Nostr Compass #43

Compound searches, encrypted app permissions, messaging recovery, web highlights, wallet safeguards, and public profile verification lead this week's Nostr development updates.

Ants keeps compound search constraints aligned. Myco (maintainer: @npub1hw6a...65gr), a host for small Nostr apps, adds permission-gated uploads; Marmot MDK @npub1marm...r6m9, an encrypted messaging toolkit, improves account discovery and attachment recovery. Iris Chat adds message editing, and Sidecar publishes web highlights. The profile tutorial explains signatures and separately verified internet identifiers.

Tagged Releases#

Nostr WoT#

Signing policies now apply global rules, site/account overrides and exact-origin defaults for NIP-98 HTTP authentication, with denials taking precedence and money requests reviewed individually in the extension release. Nostr WoT (maintainer Leon: @npub1gxdh...5zfk)'s trust and signing tools also gain a published bunker responder for NIP-46 remote signing, with verified replay bounds and authenticated pairing state. Hosts still own approvals, key storage and durable revocation state.

Account Archive in v0.8.11 synchronizes original signed events across relays with checkpoints and encrypted local storage. Version 0.8.12 makes exported archive files passwordless while checking signatures and account ownership on import; older encrypted exports remain supported. Exported files and encrypted local storage have different privacy boundaries.

Scramble#

Still-sealed messages arriving ahead of the current group epoch now survive restarts and replay when the epoch advances in Scramble v0.7.9. The group messenger also binds KeyPackage identifiers before relay exposure. Recovery is bounded by a 256-envelope cap per group and a retention window.

Sonar#

Active conversations gain [chat catchup](https://github.com/hedwig-corp/bitchat-to-sonar @npub1wg2m...dzaw/pull/649), while queue isolation and bounded push-token sharing improve how Sonar, a chat application, handles background work. These changes ship in v0.1-alpha.15.4; relay caps and queue overflow still limit catchup.

Chama#

Creator checks now compare the full creator identity when known, discard provisional link claims after failed loads and refuse ambiguous fresh legacy links in Chama v6.4.20 @npub1m7ny...jsln. The Nostr peer-to-peer escrow client also waits for relay acknowledgement before on-chain locking. Cold-start wakes after swiping the app away have regressed in v6.4.20.

Mostro#

Funded hold invoices are protected from cancellation, failed lookups are deferred and bonds are paid exactly in Mostro v0.19.1 @npub1m0st...40un, the peer-to-peer trading daemon. Core progress adds weighted imported reputation and signed reputation validation, with issuer trust left to callers. Unreleased main-branch work adds Cashu ecash discovery and order creation plus taking orders and locking escrow; release, cancellation and dispute operations remain rejected. Additional unreleased main-branch payer declarations let buyers exchange a fiat-account hash bound to the current trade. It is disabled by default and unavailable in Cashu mode; guessable account hashes do not prove identity.

Main-branch Mostro core user-info messages add a restore-only request and reply for a user's own reputation, including rating, review count, operating days and first-trade date. Daemon identity-proof and lookup integration remain separate.

Earthly#

Map, Story and Atlas authoring now share [native Chrome WebMCP browser-agent operations](https://github.com/zeSchlausKwab/earthly @npub1dmmh...mc87/pull/31), with confirmation tied to the exact preview and account revision. Earthly, a map-based publishing tool, adds signed-byte recovery and explicit draft-preserving rebase. Chrome support remains experimental, and later observation of a publication is distinct from an acknowledgement whose outcome was unknown.

nostream#

Multiple tag constraints and per-filter limits now produce correct query results through the [filter-query repair](https://github.com/cameri/nostream (maintainer: @npub1a5r2...g39a)/pull/792) included in nostream v3.2.0. The Nostr relay's release also includes optional HAProxy/readiness support and Redis fanout. Existing sockets do not migrate during cutover, and Redis unavailability can drop fanout messages.

Grain#

Event serialization and replacement preflight checks improve in Grain v0.8.0 (maintainer: @npub1zmc6...7f60), a Nostr relay. Malformed subscription and count constraints now fail without widening queries, while newly tracked late backfills use receipt time for purging. Replacement preflight is not a durable commit: deletion can still precede asynchronous ingestion, leaving a write gap.

Ditto#

Ditto @npub10qdp...arpj, a Nostr social client, adds file posts and a tap-to-load 3D attachment viewer in v2.43.0, with 200 MiB download limits. v2.44.0 adds event-native 3D objects, customizable Blobbi rooms and addressable videos, plus NSFW and blocked-term filtering in public feeds and search. Release notes also report interrupted-wallet repairs and add Lightning-address fallback for failed Lightning URLs. Zap invoice amounts must match, but description-hash mismatches only warn: automatic payment can proceed with unverified sender or post binding. v2.44.1 reads notifications from account-declared inbox relays with per-relay paging, retrieves own saved lists from write relays and repairs WebLN payment-provider handling. List edits use the latest observed event; withheld or stale relay copies remain a limit. Separate relay-source mention parsing continues past truncated references.

Nostr Double Ratchet journals received controls#

Private control messages now share a durable journal row with advanced receiver state in the TypeScript v0.0.176 release. The encrypted messaging library retains them until the application's durable acknowledgement, enabling replay after failure or restart. Callbacks must be idempotent and validate authorized siblings; newly ratcheted AppKeys labels do not retroactively protect older records.

Private-contact edits now persist before notification, with owner-bound controls, fieldwise clocks and exact pending acknowledgements in nostr-social-graph v2.0.3 (maintainer: @npub1g53m...drvk). The social-graph library retains rejected handoffs for bounded retries. Callers must provide authenticated, durable sibling transport; a ready status means acceptance into an outbox, not delivery to every device.

nostr-pubsub#

Ordinary subscriptions start immediately, followed by optional bounded NIP-77 inventory reconciliation in nostr-pubsub TypeScript v0.5.14. The subscription library fetches missing event IDs over the existing relay socket and verifies events through the normal admission path. Reconciliation does not upload local-only events or change history-completion semantics.

The separate Rust FIPS package v0.5.20 (maintainer: @npub19wav...8p6k) preserves pending replies and subscriptions when an inbound peer becomes a discovered outgoing peer, reusing its established stream. Physical-link changes and advertised service restarts still reset that stream.

FIPS#

Missing routed sessions can recover through authenticated discovery after a browser restart that retains identity in FIPS runtime v0.0.53. The Nostr-keyed transport bounds recovery attempts and checks for a usable route before signaling. Recovery completion can clear pending state only in its original node generation, preventing stale work from clearing a replacement node's state.

Later TypeScript runtime v0.0.56 restricts nonforwarding browser nodes to advertising their own identity and refreshes cached routing announcements after a fresh authenticated responder carrier. Wire formats, identity checks and session authentication remain unchanged.

Separate Rust source changes adopt pending key sessions only after authentication, even when key-epoch bits match. Failed decryptions no longer evict live peers using public receiver indices; authenticated liveness still determines expiry. Session backoff temporarily refuses repeated silent sessions, while BLE connection arbitration addresses shared-connection races. Rekey guards reject copied setup messages and off-link attempts, age and drain floors protect session transitions, and bounded child-filter checks reject apparent echoes with threshold exemptions. These are development changes, with no new Rust release or device validation established.

Elisym#

Elisym, a merchant payment tool, adds webhook signature and freshness verification in commerce 0.9.0, merchant-node 0.9.1 and MCP 0.32.1, an AI-tool interface using the Model Context Protocol. Checkout changes reset closed or reloaded modals while existing payments continue, checking unresolved payments before another wallet request. Those pages lose the order’s onPaid callback; signed backend webhooks remain authoritative. A durable paid-order webhook outbox queues signed retries alongside ledger changes. Receipts travel over Nostr, but fulfilment and event-ID deduplication remain merchant-owned; payment completion does not confirm delivery.

Hashtree#

Remote blocks can retain peer-readable provenance after restart through durable verified-block sharing, included in Hashtree runtime v0.5.19 (organization Sirius Business Ltd: @npub1xdhn...eycm). The content-addressed sharing runtime persists hash-verified bytes and authorization before returning. A full or unavailable cache still permits a valid download, but durable sharing cannot be promised for that read.

Later Rust source adds automatic, bounded peer archive intake alongside relay catchup, using an ephemeral identity and verified events. Peer observations cannot satisfy missing required relay coverage. Interrupted appends resume only from matching durable input; author coverage advances after the whole author is durable.

A standalone Git reader combines bounded relay observations with public signed index roots while preserving original signatures. Unreachable sources remain distinct from absent repositories. An explicit expected release root preserves existing history or stops on conflict; it does not guarantee concurrent publication safety.

Amethyst#

Amethyst v1.17.0 @npub142gy...xrj0, an Android Nostr client, includes document-bound browser signing through NIP-07 browser signing and profile updates. Departed-document messages are discarded; Tor-required pages fail closed on proxy failure, but WebView proxy settings affect other views process-wide. Later merged QR safety changes require confirmation before opening an ambiguous 64-character hex scan as a public profile, avoiding automatic transmission of possible private-key bytes to relays. Software-release handling trusts app branding and downloads only from its publisher or a declared maintainer, and separates stable versions from prereleases.

Later development limits browser signing prompts to 120 seconds and always asks before signing reports. Encrypted-message history now pages only the visible account, prioritizes its DM relay list and offers bounded searches with retry controls. Relay-hint and search repairs reject malformed relay URLs, stop indexing encrypted emoji-pack contents and stop linking anonymous or private zap sender keys; expanded public-text search requires existing stores to be reindexed. The amy command-line client adds posting, threads and deletion while restricting group content to its host relay and refusing group reposts or quotes. The Android app’s own group-repost path remains unchanged. Paired clients using NIP-46, Nostr's remote-signing protocol bypass the unpaired-client rate limiter; unpaired traffic remains limited to 10 requests per author and 100 combined per minute. Queue and concurrency bounds and per-request authorization remain.

My Signet#

Per-app phone approval is available, default off, in My Signet v0.18.2, a hardware-signer companion. It requires an imported Heartwood hardware-signer operator key, compatible firmware and a connected, unlocked inbox. Possession of that phone key authorizes enabled requests without touching hardware; "Approve once" can permit the same event kind for ten minutes, while wallet pairing and login codes still require the hardware button.

Nsync#

Signed Nostr address announcements now help paired devices find each other in Nsync v0.3.0, a Syncthing-based file synchronizer. Pairing binds each Nostr identity to a Syncthing device ID, and receivers require newer announcements. Files still transfer through Syncthing; relay announcements expose address and online-timing metadata, even with public-IP announcement disabled.

PsstPsst#

PsstPsst v26.10.1 adds small private groups for text, reactions and files through PsstPsst's group-send implementation. The messenger extends NIP-17 private messaging and NIP-59 gift wrapping with encrypted group identifiers and membership actions, using per-recipient NIP-44 encryption. These extensions remain draft and optional: other clients may split rooms, and any current member can publish membership changes.

Write Nostr#

Encrypted draft and account-settings sync arrives in Write Nostr's v0.4.11 changes. The writing client commits a draft revision only after every chunk and its head record reach at least one common accepting relay, preserving local content on incomplete or invalid recovery. Signers without NIP-44 support retain local drafts but cannot use encrypted sync.

Flotilla#

Screen sharing joins existing calls through Flotilla's cross-platform sharing implementation (maintainer: @npub1jlrs...ynqn), released in Flotilla 1.12.0. The community chat client provides web, Electron and native adapters, including Android MediaProjection and an iOS broadcast-extension path. The release also preserves drafts when sending fails, allowing users to retry without rewriting their message.

Blitz Wallet#

Native Android background handling for NIP-47 wallet requests arrives in the Blitz Wallet Android prerelease. The Lightning wallet shares SQL-backed budget reservations, payment-hash claims and uncertain-payment markers with JavaScript handling, alongside startup fallback and background crash containment. Firebase Cloud Messaging is required, and Android may still need JavaScript execution or an open app.

Sidecar#

Selected web text can be published as NIP-84 highlights in Sidecar v1.15.6. The browser extension's v1.15.8 composer changes align mention and quote tags, convert pasted identifiers and skip unanswered relays after 12 seconds, so delivery can remain partial. The server-discovery repair in v1.15.9 finds Blossom servers through account-declared relays, including write-only relays, and retries failed discovery on the next upload. The same fix covers profile images; nostr.build remains the fallback.

BuhoGO#

BuhoGO, a Bitcoin wallet, releases 1.10.0. Purchased NIP-05 identity names now survive restarts and delayed relay replies through durable profile synchronization. Activation continues after checkout closes, and verified recovery requires no second payment; newer username choices remain authoritative. Android installations older than 1.9.1 use another signing key: back up recovery phrases before uninstalling and reinstalling.

Staircase#

Staircase, an MLS group-chat client over Nostr, releases 0.1.20. Its forwarding and synchronization changes re-encrypt forwarded attachments; captions default off, with no original author, chat or reply metadata. Folders stay local unless multi-device sync encrypts them under derived keys. Search excludes deleted messages and covers device-held history. New accounts use cordn.feeds.relay.tools; existing coordinators remain. Startup key-package reconciliation survives leaving onboarding.

KithMoot#

KithMoot, an encrypted room messenger over Nostr, releases 0.6.62. Queued messages retry oldest first using their original signed events. Never-sent messages remain editable or deletable; possibly delivered messages can only leave the local pending list. Saved-room synchronization republishes missing relay records using their original signed events, preserving deletion records.

Later merged 0.6.63 preparation adds VMLS rooms on user-operated Bothy servers, with Nostr invitations and signer-authorized access grants. This preview has no persistent VMLS message history. Compromised-device removal holds new sends and joins until witnessed, revokes keeper-owned grants without grace, and retries unconfirmed revocations; existing traffic may arrive first. Tor-only rooms pause server traffic. Signing, publication and handset acceptance remain pending; downgrades discard removal journals and compromise marks.

