Feed: reposts. Amethyst showed Zapstore's repost of LWB's "Tankful" post in Adam's follows; we showed nothing — a feed asked only for posts (kinds 1, 1068). A feed of people now asks for their reposts too (NIP-18 kind 6; topic and firehose asks stay posts-only), and a repost shows as the note itself, under "🔁 <name> reposted" — its reactions, zaps, ⋯ and thread are the note's. Only reposts that carry the note and whose copy checks out (kind 1/1068, the id the e tag names, a valid signature); a muted author's note stays out. A note shows once: as itself, or under the first repost of it to arrive, counting rows still warming at the door. Media grids skip reposts. tools/feed-repost-test.js

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vps2H27rhbG9ZqseGfMrc3

4 files changed, 134 insertions, 9 deletions

diff --git a/src/features/messages.js b/src/features/messages.js
index cab7a97..99b5c48 100644
--- a/src/features/messages.js
+++ b/src/features/messages.js
@@ -43,6 +43,7 @@ import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
 import { sha256 } from '@noble/hashes/sha256';
 import { base64urlnopad } from '@scure/base';
 import { t, getLang } from '../i18n.js';
+import { verifyEvent } from 'nostr-tools/pure';
 import { createGifPicker, gifMedia } from '../gif-picker.js';
 import { inLanguage, isMachinePost, guessLang } from '../lang-guess.js';
 import { translatePieces, translatable as transParts } from '../translate-split.js';
@@ -537,6 +538,28 @@ export function messagesFeature(ctx) {
   const toOwnInbox = (wrap) => { if (ownInbox.length) publishOn(ownInbox, wrap, { onauth: relayAuth }); };
   // what a feed or a profile lists: notes, and polls (NIP-88)
   const FEED_KINDS = [1, 1068];
+  // A repost (NIP-18 kind 6) of someone's note shows in a feed of the
+  // people who reposted it, as the note itself under "<name> reposted".
+  // Only reposts that carry the note (every major client embeds it) and
+  // whose copy checks out: the id it names, a valid signature.
+  const REPOST = 6;
+  const repostInners = new Map(); // repost id -> the note, or null
+  function repostInner(ev) {
+    if (!ev || ev.kind !== REPOST) return null;
+    if (repostInners.has(ev.id)) return repostInners.get(ev.id);
+    let inner = null;
+    try {
+      const e = JSON.parse(ev.content || 'null');
+      const named = (ev.tags || []).filter((x) => x[0] === 'e').map((x) => x[1]);
+      if (e && FEED_KINDS.includes(e.kind) && typeof e.id === 'string' && (!named.length || named.includes(e.id)) && verifyEvent(e)) {
+        inner = { id: e.id, pubkey: e.pubkey, created_at: e.created_at, kind: e.kind, tags: e.tags, content: e.content, sig: e.sig };
+      }
+    } catch {}
+    if (repostInners.size > 2000) repostInners.delete(repostInners.keys().next().value);
+    repostInners.set(ev.id, inner);
+    return inner;
+  }
+  let repostBy = null; // set while noteRow draws a repost's note
   // A profile shows its articles (NIP-23) among the notes, as Amethyst does.
   const PROFILE_KINDS = [...FEED_KINDS, 30023];
   // An edited article is a new event at the same address: keep the newest.
