      rename.className = 'btn';
+      rename.href = '#';
+      rename.textContent = 'Rename';
+      rename.onclick = function(e) {
+        e.preventDefault();
+        var newName = prompt('Rename folder "' + node.path + '" to:',
+                             node.path);
+        if (newName && newName.trim() && newName.trim() !== node.path) {
+          location.href = 'sovereign://bookmarks/renamedir?old=' +
+                          encodeURIComponent(node.path) + '&new=' +
+                          encodeURIComponent(newName.trim());
+        }
+      };
+      actions.appendChild(rename);
+
+      var del = document.createElement('a');
+      del.className = 'btn btn-del';
+      del.href = '#';
+      del.textContent = 'Delete';
+      del.onclick = function(e) {
+        e.preventDefault();
+        if (confirm('Delete folder "' + node.path + '"? ' +
+                    'Bookmarks will be moved to General.')) {
+          location.href = 'sovereign://bookmarks/deletedir?dir=' +
+                          encodeURIComponent(node.path);
+        }
+      };
+      actions.appendChild(del);
+    }
+  }
+  row.appendChild(actions);
+
+  wrap.appendChild(row);
+
+  /* Child list: bookmarks + subfolders. */
+  var childList = document.createElement('div');
+  childList.className = 'tree-children';
+  childList.style.display = isExpanded ? '' : 'none';
+  childList.style.marginLeft = '20px';
+
+  /* Bookmarks in this folder. */
+  (node.bookmarks || []).forEach(function(bm) {
+    childList.appendChild(renderBookmark(bm, node, haveSigner));
+  });
+
+  /* Subfolders. */
+  (node.children || []).forEach(function(child) {
+    childList.appendChild(renderNode(child, haveSigner, depth + 1));
+  });
+
+  wrap.appendChild(childList);
+  return wrap;
+}
+
+function renderBookmark(bm, folder, haveSigner) {
+  var row = document.createElement('div');
+  row.className = 'bm';
+
+  var info = document.createElement('div');
+  var title = document.createElement('div');
+  title.className = 'bm-title';
+  title.textContent = (bm.title && bm.title.length) ? bm.title : '(untitled)';
+  info.appendChild(title);
+
+  var urlLink = document.createElement('div');
+  var a = document.createElement('a');
+  a.className = 'bm-url';
+  a.href = bm.url;
+  a.textContent = bm.url;
+  urlLink.appendChild(a);
+  info.appendChild(urlLink);
+
+  var meta = document.createElement('div');
+  meta.className = 'bm-meta';
+  meta.textContent = 'Added: ' + bm.added;
+  info.appendChild(meta);
+
+  row.appendChild(info);
+
+  if (haveSigner) {
+    var actions = document.createElement('div');
+    actions.className = 'actions';
+
+    var moveBtn = document.createElement('a');
+    moveBtn.className = 'btn';
+    moveBtn.href = '#';
+    moveBtn.textContent = 'Move';
+    moveBtn.onclick = function(e) {
+      e.preventDefault();
+      var dest = prompt('Move bookmark to folder path:', folder.path);
+      if (dest && dest.trim() && dest.trim() !== folder.path) {
+        location.href = 'sovereign://bookmarks/move?from=' +
+                        encodeURIComponent(folder.path) + '&to=' +
+                        encodeURIComponent(dest.trim()) + '&url=' +
+                        encodeURIComponent(bm.url);
+      }
+    };
+    actions.appendChild(moveBtn);
+
+    var delBtn = document.createElement('a');
+    delBtn.className = 'btn btn-del';
+    delBtn.href = '#';
+    delBtn.textContent = 'Delete';
+    delBtn.onclick = function(e) {
+      e.preventDefault();
+      if (confirm('Delete this bookmark?')) {
+        location.href = 'sovereign://bookmarks/delete?dir=' +
+                        encodeURIComponent(folder.path) + '&url=' +
+                        encodeURIComponent(bm.url);
+      }
+    };
+    actions.appendChild(delBtn);
+
+    row.appendChild(actions);
+  }
+
+  return row;
+}
+
+/* ── Fetch + actions ───────────────────────────────────────────────── */
+
 function fetchBookmarks() {
   sovereignGet('sovereign://bookmarks/list?_=' + Date.now())
-    .then(function(data) { renderBookmarks(data); })
+    .then(function(data) { renderTree(data); })
     .catch(function(e) {
-      document.getElementById('bm-list').innerHTML =
+      document.getElementById('bm-tree').innerHTML =
         '<p class="empty">Failed to load bookmarks: ' + esc(e.message) + '</p>';
     });
 }
@@ -100,15 +267,15 @@ function fetchBookmarks() {
 function addBookmark() {
   var url = encodeURIComponent(document.getElementById('bm-url').value);
   var title = encodeURIComponent(document.getElementById('bm-title').value);
-  var dir = encodeURIComponent(document.getElementById('bm-dir').value);
+  var path = encodeURIComponent(document.getElementById('bm-path').value);
   if (!url) { alert('URL is required'); return; }
-  location.href = 'sovereign://bookmarks/add?dir=' + dir + '&url=' + url +
+  location.href = 'sovereign://bookmarks/add?dir=' + path + '&url=' + url +
                   '&title=' + title;
 }
 
 function createDir() {
-  var name = encodeURIComponent(document.getElementById('new-dir').value);
-  if (!name) { alert('Directory name is required'); return; }
+  var name = encodeURIComponent(document.getElementById('new-path').value);
+  if (!name) { alert('Folder path is required'); return; }
   location.href = 'sovereign://bookmarks/createdir?name=' + name;
 }
 

www/fips.css

@@ -0,0 +1,193 @@
+/* FIPS management page — sovereign://fips
+ * Imports the shared sovereign:// base theme, then adds FIPS-specific
+ * layout for status cards, the peers table, and the add-peer form. */
+@import url("sovereign://sovereign-base.css");
+
+.card {
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 12px 16px;
+  margin: 10px 0 20px;
+}
+
+.card .actions {
+  margin-top: 12px;
+}
+
+.mono {
+  font-family: var(--font);
+  word-break: break-all;
+}
+
+.err-text {
+  color: var(--accent);
+}
+
+/* State indicator dot. */
+.state-dot {
+  display: inline-block;
+  width: 8px; height: 8px;
+  border-radius: 50%;
+  margin-left: 6px;
+  vertical-align: middle;
+  background: var(--muted);
+}
+.state-dot.ready    { background: var(--primary); }
+.state-dot.failed   { background: var(--accent); }
+.state-dot.starting,
+.state-dot.stopping,
+.state-dot.bootstrapping,
+.state-dot.discovering,
+.state-dot.attaching { background: var(--accent); animation: pulse 1s infinite; }
+
+/* Peers table. */
+#peers-table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 10px 0;
+}
+#peers-table th,
+#peers-table td {
+  text-align: left;
+  padding: 6px 10px;
+  border-bottom: 1px solid var(--border);
+  font-size: 13px;
+}
+#peers-table th {
+  color: var(--muted);
+  font-weight: bold;
+  border-bottom: 2px solid var(--primary);
+}
+#peers-table td.mono { word-break: break-all; }
+
+.peer-state-connected    { color: var(--primary); }
+.peer-state-connecting,
+.peer-state-disconnected { color: var(--muted); }
+.peer-state-failed       { color: var(--accent); }
+
+#refresh-btn { margin-left: 12px; }
+
+/* Tab navigation. */
+.tabs {
+  display: flex; gap: 4px;
+  border-bottom: 1px solid var(--border);
+  margin-bottom: 16px;
+}
+.tab-btn {
+  background: var(--bg); color: var(--muted);
+  border: 1px solid transparent; border-bottom: none;
+  border-radius: var(--radius) var(--radius) 0 0;
+  padding: 6px 16px; cursor: pointer;
+  font-family: var(--font); font-size: 13px; font-weight: bold;
+  margin-left: 0; min-width: auto;
+  transition: color 0.2s, border-color 0.2s;
+}
+.tab-btn:hover { color: var(--primary); }
+.tab-btn.active {
+  color: var(--primary);
+  border-color: var(--border);
+  border-bottom: 1px solid var(--bg);
+  margin-bottom: -1px;
+}
+.tab-panel { display: none; }
+.tab-panel.active { display: block; }
+
+/* Known-nodes / tree-peers tables. */
+#nodes-table, #tree-peers-table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 10px 0;
+}
+#nodes-table th, #nodes-table td,
+#tree-peers-table th, #tree-peers-table td {
+  text-align: left;
+  padding: 6px 10px;
+  border-bottom: 1px solid var(--border);
+  font-size: 13px;
+}
+#nodes-table th, #tree-peers-table th {
+  color: var(--muted);
+  font-weight: bold;
+  border-bottom: 2px solid var(--primary);
+}
+#nodes-table td.mono, #tree-peers-table td.mono { word-break: break-all; }
+
+/* Direct-peer badge in the known-nodes table. */
+.peer-badge {
+  display: inline-block; width: 8px; height: 8px;
+  border-radius: 50%; background: var(--primary);
+}
+.peer-badge.indirect { background: var(--muted); }
+
+/* Staleness coloring for last-seen. */
+.last-seen-fresh { color: var(--primary); }
+.last-seen-stale { color: var(--muted); }
+.last-seen-old   { color: var(--muted); font-style: italic; }
+
+/* Tree role tags. */
+.tree-role { font-size: 11px; padding: 1px 6px; border-radius: 3px;
+  border: 1px solid var(--border); }
+.tree-role.root   { color: var(--accent); border-color: var(--accent); }
+.tree-role.parent { color: var(--primary); }
+.tree-role.child  { color: var(--muted); }
+
+/* Directory tab — compact one-line rows, wider table, smaller font. */
+body.wide { max-width: 1400px; }
+#tab-directory { max-width: 100%; }
+#dir-table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 10px 0;
+  table-layout: fixed;
+}
+#dir-table th, #dir-table td {
+  text-align: left;
+  padding: 3px 8px;
+  border-bottom: 1px solid var(--border);
+  font-size: 11px;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+#dir-table th {
+  color: var(--muted);
+  font-weight: bold;
+  border-bottom: 2px solid var(--primary);
+}
+/* Column widths: badge | npub | endpoint | connect */
+#dir-table th:nth-child(1), #dir-table td:nth-child(1) { width: 20px; }
+#dir-table th:nth-child(3), #dir-table td:nth-child(3) { width: 35%; }
+#dir-table th:nth-child(4), #dir-table td:nth-child(4) { width: 80px; }
+#dir-table td.mono {
+  font-family: var(--font);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+/* Pinned "this is you" row — highlighted border. */
+#dir-table tr.dir-ours-row {
+  border: 2px solid var(--accent);
+  background: rgba(255, 0, 0, 0.05);
+}
+#dir-table tr.dir-ours-row td {
+  border-bottom: 2px solid var(--accent);
+  font-weight: bold;
+}
+.dir-ours-tag {
+  color: var(--accent);
+  font-size: 10px;
+  font-weight: bold;
+  border: 1px solid var(--accent);
+  padding: 1px 4px;
+  border-radius: 3px;
+}
+
+/* Connect as clickable text, not a button. */
+.dir-connect-link {
+  color: var(--accent);
+  font-size: 11px;
+  cursor: pointer;
+  text-decoration: underline;
+}
+.dir-connect-link:hover { text-decoration: none; }

www/fips.html

@@ -0,0 +1,160 @@
+<!DOCTYPE html>
+<html class="light">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>FIPS Mesh Network</title>
+  <link rel="stylesheet" href="sovereign://fips.css">
+</head>
+<body>
+  <h1>FIPS Mesh Network <button class="btn" id="refresh-btn">Refresh</button></h1>
+
+  <div class="tabs">
+    <button class="tab-btn active" data-tab="status">Status</button>
+    <button class="tab-btn" data-tab="peers">Peers</button>
+    <button class="tab-btn" data-tab="network">Network</button>
+    <button class="tab-btn" data-tab="tree">Tree</button>
+    <button class="tab-btn" data-tab="directory">Directory</button>
+  </div>
+
+  <div id="status-msg" class="status"></div>
+
+  <!-- Status tab -->
+  <div class="tab-panel active" id="tab-status">
+    <h2>Status</h2>
+    <div class="card" id="fips-status">
+      <div class="info-row"><span>State</span><span id="fips-state">—</span></div>
+      <div class="info-row"><span>Node</span><span id="fips-node" class="mono">—</span></div>
+      <div class="info-row"><span>TUN</span><span id="fips-tun">—</span></div>
+      <div class="info-row"><span>Peers</span><span id="fips-peers">—</span></div>
+      <div class="info-row"><span>Tree</span><span id="fips-tree">—</span></div>
+      <div class="info-row"><span>Ownership</span><span id="fips-ownership">—</span></div>
+      <div class="info-row"><span>Control</span><span id="fips-control" class="mono">—</span></div>
+      <div class="info-row" id="fips-error-row" style="display:none">
+        <span>Error</span><span id="fips-error" class="err-text"></span>
+      </div>
+      <div class="actions">
+        <button class="btn" id="restart-btn">Restart Service</button>
+      </div>
+    </div>
+
+    <h2>Tor Status <span class="note">(read-only)</span></h2>
+    <div class="card" id="tor-status">
+      <div class="info-row"><span>State</span><span id="tor-state">—</span></div>
+      <div class="info-row"><span>Bootstrap</span><span id="tor-bootstrap">—</span></div>
+      <div class="info-row"><span>SOCKS</span><span id="tor-socks" class="mono">—</span></div>
+      <div class="info-row"><span>Ownership</span><span id="tor-ownership">—</span></div>
+      <div class="info-row" id="tor-error-row" style="display:none">
+        <span>Error</span><span id="tor-error" class="err-text"></span>
+      </div>
+    </div>
+  </div>
+
+  <!-- Peers tab -->
+  <div class="tab-panel" id="tab-peers">
+    <h2>Peers</h2>
+    <div id="peers-container">
+      <p class="empty" id="peers-empty">Loading peers…</p>
+      <table id="peers-table" style="display:none">
+        <thead>
+          <tr>
+            <th>npub</th><th>address</th><th>transport</th><th>state</th><th></th>
+          </tr>
+        </thead>
+        <tbody id="peers-body"></tbody>
