| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |
|
|
|
|
|
| |
activate, so no one inherits another wallet's chats or steals its inbox
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01DbA53PJA8fgSvMcEzfuw22
|
| |
|
|
|
|
| |
search answers from memory before the network
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
| |
address to land on becomes a gift only their key can open
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
| |
keeps its pending line to itself
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01M5kFodm9azZJVTQxnkDdKe
|
| |
|
|
|
|
|
| |
anywhere
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01M5kFodm9azZJVTQxnkDdKe
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The warning: when the Spending balance minus round fee is under the
330-sat round minimum AND a vtxo enters the renewal window, auto-refresh
can't save the coins — a wallet-screen notice (and a daily local
notification, when permitted) says to receive any amount or spend
before the deadline. New walletNotices feature hook renders under the
balance card.
The amnesty: sub-dust vtxos have no unilateral exit to protect, and
regtest proves captaind keeps cosigning their spends past expiryHeight —
even after the watchman claims the backing on-chain
(tools/ark/expired-dust-test.js). Only hal's own receive validation
stood in the way; it now exempts sub-330 vtxos from the expiry check.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Regtest-proven (tools/ark/dust-gift-test.js): the ASP cosigns all-dust
arkoor sends, so a sub-dust bearer vtxo sweeps to its claimer fine, and
dust folds into rounds alongside bigger siblings. The 330-sat gift
floor guarded a failure that can't happen — dropped to 1 sat.
The experiment also caught a live bug: refresh() of a balance smaller
than the round fee computed a negative output amount, and pbWriter's
varint sign-extends negatives into an infinite loop — auto-refresh
would OOM the tab of any wallet too small to renew. varint now throws
on negatives and refresh() refuses cleanly, before marking coins
pending, when balance minus fee is under the server's 330-sat output
minimum.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
| |
Not a pane of its own: a regular Bitcoin address means receiving to
Savings, so the entry switches the account selector over and lets the
savings receive view show its fresh address.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
|
|
| |
The keyboard shrinks the viewport-sized chat card: the composer stayed
on screen but the log kept its old scroll offset, hiding the newest
messages. Re-stick on every viewport resize and on composer focus —
unless the reader has deliberately scrolled up, which msgStick already
remembers.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
| |
Behind it: a one-time BOLT 11 invoice (minted by the ASP), the reusable
BOLT 12 offer flow, the wallet's raw ark address, and the CLINK offer
code — each on its own pane so only one scannable code shows at a time.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
|
| |
The header dot cleared only per-conversation, so a channel or thread you
never clicked into kept it lit forever. Now the list screen has its own
watermark: visiting it answers the header dot, while each DM and
community row shows an unread dot of its own until actually opened.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QwAtBSpKvECqp1rHLHjJk
|
| |
|
|
|
|
|
|
|
|
|
| |
adoptIdentity claimed the identity npub whenever the local name differed
— and claim() releases the previous name, so a nostr login could delete
the user's custom address from the registrar (it did). It now asks the
registrar first and yields to any custom name. The registrar's /pubkey
lookup also matches manager keys now and prefers real names over npub
defaults, so restored wallets find their name again.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
| |
Finishing the avatar step published name = the payment-address name and
the default punk under the user's real nostr identity — renaming (and
re-facing) profiles that already existed. Wizard-suggested fields are
fill-only now: they land only where the profile has nothing.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
| |
A recreated <img> decodes async — one blank frame per render, and boot
renders in bursts. A CSS background paints synchronously from cache, so
the profile page, chat rows, and send candidates all hold steady now.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
| |
The pencil opens a dedicated screen — no balances, no tabs — wired into
the history stack like the other sub-pages.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
| |
The avatar img was recreated on every render — boot's render bursts made
it flash; there is exactly one header avatar, so the node is reused until
the profile actually changes.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
| |
Anyone still on the npub-shaped default sees their address here, not in
the collapsed corner of Settings where the claim form lived.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
| |
The registrar now lets a migrated coinos user's nostr identity (re)take
its own name — migration could land the claim in whatever wallet ran it,
stranding the name there. The claim form signs with the (re)attached
login identity when there is one; the wallet key alone could never prove
the takeover.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
| |
Signing in mid-wizard with a key whose wallet was restored left you on
the sign-in step: the back-button hold matched the restored account and
blocked the auto-advance. A login now clears the hold explicitly — and a
restored wallet skips the rest of onboarding entirely; it was already
onboarded wherever it came from.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Signing in with a key whose wallet backup exists on relays could still
land in 'create a new wallet' when the lookup failed (relays unreachable,
signer decrypt denied) — and confirming would have replaced the real
backup on any relay the new one reached. Absence is now only believed
when a relay actually answered; decrypt failures surface as errors; and
the create path takes one last look and adopts a backup that surfaces
rather than clobbering it.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
| |
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The sign-in screen stacked 'Connect a signer app' directly above a
bunker/nsec field, which reads as two steps rather than two ways in.
