Nostr Compass #44

Amethyst @npub142gy...xrj0 brings its Android interface to desktop and adds native Wayland support. Amber (maintainer: @npub1w4us...0jr5) fixes permission revocation, copied-secret clearing and a settings change that could lose keys. Keep tightens automatic signing permissions, while MDK @npub1marm...r6m9 ships streaming private attachments and oldest-first message catch-up. Zap Cooking @npub1xxdd...kt7a merges safeguards for follow-list edits and authenticated membership. Release details follow, alongside protocol changes and public-status mechanics.

Top Stories#

Amethyst#

Amethyst v1.18.0 brings the Android social client's shared interface to desktop, with custom feeds, wide-window decks, opt-in locks, encrypted media and Blossom uploads. Provider scores from NIP-85, trusted assertions, are indexed locally for requests, notifications and badges, with user-selected providers and thresholds.

Today's v1.19.0 release adds native Wayland support and desktop video compression using separately installed FFmpeg and ffprobe. Key-storage fixes address repeated keychain prompts and Linux keyring failures. Calendar collections and RSVPs gain rendering, and the Android login interface adds NIP-46 remote signing. Parallel opening of encrypted envelopes precedes serial indexing, while relay reconnection and feed-author relay-list handling are corrected. The relay client honors rate-limit backoff before resuming subscriptions or publications.

The trust-provider relay change treats provider relays from the user's kind 10040 list as own, trusted relays. Those connections use a direct route by default; Tor requires enabling the trusted-relays setting. The main client's NIP-42 relay authentication can disclose the user's public key to these relays.

Amber#

Amber 6.6.9 fixes three security flaws in the Android Nostr signer. Revoked permissions no longer survive a cache race, and explicit rejections override fully trusted status. Copied secrets receive a system-scheduled clipboard clear after 60 seconds, including when the process is killed; contents remain readable during that interval, and newer copied text may also be cleared. Changing “require unlocked device” preserves the old wrapping key until secret migration completes, while previously lost keys remain lost. The release repairs multi-request nostrconnect approvals and replies on the URI's specified relays. Users of 6.6.8 and earlier should update.

Keep Android#

Keep Android v1.3.0 (maintainer: @npub1h3fz...96sj), a FROST threshold signer, adds on-device distributed key generation and authenticated recovery of interrupted share operations. It also handles devices without StrongBox support. With threshold signing, participating devices hold shares of the signing secret and cooperate to produce a signature; the setup and recovery steps determine which devices can participate.

Version 1.3.1 prevents automatic signing from overriding remembered refusals, Ask permissions, expired approvals or failed permission reads. Expiry removes background approval while retaining denials. The per-app policy migration moves permissions into the core-owned store while preserving stricter decisions.

Chama#

Chama v6.4.21 @npub1m7ny...jsln authenticates the native wallet bridge used by its Nostr-mediated trade application, disables production URL-based bridge redirection and validates payout amounts. It also refuses to wipe a wallet whose contents cannot be read.

Version 6.4.22 hardens replay against outsider events, checks successor relationships, rejects empty arbiter pools and derives refund timing from the signed LOCK time. Its consensus changes apply to CREATE events signed from November 1, 2026; the client protections apply immediately. The release notes retain caveats about listing-selected federations and dust payouts. Subsequent signer and recovery changes add protected-seed readers and recoverable late locks, while v6.4.24 improves large trade lists.

Zap Cooking#

The recipe and social client Zap Cooking merges safeguards for follow-list edits against incomplete, stale or unexpectedly shrinking reads. Follow actions share one guarded update path that preserves existing tags and content. Signer identity is checked before publication. Its membership authorization fix uses the public key signing the authenticated request. A route that exposed an administrative secret was removed; deployment still requires secret rotation, which a merged change alone cannot establish. Later thread and bookmark repairs preserve the real reply root and recover failed bookmark writes. Recipe tag fields no longer send keystrokes to profile or NIP-50 search services or leave the editor with unsaved changes.

Tagged Releases#

MDK#

MDK v0.13.0, the runtime for Marmot encrypted groups, adds streaming and resumable private attachments with progress and cancellation. It also sends private NIP-56 reports to the deployment operator through NIP-59 gift wraps, omitting message, group and relay identifiers. Catch-up processes oldest-first batches of up to 256 events and preserves relay CLOSED refusals. SOCKS5 routing covers relays, media and discovery services without a direct fallback.

The release guide requires bindings, headers and native artifacts to move together. Database schemas advance from 101 to 107 without a downgrade path. Host secret storage needs migration. MarmotKit and C artifacts are stable; WN Agent remains a prerelease and workspace crates are unpublished on crates.io. History arriving more than five MLS epochs late can still be undecryptable without an incomplete-history notice, and authenticated agent clients retain access to the whole API.