+      </table>
+    </div>
+
+    <h2>Add Peer</h2>
+    <div class="card">
+      <div class="form">
+        <input type="text" id="peer-npub" placeholder="npub1..." size="50">
+        <input type="text" id="peer-address" placeholder="host:port" size="30">
+        <select id="peer-transport">
+          <option value="udp">udp</option>
+          <option value="tcp">tcp</option>
+        </select>
+        <button class="btn" id="connect-btn">Connect</button>
+      </div>
+    </div>
+  </div>
+
+  <!-- Network tab -->
+  <div class="tab-panel" id="tab-network">
+    <h2>Mesh Summary</h2>
+    <div class="card" id="mesh-summary">
+      <div class="info-row"><span>Known nodes</span><span id="mesh-known">—</span></div>
+      <div class="info-row"><span>Direct peers</span><span id="mesh-direct">—</span></div>
+      <div class="info-row"><span>Tree depth</span><span id="mesh-depth">—</span></div>
+      <div class="info-row"><span>Root</span><span id="mesh-root" class="mono">—</span></div>
+      <div class="info-row"><span>Our parent</span><span id="mesh-parent">—</span></div>
+      <div class="info-row" id="mesh-error-row" style="display:none">
+        <span>Error</span><span id="mesh-error" class="err-text"></span>
+      </div>
+    </div>
+
+    <h2>Known Nodes <span class="note" id="nodes-count-label"></span></h2>
+    <div id="nodes-container">
+      <p class="empty" id="nodes-empty">Loading network…</p>
+      <table id="nodes-table" style="display:none">
+        <thead>
+          <tr>
+            <th></th><th>npub</th><th>name</th><th>ipv6</th><th>last seen</th>
+          </tr>
+        </thead>
+        <tbody id="nodes-body"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <!-- Directory tab -->
+  <div class="tab-panel" id="tab-directory">
+    <h2>FIPS Node Directory <span class="note" id="dir-count-label"></span></h2>
+    <p class="note">All nodes that have published a FIPS service advert (Kind 37195) to the Nostr advert relays. This is the global network directory, like join.fips.network.</p>
+    <div id="dir-container">
+      <p class="empty" id="dir-empty">Click to load the directory from Nostr relays…</p>
+      <table id="dir-table" style="display:none">
+        <thead>
+          <tr>
+            <th></th><th>npub</th><th>endpoint</th><th></th>
+          </tr>
+        </thead>
+        <tbody id="dir-body"></tbody>
+      </table>
+    </div>
+    <div class="actions" id="dir-actions" style="display:none">
+      <button class="btn" id="dir-refresh-btn">Reload Directory</button>
+    </div>
+  </div>
+
+  <!-- Tree tab -->
+  <div class="tab-panel" id="tab-tree">
+    <h2>Spanning Tree</h2>
+    <div class="card" id="tree-summary">
+      <div class="info-row"><span>Root</span><span id="tree-root" class="mono">—</span></div>
+      <div class="info-row"><span>Is root</span><span id="tree-is-root">—</span></div>
+      <div class="info-row"><span>Our depth</span><span id="tree-depth">—</span></div>
+      <div class="info-row"><span>Our parent</span><span id="tree-parent">—</span></div>
+      <div class="info-row"><span>Our node addr</span><span id="tree-node-addr" class="mono">—</span></div>
+      <div class="info-row" id="tree-error-row" style="display:none">
+        <span>Error</span><span id="tree-error" class="err-text"></span>
+      </div>
+    </div>
+
+    <h2>Tree Peers <span class="note">(1-hop neighbors)</span></h2>
+    <div id="tree-peers-container">
+      <p class="empty" id="tree-peers-empty">Loading tree…</p>
+      <table id="tree-peers-table" style="display:none">
+        <thead>
+          <tr>
+            <th>node addr</th><th>name</th><th>depth</th><th>distance</th><th>role</th>
+          </tr>
+        </thead>
+        <tbody id="tree-peers-body"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <script src="sovereign://fips.js"></script>
+</body>
+</html>

www/fips.js

@@ -0,0 +1,564 @@
+/* FIPS management page — sovereign://fips
+ *
+ * Tabs: Status | Peers | Network | Tree
+ *
+ * - Status: FIPS + Tor status cards (sovereign://fips/status)
+ * - Peers:  direct peers table + add-peer form (sovereign://fips/peers)
+ * - Network: mesh summary + known-nodes table (sovereign://fips/network)
+ * - Tree:   spanning tree view (sovereign://fips/tree)
+ *
+ * Uses XMLHttpRequest via sovereignGet() because WebKit's custom scheme
+ * handler does not reliably support fetch() for sovereign:// URLs.
