99 Commits

Author SHA1 Message Date
dependabot[bot] 137fcf176b Bump tar from 0.4.45 to 0.4.46 in /src-tauri (#4)
Bumps [tar](https://github.com/composefs/tar-rs) from 0.4.45 to 0.4.46.
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-31 12:26:10 +02:00
Jure d80233e4d9 Bump to v0.13.1 — article reader scroll lock fix + click-to-zoom 2026-05-24 20:15:10 +02:00
Jure 2dfe0e86c1 Bump to v0.13.0 — visual overhaul: themes, readability, accessibility 2026-05-21 21:26:43 +02:00
Jure 62667bc8ef Bump to v0.12.17 — infinite scroll & virtualized feed 2026-05-17 21:10:29 +02:00
Jure db81de9007 Bump to v0.12.16 — security hardening: http(s) scheme guard on link sinks, loop-stable HTML tag strip 2026-05-16 13:59:10 +02:00
Jure 61c6703513 Bump to v0.12.15 — install-aware update banner (Arch/deb/rpm get manual update guidance) 2026-05-16 13:43:38 +02:00
Jure 3757368990 Bump to v0.12.14 — fix macOS auto-updater (add app bundle target) 2026-05-16 13:26:57 +02:00
Jure 0d4153e6de Bump to v0.12.13 — union legacy + cloud on first podcast hydrate 2026-05-15 20:50:47 +02:00
Jure 1cbd13031d Bump to v0.12.12 — podcast subscriptions sync via Nostr (kind 30003) 2026-05-15 20:35:36 +02:00
Jure 7e998be45b Bump to v0.12.11 — read-only mode write-action guards
The app now behaves coherently for users without a signer (fully logged
out, or signed in with an npub). No broken Publish buttons, no dead-end
"Not logged in" toasts.

- Add useCanSign() hook in src/stores/user.ts as the single source of
  truth for write-capability. Captures both "no pubkey" and
  "npub-only login" states.
- ReadOnlyBanner now fires for both states (was only "no pubkey" before).
- Hide account-bound sidebar entries (Bookmarks, Messages, Notifications,
  Zaps, V4V) in read-only mode. Read-only-OK views (Feed, Articles, Media,
  Podcasts, Search, Follows, Relays, Settings, Support) stay visible.
- Guard every write surface, two patterns:
  - Hide inline UI: ComposeBox, InlineReplyBox, NoteActions row, NoteCard
    context menu, ArticleFeed "Write article", FollowsView per-row
    follow/unfollow, ThreadView root reply, PollWidget vote controls,
    RelaysView "Publish list", PodcastPlayerBar ShareButton.
  - "Sign in to X" CTA: ArticleEditor publish, QuoteModal post, ZapModal,
    EditProfileForm save. CTAs open LoginModal.
- ProfileView edit/follow/mute/zap/DM buttons each gated by canSign.
- ArticleView like/repost/comment/bookmark/zap each gated by canSign.
- Belt-and-suspenders runtime guards in user store follow/unfollow.

Bookmark / mute stores already swallow publish errors via .catch(() => {}),
so they don't need explicit runtime guards.
2026-05-11 22:08:06 +02:00
Jure 9fc585a395 Bump to v0.12.10 — security: Tauri, rustls-webpki, rand, dompurify, postcss
Clears all Dependabot alerts except glib (pinned upstream by Tauri's gtk-rs
stack via wry — waits for upstream).

- Tauri 2.10.3 → 2.11.1 (Origin Confusion IPC fix, + wry/tao/tray-icon bumps)
- rustls-webpki 0.103.10 → 0.103.13 (high-severity DoS panic on malformed CRL)
- rand 0.8.5 → 0.8.6, rand 0.9.2 → 0.9.4 (soundness with custom loggers)
- dompurify 3.3.2 → 3.4.2 (four sanitization bypasses)
- postcss 8.5.8 → 8.5.14 (XSS via unescaped </style>)

No functional changes. Smoke tested on Linux: build clean, app starts, feed
renders, podcast playback works, login flow works.
2026-05-11 15:20:01 +02:00
Jure 58f3b4d7cb Bump to v0.12.9 — Web of Trust everywhere
Extends the WoT filter beyond the global feed: reaction pills, zap
totals, and all feed tabs (global, following, trending) now respect
the trust graph. Also drops the "new account" badge, since the
kind-0 created_at proxy was unreliable.

