Others' flyers now offer a "Report" action (in the ