Build157 put GoblinView::avatar_self (a tap-through to Settings) top-right
on both the home and pay headers. Per owner request, drop it from the PAY
page only; the home header avatar is unchanged. The scan-QR glyph and the
rest of the pay layout are left in place. Settings remains reachable from
the bottom nav bar (Tab::Me) and the wide-mode sidebar.
Full native-quality Traditional Chinese (Taiwan) locale covering all 910
keys. Shared GRIM-inherited keys use jasperli2026's zh-TC values verbatim;
goblin.* namespace translated from the corrected Simplified source into
Taiwan-idiom Traditional (OpenCC s2twp plus a manual Taiwan post-fix and
review pass), keeping Jasper's voice and crypto-wallet register. Cangjie
keyboard labels reused from zh-CN; lang_name set to 繁體中文.
Wired into the i18n drift test (OTHER_LOCALES) and README attribution;
rust_i18n auto-loads it and the language picker labels it via lang_name.
System locale zh-TW auto-selects; news folds zh-TW to zh (shared with
Simplified) as noted in news_locale_code.
Append ui.add_space(View::get_bottom_inset()) at the end of
SettingsContent::ui. The settings screen supplies no bottom inset (its
tab panel is hidden and the CentralPanel frame uses bottom:0), so the
final FADERS Settings button clipped under 3-button nav / the gesture
pill. get_bottom_inset() is 0 off Android, so desktop is unaffected.
Drop the PoolRelay.exit field and the exit_for/exit_for_host/has_exit
helpers left over from the retired Nym-era co-located scoped exit. The
deleted src/nym was their only real caller; the Tor build never consumes
them. PoolRelay has no deny_unknown_fields, so a gist that still carries
a stray per-relay "exit" key keeps deserializing and the key is ignored
(covered explicitly in the unknown-fields test).
The wallet pivoted from the Nym mixnet to Tor in build134; the Nym code
had been left on disk behind an optional, always-off "nym" feature and
never ran since. Delete it entirely: no Nym/mixnet fallback and no
Nym/mixnet mentions remain. Tor is the sole transport.
- Delete src/nym/ (mod, transport, streamexit, dns, nymproc) and its
`#[cfg(feature = "nym")] pub mod nym;` declaration in lib.rs.
- Cargo.toml: drop the `nym` feature and the commented-out Nym-only
path deps (nym-sdk, smolmix, hickory-proto); rewrite the mixnet-era
comments on the rustls/tokio-rustls/arti/openssl deps to the current
Tor reality. No active dependency changed: rustls, tokio-rustls and
webpki-roots stay (used by the Tor HTTPS client in tor/mod.rs).
- settings/config.rs: remove the persisted nym_entry_gateway /
nym_last_ipr fields and their getters/setters. No serde
deny_unknown_fields, so existing on-disk configs that still carry
those keys keep deserializing (the removed keys are ignored and
dropped on next save; same path the price-cache-removal test guards).
- Rename the Nym/mixnet-named i18n keys (values already said "Tor")
across all 9 locales and their t!() call sites: connected_nym ->
connected_tor, nym_ready -> tor_ready, connecting_nym ->
connecting_tor, mixnet_routing -> tor_routing, over_mixnet ->
over_tor. Displayed strings unchanged.
- Rewrite the Nym/mixnet-referencing comments in the active Tor files
(tor/engine.rs, tor/mod.rs, nostr/client.rs, nostr/pool.rs,
nostr/mod.rs, lib.rs, wallet/wallet.rs, node/node.rs,
gui widgets/mod/onboarding, Android BackgroundService) to describe
Tor; drop the now-broken [crate::nym::*] intra-doc links. No active
code behavior changed.
The pool's `exit` schema slot and exit_for/exit_for_host/has_exit
helpers are kept (comments de-Nym'd): they are inert under Tor but let
a pool document that carries an exit still parse.
The .backup file now seals the money seed AND every held identity in one
encrypted, versioned envelope, and the caption's promise ("Contains your
wallet and all identities.") is finally true.