Rooms have no end by default; when one is chosen, self-destruct defaults on, with a read-only alternative. Cleanup runs with background ringing or delivery enabled, otherwise at next start. It requests deletion of this device's signed events and attempts local cleanup; failed stores, relays or recipients may retain copies. Without a reachable relay, cleanup retries while retaining its signing key.

Nostr Vault#

Nostr Vault, an Android client with an on-device relay, releases 2.7.2 with marketplace listings, polls, article highlights and nostrconnect signer pairing. Release notes also report cross-device DM catchup and signature checks; NIP-29 relay groups are removed. These are publisher-reported release behaviors, without independent security or background-delivery validation.

Private Provider#

Private Provider is an Android AI coding workspace that builds APKs on the phone and publishes Nostr repositories through ngit. Version 0.7.2 lets the in-app agent, Pi, request issues, comments and pull requests with explicit command approval and signatures from the Amber Android signer. 0.7.5 pins Blossom and Zapstore publication targets in a committed manifest and rejects tag/commit mismatches. Wallet recovery remains unavailable; the documentation cautions users to keep only small balances.

Haps v0.1.11, a Nostr-key package publisher and installer, adds signed immutable bootstrap discovery and publisher-maintained catalogs, preserving custom sources and publisher pins. Search and bare-name installs require a publisher or release voucher from the user's social graph, excluding muted or overmuted people. Explicit npub/package installs warn outside that graph; trusted warnings block installation. The installer retains its verified selection. Signatures establish authorship, not safety: native programs and build recipes remain unsandboxed; package formats remain unstable.

soyLI#

soyLI v0.25.0, a toolkit for publishing sandboxed Nostr apps, uses creators' own NIP-34 Git repositories, checking signed refs and clone reachability again on resume. It avoids duplicate repositories and retains linked source on deletion. Remote dynamic backends still require soyLI-managed source. Earlier changes accept NIP-22 replies with extra mentions and prevent a relay-handshake timeout race from terminating the web process.

fips2go#

fips2go @npub1yptp...a52w, an Android mesh client using Nostr-signed domain bindings, releases 0.9.4 and 0.9.5. Fallback TTLs follow retries, initially 20 seconds, tripling to three hours. Cached mesh answers avoid parallel DNS; ordinary fallback still queries upstreams. First denials release fallback while validation continues. Its resolver supports configured offline witness quorums, excluding self-vouching; pins and DNS retain precedence. Desktop operators may disable plain probes with DNSSEC; default probing remains enabled. Phone probing follows connectivity validation. Denials do not authenticate targets.

In Development#

Dart NDK#

Dart NDK (maintainer: @npub1xpuz...5ams), a Dart and Flutter Nostr toolkit, adds authentication consent controls for relays and Blossom servers. Without an explicit policy or consent handler, relay operations stop authenticating automatically as the logged account and default Blossom writes use throwaway keys. Signed events still identify their authors. Its NIP-46 relay switching follows a signer's replacement relay list; applications must persist the updated connection. These are merged changes, with no tagged release established.

MintRadar#

MintRadar (maintainer: @npub1zate...d6rg), a Cashu mint directory with signed Nostr reviews, restricts shared-link relay hints to three known relays plus its defaults, and caps account-list connections at ten public secure-WebSocket hosts. Its new server profile index supplies reviewer names when browser lookup finds none; internet identifiers remain labeled as claims until separately verified. These are main-branch changes, with deployment unverified.

LNbits#

LNbits, a Lightning service with Nostr notifications, lets WASM extensions request user notifications under an explicit permission. The host selects the current user or invocation wallet owner and their saved Nostr, email or Telegram settings; extensions cannot supply an arbitrary recipient. This is merged development work, and a queued response does not guarantee delivery.

Zeus#

Zeus @npub1xnf0...lpr5, a Lightning wallet, repairs LDK routing-fee reporting used by Nostr Wallet Connect, allowing responses and connection spending to include the reported fee. Budget checks still cover the invoice amount before settlement and debit rounded fees afterward; the service uses a separate 1,000-satoshi routing-fee cap. This is merged source work, with no release established in the window.

Pollerama#

Pollerama (maintainer: @npub1cgd3...kfex), a Nostr polls and feeds client, repairs encrypted-message delivery by waiting for relay-authentication acknowledgement before replaying subscriptions on relay.formstr.app. Its local-relay library discards signing results from replaced sockets and directs outgoing gift-wrapped messages to the recipient's declared inbox relays.

Nostur#

Nostur @npub1n0st...k6h0, an iOS Nostr client, adds kind 16 generic repost support across feeds, rendering and event references, so reposts of other event types can resolve their original content. A saved-repost repair restores missing target links when those reposts are reopened, validating embedded events before using them. Existing repost counts are preserved.