A divider says which it is.
The wizard's second step asked whether you have a nostr account, then
sent you to a screen that asks the same thing. Step one now offers both
paths directly — Get started, or sign in with Nostr — and the middle
step is gone, along with its strings. The welcome blurb goes too: the
screen is one decision, and prose above it is something to read before
you can make it.
The footer sinks to the bottom of the window rather than trailing the
content up the page. #app is a full-height column now; the chat card
sizes itself against the viewport, so the layout test covers it at
three sizes.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The message log had a fixed 62vh height, so the card was head + panels +
log + composer tall and the input fell off the bottom of the screen. The
card is now sized to the viewport and the log is the only part that
flexes: opening the invite or member panel shrinks the scroll area
instead of pushing the composer out of reach.
Three header changes, all the same idea — don't show a control for a
choice nobody is making:
'+' becomes 'Add person', because a plus sign doesn't say what it adds.
A lone channel isn't named at all. '#general' next to a composer that
says 'Message #general' points at a choice of one; several channels
become a select, which is what a choice looks like.
The new-channel field hides behind a 'New channel' button. Sitting open
right after you create a community, it reads as something you're
supposed to fill in.
tools/chat-layout-test.js holds the line at three viewport sizes with
both panels open, and covers the header behaviour through actually
adding a second channel.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
| |
A dark pill floating at the bottom of the screen reads as a stray button
under the footer, and it was saying something the page already showed:
the badge flips to connected and the reconnect controls disappear.
Failures still surface — those go in the card, where the problem is.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The app could tell you your signer wasn't connected and then send you
somewhere with nothing to click: once an account was linked, the nostr
card showed only an npub. It now shows connected/not connected, says
what's missing, and offers the same signer options as signing in —
refusing a different account rather than quietly swapping identities,
since this is a reconnect and not a login.
Pasted keys go back to not being persisted at all. Storing one would
have survived a reload, but the UI promises a pasted key is used once
and never kept, and that promise is worth more than saving a paste;
those logins reconnect from this card like any other.
The chat banner now tracks the live signer alone. The flag that
suppressed it after a reconnect would also have hidden a later genuine
disconnect.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
| |
A NIP-46 connection can die quietly, leaving the app with a signer
object that will never reply — and since it's still the cached live
signer, every send after that fails the same way until the page is
reloaded. Wrap a remote signer so the first failed call drops it,
letting the next attempt resume a fresh connection instead.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
A remote signer dropped by a reload now says so above the composer, with
a button that reconnects in place — rather than letting someone write a
message and only then be told it can't be sent as them. Failing that it
opens the nostr settings, where logging in again is the fallback.
Every remote-signer login made before sessions were persisted lands in
exactly this state once.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Logging in with a remote signer and reloading left the app showing your
avatar and profile while signing everything with the wallet's own key —
so chat messages arrived under a different npub with a stranger's punk
on them. identity() had a fallback: when the login signer wasn't
available it quietly used the wallet key instead. That fallback is gone.
If you logged in as a nostr account, the app speaks as that account or
it refuses and says so.