The release also retries profile, follow-list and relay-list saves left pending after the first acknowledgement; these background retries do not survive restart. Invitation lookup checks KeyPackage deletion and expiry on discovery relays, whose answers cannot prove the recipient still holds its private KeyPackage material. Activity-reaction targets now derive consistently from authenticated actors and individual group commits; older actorless history remains incomplete.

Later master work closes leaked relay subscriptions and pages activation replays clamped to 500 events. Epoch-gap recovery fetches a failed comparison relay's newest 256 events without certifying complete history. Self-update commits retry every missed group relay. New advisory checks cover known stale epochs and commits still owed to relays; users can acknowledge the risk, so these do not guarantee that a group cannot fork.

Storage-blocked attachment downloads retain resumable progress when free space is insufficient. Large explicit downloads use a file sink, with staging and checkpoints requiring roughly five to six times the body size in free space. Verified public-event previews gain a bounded encrypted account cache, while obsolete-only KeyPackage results become distinguishable from incomplete relay lookups. These are later source changes requiring matching host adoption; event-ID previews from completed fetches do not recheck later deletions.

The agent bridges also bound backend output to prevent oversized replies from exhausting memory, and accept the connector's actual deletion response. Previously delivered text remains delivered when an output limit stops a turn.

Myco#

Myco v0.11.0 (maintainer: @npub1hw6a...65gr) adds USB links between phones or fips desktops and adopts the current proposed NIP-5D manifest format, with signed artifact and icon hashes. Older phones can still pair but need updating to open these napplets. Its download-policy changes distinguish Internet, mesh and user-configured HTTP destinations. Author-provided hints and redirects cannot probe local networks under the Internet policy, while destinations configured by the user remain unrestricted. The software client also discovers blobs on the author's BUD-03 Blossom servers. That improves artifact discovery but exposes installation traffic to those servers. These HTTP changes do not establish equivalent protections for WebSocket connections. Nearby mesh availability checks probe peers for blobs without downloading them or contacting public Blossom servers. These bounded HEAD requests require mesh permission; a holder count does not prove the whole artifact remains available.

The release also races upstream DNS servers to avoid roaming-carrier timeouts blocking relay and artifact lookups. Outbox publications target every listed write relay, with slower destinations delivered in the background. Internet mesh remains off by default, and web pictures are not retained across restarts.

Unfiltered#

Unfiltered 1.0.13 (maintainer CheshireRemnant: @npub1w059...tl3x) adds read/write relay lists and outbox routing to its Android photo client. Its release notes describe relay roles, and accounts without a list begin with three public defaults. Nearby uses coarse geohashes and adjacent cells; adding location to a post is opt-in and off by default. Those tags still reveal an area publicly. The inspected publish result means queued to a socket, with relay acceptance still unconfirmed.

monostr#

monostr 0.17.0 @npub1zcql...e6z2 lets users receive Monero tips through a personal watcher, while 0.18.0 hides new setups’ tip amounts and notification sender names by default. Pictures default to tap-to-load, and optional Primal counts and client tags are disabled. A hosted watcher still learns every incoming payment to the registered wallet through its private view key. Public receipts retain the recipient, time and referenced post even when amounts are hidden.

Grocery#

Grocery 1.0.2 (maintainer Marc: @npub1marc...f3g0) combines shared encrypted shopping lists with passkey-backed Nostr identities and per-list Marmot chat. Lists can be joined by pasting a bearer key, which grants reading and editing. Passkey login depends on browser and provider support for WebAuthn’s pseudo-random-function extension; member tags remain visible to relays. Version 1.0.3 preserves lists across reopening by caching decrypted contents locally, fixing cases where only the key survived until a relay re-delivered the list.

Roadstr#

Roadstr 1.1.0 reads another Roadstr client’s kinds 1315/1316 with their intended lifetimes and confirmation rules. A compact codec preserves reconstructible signed reports for an experimental MeshCore radio and relay bridge. Compatible publishing and radio transmission are off by default, with consent before sharing. Radio reports expose position, time and the signing public key to anyone in range. Tests used simulated radios; real hardware, Android BLE and public-relay publication remain unverified.

OUTKAST#

OUTKAST 1.1.3 improves article comments and quoted-post handling in its Android client. Article comments use kind 1111 with the article as root and the comment as parent, while ordinary note replies remain kind 1. Quote discovery accepts both q tags and older link-bearing e mentions; newly published quotes add q tags. Failed publication rolls back optimistic reactions.

Bookshelf#

Bookshelf 0.1.28 (organization Decent Newsroom: @npub1ez09...y2lz) describes reading nested kind-30040 publication indexes containing both chapters and child indexes in publisher order. Offline copies retain that hierarchy and bookmarks tied to each occurrence. Refreshing fetches current revisions by coordinate, but keeps the previous download when results are incomplete, older or unsuccessful. Rebroadcasting preserves original signed descendants. Bounded expansion and readable partial branches prevent missing structure from being presented as a completed book.

