amethyst on Nostr: #Amethyst v1.18.0: Amethyst Desktop, Web of Trust, Privacy Lock, and a Deck ...

#Amethyst v1.18.0: Amethyst Desktop, Web of Trust, Privacy Lock, and a Deck

Highlights:

- Ships **Amethyst Desktop**: the desktop app now runs the same screens and navigation as Android, and the legacy desktop app is gone.
- Adds a **Web of Trust** network from your NIP-85 provider. Strangers' DMs go
to New Requests, and Curated notifications and replies leave them out.
- Adds a **Privacy lock** for the whole app, your messages or your wallet,
with biometrics on Android and a password on desktop.
- Adds **Custom feeds** built from people, hashtags, kinds and relays, and an
opt-in **Deck** of columns for wide windows.
- Rewrites **web-app signing prompts** to say what each request does, and
stops one stuck prompt from blocking every later signature.
- Lets you **drag the panes** in wide windows, and opens every chat type
beside its list.
- Redesigns **My Fitness** around weekly goals, with streaks, history and
charts.
- Makes the **Messages toggles** stop loading NIP-04 or NIP-17, instead of
only hiding them.
- Renders **NIP-82 software releases** with their app, release notes, and
downloads for your device first.

## New Features

### Privacy Lock

- Adds a Privacy lock settings screen with three switches, all off by default:
lock the entire app, lock messages, lock the wallet. Plus an idle timeout.
- Unlocks with biometrics or the device credential on Android, and with an
app password on desktop.
- Locks you out for 30 s after five wrong passwords, doubling up to
5 minutes, and keeps the lockout across restarts.
- Asks for the credential before a lock is turned off or its timeout made
longer.
- Hides message text in notifications while the messages or app lock is on,
and guards the secret-key backup behind any lock.
- Locks the Marmot and Cordn group screens, drafts, and the payment and mint
top-up screens too.

### Custom Feeds and Deck

- Adds custom feeds: pick people, hashtags, kinds and relays, minus hidden
people and keywords. They show in the Home feed picker under "Your feeds",
with a manage screen and an editor.
- Adds an opt-in Deck (Settings › App › Deck) for windows 1,200 dp and wider,
in place of the notification panel.
- Makes every Deck column any screen, with its own back stack. Columns can be
added, moved, resized, reset and closed, across up to nine workspaces.
- Adds Deck shortcuts on desktop: Ctrl/Cmd+T, +W, +Shift+PageUp/PageDown,
+Alt+1–9 and +Shift+S, plus a Deck menu on macOS.
- Imports the legacy desktop app's feeds, workspaces and lock settings.

### Web of Trust

- Downloads your NIP-85 rank provider's trust cards into a compact index on
the device, and keeps it current with small, cheap updates.
- Treats people below a minimum trust score as strangers. Their DMs go to New
Requests, Curated notifications drop them (in-app and push, zaps exempt),
and their thread replies start collapsed. Follows always pass.
- Adds a Web of Trust settings screen: the network's size over a histogram of
ranks, a minimum-score slider with a live count, and sync status.
- Sets up Brainstorm's GrapeRank with a guided sign-up, or any NIP-85 provider
by its key and relay.
- Reads rank and follower badges from the index, without a subscription per
profile.
- Shows on a profile whether the person is in your network, with their score
or "You follow them". Tapping it opens the Web of Trust settings.
- Collapses runs of public-chat messages from people outside your network
into one "3 messages from outside your network · Show" row, in NIP-28,
live-stream, ephemeral and relay-group chats.
- Orders people search, mentions and people lists by follows, then trust
score, then everyone else.
- Resumes a cut-off trust network download instead of starting over.
- Lets you copy another person's trust view, or enter a provider key with its
tags as chips, under "Set up by hand".
- Opens the provider's website in Amethyst's browser, signed in with this
account.
- Adds the Brainstorm relay to the default search and indexer relays.

### Signing

- Times out a web-app signing prompt after 120 s. A prompt left behind Home
used to block every later request from every web app.
- Brings a pending prompt back when Amethyst returns to the foreground.
- Shows what each request does: the private message inside a seal, the relay
of a relay login, the method and URL of a NIP-98 request, and the verb, file
and server of a Blossom upload or delete.
- Previews a profile edit as the new profile, with "Changes your bio ·
Removes your lightning address" lines.
- Summarizes follow, mute, deletion and report changes in one line, and shows
reports as report cards.
- Asks before signing a report under the Reasonable trust level, and asks
once, not twice, in Paranoid mode.
- Warns when a prompt has been open a minute or more that the app may have
stopped waiting.
- Fixes Connected Apps for web apps: Forget now forgets an app's decisions, a
new trust level takes effect, and an app no longer shows once per account.
A forgotten app could keep signing logins without a prompt.
- Only the buttons and Back decide a prompt now. A tap beside it no longer
denies silently.
- Removes the 40-requests-per-10-seconds limit on Amethyst's own NIP-46
signer for paired apps, and answers their requests in parallel, so busy
clients are no longer refused. Unpaired keys get 10 requests a minute each,
100 in total, and the rest are dropped unanswered.