@@ -5781,7 +5804,8 @@ export function messagesFeature(ctx) {
     try {
       const orT = orTopicsOf(def);
       await Promise.all([
-        queryFeed(feedRelaysOr(def, def && def.all ? FIREHOSE_RELAYS : NOTE_RELAYS), { kinds: FEED_KINDS, limit: FEED_PAGE,
+        // people's reposts with their posts (a topic or firehose ask: posts only)
+        queryFeed(feedRelaysOr(def, def && def.all ? FIREHOSE_RELAYS : NOTE_RELAYS), { kinds: authors.length && !topics.length ? [...FEED_KINDS, REPOST] : FEED_KINDS, limit: FEED_PAGE,
           ...(authors.length ? { authors } : {}), ...(topics.length ? { '#t': topics } : {}) }, merge, c, 3000),
         orT.length ? queryFeed(feedRelaysOr(def, TOPIC_RELAYS), { kinds: FEED_KINDS, limit: FEED_PAGE, '#t': orT }, merge, c, 3000) : null]);
     } catch {} finally {
@@ -6527,6 +6551,7 @@ export function messagesFeature(ctx) {
     if (p?.picture) makeThumb(pk, p);
   }
   async function noteReady(ev, deadline = Date.now() + READY_MS, depth = 0) {
+    if (ev && ev.kind === REPOST) { const inner = repostInner(ev); if (!inner) return; ev = inner; }
     const tasks = [warmAvatar(ev.pubkey, deadline), ...noteMediaUrls(ev.content).map((u) => warmMedia(u, { thumb: true })),
       ...(learnVideoMeta(ev), noteVideoUrls(ev.content).map((u) => warmVideo(u, imetaDim(ev, u)))),
       ...notePreviewUrls(ev.content).map(warmPreview),
@@ -6605,13 +6630,20 @@ export function messagesFeature(ctx) {
     if (!staged) feedStaged.set(c, staged = new Set());
     const known = new Set([...c.notes, ...(c.deferred || [])].map((e) => e.id));
     for (const e of evs || []) noteForSpam(e);
-    let add = (evs || []).filter((e) => FEED_KINDS.includes(e.kind) && !isReply(e) && !hidden(e)
-      && !known.has(e.id) && !staged.has(e.id) && known.add(e.id) && staged.add(e.id));
+    // A note shows once: as itself, or under the first repost of it to
+    // arrive — counting the ones still warming at the door.
+    // (`staged` holds the note's id too, for a repost)
+    const noteOf = (e) => (e.kind === REPOST ? repostInner(e) : e);
+    const notesIn = new Set([...c.notes, ...(c.deferred || [])].map((e) => noteOf(e)?.id).filter(Boolean));
+    const fresh = (e) => { const n = noteOf(e); return !!n && !notesIn.has(n.id) && !staged.has(n.id); };
+    const unstage = (e) => { staged.delete(e.id); const n = noteOf(e); if (n) staged.delete(n.id); };
+    let add = (evs || []).filter((e) => (e.kind === REPOST ? !!repostInner(e) && !hidden(repostInner(e)) : FEED_KINDS.includes(e.kind) && !isReply(e)) && !hidden(e)
+      && fresh(e) && !known.has(e.id) && !staged.has(e.id) && known.add(e.id) && staged.add(e.id) && staged.add(noteOf(e).id));
     if (!add.length) return false;
     const def = feedDef(c.id);
     if (def && def.curated) {
       const kept = curateFeed(add);
-      for (const e of add) if (!kept.includes(e)) staged.delete(e.id);
+      for (const e of add) if (!kept.includes(e)) unstage(e);
       add = kept;
       if (!add.length) return false;
     }
@@ -6621,7 +6653,7 @@ export function messagesFeature(ctx) {
       // Paint text now using the same progressive rows as the local cache;
       // slow media/quotes must not hold the whole first page behind a spinner.
       c.booting = true;
-      for (const e of add) staged.delete(e.id);
+      for (const e of add) unstage(e);
       admitFeed(add, c);
       c.boot = notesReady(c.notes.slice(0, FEED_PAGE)).finally(() => {
         c.booting = false;
@@ -6635,7 +6667,7 @@ export function messagesFeature(ctx) {
     // cannot hold ready text posts (or their new-post notice) behind it.
     const ready = await Promise.all(add.map(async (e) => {
       await noteReady(e);
-      staged.delete(e.id);
+      unstage(e);
       if (c.stopped) return false;
       // Cached rows can still be warming. This new row is already prepared
       // and can take its stable presentation without waiting for that page.