Ditto#

Ditto 2.45.0 @npub10qdp...arpj replaces Global with Discover across its content feeds. Discover draws from people followed by the user’s follows and ranks posts by shared connections, excluding the user and accounts already followed. Logged-out users and accounts without follows see a selected starter network instead. This changes the scope of default discovery to a social neighbourhood; spam resistance and the trustworthiness of those accounts remain separate questions.

Postr#

Postr 1.1.2 @npub1qwkd...qfvl keeps selected profile identities attached to mentions through saved drafts and publication. The composer freezes the account, text, mentions and attachments during signing and sending, retaining incoming shares until that operation finishes. Retries preserve the original signed event, including older pending posts. Typing a name after @ is insufficient: users must select a profile, and identities already lost from old drafts need to be selected again.

Nostrautica#

Nostrautica Android 0.11.0 (maintainer Juraj: @npub1m2mv...r8p9) links communities to their meetups. Approval for a linked event can also grant community membership without a second approval; the join form discloses this and lets applicants opt out. Existing attendees receive a one-tap invitation. Events retain their own participants, matching and chat while the community lists its events. Release notes describe support for different event and community coordinators, without establishing independent interoperability or encryption testing.

Minibits#

Minibits v0.4.4 beta 1 @npub1kval...tkzv repairs Android Nostr Wallet Connect payment processing that could stop while the wallet was backgrounded and accumulate into an application-not-responding failure. The native release bundles five months of earlier over-the-air changes. Version 0.4.5 beta 1 fixes Android-to-iOS NFC transfer; future over-the-air updates require this version. These are release-reported fixes, with background processing still dependent on the phone's lifecycle restrictions.

NoorNote#

NoorNote v1.9.0 (maintainer: @npub175nu...g6w0) lets users publish recipes from its article editor, open shared recipe packs and browse recipes from followed authors. Website cards and profile grids covered last week now ship in the release, alongside relay rate-limit handling and direct Android nostr: links. Website links remain distinct from verifying a site's contents; gateway access exposes a clicked request to that gateway.

Gittr#

Gittr v1.0.2 (maintainer arbadacarbaYK: @npub1n2ph...hzmc) packages its Nostr Git forge for Android, using Amber through NIP-46 remote signing. The APK opens the existing hosted gittr.space application, so users still depend on its served browser code and availability. Browser-extension signing is unavailable inside this wrapper; self-hosting remains a separate Git deployment.

Dart NDK#

Dart NDK 0.11.0 development zero (maintainer: @npub1xpuz...5ams) brings the Dart and Flutter toolkit's authentication-consent handler and NIP-46 signer relay switching into a prerelease. These changes were covered last week as merged work and have now been released. The signer can follow a replacement relay list, which applications must persist. Development one adds support for lettered NIP identifiers in relay information. Both releases carry breaking integration changes.

Cambium#

Cambium v0.9.0 @npub1mgvl...e7q2 gives native Android apps four approval choices: once, one hour, one day or indefinitely. Grants are scoped by operation and event kind. Cambium forwards requests to a Heartwood hardware signer through remote signing; Heartwood still decides which requests it signs. Website approvals remain one-shot. Paired signers gain test and reconnect controls, supported transport-relay updates and redacted diagnostics. NIP-55, Android signing, batches preserve request order and individual rejections, with visible one-shot consent for ambiguous reused intents.

Grain#

Grain v0.8.1 (maintainer: @npub1zmc6...7f60) repairs its Go client library's NIP-42 relay authentication for applications serving multiple users. Each UserContext owns private authenticated connections, relay preferences and connection holds; the shared pool never authenticates. The library validates incoming IDs and signatures, checks subscription matches and serializes tag and time filters correctly. Authenticated callers must migrate to UserContext. Relay storage and serving are unchanged, and authentication still requires a challenge when the connection opens.

Nmail#

Nmail v0.18.0, an encrypted mail client, places unfamiliar senders in Requests and blocked senders in Spam. Acceptance and blocking synchronize across devices. Existing inbox senders need acceptance, with Accept all available; Spam stays silent and waiting requests avoid repeated sender alerts. Replies use the receiving identity. Private-relay management, device-lock checks before copying synchronization codes, shared themes, richer contact preservation and a Windows installer accompany mailbox restoration fixes after reset or login.

Meiso#

Meiso v1.5.0 (maintainer: @npub1gzuu...a5ds) ships encrypted comments and unread indicators for its Nostr-synchronized task manager. Comments use addressable kind 35002 events with NIP-44 encryption, keeping their task association inside the ciphertext. The release fixes offline sends, reconnect catch-up, startup with saved relays and propagation of empty lists. It also prevents partial synchronization from deleting tasks. The unread and catch-up features do not add a notification service for a closed application.