### Messages

- Turns NIP-04 or NIP-17 loading, paging and subscriptions off when you turn
its toggle off. With NIP-17 off, its rooms, composer and calls are gone, and
the gift-wrap subscription asks only for what Marmot or Concord still need.
- Brings cached messages back when a protocol is turned on again.
- Pages NIP-17 history one round at a time. A quiet chat offers Keep looking
and Stop instead of walking every gift wrap you ever received, and names the
relays that didn't answer.
- Pages NIP-17 history from your DM relay list only, 500 gift wraps at a time.
- Pages history (messages, notifications, Cashu wallet) only for the account
on screen. With several accounts logged in, a NIP-17 group showed only its
last message.
- Keeps pinned conversations in the list when none of their messages is
loaded yet.
- Opens every chat type beside its list on wide screens: Buzz, Marmot, Cordn,
Concord, relay groups and location channels, like DMs.
- Softens the bubble colors: other people's bubbles are lighter in the light
theme, and your own keep the accent's hue without the neon glare.
- Checks the stock Concord relays for invites every 15 minutes instead of
keeping them open.

### Wide Windows

- Lets you drag the splitters between the drawer and the content, the content
and the notification panel, and a chat list and its chat. Widths are saved
per device.
- Opens a note's menu as a dropdown by its ⋮ button, with keyboard navigation
and submenus, instead of a dialog in the middle of the screen.
- Wraps the composer's tools under the text instead of scrolling them
sideways, with hover tooltips.
- Opens the account switcher as a menu from the docked drawer.
- Scrolls the feed with the mouse wheel over the empty gutters beside it.
- Adds a refresh button to the docked notification panel, and shows today's
counts and the 7-day chart in it.
- Opens the drawer from a tab pager only after a 120 dp swipe or a fast
flick, instead of on the first pixel, and keeps wheel and trackpad scrolls
with the pager.
- Puts Navigate before You in the drawer when there is no bottom bar.

### My Fitness

- Redesigns My Fitness around weekly goals: rings for active minutes, workouts
and active days, plus an optional weekly distance, each "on track" or
"behind pace".
- Adds a goal editor. The default is 150 active minutes a week, the WHO
guideline.
- Adds 12 weeks of weekly active time, a 18-week consistency heatmap with
streaks, your busiest days and times, and the activity mix against the
previous four weeks.
- Fetches your own published workouts, instead of only those another screen
had loaded.
- Stops counting fasting, diet and meditation as active time.

### Composer and Uploads

- Adds a custom-emoji picker to the note, comment, DM and public-chat
composers. It inserts your NIP-30 emoji as `:shortcode:`.
- Makes the image quality slider also set a maximum size: 640, 1280 or
1920 px, then uncompressed. Posts start at 1280 px on phones, now at JPEG
quality 85 instead of 75.
- Resizes photos on Android to exactly that size. A 12 MP photo used to go up
at about 2016 px whatever the setting.
- Previews the first image compressed in the upload dialog, with its size and
dimensions next to the original's. Tap it to compare both full screen at
their real resolution, with zoom; tap again to flip between them.
- Deletes the temporary copies a compression leaves behind when the quality
slider moves on before it finishes.
- Tags music uploads with their `format` (m4a, mp3, …), so other clients
know the `.mp4` Blossom returns is audio.
- Adds imeta (hash, size, type, dimensions, blurhash) to images pasted as
links in the note, comment, public message, classified and new group DM
composers, so readers can lay them out before they load. Links without an
image extension count when their preview is an image.
- Waits up to 3 s for a link just pasted before posting, so its imeta goes
out with the post.
- Fetches a pasted link once for its preview card and its imeta.