@@ -6882,7 +6914,9 @@ export function messagesFeature(ctx) {
         const chunks = [];
         for (let i = 0; i < a.length; i += REQ_AUTHORS) chunks.push(a.slice(i, i + REQ_AUTHORS));
         return chunks.map(async (chunk) => {
-          if (await queryFeed(relays, { kinds, authors: chunk, ...tag, limit, ...extra }, merge, c)) got = true;
+          // the people's reposts too, unless this pass asks for particular kinds
+          const ks = kinds === FEED_KINDS && !topics.length ? [...kinds, REPOST] : kinds;
+          if (await queryFeed(relays, { kinds: ks, authors: chunk, ...tag, limit, ...extra }, merge, c)) got = true;
         });
       }));
     };
@@ -7082,7 +7116,7 @@ export function messagesFeature(ctx) {
     const plan = feedRelays(def) ? [{ relays: feedRelays(def), authors }] : outboxPlan(authors);
     for (const { relays, authors: a } of plan)
       for (let i = 0; i < a.length; i += REQ_AUTHORS)
-        feedUnsubs.push(subscribeOn(relays, { kinds: FEED_KINDS, authors: a.slice(i, i + REQ_AUTHORS), ...tag, since }, on));
+        feedUnsubs.push(subscribeOn(relays, { kinds: topics.length ? FEED_KINDS : [...FEED_KINDS, REPOST], authors: a.slice(i, i + REQ_AUTHORS), ...tag, since }, on));
   }
   function stopFeedWatch() {
     for (const u of feedUnsubs) { try { u(); } catch {} }
@@ -9472,6 +9506,17 @@ export function messagesFeature(ctx) {
   }
 
   function noteRow(pk, ev, name, { open = true, focus = false, joined = false } = {}) {
+    if (ev.kind === REPOST) {
+      const inner = repostInner(ev);
+      if (!inner) return h('div', { class: 'row note-post', style: 'display:none' });
+      const prev = repostBy;
+      repostBy = ev.pubkey;
+      try { return noteRow(inner.pubkey, inner, displayName(inner.pubkey), { open, focus, joined }); }
+      finally { repostBy = prev; }
+    }
+    // who reposted this, for its header line (only this row: a quote inside draws none)
+    const reposter = repostBy;
+    repostBy = null;
     // A zap receipt (9735, or coinos's 9737) reached as a reply or through a
     // reaction to it — some clients let you react to a zap — is the zap, not
     // a post by the lightning server that signed it: the zapper's face and
@@ -9526,6 +9571,8 @@ export function messagesFeature(ctx) {
       // row — its handler stops propagation, so the row still opens the thread
       avatar(pk, 'chat-avatar note-avatar'),
       h('div', { class: 'note-content' },
+        reposter ? h('div', { class: 'small faint note-reposted', onClick: (e) => { e.stopPropagation(); openProfile(reposter); } },
+          h('span', { 'aria-hidden': 'true' }, '\u{1F501} '), t('postRepostedBy', { name: displayName(reposter) })) : null,
         h('div', { class: 'row between note-header', style: 'align-items:center;gap:8px' },
           h('div', { class: 'row', style: 'gap:7px;align-items:baseline;min-width:0' },
             h('span', {
@@ -10949,7 +10996,7 @@ export function messagesFeature(ctx) {
   // for more picks up where it stopped instead of re-reading the relays.