+ */
+
+function sovereignGet(url) {
+  return new Promise(function(resolve, reject) {
+    var x = new XMLHttpRequest();
+    x.open('GET', url, true);
+    x.onreadystatechange = function() {
+      if (x.readyState !== 4) return;
+      try { resolve(JSON.parse(x.responseText)); }
+      catch (e) { reject(e); }
+    };
+    x.onerror = function() { reject(new Error('XHR error')); };
+    x.send();
+  });
+}
+
+function esc(s) {
+  var d = document.createElement('div');
+  d.textContent = s == null ? '' : String(s);
+  return d.innerHTML;
+}
+
+function showMsg(text, isErr) {
+  var el = document.getElementById('status-msg');
+  el.textContent = text || '';
+  el.className = 'status show ' + (isErr ? 'err' : 'ok');
+  if (!text) el.className = 'status';
+}
+
+function stateDotClass(state) {
+  return 'state-dot ' + (state || '');
+}
+
+/* Global: our own FIPS node npub (from show_status), used to pin our
+ * node in the Directory tab. */
+var gOurNpub = '';
+
+/* ── Tab switching ──────────────────────────────────────────────── */
+
+function switchTab(tabName) {
+  document.querySelectorAll('.tab-btn').forEach(function(btn) {
+    btn.classList.toggle('active', btn.dataset.tab === tabName);
+  });
+  document.querySelectorAll('.tab-panel').forEach(function(panel) {
+    panel.classList.toggle('active', panel.id === 'tab-' + tabName);
+  });
+  /* Widen the page for the directory tab (long npub list needs width). */
+  document.body.classList.toggle('wide', tabName === 'directory');
+  /* Load tab data on demand. */
+  if (tabName === 'network') fetchNetwork();
+  if (tabName === 'tree') fetchTree();
+  if (tabName === 'directory') fetchDirectory();
+}
+
+document.querySelectorAll('.tab-btn').forEach(function(btn) {
+  btn.addEventListener('click', function() { switchTab(btn.dataset.tab); });
+});
+
+/* ── Status tab ─────────────────────────────────────────────────── */
+
+function renderFipsStatus(data) {
+  var f = data.fips || {};
+  var state = f.state || 'disabled';
+  /* Store our npub for the Directory tab pinning. */
+  gOurNpub = f.node_npub || '';
+  document.getElementById('fips-state').innerHTML =
+    esc(state) + '<span class="' + stateDotClass(state) + '"></span>';
+  document.getElementById('fips-node').textContent = f.node_npub || '—';
+  var tun = '—';
+  if (f.tun_name && f.tun_name.length) {
+    tun = f.tun_name + (f.tun_active ? ' (active)' : ' (inactive)');
+  }
+  document.getElementById('fips-tun').textContent = tun;
+  document.getElementById('fips-peers').textContent =
+    (f.peer_count != null ? f.peer_count : '—') + ' connected';
+  document.getElementById('fips-tree').textContent = f.tree_state || '—';
+  document.getElementById('fips-ownership').textContent =
+    f.ownership || '—';
+  document.getElementById('fips-control').textContent =
+    f.control_socket || '—';
+
+  var errRow = document.getElementById('fips-error-row');
+  var errEl  = document.getElementById('fips-error');
+  if (f.error && f.error.length) {
+    errEl.textContent = f.error;
+    errRow.style.display = '';
+  } else {
+    errRow.style.display = 'none';
+  }
+}
+
+function renderTorStatus(data) {
+  var t = data.tor || {};
+  var state = t.state || 'disabled';
+  document.getElementById('tor-state').innerHTML =
+    esc(state) + '<span class="' + stateDotClass(state) + '"></span>';
+  document.getElementById('tor-bootstrap').textContent =
+    (t.bootstrap_progress != null ? t.bootstrap_progress : '—') + '%';
+  document.getElementById('tor-socks').textContent =
+    t.socks_endpoint || '—';
+  document.getElementById('tor-ownership').textContent =
+    t.ownership || '—';
+
+  var errRow = document.getElementById('tor-error-row');
+  var errEl  = document.getElementById('tor-error');
+  if (t.error && t.error.length) {
+    errEl.textContent = t.error;
+    errRow.style.display = '';
+  } else {
+    errRow.style.display = 'none';
+  }
+}
+
+function fetchStatus() {
+  return sovereignGet('sovereign://fips/status?_=' + Date.now())
+    .then(function(data) {
+      renderFipsStatus(data);
+      renderTorStatus(data);
+    })
+    .catch(function(e) {
+      showMsg('Failed to load status: ' + e.message, true);
+    });
+}
+
+/* ── Peers tab ──────────────────────────────────────────────────── */
+
+function renderPeers(data) {
+  var body = document.getElementById('peers-body');
+  var table = document.getElementById('peers-table');
+  var empty = document.getElementById('peers-empty');
+
+  var peers = data.peers || [];
+  if (!peers.length) {
+    table.style.display = 'none';
+    empty.style.display = '';
+    empty.textContent = data.error
+      ? 'No peers (' + data.error + ')'
+      : 'No peers connected.';
+    return;
+  }
+
+  empty.style.display = 'none';
+  table.style.display = '';
+  var html = '';
+  peers.forEach(function(p) {
+    var npub = p.npub || p.id || '';
+    var addr = p.transport_addr || p.address || p.addr || '';
+    var transport = p.transport_type || p.transport || '';
