Commit Graph

275 Commits

Author SHA1 Message Date
Jure 62667bc8ef Bump to v0.12.17 — infinite scroll & virtualized feed v0.12.17 2026-05-17 21:10:29 +02:00
Jure 7678ad2f1f Feed virtualization Stage 2: infinite scroll
Adds older-notes pagination to the Global feed. fetchGlobalFeed gains an
optional until param (fetch events before a timestamp, no since bound).
The feed store's new loadOlderNotes action fetches 50 older notes when
triggered, dedups, merges, re-sorts. MAX_FEED_SIZE raised 200 to 1000 —
virtualization bounds the DOM-node/bitmap count, so this just caps the JS
notes array as hygiene.

Feed.tsx auto-triggers loadOlderNotes when the user scrolls within ~8 rows
of the bottom; a 'Loading older notes' row shows during the fetch. Global
tab only (Following uses a separate path, Trending is a ranked snapshot).

Pending: sandboxed memory verification.
2026-05-17 20:26:15 +02:00
Jure 73c1bd1ac9 Virtualize feed list with @tanstack/react-virtual
Stage 1 of the feed virtualization work. The feed now renders only the
visible window of note cards (~25-35 in the DOM) instead of all up to 200,
via @tanstack/react-virtual (pinned 3.13.24). This structurally caps the
WebKit decoded-bitmap accumulation that caused the v0.12.6-era OOM.

Error and 'new notes' banners moved above the scroll container so the
virtualizer's coordinate space always starts at scrollTop 0. Upward-scroll
flicker fixed with a scroll-direction-aware measureElement that reuses the
cached row height on backward scroll (TanStack/virtual#659).

Feed still capped at MAX_FEED_SIZE; infinite scroll is Stage 2.
2026-05-16 19:02:18 +02:00
Jure db81de9007 Bump to v0.12.16 — security hardening: http(s) scheme guard on link sinks, loop-stable HTML tag strip v0.12.16 2026-05-16 13:59:10 +02:00
Jure 61c6703513 Bump to v0.12.15 — install-aware update banner (Arch/deb/rpm get manual update guidance) v0.12.15 2026-05-16 13:43:38 +02:00
Jure 3757368990 Bump to v0.12.14 — fix macOS auto-updater (add app bundle target) v0.12.14 2026-05-16 13:26:57 +02:00
Jure 0d4153e6de Bump to v0.12.13 — union legacy + cloud on first podcast hydrate v0.12.13 2026-05-15 20:50:47 +02:00
Jure 1cbd13031d Bump to v0.12.12 — podcast subscriptions sync via Nostr (kind 30003) v0.12.12 2026-05-15 20:35:36 +02:00
Jure 7e998be45b Bump to v0.12.11 — read-only mode write-action guards
The app now behaves coherently for users without a signer (fully logged
out, or signed in with an npub). No broken Publish buttons, no dead-end
"Not logged in" toasts.

- Add useCanSign() hook in src/stores/user.ts as the single source of
  truth for write-capability. Captures both "no pubkey" and
  "npub-only login" states.
- ReadOnlyBanner now fires for both states (was only "no pubkey" before).
- Hide account-bound sidebar entries (Bookmarks, Messages, Notifications,
  Zaps, V4V) in read-only mode. Read-only-OK views (Feed, Articles, Media,
  Podcasts, Search, Follows, Relays, Settings, Support) stay visible.
- Guard every write surface, two patterns:
  - Hide inline UI: ComposeBox, InlineReplyBox, NoteActions row, NoteCard
    context menu, ArticleFeed "Write article", FollowsView per-row
    follow/unfollow, ThreadView root reply, PollWidget vote controls,
    RelaysView "Publish list", PodcastPlayerBar ShareButton.
  - "Sign in to X" CTA: ArticleEditor publish, QuoteModal post, ZapModal,
    EditProfileForm save. CTAs open LoginModal.
- ProfileView edit/follow/mute/zap/DM buttons each gated by canSign.
- ArticleView like/repost/comment/bookmark/zap each gated by canSign.
- Belt-and-suspenders runtime guards in user store follow/unfollow.

Bookmark / mute stores already swallow publish errors via .catch(() => {}),
so they don't need explicit runtime guards.
v0.12.11
2026-05-11 22:08:06 +02:00
Jure 88c42fcb57 Bump @tauri-apps/api to ^2.11.0 to match Rust tauri 2.11.1
CI tauri-action enforces matching major/minor between the @tauri-apps/api
JS package and the Rust tauri crate. v0.12.10's first build failed because
the JS side was still at 2.10.1 after only the Rust crate was bumped.
v0.12.10
2026-05-11 16:30:45 +02:00
Jure 9fc585a395 Bump to v0.12.10 — security: Tauri, rustls-webpki, rand, dompurify, postcss
Clears all Dependabot alerts except glib (pinned upstream by Tauri's gtk-rs
stack via wry — waits for upstream).