Format (nostr/identity.rs): a JSON envelope tagged goblin_backup:2. The
seed phrase is sealed with seal_secret_text() and each identity with the
existing per-identity to_encrypted_backup() (so every element is itself a
valid v1 identity envelope). Both layers reuse the in-tree NIP-49 ncryptsec
+ NIP-44 primitives under one password: no new crypto, no new dependency.
The plaintext seed is assembled and sealed in memory (the zeroizing
recovery string drops at scope end) and never written to disk. Old v1
single-identity backups keep restoring unchanged; is_full_backup() is
checked before the v1 path so the two never collide.
Build (wallet.rs): create_full_backup() gathers the seed via the existing
recovery API (which proves the wallet password) plus every unlocked held
identity. restore_full_backup_identities() reinstates them into a freshly
created wallet, re-encrypting each under the new wallet password, making the
backup's active identity active, and reusing the held-index/service-rebuild
plumbing. The identity-only import paths now reject a full backup with a
clear pointer to wallet creation.
Restore (onboarding.rs): the restore-from-seed step gains a .backup picker;
unlocking it decrypts the seed into the standard 24-word creation grid and
stashes the identities, which a worker reinstates once the wallet opens.
Copy: backup caption, title, blurb, and saved-sub updated across all nine
locales; two new restore strings added in all nine.
Tests: full_backup_roundtrips_seed_identities_and_active,
old_single_identity_backup_is_not_a_full_backup,
seal_secret_text_roundtrips_and_is_opaque; i18n drift + news tests green.
Group the Advanced settings page under two grey/red section kickers:
- ADVANCED NOSTR SETTINGS: the Nostr key, and directly below it the
single always-everything .backup download (one button, no checklist).
Moved the .backup off the main Settings identity card so it has one
home (no duplicated exposure). Caption states what the file truly
holds: the current identity's key and username.
- DANGER ZONE (red kicker): Delete wallet, now password-gated. The old
tap-twice confirm is replaced by a wallet-password gate
(get_recovery), with an inline "Download backup" button before the
password field wired to the same seal action. Copy states the delete
also removes every identity and urges a backup first.
Add w::kicker_danger; BackupState.anchor_delete routes the seal form to
whichever section opened it. New strings in all nine locales; clear the
backup password from memory on leaving the page.
Build 157 hard-coded the flat Goblin-yellow censored tile for the user's
own top-right avatar on the home and pay headers, regardless of anonymous
mode. The owner clarified: anonymous mode is the ONLY thing that turns an
avatar yellow.
Replace the mode-blind w::avatar_self widget with a mode-aware
GoblinView::avatar_self helper: anon ON renders the censored yellow tile
(w::avatar_censored), anon OFF renders this identity's normal gradient/
picture identicon (w::avatar_any), matching every other surface. Remove
the now-unused free avatar_self widget from widgets.rs.
All other avatar_censored call sites (identity switcher, activity rows)
remain correctly gated behind the anonymous-mode flag.
A single news post now ships as nine per-`d` language variants and the
publisher emits English first, giving it the oldest `created_at` in the
batch. With the store capped at 8 events across all d-tags, the English
event was always the 9th-newest and got evicted — English readers saw no
news. The catch-up/subscription filter also capped fetches at 4, so fresh
installs only ever received the newest four events.
Raise NEWS_CAP from 8 to 18 (two full nine-language posts) and bump the
news filter limit from 4 to 18 to match. Selection logic is unchanged.
Extend the reconcile_news test with a nine-variant batch that proves the
untagged English event survives under the real cap.
Anonymous-mode censored avatar now composites the Grin mark (the same path,
90% scale, and 67%-black ink a normal gradient avatar draws) over the flat
#FED60E tile instead of the Goblin head. The user's own top-right avatar on
the Home, Pay, and Activity surfaces always renders as that same flat yellow
+ Grin-mark tile (new avatar_self), never a picture or per-identity gradient;
Activity gains the settings avatar to match Home and Pay.
Export archive gains a caption describing exactly what it copies (contacts,
payment history, and requests, to the clipboard as JSON), localized across all
nine locales. The standalone Archive section is removed from the main settings
page; Export archive and Wipe payment history now live inside Advanced privacy.