   const mediaIdx = new Map(); // key -> { key, images: Map, videos: Map, checked: Set, until, end, loaded }
   const mediaIdxKey = (feedId) => (mePk() || 'visitor') + '|' + feedId;
-  const hasMediaOf = (ev, kind) => kind === 'videos' ? noteVideoUrls(ev.content).length > 0
+  const hasMediaOf = (ev, kind) => ev.kind === REPOST ? false : kind === 'videos' ? noteVideoUrls(ev.content).length > 0
     : noteMediaUrls(ev.content).some((u) => !u.startsWith('https://i.ytimg.com/'));
   function mediaIndex(feedId) {
     const key = mediaIdxKey(feedId);
diff --git a/src/i18n.js b/src/i18n.js
index 5bf7f91..2d2c976 100644
--- a/src/i18n.js
+++ b/src/i18n.js
@@ -517,6 +517,7 @@ const STR = {
     msgSignerOff: "Your nostr signer isn't connected, so you can't post as yourself yet.",
     msgAmberDms: 'Signed in with Amber, messages sent to you can’t be opened here, only ones you sent from this device.',
     msgAmberConnect: 'Connect Amber',
+    postRepostedBy: '{name} reposted',
     gifBtnTitle: 'Add a GIF',
     gifSearchPh: 'Search GIFs',
     gifFrom: 'GIFs from',
diff --git a/src/style.css b/src/style.css
index 2ed97a1..f0b5de8 100644
--- a/src/style.css
+++ b/src/style.css
@@ -1651,3 +1651,4 @@ body::after {
 .gif-search::-webkit-search-cancel-button { cursor: pointer; }
 .gif-tile video, .gif-tile img { width: 100%; height: 100%; object-fit: cover; display: block; pointer-events: none; }
 .gif-note { display: flex; justify-content: center; padding: 32px 0; }
+.note-reposted { margin-bottom: 2px; cursor: pointer; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
diff --git a/tools/feed-repost-test.js b/tools/feed-repost-test.js
new file mode 100644
index 0000000..7bc43aa
--- /dev/null
+++ b/tools/feed-repost-test.js
@@ -0,0 +1,76 @@
+// Reposts in a feed: someone you follow reposting a note (NIP-18 kind 6,
+// the note embedded) shows the note under "<name> reposted" — Amethyst
+// showed Zapstore's repost of LWB's post, we showed nothing. A repost whose
+// copy doesn't check out is left out, and a note already in the feed isn't
+// shown twice.
+// Run: bun tools/feed-repost-test.js
+import puppeteer from './puppeteer.js';
+import { cacheKeyFor } from '../src/wallet.js';
+import { generateSecretKey, getPublicKey, finalizeEvent } from 'nostr-tools/pure';
+import { buildHtml } from '../build.js';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let ok = true;
+const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + d : ''}`); if (!c) ok = false; };
+const key = () => { const sk = generateSecretKey(); return { sk, pk: getPublicKey(sk) }; };
+const ZAPSTORE = key(), LWB = key(), OTHER = key();
+const now = Math.floor(Date.now() / 1000);
+const note = (who, content, ago) => finalizeEvent({ kind: 1, created_at: now - ago, tags: [], content }, who.sk);
+const repost = (who, ev, ago, content = JSON.stringify(ev)) => finalizeEvent({ kind: 6, created_at: now - ago, tags: [['e', ev.id, '', 'mention'], ['p', ev.pubkey]], content }, who.sk);
+const TANKFUL = note(LWB, 'Tankful is a vehicle logbook that stays on your phone', 900);
+const FORGED = { ...note(OTHER, 'the real words', 950) };
+const forgedCopy = JSON.stringify({ ...FORGED, content: 'words swapped after signing' });
+const OWN = note(ZAPSTORE, 'zapstore says hello itself', 300);
+const POSTS = [
+  OWN,
+  repost(ZAPSTORE, TANKFUL, 200),
+  repost(ZAPSTORE, FORGED, 250, forgedCopy),
+  repost(ZAPSTORE, OWN, 100), // its own note, already in the feed
+];
+const html = await buildHtml({ minify: true, pwa: false });
+const server = Bun.serve({ port: 5316, fetch: (req) => { const p = new URL(req.url).pathname; if (p === '/verify-worker.js' || p.startsWith('/punks')) return new Response(Bun.file('dist' + p)); return new Response(html, { headers: { 'content-type': 'text/html' } }); } });
+const browser = await puppeteer.launch({ relays: 'read', executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
+const page = await browser.newPage();
+await page.evaluateOnNewDocument((fx) => {
+  const Real = window.WebSocket;