Gittr#

Gittr, a Nostr-based Git platform, repairs Settings deletion requests that could fail to reach Amber. Subscriptions measure their wait from the current signer-connection pause, and a saved signer identity can proceed to signing when the initial connection warmup finds no open socket. This repairs signer contact; it does not establish that deletion has completed across relays.

NosTube#

NosTube, a Nostr video client, adds a separate instance build that loads server configuration before starting the app and limits its video catalog to configured creators and sources. Signer and wallet connections retain their own relay access. Admin routes are served by nostube-server. Search remains disabled in this initial instance variant.

eHagaki#

eHagaki, a Nostr client, stores content-warning bodies separately in verified kind 36 payloads before publishing the original event structure. Only compatible clients retrieve and display those bodies; the warning does not encrypt them. Local history search now streams its first 50 matches while scanning continues, then reports the exact total.

Nostr Components#

Nostr Components (maintainer saiy2k: @npub1qsvv...sft3), a web-component toolkit, adds signed profile and relay records and URL-activity APIs. Zap capability stays unknown until checked, and ingestion stores an event only after a sweep relay returns it. These changes are merged development work; deployment remains pending.

Holoboard#

Holoboard, a paid Nostr note-promotion board, preserves unfinished promotion payments when users return to editing or switch notes. Earlier invoices remain available for explicit resume, and late wallet replies update their own payment record. Unconfirmed payments retain a warning that they may already have succeeded. Issued invoices remain payable; returning to the editor neither cancels them nor refunds a payment. Failed browser storage leaves a visible notice.

Milk Market#

Milk Market @npub1wm7w...pud0, a Nostr marketplace, adds mobile seller shipping, return labels and optional activity alerts, and native catalog editing. Return labels preserve outbound tracking and order status; uncertain label purchases keep their duplicate-prevention records. Catalog editors reject stale or wrong-owner edits and protect sold stock from duplicate retries. Server push remains disabled unless explicitly configured.

NYM#

NYM (lead developer Luxas: @npub16jdf...33sv), a Nostr chat client, changes notification handling so service-worker notification clicks reopen the relevant private, group or location conversation, with page notifications as a fallback. Unread in-app toasts held while a sheet was open remain eligible after their ordinary timeout. System notifications still require permission and browser support.

Client AI consent and account-deletion changes add prompts before bot processing and translation; bot consent can also enable translation. Requests may share conversation or channel context, including other people’s recent messages and approximate location, with the service and selected model providers. Deletion attempts cover usable saved identities and local wiping, but public relay copies, inaccessible identities and external backups can remain, and some server-cleanup errors are not surfaced. Closed-app ringing is opt-in for one identity per phone.

Nostr Inspect#

Nostr Inspect, an event-inspection tool formerly called Nostr Events Monitor, adds browser-side signature and content-ID checks, address lookup and relay-copy status, plus exact-event or latest-address sharing. Latest means the newest valid copy observed from queried relays, which may withhold other copies. Shared search filters run ordinary searches on opening; streaming needs a user start. The rename resets existing browser settings and repeats the walkthrough once. These changes are merged source work.

Bark#

Bark @npub1mgvl...e7q2, a browser extension using NIP-46 remote signing, serializes signer handshakes so concurrent requests wait for the existing attempt. Each handshake keeps its own signer; superseded work cannot clear a replacement connection or return its signer. Failed candidates close, stale relay-health results are ignored, and the current signer can still request approval. This is merged recovery work; live Heartwood hardware-signer acceptance remains unverified.

NoorNote#

NoorNote (maintainer: @npub175nu...g6w0), a Nostr client, adds website-manifest cards with normal note interactions, a Websites profile tab and named-site address routing. Unsupported-event cards gain navigation and copy/raw-event menus. Website support is display-side development: it neither publishes sites nor adds manifests to ordinary feed filters. Gateway and source links open on user clicks; the client does not automatically fetch or validate website contents.

Wisp#

Wisp (maintainer: @npub1utx0...50e8), a Nostr client, adds Android signature verification before delivery and deduplication, preventing invalid events with matching IDs from hiding valid posts. Verification uses bounded workers and fails closed; authentication also fences stale identities. The write queue remains unbounded.

Meiso#

Meiso (maintainer: @npub1gzuu...a5ds), a task app, adds automatic synchronization safeguards in 1.4.1: failed reads no longer become empty lists, publishing requires a successful session fetch, and large list shrinkage needs confirmation. Failed sends remain pending synchronization. Manual sync bypasses these guards, and local tasks absent remotely for 24 hours can still be deleted without causal deletion tracking.

ZapTracker#

ZapTracker (maintainer Pratik (pratik227): @npub1s56k...3h9f), a publishing dashboard, adds source-level RSS and Atom publishing as articles or short posts, plus media and self-thread export/import. Automatic publishing requires the app to remain open with a signer and handles at most three new items per feed; backlog publishing is manual. Deduplication is account-local, so clearing history can permit repeats.