Haps#

Haps v0.1.13 (organization Sirius Business Ltd: @npub1xdhn...eycm), an experimental software installer, requires an audit of the exact release from the user's web of trust by default. Audits can compare pinned source and rebuilt artifacts, and remain private or be published. Version 0.1.14 asks users to confirm the publisher when installing by bare name; automation must specify one. Audits supply evidence, while native programs and build recipes still execute without a sandbox. The audit requirement can be bypassed for one operation; signature, integrity and publisher-confirmation checks remain.

Sidecar#

Sidecar v1.16.0 (maintainer Daniel: @npub1aeh2...4nwx) adds livestream discovery and playback to its browser-extension social client, with signed chat, reactions and zaps. Saved stream bookmarks support encrypted account backup and restore, and private notification mutes let users control alerts. Search gains follow and mute controls; automatic locking and wallet-history refresh changes accompany them.

Ants#

The search interface Ants v0.7.0 (maintainer Gigi: @npub1derg...xzpc) routes structured searches to authors' advertised write relays and mentioned users' read relays through NIP-65 relay lists, without login. Discovery limits the number of identities and relays consulted, and stops on cancellation or timeout. Missing lists retain fallback routing. Text queries still use verified NIP-50 search relays.

soyLI#

soyLI v0.27.0, a napplet publisher and player for proposed NIP-5D applications, adds keyboard bindings and forkless proposals through GRASP, a Git hosting service, with exact-revision retry checks. Its v0.26.0 release distributes signed releases to verified outbox relays after primary publication; deletion tracks attempted destinations but cannot recall unknown copies. Version 0.26.1 raises read, play and review budgets to 100 MiB while retaining a 25 MiB limit for new builds and publication. Later direct presentation metadata places author covers and clips directly on signed manifests, retiring the companion event. Frozen older jobs remain supported; this versioned Soy extension requires compatible readers and is not part of the pinned NIP-5D specification.

nostream#

The relay server nostream v3.3.0 (maintainer: @npub1a5r2...g39a) adds NIP-66 relay monitoring probes for WebSocket read and write round-trip times, optional authentication detection and mirror-target discovery. It warns when observed behavior disagrees with NIP-11 relay information. Rate-limited OK responses can include an optional fifth element containing a millisecond backoff. Version 3.4.0 adds a fourth, millisecond backoff element to CLOSED responses when IP message limits reject REQ or COUNT. It ships the PostgreSQL negentropy reconciliation core and ordered event inventory; NIP-77 relay wire messages and capability advertising remain separate work.

Bark#

Bark v1.3.15 gives remote-signing approvals keyboard controls, explicit event and identity review, and one, five or ten minutes to decide. Background enforcement rejects expired decisions and queued requests; failed decision delivery keeps the popup open for retry. Version 1.3.17 makes NIP-07 browser signing available when the signer handshake completes, while optional diagnostics continue. It restores bridges on existing tabs after updates.

Mostro#

Mostro v0.19.3 @npub1m0st...40un answers identity-authenticated requests for the user's own reputation, even without an open order. The peer-to-peer exchange sends replies privately to the requesting trade key, and a merged CLI command exposes that query. Reputation import remains a preview whose imports are unimplemented; operators should leave it disabled. Later merged work publishes the Lightning escrow guardian margin and rejects unsafe configurations; its 18-block minimum assumes LND's default hold-expiry setting.

Elisym#

Elisym's commerce 0.11.0 supports fees deducted from merchant revenue, with a signed store-profile tag declaring split-payment support and incompatible stores refused when a fee applies. Merged admin work reads orders and listings from Nostr relays. It asks for the store's secret key, requiring trust in served browser code and extensions; the local admin remains available. Hosted deployment and mainnet fee activation remain unverified. Merchant-node 0.10.0 upgrades its ledger without downgrade support.

Routstrd#

Routstrd v0.4.16 @npub130mz...l29s prevents a timed-out Nostr Wallet Connect refill from immediately producing another payable invoice. It checks the existing mint operation until payment succeeds or fails; an unavailable status keeps the refill paused. The inference gateway enables providers by Nostr review label, with experimental labels requiring explicit opt-in. Version 0.4.17 includes the supporting SDK. The unsettled-operation guard remains in memory, so restarting the daemon loses that protection.

Buzz#

Buzz desktop 0.5.28 @npub16l0c...yj9s lets authenticated staff browse and moderate every community on a relay without switching connections. Administrative actions retain the reviewed community, relay and signer; disabled authentication leaves the console available for reading. Separately merged relay work hides properly tagged deletion events for private author records across queries and live delivery. That server repair requires deployment and leaves previously disclosed copies and historical untagged deletion records outside the fix.

Earthly#

Earthly v0.1.21 @npub1dmmh...mc87 lets users embed public Nostr map datasets on websites, with a preview and controls for appearance and initial camera position. Its Maps MCP integration creates and publishes maps from chat, then generates sharing links or embeds. The integration remains a personal connected-plugin pilot. Embeds support inline datasets up to 300 features and 48 KiB; private, unpublished and blob-backed datasets are excluded.

Milk Market#

Milk Market's mobile v0.3.0 @npub1wm7w...pud0 brings full storefront design editors to its seller app, with the same sections and fields as the web editor. Per-product page design can override theme and section choices, including metadata and social images. The release adds checks to keep mobile and web configurations aligned. Version 0.3.1 corrects contrast in the mobile preview card; Android downloads are attached to the releases, with iOS availability on TestFlight.

Zeus#

Zeus v13.2.3 @npub1xnf0...lpr5 includes the LDK routing-fee repair covered last week, which has now shipped. Its LDK-backed Nostr Wallet Connect service can include reported routing fees in responses and spending records. Budget checks still cover the invoice amount before settlement, with rounded fees debited afterward and a separate 1,000-satoshi routing-fee cap. The release also updates embedded LND and includes rust-lightning security fixes; live NWC device validation remains unverified. Later merged Zaplocker removal retires its Nostr attestation and redemption flow. Upgrading with payments still held by that server removes redemption; senders must wait for hold-invoice expiry and refund. That retirement is outside v13.2.3; rollout depends on disabling the server and warning existing users.

In Development#

nosvelte#

nosvelte's event-verifier fix (maintainer akiomik: @npub12gtr...y5qj) checks an event's supplied ID against the canonical hash of its fields before verifying the signature. The Svelte library's default verifier previously accepted correctly signed fields carrying a substituted ID, allowing content to occupy another event identity and interfere with replacement handling. The merged change applies to version-one request and send paths using the default verifier; it does not certify the legacy export or custom verifiers under NIP-01's event format. A later request-filter repair checks and copies relay event fields before matching them. Malformed data can no longer end the default provider's subscription or discard its next valid event. Caller-supplied engine clients can retain earlier dependency matching behavior.

nostter#

nostter restricts externally supplied relay hints to secure WebSocket URLs, rejecting local hostnames and non-global IP addresses. Account-selected local relays and remote-signer URLs retain their existing paths; DNS rebinding remains outside the check. The web client also reads experimental separated content-warning payloads only after the reader presses Show, checking the referenced event ID, matching author and a k tag matching the original event kind. Reactions and replies target the original event. These merged changes leave its current NIP-36 publishing format unchanged.

Coracle#

Coracle's list editor (maintainer: @npub1jlrs...ynqn) restores editing and deletion by waiting for asynchronous decoding before rendering the form. Previously, editing lost the list's fields and neither saving nor deletion published an event.

Routstr Core#

Routstr Core’s current version 0.5.0 source stops logging autogenerated Nostr private keys and preserves the first-boot public identity. Provider announcements exclude localhost and literal private or link-local HTTP addresses; hostnames are not resolved for this check. The current tag includes work merged after its recorded October 7 publication date, so historical binaries and deployments remain unverified. Previously exposed logs still require operator review.

Alby Hub#

Alby Hub's invoice-authorization change @npub1geta...0nfm limits settlement and cancellation to invoices created by the requesting app. The self-hosted wallet exposes app connections through NIP-47, Nostr Wallet Connect; a connection's ability to manage its invoices must not grant authority over another app's invoices. A separate isolated-connection privacy fix removes the principal wallet's Lightning address from browser success paths for isolated connections.

nak#

nak's merged relay command (maintainer: @npub180cv...h6w6) probes connection, read and write timings and relay information, then prints unsigned kind 30166 discovery events. Piping those results into nak event supplies signing and publication, making scheduled NIP-66 relay monitoring possible with the same terminal tool. Observed authentication or restriction responses override advertised relay information. Write probes use an ephemeral event signed by a throwaway key; kind 10166 monitor announcements remain a separate operation.

Kehto#

Kehto's manifest verification checks current single-artifact signed manifests and artifact bytes before execution, with legacy parsing kept separate. The napplet shell also verifies recommended handlers, asks users about conflicts with saved choices and consumes an accepted invocation URL to prevent repeated delivery. Manifest verification checks publisher identity and artifact bytes; it does not establish that the application code is safe. Gamepad snapshots now follow focus and visibility. Paja/playground frames block direct native gamepad, HID and USB access before application code runs, leaving mediated access to the host. Consumers need the corresponding host packages; shell readiness is a separate capability. A later Paja admission change warns about unavailable experimental required domains but permits loading; those domains still expose no APIs or grants.

napplet SDK#

The napplet SDK implements URI-based invocation and retained delivery (maintainer: @npub1uac6...99rx). Publishing metadata survives in standalone HTML, and optional application references connect manifests to signed listings and screenshots without changing artifact hashes. The application-reference format remains a proposal. Reference-shell tests leave production discovery, installation and signature verification to hosts.

rust-nostr#

The Rust Nostr library rust-nostr preserves partial download progress alongside terminal relay errors (maintainer: @npub1drvp...seet). The failed relay remains in the failed set, so callers can use events already received without losing the evidence that synchronization stopped early.