Restore the Pay tab header top-left rendering to the original goblin
mark (goblin-logo2.svg tinted to the header ink at 40px), reverting the
GoblinPay badge/wordmark theme-split lockup introduced by f768907 (UI
pack 153, merged via build154). Matches the owner reference: the plain
black goblin girlhead silhouette on the yellow header, no badge, no
wordmark.
The two badge assets added by that commit are no longer referenced
anywhere after the revert, so remove them:
img/goblinpay-badge-black.svg
img/goblinpay-wordmark.svg
Scope is strictly the Pay header hunk; the Home wordmark sizing from the
same UI pack is untouched.
Full read-through of the just-landed es and ko locales against en.yml.
ko needed no changes. es had three spots that drifted from its own
established style:
- share_handle / n05_blurb translated "handle" as "identificador(es)"
while every other occurrence in the file (search_hint, no_contacts,
scan_not_recipient, enter_recipient) keeps it as the loanword
"handle" — switched these two to match, consistent with the
fr/de/tr precedent of treating "handle" as an untranslated loanword.
- scan_to_pay_me used the imperative "Escanea" while every sibling
label (scan_to_pay, scan_to_request, tab_scan, scan_qr) uses the
infinitive "Escanear" — aligned it to match.
Full translation of all 918 goblin.* leaf keys from en.yml, byte-matching
key order and %{...} placeholders, standard polite desu/masu register.
House terms follow the es/ko precedent: Goblin/GoblinPay/GRIM/Tor/Nostr/
slatepack/npub/nsec stay untranslated; wallet = ウォレット, recovery
phrase = リカバリーフレーズ, identity = アイデンティティ, relay = リレー,
handle stays as a katakana loanword (ハンドル) throughout.
Font: verified glyph-by-glyph against fonts/noto_sc_reg.otf (already
wired into every font family stack) that it covers every character used
in ja.yml, including hiragana/katakana and kokuji kanji not used in
Chinese, so no new Japanese font file is needed.
Keyboard block keeps literal QWERTY romaji like en/es/fr/de: the custom
on-screen keyboard widget is dead code in this fork (no_soft_keyboard is
always true; native OS keyboards handle all text entry), so there is no
functional need for a kana layout, per zh-CN precedent review.
Registers ja in tests/i18n_keys.rs OTHER_LOCALES and refreshes locale
count/list comments in src/lib.rs, src/gui/views/goblin/mod.rs and
src/gui/views/goblin/data.rs.
The session-open announce that tells the site a trust session exists was
confirmed on the wrong signal and never retried, so the live flow either
toasted announce_failed or returned to the browser without logging in.
Root causes:
- Confirm-on-any-relay: announce_new_sessions marked the grant confirmed
when ANY wallet relay accepted the session-open (out.success non-empty).
The site (magick) subscribes ONLY on its r= hint relay, so an accept on
another wallet default let the wallet "succeed" and return-to-caller
while the site never saw the session. Now confirm requires a relay the
site actually listens on (the hint) via announce_confirmed().
- Announced-set-unconditionally: s.announced was set true even when the
publish failed, and nothing re-armed sessions_dirty, so a failed announce
was never retried and announced_ok stayed empty forever. announced now
flips true only on a real hint-relay confirm; the loop re-arms and
re-publishes each tick until confirmed or ANNOUNCE_MAX_ATTEMPTS, tracked
by a new Session::announce_attempts counter.
- Relay dedup/normalization: channel_relays deduped hints by raw string, so
a trailing-slash or case difference (wss://host/ vs wss://host) forked a
phantom cold relay and broke confirm matching. canonical_relay() now folds
both the union (dedup_relay_union) and the confirm comparison.
- Deadline too short for a cold Tor circuit: TRUST_ANNOUNCE_TIMEOUT_SECS
raised 15s -> 30s to cover reaching a relay we were not already dialed to.
Tests: canonical_relay/dedup, hint-relay confirm semantics, retry cap.
cargo test --lib 246 passed (242 baseline + 4), i18n_keys green, fmt clean.