- Tauri 2.10.3 → 2.11.1 (Origin Confusion IPC fix, + wry/tao/tray-icon bumps)
- rustls-webpki 0.103.10 → 0.103.13 (high-severity DoS panic on malformed CRL)
- rand 0.8.5 → 0.8.6, rand 0.9.2 → 0.9.4 (soundness with custom loggers)
- dompurify 3.3.2 → 3.4.2 (four sanitization bypasses)
- postcss 8.5.8 → 8.5.14 (XSS via unescaped </style>)

No functional changes. Smoke tested on Linux: build clean, app starts, feed
renders, podcast playback works, login flow works.
2026-05-11 15:20:01 +02:00
Jure 7f3dafa97a README: link to veganostr.com, refresh signature notes
- Website was never linked from the README. Add a header link line
  (Website / Download / AUR) directly under the tagline and a second
  pointer in the Download section.
- Verify example used vega_0.12.1_amd64.AppImage.tar.gz — AppImage was
  dropped in v0.1.6. Swap in a current .deb example.
- Sig note was stale: .deb and .rpm actually ship with minisign
  signatures now (tauri-action unified installer and updater artifacts).
  Only .dmg is unsigned.
2026-04-23 19:51:11 +02:00
Jure 992b7f97b1 README: add Web of Trust feature, refresh Up Next, add NIP-32 row
- Web of Trust wasn't mentioned in the features list despite shipping
  in v0.11.0 and being extended to reactions/zaps/all tabs in v0.12.9.
  Added under Feed & content next to keyword muting.
- Drop "custom Go relay" from Up Next — Vega Relay is live and is
  Vega's default relay. Swap in real remaining work (NIP-96, WoT-
  powered feed ranking).
- Add NIP-32 row — partial support via the language filter's script
  tags.
2026-04-23 19:48:38 +02:00
Jure 58f3b4d7cb Bump to v0.12.9 — Web of Trust everywhere
Extends the WoT filter beyond the global feed: reaction pills, zap
totals, and all feed tabs (global, following, trending) now respect
the trust graph. Also drops the "new account" badge, since the
kind-0 created_at proxy was unreliable.

Softens the v0.12.8 forward-reference to Blossom — it will reappear
in a future release, not specifically this one, since it still needs
a safe-probe or allowlist (see WEBKIT_OOM_INVESTIGATION).
v0.12.9
2026-04-23 19:34:16 +02:00
Jure 7a07d732e6 Remove broken "new account" badge
The badge marked notes from pubkeys whose kind-0 profile event was
newer than 60 days, on the theory that that approximated account age.
It doesn't: kind-0 created_at is "profile last updated," so any user
who refreshed their bio recently got flagged as new regardless of how
long they've been on Nostr. The proxy was misleading, so drop it
entirely until there's a real signal to use.

- NoteCard.tsx: remove isNewAccount badge.
- social.ts: remove batchFetchProfileAges, getProfileAge, and the
  module-level profileAgeCache Map.
- nostr/index.ts: drop the barrel re-exports.
2026-04-23 19:20:37 +02:00
Jure 6a23f0223c Apply WoT filter to reactions, zaps, and all feed tabs
WoT was previously global-feed only. Now it filters notes on every feed
tab (global, following, trending) and also gates reaction pills and zap
totals — so a reaction from someone outside your social graph no longer
shows up in the counts.