Pensieve#

Pensieve's reconciliation safety fix (maintainer: @npub1zuua...c2uc) follows its missing-event exclusion work. The relay and archive tooling re-requests exact missing IDs before classifying failures, preventing capped query tails from becoming false exclusions. Pause accounting is per job, and already-archived events are handled separately. A completed job can retain explicit missing-event records; completion alone does not establish a complete archive.

Continuous Premium Primal reconciliation was enabled October 12. The operator's deployment record reports both repaired binaries deployed and failure-based pausing enabled October 13. Later exclusion carry-forward reuses only original proven exclusions for the same relay and overlapping window, excluding chained carries and newly mixed IDs; its deployment was recorded that afternoon. The archive preflight and cache-stall repair was deployed October 14. A later carry-priority fix is merged but not yet deployed in its source record.

njump#

The Nostr web viewer njump restores embedded relay defaults when no override file is supplied. It also isolates concurrent Markdown renderers and response headers during timeouts, fixing races that could crash the process while rendering quoted long-form events or serving concurrent requests. These are merged server changes; live deployment remains unverified.

Nostr Components#

Nostr Components' zap-signing repair (maintainer saiy2k: @npub1qsvv...sft3) stops the payment flow when the selected signer refuses. The embeddable social widgets no longer substitute a random anonymous identity after rejection. Their receipt aggregation validates NIP-57 zap receipts before deduplicating relay copies, invoices and request IDs.

rx-nostr#

The reactive client library rx-nostr's version-four verification changes check canonical event structure, IDs and signatures consistently across JavaScript and WebAssembly. An empty request condition list matches nothing and completes; legacy sending reports failure when it has no destination. Publication observers cannot change settlement, and disposed request descendants cannot restart. Finite query segments allow backward queries to complete after all supplied segments finish. These changes are included in 4.0.0 beta 2, a prerelease with breaking API changes.

eHagaki#

The social client eHagaki adds staged outbox delivery (maintainer Lokuyow: @npub1a3pv...sgh3), freezing author relay targets before signing. Its sensitive-post flow sends each relay the payload before its referencing structure, using that relay's own acknowledgement; payload-only success retains the composer. A full post-history scan saves verified results incrementally. Ambiguous ranges remain unconfirmed even when the scan is displayed as completed, with an explanatory information control. Citrine local-relay support preserves verified browsing ranges and archives exact signed events after successful external publication. Local acknowledgements do not turn a failed external send into success, and this adds no offline publishing queue. Uploaded-media management lists and deletes uploaded images and videos on supported NIP-96 and Blossom servers. A later database migration resets cached display and post history while retaining drafts and deletion requests. It also prevents older queued sync results from repopulating history after a clear.

Formstr#

Formstr's submission-result fix @npub1qu7d...7p98 rejects a form response when no relay accepts it. The Nostr forms application shows relay outcomes and offers retry while preserving filled answers. Webhooks and confirmation pages wait for acceptance, and the SDK receives the same check. A relay acknowledgement still differs from guaranteed long-term storage, but total publication failure no longer produces a success message.

Auditable Voting#

Auditable Voting adds optional private-worker ballot batching (maintainer: @npub19at4...upzr). Organiser-signed definitions select a worker identity, DM relays and release threshold or deadline. Voters send NIP-17 gift-wrapped ballots and authenticate receipts against that worker; delegations must authorise both queueing and release. Released ballots use the worker's identity. The worker can read submissions, and deadline batches can be small. If no valid private route resolves, the inspected client falls back to public submission. This is merged development work.

MintRadar#

MintRadar adds opt-in gift-wrapped alerts (maintainer: @npub1zate...d6rg) for mint or melt problems, outdated software and lost support for those operations. Its Cashu mint directory connects watchlist controls to those notification settings and confirms them after the server responds. Atomic claims prevent overlapping probes from sending the same alert, and unsuccessful relay publication releases the claim for retry. NIP-17 private messages protect the notification contents; relay acceptance leaves recipient reading unconfirmed.

Nostr Docs#

Nostr Docs' local-relay migration routes the collaborative Markdown editor's reads and writes through a Web Worker with an IndexedDB event cache and retry outbox. Document titles and tags survive reloads, and successive metadata edits receive increasing timestamps so two edits in one second remain distinct. Existing encryption-key storage stays intact. The network-pool fallback lacks worker outbox durability, and accepting a queued publication does not establish relay acceptance.