Softens the v0.12.8 forward-reference to Blossom — it will reappear
in a future release, not specifically this one, since it still needs
a safe-probe or allowlist (see WEBKIT_OOM_INVESTIGATION).
2026-04-23 19:34:16 +02:00
Jure bc4c72d6a0 Fix Linux OOM: disable Blossom SHA-256 URL auto-detection
Commit 214c42b (v0.12.6) added auto-detection of content-addressed
Blossom URLs (64-hex SHA-256 paths) as <img> elements. Blossom is
widespread in modern Nostr feeds — every feed page started rendering
3-5x more <img> elements. Combined with WebKitGTK's weak decoded-
bitmap eviction, feed scrolling grew the WebKit web process to
8-12 GB and triggered WebKit's self-kill threshold with:

  Unable to shrink memory footprint of process (9022 MB) below
  the kill threshold (8192 MB). Killed

Disable BLOSSOM_URL_REGEX in parseContent(). Real Blossom images
shared via standard upload flows (with proper extensions) still
render. Proper reintroduction (HEAD request + Content-Type
validation, or known-server whitelist) planned for v0.12.9.

Also restore feed depth caps to pre-crisis values now that memory
is under control:
  - MAX_FEED_SIZE 30 → 200 (v0.12.6 baseline)
  - fetchFollowFeed limit 30 → 100
  - fetchGlobalFeed fetch 80 → 100
  - Following tab slice 30 → 100

The earlier 30-caps were themselves OOM firefighting that shipped
in v0.12.7 and were no longer needed.

Memory verified 2026-04-16: oscillates 1.1-1.6 GB across all tabs
(Global / Following / Trending / Media / profile / thread) under
heavy use with embedded relay enabled. No crashes. Elastic cache
behaviour rather than monotonic leak — memory spikes briefly on
content loads and reclaims within seconds.