- engagement.ts: wotSet param threaded through groupReactions,
  fetchReactions, fetchZapCount, fetchBatchEngagement. Zaps are filtered
  by the pubkey inside the zap request (the actual zapper), not the
  outer event.pubkey (the LNURL wallet). Extracted getZapperPubkey and
  getZapAmountSats.
- useReactions / useZapCount: cache key embeds WoT state so filtered
  and unfiltered counts don't collide. Hooks subscribe to the WoT store
  so toggling re-renders.
- feed store: reads WoT state and passes wotSet to fetchBatchEngagement,
  seeds cache with the correct key.
- Feed.tsx: drop the tab === "global" guard.
- SettingsView.tsx: update copy to reflect the wider scope.
2026-04-23 19:20:29 +02:00
Jure c93a07c48e Add interactive WebKit memory watcher script
scripts/memory-test.sh records peak/min WebKit RSS per user-driven
phase (login, global scroll, following scroll, thread open, etc.)
and writes a TSV for side-by-side comparison between builds. Used
during the v0.12.8 OOM investigation and kept for future
regressions. Output files gitignored.
2026-04-17 14:17:48 +02:00
Jure 704e738d3a Docs: changelog + WebKit OOM lessons for v0.12.8
Add v0.12.8 entry to CHANGELOG.md with Blossom regex root cause,
WebKit rendering fix, and notification dedup. Add hard-won
Linux/WebKitGTK lessons section to CLAUDE.md (bitmap eviction,
MemoryPressureSettings process boundary, bisect-first, cache vs
leak) and flag safe Blossom URL auto-detection as pending for
v0.12.9.
2026-04-17 14:16:09 +02:00
Jure bc4c72d6a0 Fix Linux OOM: disable Blossom SHA-256 URL auto-detection
Commit 214c42b (v0.12.6) added auto-detection of content-addressed
Blossom URLs (64-hex SHA-256 paths) as <img> elements. Blossom is
widespread in modern Nostr feeds — every feed page started rendering
3-5x more <img> elements. Combined with WebKitGTK's weak decoded-
bitmap eviction, feed scrolling grew the WebKit web process to
8-12 GB and triggered WebKit's self-kill threshold with:

  Unable to shrink memory footprint of process (9022 MB) below
  the kill threshold (8192 MB). Killed

Disable BLOSSOM_URL_REGEX in parseContent(). Real Blossom images
shared via standard upload flows (with proper extensions) still
render. Proper reintroduction (HEAD request + Content-Type
validation, or known-server whitelist) planned for v0.12.9.

Also restore feed depth caps to pre-crisis values now that memory
is under control:
  - MAX_FEED_SIZE 30 → 200 (v0.12.6 baseline)
  - fetchFollowFeed limit 30 → 100
  - fetchGlobalFeed fetch 80 → 100
  - Following tab slice 30 → 100

The earlier 30-caps were themselves OOM firefighting that shipped
in v0.12.7 and were no longer needed.

Memory verified 2026-04-16: oscillates 1.1-1.6 GB across all tabs
(Global / Following / Trending / Media / profile / thread) under
heavy use with embedded relay enabled. No crashes. Elastic cache
behaviour rather than monotonic leak — memory spikes briefly on
content loads and reclaims within seconds.

See private_docs/WEBKIT_OOM_INVESTIGATION.md for the full
investigation (4 days of chasing symptoms before finding the
one-line regex as the real cause).
v0.12.8
2026-04-16 21:31:04 +02:00
Jure 8b5fdc0720 Bump to v0.12.8 — fix Linux OOM crash 2026-04-16 11:44:19 +02:00
Jure 5fe3554579 Fix feed OOM: cap follow feed at 30, WebKit software rendering, dedup notification fetches
- followNotes capped at 30 (was 80) — following feed was rendering 2.7x more
  notes than global, causing 4GB+ spike on media-heavy follow content
- fetchFollowFeed limit 80→30 to match
- WEBKIT_FORCE_SOFTWARE_RENDERING=1 replaces WEBKIT_DISABLE_COMPOSITING_MODE=1
  (compositing mode killed Wayland path → blank window on Hyprland)
- HardwareAccelerationPolicy::Never → OnDemand (Never also caused blank screen)
- set_enable_page_cache(false) — SPA never navigates, bfcache is pure waste
- Removed duplicate fetchNotifications calls on login (was firing 3x in 8s)
- First notification poll delayed 8s→90s to avoid competing with feed load
- Result: login 3600MB→453MB, following feed crash→737MB, plateau at ~950MB
2026-04-16 11:43:48 +02:00
Jure 0894389fe0 Fix feed OOM: lazy image loading, inView gating, WebKit memory tuning
- NoteContent: remove ImageGrid from inline mode — images now only load
  when note is inView (via mediaOnly), stopping runaway scrolling leak
- NoteCard: content-visibility:auto to skip layout/paint for off-screen
  cards; inView-gated media, NoteActions, NIP-05 verification
- useInView: new IntersectionObserver hook with 300px rootMargin
- useProfile: MAX_PROFILE_CONCURRENT=8 throttle with fetch queue
- useReplyCount/useZapCount/useReactions: enabled param, throttled queues
- feed.ts: MAX_FEED_SIZE 200→30, live sub disabled (pendingNotes pattern),
  250ms batch debounce on live events
- core.ts: MAX_CONCURRENT_FETCHES=25 global NDK cap, fetchWithTimeout
  uses subscribe+stop instead of fetchEvents (no zombie subscriptions)
- lib.rs: HardwareAccelerationPolicy::Never + CacheModel::DocumentViewer
- main.rs: WEBKIT_DISABLE_COMPOSITING_MODE=1 for Linux
- relay/db.rs: TTL eviction + 5000 event cap
- feedDiagnostics.ts: file-flushing diag log survives crashes
2026-04-15 20:36:14 +02:00
Jure 018ee0e0f3 Fix thread OOM: hard-truncate events client-side, remove batchFetchProfileAges from thread 2026-04-13 22:16:02 +02:00
Jure a87abb6d97 Fix thread OOM: cap fetchThreadEvents at 300 events, cap profile cache at 500 entries 2026-04-13 21:37:41 +02:00
Jure 5d59797d5d Add thread load timing diagnostics (Ctrl+Shift+D to view) 2026-04-13 21:34:40 +02:00
Jure 95785dcb07 Fix profile fetch architecture: batch kind-0 queries, restore NDK pooling 2026-04-13 21:06:08 +02:00
Jure d8217bda49 Add new account age badge on notes (< 60 days) 2026-04-13 20:51:24 +02:00
Jure 4ce272ce5a Add opt-in WoT feed filter (hop-1 + hop-2 social graph) 2026-04-13 18:11:45 +02:00
Jure f3b92004f0 Bump to v0.12.7 — fix NIP-96 upload endpoints, block SVG uploads v0.12.7 2026-04-13 14:43:03 +02:00
Jure c6ccb0989c Remove unused delete_event function; bump Vite + picomatch (audit fix) 2026-04-12 18:56:02 +02:00
Jure a393469c17 Add interest selection step to new-user onboarding
New users now choose topics after backing up their key. Selected interests
are saved to localStorage (wrystr_interests) and surfaced as clickable
hashtag pills in the Following feed empty state, giving new users a path
into content without auto-following strangers.