Pakstr#

Pakstr's native local signer lets its Android application shell create a Nostr account on the device. The key stays in the native layer, encrypted with an Android Keystore-protected wrapping key. Signing results are verified before returning to the web application. The shell supports NIP-07 browser signing and encrypted requests. Signer selection opens lazily when needed and coordinates concurrent requests.

Nostr WoT SDK#

The web-of-trust library Nostr WoT SDK extends authentication consent (maintainer Leon Acosta: @npub1gxdh...5zfk) to typed native and remote requesters. Stored denials are checked before prompts, and reusable consent is bound to the requesting transport and destination. Web requests remain one-shot by default. Its managed Blossom uploads validate immutable bytes, support cancellation and stop when the active session changes, with server-bound authentication and redirect restrictions.

NosTube#

NosTube v0.2.49 (maintainer flox1an: @npub1klr0...7gxc) supplies desktop installers. Separately, merged server work adds durable scheduled publication. Events are signed before their due time, stored in SQLite and published by a worker that catches up after downtime. Its editing and deletion flow tracks tombstones, mirror delivery and owned-file cleanup. First-run setup distinguishes a user's browser signer from a server-managed channel key. Historical unowned blobs remain outside automatic cleanup.

diVine#

diVine 1.0.24 (maintainer: @npub1wmr3...g240) adds private clip collaboration with credits and checks of signed capture or edit provenance. Viewer-selected translated captions fall back to the originals while translation is pending or unverified. These provenance checks do not guarantee an unedited recording.

The short-video client's routing changes consult recipients' inbox relays for text and video chat messages and preserve uncertain delivery outcomes. Sender-copy handling lets users' own group messages appear on their other devices; previously discarded copies require reimporting the account. Cancelled partial group sends retain “Not sent to everyone” records; cancellation is terminal and those records cannot retry. Group creation and recognition of new peer-started rooms remain behind an off-by-default flag.

Subsequent main-branch changes keep interrupted database-restore copies outside the temporary cache and preserve scheduled posts, queued reports, profile edits and removed-chat records during rebuilding. Send deadlines include relay reconnection, reducing the abandoned-send retry threshold from 160 to 137 seconds. Indexer inbox lookups use a separate bounded pool to avoid waiting behind feed reads, and follow controls preserve the chosen action if the contact list changes before confirmation. These later merges leave less time for relay acknowledgement during slow reconnects; database repairs cannot restore previously lost data. Later opt-in recording copies let Android and iOS gallery backup preserve newly recorded clips. Copies without signed provenance are warned and cannot be reimported; this is off by default and needs additional storage.

Conduit#

The commerce applications in Conduit gain a shared durable inbox @npub1nkfq...2svu, retaining encrypted message delivery and recovery across Market and Merchant. Recipient-relay acceptance survives a failed sender self-copy, with recovery reusing the same bytes to avoid a second semantic send. Shared signer-backed wallets connect both applications. That recovery path trusts the signer with recovery plaintext; source integration alone establishes neither a live deployment nor funded acceptance testing. Independent relay grants survive when several account routes share a URL. Disabling one route no longer erases another signed relay-list or inbox grant, and authentication-required or incomplete reads retain an unavailable outcome. The merged payment router splits one buyer-approved funding payment into merchant and supplier Lightning payouts, then the Conduit fee, with exact-intent reconciliation and encrypted recovery through the shared Nostr inbox. Production and staging execution remain disabled; provider completion does not prove receiver claim or payment retirement.

Bitcredit#

Bitcredit's persistence encryption @npub1eajv...cd93 protects its electronic-bill application's identity, company and bill keys, including the Nostr resend queue, using the personal identity's mnemonic. Initialization requires a matching mnemonic. Instance management lets testnet and mainnet instances keep their background Nostr subscriptions running independently on one device.

New Projects#

Submarine#

Submarine 0.1.0 (maintainer Russell: @npub1kg4s...w5te) releases a password manager whose encrypted vaults sync over Nostr. It supports external signers and retains concurrent item versions, with Bitwarden JSON import and export. Changes are saved locally before waiting for relay acceptance. Android, desktop and CLI downloads accompany the release. The project calls it young and advises a proven manager for critical passwords; the tagged protocol specification is still empty. Its web storage keeps the encryption key alongside the protected data.

cl-marmot#

cl-marmot adds a Common Lisp implementation of MLS group chat over Nostr. October 9 code adds competing-commit convergence and encrypted Blossom attachments, with author-reported interoperability tests against MDK’s wn command-line client. The implementation is unaudited, and account keys and message logs lack encryption at rest. Timed convergence windows, replay beyond the rollback horizon and disbanding remain unimplemented; the inspected harness uses disposable local relays.

nalgorithm Android#

nalgorithm's Android release builds a preference-ranked Nostr feed and a background audio digest that can be played offline. Users choose hosted, Lightning-priced inference or own-key inference requested from the phone; these are separate routes. Login supports Amber through remote signing. Follow-up releases repair own-key ranking and follow-list discovery, then preserve likes from working relays when another relay fails and improve digest recovery. Version 1.0.3 reorders model setup and reports missing connection-test inputs.