See private_docs/WEBKIT_OOM_INVESTIGATION.md for the full
investigation (4 days of chasing symptoms before finding the
one-line regex as the real cause).
2026-04-16 21:31:04 +02:00
Jure 8b5fdc0720 Bump to v0.12.8 — fix Linux OOM crash 2026-04-16 11:44:19 +02:00
Jure 5fe3554579 Fix feed OOM: cap follow feed at 30, WebKit software rendering, dedup notification fetches
- followNotes capped at 30 (was 80) — following feed was rendering 2.7x more
  notes than global, causing 4GB+ spike on media-heavy follow content
- fetchFollowFeed limit 80→30 to match
- WEBKIT_FORCE_SOFTWARE_RENDERING=1 replaces WEBKIT_DISABLE_COMPOSITING_MODE=1
  (compositing mode killed Wayland path → blank window on Hyprland)
- HardwareAccelerationPolicy::Never → OnDemand (Never also caused blank screen)
- set_enable_page_cache(false) — SPA never navigates, bfcache is pure waste
- Removed duplicate fetchNotifications calls on login (was firing 3x in 8s)
- First notification poll delayed 8s→90s to avoid competing with feed load
- Result: login 3600MB→453MB, following feed crash→737MB, plateau at ~950MB
2026-04-16 11:43:48 +02:00
Jure 0894389fe0 Fix feed OOM: lazy image loading, inView gating, WebKit memory tuning
- NoteContent: remove ImageGrid from inline mode — images now only load
  when note is inView (via mediaOnly), stopping runaway scrolling leak
- NoteCard: content-visibility:auto to skip layout/paint for off-screen
  cards; inView-gated media, NoteActions, NIP-05 verification
- useInView: new IntersectionObserver hook with 300px rootMargin
- useProfile: MAX_PROFILE_CONCURRENT=8 throttle with fetch queue
- useReplyCount/useZapCount/useReactions: enabled param, throttled queues
- feed.ts: MAX_FEED_SIZE 200→30, live sub disabled (pendingNotes pattern),
  250ms batch debounce on live events
- core.ts: MAX_CONCURRENT_FETCHES=25 global NDK cap, fetchWithTimeout
  uses subscribe+stop instead of fetchEvents (no zombie subscriptions)
- lib.rs: HardwareAccelerationPolicy::Never + CacheModel::DocumentViewer
- main.rs: WEBKIT_DISABLE_COMPOSITING_MODE=1 for Linux
- relay/db.rs: TTL eviction + 5000 event cap
- feedDiagnostics.ts: file-flushing diag log survives crashes
2026-04-15 20:36:14 +02:00
Jure f3b92004f0 Bump to v0.12.7 — fix NIP-96 upload endpoints, block SVG uploads 2026-04-13 14:43:03 +02:00
Jure c6ccb0989c Remove unused delete_event function; bump Vite + picomatch (audit fix) 2026-04-12 18:56:02 +02:00
Jure 35da2a9111 Sync Cargo.lock to v0.12.6 2026-04-11 22:23:53 +02:00
Jure 37e87825d4 Bump to v0.12.6 — DM polish, multi-image upload fix, Blossom image rendering 2026-04-10 20:10:20 +02:00
Jure 2b2a5929f7 Bump to v0.12.5 — UI polish, V4V fix, production-silent logging 2026-04-09 19:57:57 +02:00
Jure acd5a5979b Bump to v0.12.4 — polls, custom relay, UI polish
NIP-1068 polls: create and vote on polls inline in the feed.
Switch default relay to custom Go relay (relay2.veganostr.com).
Note action icons with tooltips, sidebar icon cleanup,
search dedup fix, thread indentation fix.
2026-04-06 18:15:48 +02:00
Jure 86b7705c07 Fix thread indentation compounding on narrow screens
Replace absolute marginLeft with relative Tailwind ml-4, cap indent
depth at 3. Deep replies get border-line only, no further indent.
2026-04-06 15:21:37 +02:00
Jure 262b2d36d5 Bump to v0.12.3 — fix direct messages
NIP-17 gift-wrapped DMs were silently dropped by NDK's fetchEvents.
Switched to subscribe-based fetch that correctly receives kind 1059.
2026-04-06 12:49:40 +02:00
Jure 5e5b3a5d48 Fix CI: sync Tauri plugin versions (fs 2.5.0, dialog 2.7.0) 2026-04-05 14:00:12 +02:00
Jure 2083e08baa Bump to v0.12.2 — Vega public relay as default 2026-04-05 13:45:57 +02:00
Jure 5d78aac091 Bump to v0.12.1 — Media feed, Trending retry, read-only banner 2026-04-04 21:09:41 +02:00
Jure 63f2803953 Bump to v0.12.0 — Podcasts & Value 4 Value 2026-04-04 20:27:48 +02:00
Jure 5444214041 Fix podcast player stability, V4V payments, and Lightning address
- Add audio.load() reset to prevent cascading failures between episodes
- Add onPlaying event handler for reliable post-buffer playback in WebKitGTK
- Add 15s loading timeout with user-friendly error for broken audio URLs
- Fix V4V LNURL-pay: use Tauri HTTP plugin instead of CORS-blocked browser fetch
- Fix Podcast Index API: use Tauri HTTP plugin for V4V enrichment
- Fall back to Podcast Index enclosure URL when Fountain.fm CDN is broken
- Update Lightning address to jure@getalby.com (Alby cloud migration)
- Add broad HTTPS scope for LNURL-pay across Lightning providers
2026-04-03 22:27:34 +02:00
Jure aa57ff4cd8 Fix Fountain.fm episode cards: use Tauri HTTP plugin for CORS bypass
- Import fetch from @tauri-apps/plugin-http (browser fetch was CORS-blocked)
- Add fountain.fm to Tauri HTTP capability scope
- Extract og:audio meta tag for reliable audio URL resolution
- Parse OG title into show name + episode title
2026-04-03 15:01:06 +02:00
Jure 9477b6d68e Bump to v0.11.0 — embedded relay, naddr links, new themes 2026-04-02 15:28:35 +02:00
Jure e3f5020eeb Add embedded Nostr relay with catch-up sync on startup
Embedded relay (strfry-lite in Rust) stores events locally in SQLite.
On startup, syncs user notes, follow feed (24h), mentions (7d), and
profile/contacts from remote relays into the local relay. Uses since
timestamp for incremental syncs. Toggle in Settings with event count
and DB size display. Add webkit2gtk GPU acceleration workaround and
connectToRelays safety timeout for NDK hang.
2026-04-01 12:10:11 +02:00
Jure 82d6d32360 Update README and roadmap: rename notice, group chat + communities on roadmap 2026-03-31 15:30:37 +02:00
Jure f2d51fba31 Bump to v0.10.1 — search resilience, nostr: URI prefix support 2026-03-31 06:35:25 +02:00
Jure 6a7a0bccf3 Bump to v0.10.0 — paste nevent/naddr in search, copy npub from profiles 2026-03-30 21:48:30 +02:00
Jure 5cbaa7b741 Rename Wrystr to Vega
Named after Jurij Vega (1754-1802), Slovenian mathematician who made
knowledge accessible through his logarithm tables. Rebrand before
OpenSats application (April 1).