Refusing is only reasonable if the signer usually comes back, so a login
now persists what it takes to be that identity again. A remote signer
stores its NIP-46 client key and pointer — the signer authorised that
client key, not one page load, so rebuilding from it resumes the session
without prompting. A pasted key stores the key, which is already the
seed of everything here since the wallet's mnemonic derives from it.
Resume is single-flight with a pause after failure, because identity()
is asked on every send and a signer that isn't answering must not mean a
relay connection per keystroke.
Existing remote-signer logins predate the stored session, so they need
one more sign-in to become resumable.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A NIP-17 wrap is signed by a throwaway key with the sender sealed under
two layers of nip44, so no server can filter DMs by who sent them. The
notifier now ships the wrap inside the push payload and the service
worker opens it locally: a message from someone you follow arrives with
their name on it, a stranger's is dropped, and your own sent-copy — every
DM is wrapped to the sender too — no longer notifies you about what you
just typed.
That needs the nostr identity key in the worker's IndexedDB, which
dm-inbox.js states plainly: for a seed-derived identity it is a second
copy of a key localStorage's seed already yields, and it exists only to
keep strangers out. A remote signer never hands its key over, so those
wallets store no secret and keep getting unfiltered notifications rather
than silence.
Silence is always the riskier failure here, so the rule leans the other
way whenever it isn't sure: a wrap we can't open notifies, an account
with no contact list published notifies (otherwise a new user's welcome
message would vanish), and anyone you already have a thread with counts
as known whether or not you follow them. The server-side DM cooldown
drops to a second — with the device discarding pushes, a throttle there
would let a discarded one swallow the message behind it.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The header carries a message button again, left of the wallet selector,
with a red dot when a conversation is waiting. Unread is a per-thread
watermark on the newest message from someone else, kept in the rumor's
own created_at so it means the same thing on every device it syncs to.
Rooms subscribe at startup now, or the dot could not speak for a
community nobody was listening to.
Communities no longer buzz a phone by default: push registration only
carries the stream keys of communities you have opted in, per community,
from a bell in the room header. DMs and payments are unchanged.
Presence and typing ride the channel stream as 21059 wraps, so who is
around stays inside the community's encryption rather than becoming a
public status. Measured against relay.coinos.io and nos.lol, neither
actually drops NIP-01 ephemeral kinds, so beats carry a NIP-40
expiration and relay.coinos.io sweeps kind 21059 hourly — and presence
is dated by the beat, never by arrival, or a replayed beat would light
up the whole member list.
The member list follows Telegram: online, then last seen in minutes and
hours, then a vague 'recently' rather than advertising how long someone
has been gone.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
giftRecords() caches the parsed blob on the wallet object, but the app
runs a single Wallet for its lifetime and load() never dropped that
cache. Switching wallets carried the old wallet's gift links into the
new one, where they all rendered as claimed — none of their outpoints
are live in a wallet that never issued them — and the first save wrote
them back under the new wallet's key.
Clear the cache on load alongside the other two gift caches, and forget
records whose funding tx isn't in this wallet's own history, to clean up
what earlier builds already misfiled.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
| |
Editing it here reads like renaming your coinos account, and for someone
using an address from elsewhere it invites breaking their own zaps. The
field is gone; an existing address is preserved untouched, and one is
filled in from the coinos payment address only when the profile has
none, so other clients can still zap them.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The service worker can't watch a relay, so it doesn't try: the app
resolves the destination to something concrete (ark address, LNURL
endpoint, or on-chain script) and mirrors it beside the keys the
background NWC payer already uses. On a push wake-up — which is exactly
when money has just landed — the worker re-checks the same gate and
sends, writing the outcome back into the mirror for the app to absorb on
next open. A partial on-chain forward still waits for the app, since
carving an exact vtxo needs more round trips than a worker is promised.
writeBgMirror now carries forward the NWC connections and offer when
another caller refreshes the mirror, instead of blanking them.