Flow: welcome → create → backup → interests → app
Login path is unchanged.
2026-04-11 22:29:25 +02:00
Jure 35da2a9111 Sync Cargo.lock to v0.12.6 2026-04-11 22:23:53 +02:00
Jure c22522a170 Add CHANGELOG entry for v0.12.6 2026-04-10 20:47:22 +02:00
Jure 4759c2df64 Parse URLs, mentions and hashtags in profile bio
Profile about/bio text now renders clickable links, nostr mentions,
and hashtags instead of plain text.
2026-04-10 20:40:35 +02:00
Jure 37e87825d4 Bump to v0.12.6 — DM polish, multi-image upload fix, Blossom image rendering v0.12.6 2026-04-10 20:10:20 +02:00
Jure 214c42b9e5 Fix Blossom image URLs with non-standard extensions (.jp etc.)
SHA-256 hash filenames from content-addressed storage (Blossom/NIP-96)
now always treated as images regardless of extension. Also broaden
IMAGE_EXTENSIONS to cover avif, bmp, tiff, jp2 and common variants.
2026-04-10 20:09:44 +02:00
Jure f4878f9d4f Polish DM view: clickable links, inline images, nostr entity rendering
- DM messages now parse and render URLs as clickable accent links
- Image URLs show inline in the bubble (max-h-48)
- nostr:naddr and mentions rendered as styled clickable links
- nostr:nevent quotes show a subtle indicator
- Media URLs (video/audio/youtube etc.) rendered as clickable links
- parseContent regex now case-insensitive for nostr: prefix; entity
  lowercased before nip19.decode for robustness
- renderTextSegments: add case for quote type (↩ note indicator)
2026-04-10 17:49:11 +02:00
Jure 7375ddc7e3 Fix multi-image upload in article editor; add thumbnail lightbox
- All selected images now upload and insert correctly (was: only last
  image kept due to stale content closure in loop)
- Images inserted as a block with proper newline padding
- Thumbnail strip thumbnails are now clickable — opens a lightbox;
  click overlay to dismiss
2026-04-10 11:33:13 +02:00
Jure 0bda04904b Add screenshot capture scripts and CHANGELOG; gitignore screenshots/ 2026-04-09 22:01:49 +02:00
Jure 2b2a5929f7 Bump to v0.12.5 — UI polish, V4V fix, production-silent logging v0.12.5 2026-04-09 19:57:57 +02:00
Jure c0fbc93377 Polish pass 14 — silence remaining console calls in production
- feedDiagnostics.ts: guard styled console.log with isDev, plain log → debug.log
- main.tsx: error boundary console.error → debug.error
2026-04-09 19:56:05 +02:00
Jure 9fb0a7ef2e Polish pass 13 — final sentence case sweep
- NoteActions: Share, Follow/Unfollow
- SearchView: Search button, Notes/Articles/People result tabs
- RelaysView: Check all, Add (suggested relays)
- SettingsView: Add (mute keywords), Export data/Exporting…/Exported ✓
- InlineReplyBox: Reply/Replied ✓/Posting…
2026-04-09 19:51:16 +02:00
Jure 721a552f91 Polish pass 12 — sentence case on ArticleView, ComposeBox, DMView, SettingsView
- ArticleView: Back, Save/Saved, Repost/Reposted, Comment, Copy link,
  Like/Liked, Post — all button labels capitalised (header + footer)
- ComposeBox: Post, Post poll, Posting…
- DMView: Send, Start
- SettingsView: mute keyword placeholder + Remove button
2026-04-09 19:49:24 +02:00
Jure 63a0f05e92 Polish pass 11 — color tokens, text size consistency, overlay fix
- V4VHistory: text-amber-400 → text-zap on sats total
- V4VSettings: size status dot to text-[8px] for visual consistency