### Feeds and Cards

- Renders NIP-82 software releases with the app's icon and name, markdown
release notes and OS chips.
- Groups release downloads by OS, with the best match for this device on top,
and splits pre-releases from the latest release.
- Trusts a release only from the app's publisher or its listed maintainers.
- Opens Zapstore apps instead of an empty group chat. Only group content
follows its `h` tag to a NIP-29 group.
- Loads an app's releases on its own page, even when it is opened from a
link, profile or mention.
- Fills bare app cards with their OSes, license and links, renders app
descriptions like a note body with translation, and groups platform chips
by OS.
- Adds cards for Kanban boards and cards, WalletScrutiny verdicts and Mostro
instance terms.
- Adds a CI status badge and runs sheet, and cover notes, to NIP-34 git PRs,
patches and issues.
- Finds Marmot key packages of White Noise users who publish only the legacy
kind 443, so they can be invited.
- Shows the caption above the reactions on video and file cards.
- Plays an audio-only `.mp4` as audio, with its cover, by reading the file's
track list. Blossom serves every M4A upload as `.mp4` / `video/mp4`, so
these showed a black video box. A music track or podcast whose file is a
real music video plays as video instead of inside the waveform strip.
- Shows the cover, title and player of audio tracks, and the player of audio
headers that carry their file in a `url` tag.

## Performance

- Moves blocking and lock-touching work off `Dispatchers.Default`: external
signer calls, proof-of-work mining, relay health saves, cache scans and
cyberspace bag sweeps. One slow job no longer stalls feeds and relay
verification behind it.

## Improvements and Bug fixes

- Shows each relay's median post, query and first-result times, and a
"Slow N×" chip on a relay that lags the others.
- Hides the broadcast banner once your outbox relays accept a post, instead of
waiting for every relay. It can always be dismissed, and an outbox failure
stays with a Retry.
- Stops a dead outbox relay or a dropped connection from showing a post as
failed.
- Counts every connected relay under a job in the always-on notification, and
says "Connected to N relays" instead of "inbox relays".
- Asks before opening a scanned 64-character hex key as a profile, since it
might be a private key.
- Completes multi-part QR codes from the camera and from images, waits for a
tap when several codes are in view, and keeps zoom and torch when the camera
reopens.
- Fixes the wallet invoice QR being clipped in wide windows.
- Converts GIFs to MP4 in comment, public message, classified and edit
composers, which ignored the switch.
- Fixes uploads of keyboard GIFs and stickers failing with a permission error
after the upload dialog had been open a while.
- Makes text fields in embedded web apps behave as in the browser: Enter
sends, cleared fields stay cleared, chips, paste, maxlength, and Next on
forms.
- Fixes the image zoom animation popping to full size instead of growing from
the thumbnail with its rounded corners.
- Fixes a pasted `nevent` to a music track, or any addressable event, showing
twice in search.
- Shows a reaction notification for a reaction to your reply. It was checked
against the thread root's author.
- Shows nested NIP-22 replies in community feeds.
- Fixes zap splits without a relay being saved so that Amethyst and other
clients read them as weight 0. Old splits still load.
- Counts on-chain and BOLT12 zaps toward your zap income only when you are the
payee, and attaches a BOLT12 zap only to the live activity it names.
- Fixes hashtag feeds asking only the first relay.
- Shows "Messages" in the Messages top bar instead of the Amethyst logo.
- Fixes weekday labels on the notification chart after a daylight-saving
change.
- Opens scanned links written in uppercase, and keeps a split nsec in an
image from being listed piece by piece.
- Reports an LNURL server's error as "service unavailable" with its message.
- Stops a bare word in a relay hint turning into a fake relay.
- Fixes a StackOverflowError on reply cycles in threads, and a link detector
that took 27 s on colon-heavy text.
- Fixes a second reaction with the same emoji missing from the reaction
gallery.
- Keeps a feed's subscription when the app comes back right at the end of its
background grace period.
- Opens a chat when you tap its name next to a community label.
- Fixes a crash on videos with side-loaded captions. They now show as
subtitles, and formats no parser reads are left out.
- Fixes padding under the disappearing bars on My Fitness.
- Fixes the call timer showing blank in Polish, and the web-app profile-edit
prompt not naming the changed fields in Polish.
- Shows errors with a severity icon, a selectable message and the stack trace
behind Details. Messages queue instead of replacing each other.
- Moves the navigation to Navigation 3. Tabs keep their scroll position, and
pinned web apps no longer share one saved screen.