Formstr Drive#

Formstr Drive @npub1qu7d...7p98, an encrypted file-sharing app, moves files into single encrypted Blossom blobs and adds range previews and key-separated sharing links. Partial previews require server range support. Folder-share creation remains unwired, and old sharing links are intentionally incompatible, although old blobs remain readable.

Safebox Acorn#

Safebox Acorn (maintainer Tim Bouma: @npub1q6mc...x7d5), a wallet component, adds a validated private-message reader and recipient inbox routing using NIP-17, Nostr's private messaging protocol. Landed code checks envelope signatures and author/recipient agreement, separates payment envelopes from ordinary chat, and reports absent routes explicitly. Ambiguous sends require checking before resending. Retrieval stops at 100 outer events, including excluded payment envelopes.

Minibits#

Minibits, an ecash wallet, adds persistent NIP-17 conversations for text, ecash and payment requests, with unread indicators and unknown-contact requests. Separate sender copies and message deduplication prevent outgoing funds from being counted as incoming. Conversations display at most 500 messages without paging; relay acceptance leaves delivery and reading unconfirmed.

LaWallet#

LaWallet, a wallet service, merges an OAuth 2.1 MCP interface for balance, invoice and payment tools, with explicit permissions and daily connection budgets. A companion listener-secret safeguard restricts stored-secret fallback to the configured origin. Pending and unknown payments remain accounted for, but concurrent grants lack a global exactly-once guarantee, and fee reserves do not enforce a total fee cap.

Zap Cooking#

Zap Cooking @npub1xxdd...kt7a, a recipe-sharing client, makes Fresh the default feed, with an isolated relay connection and public 14-day access. Deeper history and topic access request NIP-42 relay authentication lazily, limiting unsolicited identity disclosure. Merged comment interoperability changes preserve root and parent relationships when reading and replying. Relay policy controls access; reply counters still omit some comments.

Later main changes route reactions, comments and zap-receipt requests, plus reposts and lists, through authors' write relays, recipient read relays and the app list. Lists omit recipient fan-out; group events stay on Pantry. Routing failure can still fall back to the pool. Extension and remote-signer relay login gets one attempt per account, relay and page load; reconnects may remain logged out until reload. Pantry and local keys are exempt. Members also gain topic-labeled day and month archives, subject to relay access and paging limits.

Kehto / Paja#

Kehto's Paja transport, for ContextVM remote tool calls over Nostr, adds bounded oversized transfers and streaming progress. Server identity and typed request tokens prevent chunks or progress from attaching to the wrong concurrent request; completed transfers require matching byte length and hash. Idle probes monitor streams, while the final response or deadline determines completion.

Notedeck#

Notedeck @npub18m76...q955, a desktop Nostr client, lets its Dave AI-agent conversations exceed individual note limits through UTF-8-safe signed multipart messages and reassembly. Readers check authorship and part completeness before reconstructing messages. Older devices display separate parts; reconstruction requires every part locally.

diVine#

diVine (maintainer: @npub1wmr3...g240), a video-sharing client, adds author-checked comment deletion across pages, reconnects and live updates using NIP-09, Nostr's deletion-request protocol. Merged code waits for a relay acknowledgement before reporting deletion success and caches the user's deletion requests for offline reads. A two-second lookup timeout leaves comments visible, and live filtering requires a comment-kind tag.

Conduit#

Conduit @npub1nkfq...2svu's public Nostr reader/writer adds verification against detached canonical signed fields, separating relay provenance from mutable events. Relay settings permit another explicit edit and review while an earlier signed update awaits confirmation; exact retry preserves unsigned drafts, with counts behind “Confirmation details.” Signing and publication still serialize, with independent relay-list and inbox checkpoints. Observed provenance is not exhaustive relay coverage; external-signer behavior and public-relay convergence remain unverified.

Buzz#

Buzz @npub16l0c...yj9s, a community relay, adds community-scoped federation enforcement: the request host selects the community, which must authorize the issuer before signing-key retrieval, and the assertion audience must match that community. Merged shadow-mode evaluation records would-deny outcomes across HTTP, WebSocket and audio without denying admission or closing observed sessions. Enforcement requires operator-supplied community configuration; shadow metrics exclude some earlier refusals.

Merged work keeps agent-to-agent replies inside threads and retries uncertain sibling-agent authorization lookups while denying the current event. An optional read-state/sidebar API remains disabled by default: database operators can read its plaintext state, and it does not synchronize with legacy read-state events. Deletion cleanup purges retention-free read-state and heartbeat rows with their mentions; ordinary deleted history remains soft-deleted.