+    var state = p.connectivity || p.state || p.status || '';
+    var label = p.display_name || '';
+    html += '<tr>';
+    html += '<td class="mono">' + esc(npub) +
+            (label ? '<br><span class="note">' + esc(label) + '</span>' : '') +
+            '</td>';
+    html += '<td class="mono">' + esc(addr) + '</td>';
+    html += '<td>' + esc(transport) + '</td>';
+    html += '<td class="peer-state-' + esc(state) + '">' + esc(state) + '</td>';
+    html += '<td><button class="btn btn-del" data-npub="' + esc(npub) +
+            '" onclick="disconnectPeer(\'' + esc(npub).replace(/'/g, "\\'") +
+            '\')">✕</button></td>';
+    html += '</tr>';
+  });
+  body.innerHTML = html;
+}
+
+function fetchPeers() {
+  return sovereignGet('sovereign://fips/peers?_=' + Date.now())
+    .then(function(data) { renderPeers(data); })
+    .catch(function(e) {
+      document.getElementById('peers-empty').textContent =
+        'Failed to load peers: ' + e.message;
+    });
+}
+
+function connectPeer() {
+  var npub = document.getElementById('peer-npub').value.trim();
+  var address = document.getElementById('peer-address').value.trim();
+  var transport = document.getElementById('peer-transport').value;
+  if (!npub || !address) {
+    showMsg('npub and address are required', true);
+    return;
+  }
+  var url = 'sovereign://fips/connect?npub=' + encodeURIComponent(npub) +
+            '&address=' + encodeURIComponent(address) +
+            '&transport=' + encodeURIComponent(transport);
+  sovereignGet(url)
+    .then(function(d) {
+      if (d.error) {
+        showMsg('Connect failed: ' + d.error, true);
+      } else {
+        showMsg('Peer added');
+        document.getElementById('peer-npub').value = '';
+        document.getElementById('peer-address').value = '';
+        fetchPeers();
+      }
+    })
+    .catch(function(e) { showMsg('Connect failed: ' + e.message, true); });
+}
+
+function disconnectPeer(npub) {
+  if (!npub) return;
+  if (!confirm('Disconnect peer ' + npub + '?')) return;
+  var url = 'sovereign://fips/disconnect?npub=' + encodeURIComponent(npub);
+  sovereignGet(url)
+    .then(function(d) {
+      if (d.error) {
+        showMsg('Disconnect failed: ' + d.error, true);
+      } else {
+        showMsg('Peer disconnected');
+        fetchPeers();
+      }
+    })
+    .catch(function(e) { showMsg('Disconnect failed: ' + e.message, true); });
+}
+
+function restartService() {
+  if (!confirm('Restart the FIPS service? This will briefly drop all peer connections.')) return;
+  showMsg('Restarting FIPS service…');
+  sovereignGet('sovereign://fips/restart')
+    .then(function(d) {
+      if (d.error) showMsg('Restart failed: ' + d.error, true);
+      else showMsg('Restart initiated');
+    })
+    .catch(function(e) { showMsg('Restart failed: ' + e.message, true); });
+}
+
+/* ── Network tab ────────────────────────────────────────────────── */
+
+function formatAge(ageMs) {
+  if (ageMs == null) return '—';
+  var s = Math.floor(ageMs / 1000);
+  if (s < 60) return s + 's ago';
+  var m = Math.floor(s / 60);
+  if (m < 60) return m + 'm ago';
+  var h = Math.floor(m / 60);
+  if (h < 24) return h + 'h ago';
+  return Math.floor(h / 24) + 'd ago';
+}
+
+function ageClass(ageMs) {
+  if (ageMs == null) return '';
+  if (ageMs < 10000) return 'last-seen-fresh';
+  if (ageMs < 60000) return 'last-seen-stale';
+  return 'last-seen-old';
+}
+
+function renderNetwork(data) {
+  var s = data.summary || {};
+  var nodes = data.nodes || [];
+
+  /* Mesh summary. */
+  document.getElementById('mesh-known').textContent =
+    (s.known_nodes != null ? s.known_nodes : '—') +
+    (s.max_cache_entries != null ? ' / ' + s.max_cache_entries : '');
+  document.getElementById('mesh-direct').textContent =
+    (data.peer_count != null ? data.peer_count : '—');
+  document.getElementById('mesh-depth').textContent =
+    (s.tree_depth != null ? s.tree_depth : '—');
+  document.getElementById('mesh-root').textContent =
+    s.root_npub ? esc(s.root_npub) : '—';
+  document.getElementById('mesh-parent').textContent =
+    s.parent_display_name ? esc(s.parent_display_name) :
+    (s.is_root ? '(this node is root)' : '—');
+
+  var errRow = document.getElementById('mesh-error-row');
+  var errEl  = document.getElementById('mesh-error');
+  if (data.error) {
+    errEl.textContent = data.error;
+    errRow.style.display = '';
+  } else {
+    errRow.style.display = 'none';
+  }
+
+  /* Known nodes table. */
+  var body = document.getElementById('nodes-body');
+  var table = document.getElementById('nodes-table');
+  var empty = document.getElementById('nodes-empty');
+  var countLabel = document.getElementById('nodes-count-label');
+
+  countLabel.textContent = '(' + nodes.length + ' nodes)';
+
+  if (!nodes.length) {
+    table.style.display = 'none';
+    empty.style.display = '';
+    empty.textContent = data.error
+      ? 'Network unavailable: ' + data.error
+      : 'No known nodes (FIPS may not be ready).';
+    return;
+  }
+