- Feed: last-updated timestamp text-[10px] → text-[11px] (matches siblings)
- NoteContent: +N overlay bg-black/50 → bg-bg/60, text-white → text-text,
  text-lg → text-[14px] (consistent with rest of file)
- RelaysView: last-checked timestamp text-[9px] → text-[10px]
2026-04-09 19:47:19 +02:00
Jure 9b3783b640 Polish pass 10 — hover titles, focus rings, disabled states
- NoteCard: title tooltip on truncated name and NIP-05
- NoteActions: emoji pill buttons dim (opacity-50) while disabled
- DMView: title tooltip on truncated conv name; focus ring on send button
- RelaysView: title tooltip on truncated relay URL
- OnboardingFlow: title tooltips on npub/nsec (nsec only when revealed)
- ArticleEditor: visible focus indicator on title and body textareas
2026-04-09 19:27:22 +02:00
Jure f34f5dc1a3 Polish pass 9 — console → debug in search.ts and localRelay.ts 2026-04-09 19:24:07 +02:00
Jure d6287fc240 Polish pass 8 — console → debug, sentence case, attachment button
- core.ts, feed.ts, user.ts: replace all console.log/warn/error with
  debug.log/warn/error (silent in production builds)
- ArticleFeed: "write article" → "Write article"
- ComposeBox: attachment remove x → ×, add aria-label
2026-04-09 19:20:47 +02:00
Jure f2546b5af7 Polish pass 7 — sentence case across profile, thread, follows, podcasts
- ProfileView: Cancel/Back, Edit profile, Zap, Follow/Unfollow, Mute/Unmute,
  Message, Notes/Articles/Media tab labels
- ThreadView: Back, Retry, Reply/Posting…/Replied ✓; console.error → debug.error
- ThreadNode: Reply/Posting…/Replied ✓
- FollowsView: Follow/Unfollow, Followers/Following tabs, Follows header
- EpisodeList: Back, Loading episodes…, amber → zap theme token on V4V badge
- AccountSwitcher: Login, Add account, Sign out, Remove
- PodcastCard: + Subscribe / Subscribed
2026-04-09 18:42:03 +02:00
Jure e30e42971e Polish pass 6 + fix V4V auto-streaming not stopping on manual toggle
Polish:
- ArticleEditor: sentence case on all buttons (← Drafts, Write, Preview,
  Zen, Meta, Publish, ← Back, New draft)
- EditProfileForm: Save profile / Saving… / Saved ✓
- ImageField: Upload / Uploading…
- RelaysView: Add, Publish list, Remove dead, Discover relays (sentence case)
- InlineReplyBox: attachment remove x → ×, aria-labels on remove/attach/emoji

Bug fix:
- V4VIndicator: add userDisabledRef so manually turning off streaming
  prevents auto-start from re-engaging on subsequent play/pause/seek
  events for the same episode; resets automatically on new episode
- V4VIndicator: remaining amber-* colors → zap theme token
2026-04-09 18:36:28 +02:00
Jure bac52b15ac Polish pass 5 — sentence case, theme tokens, remaining a11y
- Sentence case on all button labels (Mark read, Go to settings, Try again,
  Mark all read, Disconnect, Connect wallet, Logging in, Posting, Quote & post,
  Loading, Refresh); V4V tabs capitalized
- V4VDashboard: amber-500 hard-coded colors → zap theme token
- BookmarkView: tab container rounded-sm overflow-hidden
- ToastContainer, DebugPanel, PodcastPlayerBar: aria-labels on dismiss/close buttons
- PodcastPlayerBar: ASCII x → × Unicode, ... → … Unicode
- AboutView: document bg-white on QR code as intentional
2026-04-09 18:29:43 +02:00