Owner correction: importing an existing identity belongs at first-run
(onboarding, restored in the previous commit), not in Settings. The
Settings > Identity "Import identity" row was the destructive
replace-the-current-identity action, redundant now that add-identity and
the identity switcher cover bringing in keys non-destructively. Removes
the settings row, the inline ImportState/import_nsec_ui flow, and the
five now-unused settings keys (import_identity, import_identity_title,
import_blurb, identity_replaced, now_using) across all eight locales.
Wallet::import_nostr_identity stays: the onboarding import panel calls
it. The shared settings.* strings the onboarding panel reuses
(importing, import_failed, import_nsec_hint, backup_read_failed,
choose_backup_file, backup_password_hint, import_btn, cancel, close)
also stay. Drift + call-site tests green.
Rotation just does Keys::generate (IdentitySource::Random) — the old
seed-derived path was dropped in Build 8 — so it is functionally a random
add-identity-and-switch, and it does NOT carry the username or profile
over (it RELEASES the old name and hands the new key a nameless identity).
It therefore adds nothing over the identity switcher, so remove it: the
Settings entry row, the inline rotate flow (RotateState + rotate_ui) and
the now-unreachable Wallet::rotate_nostr_identity. Shared helpers
(unlock_all_identities, create_random, nip05::unregister) are untouched.
Drops the fifteen unused goblin.settings.rotate_* / key_rotated /
new_npub / backup_new_key / copy_new_nsec / rotation_failed keys from all
eight locales; drift + call-site tests green.
Onboarding import replaces the just-created identity and is risky, so the
owner ruled it out of the first-run flow; returning users import via the
normal identity-management flow in Settings instead. Removes both entry
points added earlier (the wallet-step import chip and the identity-step
centered button) and the now-unreachable onboarding import sub-flow
(OnbImport state + import_ui), leaving the Settings import path fully
intact. Drops the unused goblin.onboarding.wallet.import_identity{,_hint}
and goblin.onboarding.identity.import_{existing,title,blurb} keys from all
eight locales; drift + call-site tests green.
Replace the long name-authority blurb on the Username page with one brief
line, plus a "Learn more" link that opens the name-authority docs chapter
(https://docs.goblin.st/features/name-authority.html) via the same
open_url idiom used elsewhere in Settings. Authority list, free-type and
save behaviour are unchanged. New goblin.username.learn_more key and the
shortened authority_blurb across all eight locales; drift + call-site
tests green.
While anonymous mode is on, replace every counterparty avatar on the
wallet home and activity panels with one uniform censored tile: a solid
Goblin-yellow (#FED60E) circle with the Goblin mark inked dark on top
(reusing the img/goblin-logo2 asset that widgets_logo draws). Identical
for every identity, so no picture, gradient, or initial leaks.
The Recent strip is now anonymized like the rest of the surface: the
censored tile for every avatar and dotted names. Tap-to-reveal is intact
(the row/tile still senses clicks and opens the full detail).
Shared CENSOR_NAME_DOTS backs the activity title and the Recent names.
Adds a unit test that the censored name is dots-only.
The release build type now applies signingConfigs.release when
android/keystore.properties exists, and stays on the debug-signed
fallback when it is absent, so existing local and CI builds are
unchanged. Also ignore *.jks so signing keys can never be committed.
Translates every en.yml key into es.yml and ko.yml (918 keys each,
placeholder-parity verified), wires both into the drift/call-site test
(tests/i18n_keys.rs), and bundles a Hangul font subset (noto_kr_reg.otf,
~1.9MB, Noto Sans CJK KR Regular subset to Hangul + Jamo + Latin/CJK
punctuation) as a proportional/monospace fallback so Korean UI text
actually renders instead of showing tofu boxes. The Chinese font already
covers Han but not Hangul, which is a disjoint Unicode block.
Language registration itself needed no code changes: rust_i18n::i18n!
auto-discovers yml files in locales/, the locale-detection fallback in
setup_i18n already matches on bare subtags generically, and the language
picker iterates rust_i18n::available_locales!() and renders each
locale's own lang_name key (Espanol, and Hangul for Korean).