+  const fits = (ev, f) => (!f.kinds || f.kinds.includes(ev.kind)) && (!f.authors || f.authors.includes(ev.pubkey)) && (!f.ids || f.ids.includes(ev.id));
+  window.WebSocket = function (...a) { const ws = new Real(...a); const send = ws.send.bind(ws); ws.send = (d) => { try { const m = JSON.parse(d); if (m[0] === 'REQ') { const fs = m.slice(2); setTimeout(() => { if (window.__live) for (const ev of fx.filter((e) => fs.some((f) => fits(e, f)))) ws.dispatchEvent(new MessageEvent('message', { data: JSON.stringify(['EVENT', m[1], ev]) })); ws.dispatchEvent(new MessageEvent('message', { data: JSON.stringify(['EOSE', m[1]]) })); }, 0); return; } if (m[0] === 'EVENT') return; } catch {} return send(d); }; return ws; };
+  window.WebSocket.prototype = Real.prototype; Object.assign(window.WebSocket, Real);
+}, POSTS);
+const errs = [];
+page.on('pageerror', (e) => errs.push(String(e)));
+const click = (t) => page.evaluate((x) => { const e = [...document.querySelectorAll('button')].find((n) => n.textContent.trim().toLowerCase().includes(x)); if (e) { e.click(); return true; } return false; }, t);
+const text = () => page.evaluate(() => document.body.innerText);
+const waitText = async (x, ms = 25000) => { for (let i = 0; i < ms / 250; i++) { if ((await text()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; };
+try {
+  await page.setViewport({ width: 390, height: 844 });
+  await page.goto('http://localhost:5316/', { waitUntil: 'domcontentloaded' });
+  await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
+  await page.reload({ waitUntil: 'domcontentloaded' }); await sleep(400);
+  await click('create a new wallet'); await sleep(600);
+  await page.waitForSelector('.words .w .t');
+  const mn = (await page.$$eval('.words .w .t', (l) => l.map((e) => e.textContent.trim()))).join(' ');
+  await click('skip verification');
+  await waitText('receive', 20000);
+  const base = cacheKeyFor(mn + '\n');
+  await page.evaluate(([k, z, l, o]) => {
+    localStorage.setItem(k + ':follows', JSON.stringify({ tags: [['p', z]], c: '', at: Math.floor(Date.now() / 1000) }));
+    localStorage.setItem(k + ':profiles', JSON.stringify({ [z]: { name: 'Zapstore', t: Date.now() }, [l]: { name: 'LWB', t: Date.now() }, [o]: { name: 'Other', t: Date.now() } }));
+    localStorage.setItem('btc-wallet-feed:' + k, 'following');
+  }, [base, ZAPSTORE.pk, LWB.pk, OTHER.pk]);
+  await page.evaluateOnNewDocument(() => { window.__live = true; });
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await waitText('receive', 20000);
+  await page.evaluate(() => document.querySelector('.app-nav-button[aria-label="Feed"]')?.click());
+  check('the reposted note shows', await waitText('Tankful is a vehicle logbook', 30000));
+  const row = await page.evaluate(() => { const r = [...document.querySelectorAll('[data-zap-post]')].find((n) => n.textContent.includes('Tankful')); return r && { text: r.innerText, post: r.getAttribute('data-zap-post') }; });
+  check('...under "Zapstore reposted", as LWB\'s post', !!row && /Zapstore reposted/.test(row.text) && /LWB/.test(row.text) && row.post === TANKFUL.id, JSON.stringify(row));
+  await sleep(1500);
+  const t = await text();
+  check('a repost whose copy was tampered with is left out', !t.includes('words swapped') && !t.includes('the real words'));
+  check('a note already in the feed isn\'t shown again for its repost', (t.match(/zapstore says hello itself/g) || []).length === 1);
+  await page.evaluate(() => [...document.querySelectorAll('[data-zap-post]')].find((n) => n.textContent.includes('Tankful')).querySelector('.note-text, .note-content').click());
+  check('a tap opens the reposted note\'s thread', await page.evaluate(async () => { for (let i = 0; i < 20; i++) { if (location.pathname.includes('nevent') || document.querySelector('.thread-reply-send, .thread-view')) return true; await new Promise((r) => setTimeout(r, 200)); } return false; }));
+  check('no page errors', errs.length === 0, errs.slice(0, 2).join(' | '));
+} finally { await browser.close(); server.stop(true); }
+console.log(ok ? '\n✅ reposts show in the feed' : '\n❌ failed');
+process.exit(ok ? 0 : 1);