+  /* Sort by last_seen descending (most recent first). */
+  nodes.sort(function(a, b) {
+    var aT = a.last_seen_ms || 0;
+    var bT = b.last_seen_ms || 0;
+    return bT - aT;
+  });
+
+  empty.style.display = 'none';
+  table.style.display = '';
+  var html = '';
+  nodes.forEach(function(n) {
+    var npub = n.npub || '';
+    var name = n.display_name || '—';
+    var ipv6 = n.ipv6_addr || '';
+    var age = n.age_ms != null ? n.age_ms : null;
+    var direct = n.is_direct_peer;
+    var badge = '<span class="peer-badge' +
+                (direct ? '' : ' indirect') + '" title="' +
+                (direct ? 'direct peer' : 'discovery only') + '"></span>';
+    html += '<tr>';
+    html += '<td>' + badge + '</td>';
+    html += '<td class="mono">' + esc(npub) + '</td>';
+    html += '<td>' + esc(name) + '</td>';
+    html += '<td class="mono">' + esc(ipv6) + '</td>';
+    html += '<td class="' + ageClass(age) + '">' + formatAge(age) + '</td>';
+    html += '</tr>';
+  });
+  body.innerHTML = html;
+}
+
+function fetchNetwork() {
+  return sovereignGet('sovereign://fips/network?_=' + Date.now())
+    .then(function(data) { renderNetwork(data); })
+    .catch(function(e) {
+      document.getElementById('nodes-empty').textContent =
+        'Failed to load network: ' + e.message;
+    });
+}
+
+/* ── Tree tab ───────────────────────────────────────────────────── */
+
+function renderTree(data) {
+  var t = data.tree || {};
+  var errRow = document.getElementById('tree-error-row');
+  var errEl  = document.getElementById('tree-error');
+
+  if (data.error) {
+    errEl.textContent = data.error;
+    errRow.style.display = '';
+    document.getElementById('tree-peers-empty').textContent =
+      'Tree unavailable: ' + data.error;
+    document.getElementById('tree-peers-table').style.display = 'none';
+    /* Clear summary. */
+    ['tree-root','tree-is-root','tree-depth','tree-parent','tree-node-addr']
+      .forEach(function(id) { document.getElementById(id).textContent = '—'; });
+    return;
+  }
+  errRow.style.display = 'none';
+
+  document.getElementById('tree-root').textContent =
+    t.root_npub || t.root || '—';
+  document.getElementById('tree-is-root').textContent =
+    t.is_root ? 'yes' : 'no';
+  document.getElementById('tree-depth').textContent =
+    (t.depth != null ? t.depth : '—');
+  document.getElementById('tree-parent').textContent =
+    t.parent_display_name || t.parent || '—';
+  document.getElementById('tree-node-addr').textContent =
+    t.my_node_addr || '—';
+
+  /* Tree peers (1-hop neighbors). */
+  var body = document.getElementById('tree-peers-body');
+  var table = document.getElementById('tree-peers-table');
+  var empty = document.getElementById('tree-peers-empty');
+  var peers = t.peers || [];
+
+  if (!peers.length) {
+    table.style.display = 'none';
+    empty.style.display = '';
+    empty.textContent = 'No tree peers.';
+    return;
+  }
+
+  empty.style.display = 'none';
+  table.style.display = '';
+  var myAddr = t.my_node_addr || '';
+  var parentAddr = t.parent || '';
+  var html = '';
+  peers.forEach(function(p) {
+    var addr = p.node_addr || '';
+    var name = p.display_name || '—';
+    var depth = p.depth != null ? p.depth : '—';
+    var dist = p.distance_to_us != null ? p.distance_to_us : '—';
+    var role = '';
+    if (addr === parentAddr && !t.is_root) {
+      role = '<span class="tree-role parent">parent</span>';
+    } else if (addr === t.root) {
+      role = '<span class="tree-role root">root</span>';
+    } else {
+      role = '<span class="tree-role child">peer</span>';
+    }
+    html += '<tr>';
+    html += '<td class="mono">' + esc(addr) + '</td>';
+    html += '<td>' + esc(name) + '</td>';
+    html += '<td>' + esc(depth) + '</td>';
+    html += '<td>' + esc(dist) + '</td>';
+    html += '<td>' + role + '</td>';
+    html += '</tr>';
+  });
+  body.innerHTML = html;
+}
+
+function fetchTree() {
+  return sovereignGet('sovereign://fips/tree?_=' + Date.now())
+    .then(function(data) { renderTree(data); })
+    .catch(function(e) {
+      document.getElementById('tree-peers-empty').textContent =
+        'Failed to load tree: ' + e.message;
+    });
+}
+
+/* ── Directory tab ───────────────────────────────────────────────── */
+
+function renderDirectory(data) {
+  var body = document.getElementById('dir-body');
+  var table = document.getElementById('dir-table');
+  var empty = document.getElementById('dir-empty');
+  var countLabel = document.getElementById('dir-count-label');
+  var actions = document.getElementById('dir-actions');
+  var nodes = data.nodes || [];
+
+  countLabel.textContent = '(' + nodes.length + ' nodes)';
+
+  if (!nodes.length) {
+    table.style.display = 'none';
+    actions.style.display = 'none';
+    empty.style.display = '';
+    empty.textContent = data.error
+      ? 'Directory unavailable: ' + data.error
+      : 'No advertised nodes found on the advert relays.';
+    return;
+  }
+
+  /* Sort: our own node first (pinned), then by created_at descending. */