## Desktop

- Runs the shared app: the same screens, navigation shell, login, account
switcher and settings as Android. The legacy desktop app is deleted, and its
accounts, feeds, deck and lock settings are imported.
- Gains what the legacy app lacked: zaps and the reactions row, chess, Git
repositories, calendar RSVPs, post editing, markdown with inline media,
Cordn groups, the audio-room list, and crash reports offered on the next
start.
- Drops the hashtag-spam filter, the WoT badge, the live-now bar, the relay
dashboard, the advanced search and the GIF search.
- Adds a 2560 px step to the image quality slider, and starts posts at
1920 px.
- Keeps phone photos upright: compression applies the EXIF orientation, and
the metadata strip keeps that one tag. Photos stored sideways were uploaded
on their side.
- Strips metadata from photos with two EXIF blocks, as some editors save
them. These were uploaded unstripped, GPS location included.
- Keeps the space for images and GIFs without a declared size while they
load, and caches decoded GIF frames so a GIF shown again isn't downloaded or
decoded again.
- Fixes tall photos spilling over the text and reactions around them.
- Draws QR codes with the shared renderer. Long payloads fall back to a lower
error-correction level instead of crashing.
- Plays video like Android: autoplay muted, pause out of view, resume where it
stopped, Android-style controls and a now-playing bar. Encrypted media plays,
and Tor-routed videos stream through Tor.
- Renders music tracks, podcast episodes, audio tracks, audio headers, voice
messages and audio in posts, which drew nothing before, with a waveform
player that seeks on click. Podcast soundbites and chapters jump there.
- Plays audio linked in posts, including audio-only `.mp4`s, in the audio
player instead of the video engine ("Can't play this video").
- Fits portrait videos, preloads the next videos in a feed, and no longer
blinks to black when one starts.
- Zooms photos and videos from their card to full screen and back.
- Redesigns the now-playing bar with thin sliders and hours in long times, and
keeps its stop button in narrow windows.
- Renders PDFs in notes, with a full-window reader that turns pages with the
arrow keys.
- Shows OS notifications with the same title and text as Android, when
previews are on, and skips muted authors.
- Replaces the bare system error box with a crash window that can send the
report to the developers.
- Uses desktop text sizes, a lighter hover, and a menu bar only on macOS. The
title bar blends into the app on macOS.
- Sizes the drawer's text and rows for the desktop, and keeps the photo
viewer's close button clear of the macOS window buttons.
- Opens a notice instead of crashing on screens the desktop doesn't have yet,
and hides their entry points, such as DM calls and the geocache Map tab.
- Drops the media setting's Wi-Fi choice, where it behaved like Always.
- Keeps the top bar on Scheduled posts when there is no post store, instead
of a blank screen.
- Shows a text reply button on voice notes where recording isn't available.
- Brings a background window forward on the first click without pressing what
is under the pointer, and stops hover while scrolling.
- Fixes the pull-to-refresh indicator staying half-pulled after a mouse-wheel
scroll.
- Opens at a larger size and reopens where you left it, and never saves a
window collapsed to a sliver.
- Names the app "Amethyst" in Linux docks and app switchers.
- Only hands http, https and lightning links to the OS.
- Keeps accounts, drafts and settings in the Flatpak across restarts. Every
Flatpak shipped so far lost them.
- Renames the Flatpak app ID to `com.vitorpamplona.amethyst`, on runtime
26.08. Remove the old `com.vitorpamplona.amethyst.Desktop` bundle and log
in again (see `BUILDING.md`).
- Declares GStreamer as a dependency of the Linux `.deb` and `.rpm`.

## Cli

- Adds `amy notes show`, `thread`, `reply`, `quote`, `react` and `repost`,
plus `delete`, `notifications` and `notes feed --hashtag`, on the app's own
routing, tagging and thread code.
- Adds `amy trust setup`, `status`, `sync`, `check` and `copy` for the Web of
Trust network.
- Reports `relay_errors` from `amy fetch`, and fails with `no_relay_served`
when no relay served the request. It used to exit 0 with `count: 0`.
- Streams `amy fetch --paginate --limit 0` with flat memory, and logs every
REQ with `--verbose`.
- Runs every `amy sync` direction through negentropy.
- Answers AUTH in `amy fetch`.
- Refuses reposts and quotes of NIP-29 group content, and sends group content
only to its host relay.
- Shows a zap's sender only when the zap request proves it, so a spoofed
zapper no longer shows.
- Fails interaction verbs with `read_only` on npub-only accounts, filters
`amy notifications --type` at the relay, and applies deletions by address.
- Trims `notes post` text and rewrites bare npub/note words like the composer.
- Keeps amy's data files owner-only on Windows (NTFS ACLs), without eight
warnings per file.