New Projects#

cvm-registry#

cvm-registry caches ContextVM service discovery, using a curator allowlist and explicit fresh or expired catalog states to help users assess service listings. This static discovery dashboard makes catalog age visible, but its restaurant demonstration does not invoke services, make payments or settle transactions.

Nostr Workshop#

Nostr Workshop's phone milestone provides phone-oriented learning tasks, a signer bridge and encrypted key backups, with published results updating task progress. The browser signer holds the unlocked private key in plaintext per-tab sessionStorage until Lock; lasting use calls for transferring the encrypted backup to a dedicated signer. The newer source milestone is not attested to the listed APK.

Nostella#

Nostella's experimental relay mesh authenticates forwarded requests and gives them stable identities to stop recursive amplification. Bounded forwarding to ordinary relays preserves filters and limits. Remote results arrive after the local end-of-stored-events signal, so clients that close their subscription at that signal miss those results.

nope-mcp#

nope-mcp adds connector metadata and default open-license filtering to educational-resource search across Nostr relays, exposing it through a public MCP interface without signing or mutation tools. Resources missing license tags are excluded by default.

Vitals#

Vitals implements owner-authorized monitoring sessions, with a Linux daemon sending ephemeral machine reports encrypted using NIP-44, Nostr's encrypted-message format. Five-minute keepalives extend a seven-minute session timeout. Closing the browser sends no signed stop, leaving monitoring to expire by timeout; the daemon is a prototype.

grasp-go-proxy#

grasp-go-proxy exposes Nostr repository discovery to Go tooling, resolving npub, naddr and NIP-05 human-readable identifiers for NIP-34 Git repository announcements into go-import metadata pointing at existing Git hosts.

Keythra#

Keythra adds a Mac-mediated remote signer using NIP-46, Nostr's remote-signing protocol, forwarding authorized applications' requests to an iPhone or local authenticator. Each signing, encryption or decryption operation requests user verification, with event IDs derived from approved fields. This remains a prototype source milestone: the Mac bridge must stay running, Nostr keys remain in software storage.

Protocol and Spec Work#

Profile image metadata matched by exact URL#

The merged NIP-92 profile metadata change lets clients associate profile pictures and banners with NIP-92, the media metadata format, only when URLs match exactly. Clients ignore unmatched tags and may use fallback URLs if the primary fails. Updates preserve metadata for unchanged fields and drop obsolete tags; the merge establishes specification behavior, not shipped client support.

Signed descriptors for napplets#

The open napplet proposal, for self-contained HTML applications, now uses a signed descriptor tied to one HTML hash. It declares required and optional capabilities, intents, icons and a plaintext description, replacing the aggregate/path model. HTML publishing metadata cannot override the signed descriptor's authority; this remains proposed protocol text.

The napplet CLI v0.7.0 implements the descriptor format and offline migration. Unattended publishing defaults to the current format; a temporary explicit legacy option supports older shells. Migration verifies the original signed event and emits an unsigned template for review, without fetching, executing, signing or publishing its HTML. Ambiguous multi-file manifests must be rebundled, and permission and storage identities change to the artifact hash. Explicit unknown capability declarations are retained with warnings; shells still decide whether they can load the app.

Financial cashtags with separate binding and indexing#

The financial cashtag proposal separates a cashtag's location in text from its indexed financial identity. Non-indexed cashtag tags bind text using UTF-8 byte offsets, while NIP-73, the external-identifier tagging convention, supplies i tags for symbol and instrument indexing. The proposal covers ISIN, FIGI, CAIP-19 and ISO-4217 identities, not prices or payments; implemented adoption is not established.

Marmot membership requests and receipts#

A proposed Marmot membership workflow, for encrypted group messaging, adds optional inner kind-458 requests, rejections, withdrawals and Applied receipts. Administrators independently validate KeyPackages, and an Applied receipt requires a matching accepted Commit. These checks tie receipts to accepted membership changes; the fixtures assume Messaging Layer Security group-key authorization facts and do not prove convergence.

Marmot multi-device pairing security#

Merged Marmot multi-device design notes introduce private, single-use KeyPackages, a device-group roster, commitment-based pairing and ordered settings. The design addresses substitution, KeyPackage reuse and offline-searchable pairing. Normative wire definitions and interoperable device support remain unfinished.

Wallet Connect commission invoices#

The unimplemented Nostr Wallet Connect commission proposal, for wallet-to-app communication, adds an optional make_commission_invoice permission governed by user-confirmed rate, payee, fee and budget limits. Shared-hash hold invoices coordinate payments, with idempotent retries to prevent duplicate requests. A preimage does not prove payment, and client delays and colluding routing remain risks.