+  nodes.sort(function(a, b) {
+    var aOurs = (a.npub && a.npub === gOurNpub) ? 1 : 0;
+    var bOurs = (b.npub && b.npub === gOurNpub) ? 1 : 0;
+    if (aOurs !== bOurs) return bOurs - aOurs;
+    var aT = a.created_at || 0;
+    var bT = b.created_at || 0;
+    return bT - aT;
+  });
+
+  empty.style.display = 'none';
+  table.style.display = '';
+  actions.style.display = '';
+  var html = '';
+  nodes.forEach(function(n) {
+    var npub = n.npub || '';
+    var direct = n.is_direct_peer;
+    var isOurs = (npub && npub === gOurNpub);
+    var badge = '<span class="peer-badge' +
+                (direct ? '' : ' indirect') + '" title="' +
+                (direct ? 'direct peer' : 'not connected') + '"></span>';
+
+    /* Compact endpoints: "udp 1.2.3.4:2121" (first one only, +N if more). */
+    var endpointsStr = '—';
+    if (n.endpoints && n.endpoints.length) {
+      var ep = n.endpoints[0];
+      endpointsStr = esc(ep.transport || '?') + ' ' + esc(ep.addr || '');
+      if (n.endpoints.length > 1) endpointsStr += ' +' + (n.endpoints.length - 1);
+    }
+
+    /* Connect: clickable text, not a button. */
+    var firstEp = (n.endpoints && n.endpoints[0]) || {};
+    var addr = firstEp.addr || '';
+    var transport = firstEp.transport || 'udp';
+    var connectLink = '';
+    if (isOurs) {
+      connectLink = '<span class="dir-ours-tag">this is you</span>';
+    } else if (addr && !direct) {
+      connectLink = '<a class="dir-connect-link" href="javascript:void(0)" onclick="connectFromDirectory(\'' +
+        esc(npub).replace(/'/g, "\\'") + '\', \'' +
+        esc(addr).replace(/'/g, "\\'") + '\', \'' +
+        esc(transport) + '\')">connect</a>';
+    } else if (direct) {
+      connectLink = '<span class="note">connected</span>';
+    }
+
+    var rowClass = isOurs ? ' class="dir-ours-row"' : '';
+    html += '<tr' + rowClass + '>';
+    html += '<td>' + badge + '</td>';
+    html += '<td class="mono">' + esc(npub) + '</td>';
+    html += '<td class="mono">' + endpointsStr + '</td>';
+    html += '<td>' + connectLink + '</td>';
+    html += '</tr>';
+  });
+  body.innerHTML = html;
+}
+
+function fetchDirectory() {
+  var empty = document.getElementById('dir-empty');
+  empty.style.display = '';
+  empty.textContent = 'Querying Nostr advert relays (this takes a few seconds)…';
+  document.getElementById('dir-table').style.display = 'none';
+  document.getElementById('dir-actions').style.display = 'none';
+  return sovereignGet('sovereign://fips/directory?_=' + Date.now())
+    .then(function(data) { renderDirectory(data); })
+    .catch(function(e) {
+      empty.textContent = 'Failed to load directory: ' + e.message;
+    });
+}
+
+function connectFromDirectory(npub, address, transport) {
+  /* Switch to the Peers tab, pre-fill the add-peer form, and connect. */
+  switchTab('peers');
+  document.getElementById('peer-npub').value = npub;
+  document.getElementById('peer-address').value = address;
+  var sel = document.getElementById('peer-transport');
+  for (var i = 0; i < sel.options.length; i++) {
+    if (sel.options[i].value === transport) {
+      sel.selectedIndex = i;
+      break;
+    }
+  }
+  connectPeer();
+}
+
+/* ── Refresh + auto-refresh ─────────────────────────────────────── */
+
+function refresh() {
+  showMsg('');
+  var activeTab = document.querySelector('.tab-btn.active');
+  var tabName = activeTab ? activeTab.dataset.tab : 'status';
+  var promises = [fetchStatus(), fetchPeers()];
+  if (tabName === 'network') promises.push(fetchNetwork());
+  if (tabName === 'tree') promises.push(fetchTree());
+  Promise.all(promises).then(function() {});
+}
+
+document.getElementById('refresh-btn').addEventListener('click', refresh);
+document.getElementById('connect-btn').addEventListener('click', connectPeer);
+document.getElementById('restart-btn').addEventListener('click', restartService);
+var dirRefreshBtn = document.getElementById('dir-refresh-btn');
+if (dirRefreshBtn) dirRefreshBtn.addEventListener('click', fetchDirectory);
+
+/* Initial load. */
+refresh();
+
+/* Auto-refresh status + peers every 5s. Network/tree refresh on
+ * tab activation and every 10s when active. */
+setInterval(function() {
+  fetchStatus();
+  fetchPeers();
+}, 5000);
+
+setInterval(function() {
+  var activeTab = document.querySelector('.tab-btn.active');
+  if (!activeTab) return;
+  var tabName = activeTab.dataset.tab;
+  if (tabName === 'network') fetchNetwork();
+  if (tabName === 'tree') fetchTree();
+}, 10000);

www/settings.html

@@ -118,6 +118,13 @@
       <button class="save-btn" onclick="save('search_engine')">Save</button></div>
   </div>
 
+  <h2>Network</h2>
+  <div class="field">
+    <div><div class="setting-name">FIPS Mesh Network</div>
+      <div class="setting-desc">Manage the FIPS mesh daemon: status, peers, and service control.</div></div>
+    <div><a class="btn" href="sovereign://fips">Open FIPS Page</a></div>
+  </div>
+
   <h2>Security</h2>
 
   <div class="setting">