Swap the two panels on the Username settings page so the flow reads
top-to-bottom: pick your name authority first (known list + custom
save, default goblin.st), then claim or release your name on it.
Pure reorder of username_ui; no behavior or copy changes.
Trusted Sites is nostr-identity signing, and name authority now lives on the
Username page, so the nostr cluster is its logical home. Pure placement move:
the row now renders inside the identity card just below Nostr Relays; label,
live session-count value, and open handler are unchanged.
Also carries the two raw-key leak fixes (goblin.receipt.copied ->
goblin.receive.copied, wallets.canceled -> wallets.tx_canceled) and the
every_t_call_site_key_exists_in_en guard, so this branch is clean on its own.
Translations for the new settings/username/advprivacy keys were reviewed
across all six locales and left as-is (consistent with house register).
The returning-user identity-import path (a .backup file or a bare nsec,
existing plumbing since Build 92) is now surfaced as proper centered
buttons instead of a small left-aligned text link.
- Wallet step: a first-class "Import identity" choice stands alongside
Create new / Restore from seed. It composes with either seed choice; the
import panel itself opens on the identity step once the wallet exists.
- Identity step: the left-aligned "Already have an identity? Import it"
link is replaced by a centered secondary button labelled "Import
identity", consistent with the other onboarding buttons. The panel behind
it clearly offers BOTH a .backup file picker and an nsec field.
New keys goblin.onboarding.wallet.import_identity{,_hint} in all six
locales; drift test green.
Follow-ups on the Settings redesign, all in the goblin view:
- Truncation sweep: settings_row_toggle now reserves room for the switch
and bounds the text column, so a long label/subtitle WRAPS to another
line instead of running under the switch and clipping. Fixes the
Advanced Privacy notification descriptions (worst in longer locales);
applies uniformly to every toggle row. The Username and Advanced Privacy
blurbs are full-width labels that already wrap. No description on the new
surfaces can truncate: wrapping is width-bounded, not length-tuned.
- Anonymous-mode censor is a FIXED count of dots (five), computed by a pure
censored_amount_dots() that ignores the real amount, so the balance
magnitude never leaks. Used for both the home balance hero and censored
activity amounts. Unit-tested to never vary with size.
- Settings navigation resets to the root whenever the user is off the
Settings (Me) tab, so leaving and re-entering always lands on the
top-level page instead of the last sub-page. One reset at the leave/enter
boundary via a pure settings_page_after(); deep links that open a
sub-page set the tab to Me in the same frame, so they survive. Unit-tested.
Two new Settings pages, each the single home for its feature.
Username (SettingsPage::Username) consolidates everything name-related
off the main Settings and out of the identity card: claim a name if you
have none, release the one you own, and choose the name authority from a
known list OR a free-typed custom server. Reuses the existing claim_ui and
claim/release worker flow; the old inline name-authority editor and the
main-settings claim card are removed (single home).
Advanced Privacy (SettingsPage::AdvancedPrivacy) replaces the lone
"hide amounts" toggle. Notifications section: hide amounts (existing),
hide names, or hide all details (a generic localized private alert that
leaks no name or amount; an empty amount collapses the Android
notification template to just the private line). Anonymous mode: one
toggle that censors STRICTLY the home balance (dots, tap to reveal; the
fiat rate fetch stays off until revealed) and the activity list (dots for
names and amounts, tap a row to reveal and open). Presentation only, with
no money-path or storage change.
Migration: the existing hide_amounts config keeps its exact meaning
(notification amount hiding); the three new fields default off, so no
surprise on upgrade. Covered by a new config test (227 lib tests).
All new strings via t!() in all six locales; drift test green.
Root cause of the broken build 153 QR trust login, confirmed in code:
cb.return_to_caller() fired in the sign handler right after spawning the
callback POST worker. The app backgrounded immediately, the GUI frame pump
stopped, and the rest of the grant lives on that pump: the outcome poll that
consumes the POST result, the session creation, and the session-open channel
publish (which the service loop only sends on its next tick, after
add_session marks the set dirty). Backgrounded, none of that ran, so the
site never received the session and the browser poll never logged in.
The ordering fix, uniform across login, authorize, and trust:
- the sign handlers no longer return-to-caller; the app stays foreground
(frames pumping) until the flow is fully complete
- login/authorize: the return decision happens in the outcome poll, only on
a successful POST; a failed POST keeps the user in the wallet with the
honest toast
- trust: the decision waits further, for the session-open announce to be
CONFIRMED handed to a relay. announce_new_sessions now records per-channel
delivery (at least one relay accepted) in NostrService::session_announced;
the new TrustWait GUI state polls it with a 15s deadline and an honest
"announce unconfirmed" toast on timeout (goblin.trust.announce_failed x6)
- a freshness bound on all three: a result consumed on a late resume (the
user backgrounded the wallet themselves mid-flow) shows the toast but
never bounces them back out
- the decision itself is the pure authuri::should_return_to_caller(allowed,
post_ok, publish_confirmed), unit-tested: pending, failed, or unconfirmed
work never returns; rt=0 never returns
Trust prompt copy, owner directive: the gist in one or two lines, detail
tucked away. The modal now leads with a single plain line (act-for-you plus
the money rule) and folds categories, money line, and duration behind the
existing show-full disclosure idiom; the red caution lines stay visible.
goblin.trust.* keys tightened in all six locales, drift test green.
The Build 151 return-to-caller is right for same-device deep-links but wrong
for a QR scanned from another screen: there is no caller, so the wallet bounced
the user into whatever app was previous. The login/authorize/trust URIs now
carry an optional rt flag: rt=0 disables the return (QR case), rt=1 or an absent
flag keeps the return (backward compatible). Parsing is byte-exact and fails
closed to the return-enabled default on empty, garbage, or duplicate values
(first occurrence wins, like every other param). Security is unchanged: the flag
is a single boolean gate on the existing best-effort app-switch and derives no
target, so it can never introduce a redirect the URI could not already perform;
cb-host==domain binding and every other check are untouched.
- shared parse_return_flag helper in authuri, reused by login and trust
- return_to_caller field on LoginUri, AuthorizeUri, TrustUri (default true)
- all three GUI flows (login, authorize, trust) honour the flag uniformly
- parser unit tests: absent/explicit/garbage/duplicate + the no-return decision
FR wallets.tx_stale was 'En attente trop longtemps' (noun + adverb, not
grammatical); now 'En attente trop longue', adjective agreeing with attente.
Other five locales for tx_stale / receipt.stale_note read natural, left as-is.
Also carries the two raw-key leak fixes (goblin.receipt.copied ->
goblin.receive.copied, wallets.canceled -> wallets.tx_canceled) and the
every_t_call_site_key_exists_in_en guard so this branch is clean standalone.
Some pending transactions showed no way to cancel or clear them, stranding
users with stuck pendings (fee-bug leftovers, and payments orphaned after an
identity switch whose nostr meta lives in another identity's store).
Root causes:
- Goblin receipt: both cancel affordances required the payment's nostr tx_meta,
which is per-identity. A tx orphaned by an identity switch (or left by an old
build) has no meta in the active store, so neither Cancel button rendered.
- GRIM tx list + tx detail: the Cancel button was gated behind
wallet.synced_from_node(), so an unreachable/unsynced node hid it entirely.
Fixes (cancellation is unchanged: the plain libwallet cancel_tx that unlocks the
reserved inputs, GRIM parity, no new money behavior):
- Receipt: universal fallback Cancel for any still-cancellable pending the
nostr-aware paths miss, running WalletTask::Cancel. ReceiptDetail carries
can_cancel/stale.
- GRIM list/detail: ungate the local Cancel from node sync (only repost/repeat
still needs a live height).
- Soft "stale" nudge on pendings older than 24h (WalletTx::stale/STALE_AGE_SECS)
with the Cancel right there. It only colours a label; nothing auto-cancels on
a timer (a slow interactive send may still complete).
- New tx_stale / receipt.stale_note strings across all six locales.
- Unit tests for can_cancel state coverage and the stale threshold.
1. Lock Android to portrait (screenOrientation="portrait" on MainActivity).
Phone-first GRIM-style wallet; no cheap phone/tablet split so the whole
Android app is locked, matching the single phone surface.
2. Enlarge the mobile Home header wordmark: mark 24 to 36 (+50%), "goblin"
text 18 to 26, gap 8 to 9, so the top-left lockup carries the same
visual weight as the 40 to 44px right cluster (owner asked for a
noticeably bigger bump than the first +25% pass).
3. Swap the Pay-screen inline mark for the official GoblinPay lockup: the
black Apple-Pay-style badge on light surfaces, the white wordmark on
dark (theme dark_base split). New img assets from the GoblinPay repo.
4. Plain GoblinPay/receive QR: drop the yellow center-mark overlay from
w::qr_code (mirrors the prior "plain QR default" decision). Test
goblin_receive_qr_decodes updated to the plain render.
After approve + hold-to-accept, the pending request card no longer keeps
the Decline button and amount alongside a half-width spinner. While the
payment is in flight the whole card is replaced by one centered spinner
labelled with the action, sitting exactly where the card was, and it
vanishes once the send completes and the request clears.
P2-1: a money-tier request id is reserved the moment its prompt is raised
(money_pending_ids); a replayed envelope (drain overlapping the live
subscription, or deliberate) returns AlreadyPending / the cached result and
can never raise a second prompt or re-sign. Applies to sign and escalated
encrypt. Regression test covers both replay-while-pending and replay-after-
completion.
P2-3: the money modal for a pay-committing encrypt now shows the inspected
plaintext (escaped + truncated exactly like the sign path), so the user sees
what they are agreeing to pay, not a blind label.
Hardening:
- payment marker set widened (amount, total, price, msat), TODO(audit) kept.
- identity dropped mid-session now answers identity_mismatch on the channel
(refusal_json per op type) instead of silently timing out the site.
- session-end payload carries reason: revoked (wallet end) / expired (TTL or
idle sweep, newly published by the tick) / logout (site's own).
- decrypt gets its own soft-cap window (30/min) and an honest 'reading your
messages' notice, distinct from the signing-volume toast (new locale key
in all six languages).
- money answers route by the session's site channel key, never the display
domain.
- committed the auditor's env-gated NIP-44 v2 interop test against
nostr-tools (GOBLIN_CT1 harness).
- The session channel now subscribes and publishes on the wallet's relays
UNION each session's relay hint (channel_relays), dialing any hinted relay
via the idempotent connect_relays, so wallet and site meet even without a
shared default relay.
- Clean up clippy findings in the new code (abs_diff, collapsible ifs via
let-chains, char-array find).
- Trust-grant modal: password-gated hold-to-confirm 'Trust <domain>?' showing
identity + truncated npub, the granted low-tier categories (human labels,
caution lines for unknown/login-excluded kinds), and the fixed money-asks
line. Folds login in; creates the session on login-POST success.
- Money-tier per-action modal: the v1-authorize-shaped password + hold-to-confirm
prompt raised over the channel for a sign or a pay-committing encrypt; declines
on cancel/timeout.
- Trusted Sites settings page: active sessions, what each signs silently, time
left, pause/resume, and one-tap end (revocation). Row + count in Settings.
- Dispatch + per-frame router for trust/money; PENDING_TRUST wired.
- goblin.trust.*, goblin.money.*, goblin.trusted_sites.*, settings.trusted_sites
in all six locales; drift test green.
- Add channel encrypt/decrypt ops (identity-key NIP-44) for magick's order-DM
seal path: EncryptRequest/DecryptRequest, serve_encrypt/serve_decrypt,
ChannelOp, generalized complete_money. Both low tier + rate-limited; an
encrypt whose plaintext commits payment escalates to the money prompt;
decrypt (the DM-read risk) is rate-limited and flagged for the security pass.
- session-open payload aligned to {type,id,identity_pubkey}; sent alongside
the unchanged 22242 server callback.
- Error codes aligned to the shared set (Refused -> kind_not_in_session).