## Quartz

- Makes `fetchAllPages` hold up on production relays: it learns each relay's
limit, drops repeated events, paces throttled relays, and walks each filter
on its own cursor. Multi-filter walks lost most of their events before.
- Fixes `negentropySync` finishing "clean" on relays that truncate their set,
and makes `fetchByIds` public.
- Returns null from `count` at once on relays without NIP-45.
- Fixes a WebSocket dial race that opened two connections per relay, and
REQs sent while a WebSocket was still opening being dropped silently.
- Breaking: `fetchAllPages` drops `DEFAULT_PAGE_SIZE`; `pageSize` is now an
optional cap. Adds `streamAllPagesFromPoolWithHooks` for walks too large to
hold in memory.
- Keeps a relay's CLOSED or connection message in `PagedFetchResult.message`,
and adds an `onRelayResult` callback to `fetchAllPagesFromPool`.
- Adds NIP-85 trust network sync and a compact index.
- Types the event kinds found by a census of 743 relays: Marmot 443, NIP-34
cover notes and NIP-C1 CI, Mostro, RoboSats, Ditto, Zapstore identity
proofs, Kanban, WalletScrutiny, NIP-4E key transfer, private note storage
and more.
- Completes hint providers on 184 kinds and NIP-50 indexing on 72. Existing
stores need `reindexFullTextSearch()`.
- Adds `RelayUrlNormalizer.normalizeHintOrNull`, a strict parser for relay
hints from other clients.
- Names every tag relationship with an accessor, such as `mentions()`,
`quotedEvents()` and `recipient()`.
- Writes the `a` and `f` tags NIP-82 releases require, and adds NIP-82 version
ordering.
- Verifies Zapstore identity proofs (kind 30509) against an APK signing
certificate (RSA, EC, Ed25519) on JVM and Android.
- Reads NIP-4E draft 10044 keys, which were always empty before, and adds
`EncryptionKeyStore`. Parses NIP-69 bonds as decimals.
- Registers `FeedDefinitionEvent` (31890) and `EncryptionKeyListEvent` (10044)
in `EventFactory`, and indexes an emoji pack's public shortcodes instead of
its encrypted content.
- Breaking: adds abstract `BaseRepostEvent.originalAuthorKeys()` and
`ZapReceiptEventInterface.zappedAddresses()`, and `DecoupledCipher` takes an
`EncryptionKeyStore`.
- Shares secp256k1 across every target and one native crypto set across
Apple and Linux, and implements `LargeSoftCache` on iOS.
- Adds a "One-shot Reads" section to `CLIENT.md` (`fetchAll`, `fetchFirst`,
`fetchAllPages`, `count`), switches it to the Maven artifact and the bundled
OkHttp transport, and ships an installable agent skill for projects that
use Quartz (`quartz/agent-skill/`).
- Adds `AudioTrackEvent.title()`, `url()`, `image()` (with `mediaUrl()`,
`coverUrl()`, `displayTitle()`), `AudioHeaderEvent.url()` / `mediaUrl()`,
and a `format` parameter to `MusicTrackEvent.edit`.

## Build & Documentation

- Continues One UI: Navigation 3 with the navigation shell in `commonsUI`,
more screens and ViewModels moved to `commons`/`commonsUI`, a headless
`BaseAccountViewModel` with typed user notices, and feature-based ViewModel
packages.
- Adds plans for iOS and web apps on the shared UI.
- Adds Navigation 3 1.1.2 and Apache PDFBox 3.0.8 (desktop only), both
Apache-2.0, and removes `navigation-compose`.
- Turns on incremental compilation for the KMP modules: a one-line change in
`commons` rebuilds in 9.5 s instead of 38.6 s.
- Builds zxing-cpp reproducibly from any NDK path, from a pinned commit.
- Requires a human to review the diff and test on a device before an AI
contribution becomes a PR.
- Gives Claude Code and Codex the same rules, skills and pre-push checks:
`AGENTS.md` holds the rules, `.agents/skills` links to `.claude/skills`, and
the checks live in `tools/agent-hooks/`. A new check, run before every push
and in CI, keeps them in sync.
- Cuts the agent skills from 33 to 14, each rewritten against the current
code, so the list fits Codex's skill budget.
- Fixes the Compose string-escaping pre-push check, which never blocked a
push.
- Documents Homebrew as autobumped, and verifies the cask instead of
submitting it.
- Bumps `appCode` to 463.

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…kcfw)

## Translations

- Czech, German, Swedish, and Brazilian Portuguese by ⚡ Dee Kay ⚡ (nprofile…kcfw)
- Hindi by राज (nprofile…z0lu)
- Hungarian by summoner (nprofile…ns2l)
- Polish by Polak (nprofile…8c53)