- Product name, window title, identifiers, binary name all renamed
- Cargo package: wrystr -> vega, wrystr_lib -> vega_lib
- PKGBUILD: wrystr -> vega (new AUR package name)
- Release workflow: artifact names, release text updated
- README: new tagline referencing Jurij Vega
- DB migration: auto-renames wrystr.db -> vega.db on first launch
- Keyring service name kept as "wrystr" for backward compatibility
- localStorage keys kept as wrystr_* to preserve existing user data

Pending manual steps:
- Rename GitHub repo hoornet/wrystr -> hoornet/vega
- Create new AUR package vega-git, orphan wrystr-git
- Update local .desktop launcher
2026-03-30 21:14:02 +02:00
Jure 1d86023779 Bump to v0.9.11 — notification cleanup, bookmark fixes
Follower notifications moved to Follows-only, deduped by pubkey.
Article bookmarks now appear under Articles tab. Updated docs.
2026-03-30 08:32:28 +02:00
Jure 56584d9b08 Bump to v0.9.10 — instant everything via SQLite caching
Followers, bookmarks, articles feed, and own profile all load
instantly from SQLite cache. Relay data merges in background.
2026-03-29 20:49:54 +02:00
Jure 5d94220e5d SQLite-backed caching for bookmarks and articles feed
Bookmarks load instantly from DB cache, then fetch missing notes
from relays in background. Articles feed shows cached kind-30023
events immediately on the latest tab. Both persist to SQLite for
instant load on next visit.
2026-03-29 20:46:18 +02:00
Jure d450f8fdeb SQLite-backed followers cache and instant own-profile load
Followers now load instantly from SQLite on startup, then merge
relay results in background. Own profile name/picture loads from
DB cache so sidebar badge never shows raw npub on slow relays.
2026-03-29 20:28:25 +02:00
Jure e86561379b Bump to v0.9.9 — instant threads, Linux upload fix, trending fix 2026-03-29 18:38:02 +02:00
Jure 8e685f2d4b Fix image upload on Linux/Wayland (WebKitGTK)
WebKitGTK can't serialize FormData with Blob objects through Tauri's
HTTP plugin, throwing "InvalidStateError: Unable to read form data
blob". Build the multipart/form-data body manually as raw bytes
instead. Also add void.cat and nostrimg.com to the HTTP scope.
2026-03-29 17:38:03 +02:00
Jure c5ddd88cbd Bump to v0.9.8 — Web of Trust, instant notifications, profile retry 2026-03-29 16:28:33 +02:00
Jure 4cc844df28 SQLite-backed notifications, WoT profile fix, reaction queue fix
Notifications now load instantly from SQLite on startup instead of
waiting for relay responses. New events merge in as they arrive.
Read state persists in DB across restarts.

Also: filter profile owner from WoT followers list, make "+N more"
clickable to expand, fix reaction throttle queue jamming on errors.
2026-03-29 16:12:36 +02:00
Jure 2c17361e50 Add Web of Trust reputation on profiles via Vertex DVM
Query Vertex Verify Reputation API (kind 5312) for each profile and
display "Followed by people you trust" with clickable top-follower
avatars. Includes in-memory cache, request dedup, and graceful
fallback when logged out or API unreachable.
2026-03-29 10:42:19 +02:00
Jure 8bc38c11e6 Bump to v0.9.7 — emoji reactions, npub search, notification fix 2026-03-27 18:25:57 +01:00
Jure bb084182d7 Bump to v0.9.6 — content-only zoom, font size fix 2026-03-25 16:35:22 +01:00
Jure 0ee9476825 Bump to v0.9.5 — large font overflow fix for Windows 2026-03-25 15:35:12 +01:00
Jure f460a53875 Bump to v0.9.4 — search, follows, editor, polish
Search overhaul with dedicated NIP-50 relays, follows view, article
editor image previews, auto-expanding textareas, profile layout fix,
thread stability fix.
2026-03-25 12:03:05 +01:00
Jure ad028c7406 Bump to v0.9.3 — color themes, font size, settings polish
7 color themes (Midnight, Light, Catppuccin Mocha, Tokyo Night, Gruvbox,
Ethereal, Hackerman), font size presets (Small/Normal/Large/Extra Large),
collapsible muted accounts list, removed old sidebar connection indicator.
2026-03-24 12:16:08 +01:00