And onboarding's legacy step loses its Back: the wallet exists by then,
so returning to the nostr question just bounced straight forward again
and the link looked broken. Its copy no longer promises a rename either.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
| |
The placeholder repeated a minimum the line below already states, and it
was clipped anyway — the amount field had 14px of usable width at 360px
because "Move to Spending" crushed it. The row wraps to two full-width
lines when it's tight and stays on one line when there's room.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Settings → Payments takes a destination, a threshold, and an optional
amount to keep behind. When Spending crosses the threshold the wallet
sends the rest on by itself, resolving the destination the same way the
send form does — an ark address goes native and free, a payment name
prefers its ark instruction before falling back to lightning, an npub
tries its ark advert then its lightning address, and an on-chain
address becomes a cooperative offboard (carving out an exact-amount
vtxo first when it isn't sending everything, since offboards move whole
vtxos).
Money moving without a human watching deserves guardrails: one transfer
at a time, never while another ark action is in flight, a fifteen-minute
backoff after a failure with the reason kept for the card, destinations
validated before it can be switched on, and dust amounts skipped.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
| |
Opening it hides the payment address and its QR — two payment codes on
one screen is a good way to have someone scan the wrong one. "Hide"
becomes "Back", which is what it now does.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Between "do you have a nostr account" and claiming a username, new users
are asked whether they already have an account on the original coinos.
Yes hands off to coinos.io/migrate with their fresh v3 payment address
and a return URL — they're already signed in there, so no password or
key ever travels. That page sweeps the balance over Lightning and
renames the old account, releasing the username.
Coming back, coinos.io returns ?migrated=<username>; v3 claims that name
on the registrar (retrying for a minute, since the registrar's
"is this a legacy user?" guard caches), and their lightning address now
resolves to the v3 wallet.
The legacy page ships in coinos-ui and is NOT deployed yet.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The inline-progress attempt still read as a flash — the send form was
visible behind it with the raw npub, its verification block and the
gift button, then all of that was replaced. Now both resolution phases
(ark advert, then lightning) render the SHAPE of the destination card:
same title, same recipient chip, a spinner where the amount form will
be, and a working Back. The card fills in instead of the screen
changing twice, and the two flows share one title so it never
re-titles at the handoff.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Mining pools (Ocean) and payroll pay to a reusable offer rather than a
lightning address, and the memo is how the payer labels it. A
disclosure under the payment address mints one: the registrar's new
NIP-98'd /offer endpoint asks the ASP's CLN for an `amount: any` offer
carrying the memo, keyed to the caller's name (issuer = their address,
so two users' identical memos can't collapse onto one CLN offer). Up to
ten each, identical memos reuse the existing offer, and GET lists them.
Settled offer payments already had a home: the registrar's settle loop
now resolves a custom offer id to its owner and hands it to the same
forwarder the default offer uses — an instant, free arkoor send into
the user's Spending balance.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Resolving a recipient (ark advert → BIP-353 → lightning) no longer
takes over the screen twice on the way: both steps keep the send form
in place and report progress as one inline line, so picking someone
goes straight to something actionable. The recipient chip on the zap
card gets a large variant — a 30px avatar and full-size name, since
it's who the money is going to.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
| |
An npub-shaped lightning address (npub1…@npub.cash) duplicated the npub
box below it and overflowed the card — it's hidden now, as is a lud16
identical to the nip05. A one-character "about" (fiatjaf's is literally
"~") is noise rather than a bio, so it's skipped. Both remaining
identity lines wrap. The inline ‹ chevron becomes a full-width Back
button under the actions, matching every other page.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
| |
"Move to Savings without the server" — the vtxo count was internal
detail in a button most users will never press. It still gates whether
the button appears at all.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Into Spending gains a Max (fee-aware — it asks the tx builder what a
sweep would actually deliver, so the mining fee can't make the board
fail), and both directions now carry Max as a small affordance inside
the input's right edge instead of a button eating a third of the row.
It only appears when there's a balance to max. Balance face height
trimmed to match its shorter content.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
|