- Owner ruling: kind 30402 (listing) is money tier, stripped from the silent
set like 17/22242; spec tier table + category map + tests updated.
- session.rs: channel-event builders (session-open / session-end / wrapped
sign_result), decrypt, SessionSummary + PendingMoney, and the serve/
complete_money runtime orchestration (with unit tests).
- client.rs: in-memory session store on NostrService (add/end/resume,
summaries, money-prompt queue + answers, high-volume notice); channel
subscription over the sessions' wallet channel keys, handle_channel event
serving, session-open announce, drain-on-resume via the frame heartbeat,
and money-answer draining wired into the service loop.
- lib.rs: PENDING_TRUST crate-root stash (set/take).
- dispatch: goblin:trust routed after authorize, before pay, in both the
deep-link and camera-scan dispatchers.
Adds the testable protocol core for the two-tier session signer:
- trusturi.rs: goblin:trust URI parser, fail-closed like login/authorize,
with sk (site channel key), r (relay hint), k (kind set) fields.
- session.rs: wallet-owned tier classifier (kind table + content
escalation for flagged conversation kinds), kind-set sanitation, the
kind-to-category display mapping, NIP-44 channel envelope shapes,
client-pinned created_at signer with skew guard, and per-session
enforcement (identity binding, replay dedup, size caps, rate limiting,
TTL/idle lifetime).
30 new unit tests; full lib suite green.
The live Goblin send UI guarded only on amount > spendable, so a send of
the whole balance was offered as valid with no room for the network fee.
The wallet then built a slate needing amount + fee but holding only amount,
so the send failed with NotEnoughFunds or sat unconfirmed.
GRIM's send modal reserves the fee: it refuses amount + fee > max and caps
its max at spendable - fee. Mirror that here. Both the amount screen and the
review page now price the exact amount (one CalculateFee per amount, as GRIM
does) and refuse the send unless amount + fee fits the spendable balance;
hold-to-send stays disabled until the fee is priced, so a full-balance
payment is never dispatched with no room for its fee.
Adds amount_fits / max_sendable helpers with unit tests covering the
send-max boundary.
Comments only, no behavior change: tag the five deferred audit findings at the
code they refer to so they are findable later. M5 (widen display escaping to
category-based) and M6 (template echo vs re-serialization) in authuri; L2
(redact secrets from Debug) at NostrIdentity; L3 (carry secrets as ZeroingString
end-to-end) at get_nostr_nsec; L4 (reset AdvancedState on back) in the goblin
on_back handler.
Copying a revealed nsec (or a post-rotation new key) left the secret sitting in
the clipboard indefinitely. Add copy_secret_to_buffer: it copies now and, after
a short delay, clears the clipboard only if it still holds exactly that secret
(compare-then-clear), so whatever the user copied since is never clobbered. Both
nsec copy sites now use it. Desktop clears through the long-lived clipboard owner
on a background thread; Android does the same over its JNI clipboard via the
established non-GUI app-handle pattern; other platforms fall back to a plain copy.
reencrypt_all was best-effort per file: a partial failure left some identities
on the old password and some on the new, a split the user cannot open with one
password. Make it all-or-nothing: stage every re-encryption to a sibling temp
file and only commit (rename into place) once every identity re-encrypts
cleanly; any phase-1 failure deletes the temps and leaves every identity on the
old password.
Surface the failure: change_password now returns a hard error when the
re-encryption fails instead of logging and reporting success.
Keep the running NostrService in sync after a successful change by refreshing
its in-memory identity blobs to the new password, so same-session gated ops
(which re-unlock with the new password) work without a wallet reopen. The
decrypted keys are unchanged by a password change, so listening and sending are
untouched. Adds an all-or-nothing test.
The login URI parser checked the callback scheme but not that its host belongs
to the displayed domain, so a site could show d=magick.market while pointing cb
at its own host and harvest a signed login event for a domain it does not
control. Apply the same domain binding the authorize URI already enforces:
share authuri's domain_bound as pub(crate) and reject a login URI whose callback
host is neither the domain nor a label-boundary subdomain of it. The
http://localhost dev callback stays exempt. Adds binding tests.
2ro