Protocol and Spec Work#

Authenticated napplet endpoints#

In the NAP specifications for napplet applications, NAP-INC endpoint identifiers, merged October 9, replace bare handler names with authenticated identifiers. Equal names from different publishers no longer identify the same peer. The runtime still mediates communication, and root or snapshot manifests need no named d coordinate.

Handler recommendations in invocation links#

The invocation-link recommendation, also merged October 9, allows an optional #naddr handler recommendation. A shell can offer discovery and installation, with ordinary resolution as a fallback. Saved preferences and shell policy take precedence. A recommended handler therefore supplies a discovery hint without replacing the user's existing choice or transferring installation authority to the link's sender.

Delivery acceptance and application work#

The intent advertisement and delivery changes derive roles and intents from the same verified manifest, using publisher-safe identifiers. Delivery acceptance no longer depends on the source application staying alive. An ok: true response accepts responsibility for delivery; it does not mean the destination's application work has finished. Retry and restart behavior remains runtime policy under this merged specification change.

Cyberspace action chains#

Cyberspace's revised chain rules make a fork invalidate a signed action chain from its spawn and require clients to confirm the live head before signing another action. The Nostr-backed world adds 140 signed synthetic chains with normative verdicts for implementations. Copy-credit rules use q references to the original object and notify its author for public remixes; sealed copies omit that notification. These are merged project specifications, with deployed verifier coverage unverified.

Relay persistence acknowledgements#

The open persistence proposal introduces persisted acknowledgements, PROOF queries and optional signed kind 1797 relay attestations. A signature makes a storage claim attributable to a relay; it does not prove continued retention. Queries also disclose which events interest the client.

Shared pins for Marmot groups#

Marmot's open pinning proposal defines authenticated shared state for up to 64 message references, with member and administrator permissions. Effective changes require an MLS Commit and epoch transition, and every resulting member leaf must support the feature. Pins do not copy message bodies or extend retention, so unavailable targets remain unresolved. The supplied fixtures assume authenticated state; they do not demonstrate cryptographic processing or convergence across clients.

NIP Deep Dive: NIP-36 and NIP-38#

Content warnings before display#

NIP-36, sensitive content, lets authors add a content-warning tag to an event, optionally including a reason. A client may hide the content until the reader chooses to reveal it. The specification leaves the interface to clients and permits supplemental label tags. Adding a warning does not change who can read the event. In a public post, relays and other clients still receive its content.

Amethyst's warning-tag parser recognizes the tag and treats a missing or blank reason as unspecified. Coracle's composer writes the reason into the tag; its content view respects the reader's sensitive-content setting and offers a reveal action. noStrudel's note view applies its own warning preference and expanded state before showing the warning interface.

NIP-36 does not encrypt events or require concealment. An absent warning says nothing about the content; clients decide how warnings affect previews and reveal controls.

Profile status and expiration#

NIP-38, user statuses, uses addressable kind 30315 events. The author, kind and d tag identify a status coordinate; general and music have defined meanings. A newer event replaces the previous status at that coordinate, while a different d value remains separate. Empty content clears a status. The specification also permits references to URLs, profiles, events and addresses.

This signed NIP-38 event shows an expired general status. The author's original spelling is preserved.

{
  "kind": 30315,
  "id": "8848719ae347e705afbbdbfa3a9f5dcca5dd31c4f39182503bf84de5e362bcf4",
  "pubkey": "f13fdeecd852acebaa77dbc18806a051eaa7ea2214c157a3495982d7535a77f3",
  "created_at": 1791983702,
  "tags": [
    [
      "d",
      "general"
    ],
    [
      "expiration",
      "1791984600"
    ]
  ],
  "content": "I'm listening 📩 on 3 ralys",
  "sig": "b5c98a578773f0199cb833d4b916aac115f2b13474a61e81fdca7316b848d397d7d8ad86d299abee4721f404b7b8a1af26e8c53143457ad14d2fb933b21daf85"
}

Damus's status model handles general and music statuses with expiration. Nostria's status service ignores empty or expired values and publishes music statuses using track duration; its normal subscriptions request only general and music types. Amethyst preserves the d identifier when clearing a status. Custom types therefore need agreement beyond the shared wire structure.

Statuses are public author statements. They do not prove online presence or that somebody listened to a track. Publishing music or availability can disclose habits, and optional expiration limits stale display without promising deletion. NIP-38 remains a draft, optional specification, as does NIP-36. Clients can implement either independently, with their display settings determining what readers see.