Cyberspace virtual brackets#

The Cyberspace spatial protocol specifies virtual brackets for games identified by their public keys. An enter-virtual action names the game in a p tag and records base and game positions; an exit returns to the entry’s base position. Verifiers follow links through unrecognized actions and compare recognized positions with the preceding recognized action, so a skipped action that moved the identity invalidates the chain. Existing client verifiers still need implementation changes.

NIP Deep Dive: NIP-05 and NIP-24#

NIP-05, human-readable account identifiers, connects local@domain to a public key; NIP-24, additional profile metadata, makes public presentation portable across clients. The NIP-05 specification is merged, final and optional. The NIP-24 specification is merged, draft and optional: draft describes its maturity, not a newly opened proposal.

Checking an account name#

After validating the signed profile, read nip05 from its JSON-string content. Split the identifier and request https://<domain>/.well-known/nostr.json?name=<local> over HTTPS, ignoring redirects. The local part permits a-z0-9-_.; the response's names[local] must equal the author's hexadecimal public key. Optional relays supplies discovery hints, not authenticated relay endorsements. _@domain is a root identifier that may display as the domain, according to the lookup specification.

Identifier-first discovery fetches the mapping, then the key's profile and matching claim. Follows retain the public key: domain reassignment invalidates the old name association without transferring the follow. This proves an association, not legal identity or biography; the email-like string implies no mailbox. Missing names, mismatched keys, invalid JSON, redirects and unreachable endpoints cannot establish it. Browser CORS failures are indistinguishable from other fetch failures under the NIP-05 rules.

The identifier server receives the requested name and may observe the client's network origin. External profile images can also reveal browsing activity to their hosts. Neither specification supplies a universal privacy proxy or cache policy; changing mappings require revalidation. NIP-05 began with June 18, 2021's DNS-name introduction, followed by December's well-known JSON revision.

Portable metadata and its limits#

NIP-24 adds optional display_name, website, banner, Boolean bot and object birthday, whose year, month and day may each be omitted. Authors should still supply name; deprecated displayName and username should be ignored or removed. Partial birthdays reduce disclosure, but supplied details remain public. The metadata specification defines fields, not universal recovery from wrong types, invalid dates or duplicate keys.

Generic r, i, title and lowercase t tags mean web URL, external identifier, named item and hashtag unless a more specific specification overrides them. Historical kind-3 relay-map content is deprecated in favor of NIP-65, relay-list metadata. NIP-24's introduction was authored September 24 and committed September 26, 2023. NIP-92, media attachment metadata, now permits profile-image descriptions through URL-matched imeta tags.

One signed profile, both specifications#

This kind-0 profile was recovered from relay.damus.io on October 6. Under NIP-01, basic event structure, id is the canonical event hash, pubkey the signing identity, created_at the author-provided Unix timestamp, kind:0 the replaceable profile type, tags the event tags, content the exact profile JSON string, and sig the signature. The event specification authenticates payload integrity, not its truth.

json

{
  "kind": 0,
  "id": "700f005cff9fcd93268053f9fda0d4f3cccb0847fc6aa4547ba80c622b98aa3a",
  "pubkey": "208ad03138eb32da4b3fb2edb79d13a8e3532842db627d76aff8168db564a0e9",
  "created_at": 1791295764,
  "tags": [
    [
      "client",
      "Nostrich"
    ]
  ],
  "content": "{\"name\":\"calavera\",\"nip05\":\"calavera@primal.net\",\"about\":\"Audentes Fortuna Iuvat\\nLe mie gesta sul video ludo 👇\",\"lud16\":\"solartern74@nostrich.org\",\"display_name\":\"Manny Calavera\",\"picture\":\"https://m.primal.net/OHcz.jpg\",\"banner\":\"https://m.primal.net/OHdW.gif\",\"website\":\"https://rumble.com/user/HomoLudensArchive\"}",
  "sig": "9bc7be81b87a7db10f812e23181fda38d5e369c49d9a52757b16fb4ff0ad544abb24486b346382d5f43fc127794ac0562d80e6e4a7df8489512f40ffbedcf670"
}

Here name is the short label, display_name the richer label, and nip05 the separately checked association. picture and banner are image URLs, website an author-supplied link, and about self-description. lud16 is a payment-address extension, not identity verification. The client tag self-asserts application context. No imeta, bot or birthday appears; NIP-24's optional fields need not all be present.

Implementation boundaries#

Amethyst's lookup client compares the mapped key, while its birthday decoder ignores undecodable birthday fields and retains the profile. The Damus client's lookup models names without explicit redirect rejection in that file, and its profile bindings expose display name, website and banner. The rust-nostr library's identifier types support root lookup and relay hints, while its metadata decoder preserves custom JSON but can reject wrong types in known fields.

Top Stories#

Ants#

Myco#

Marmot MDK#

Iris Chat#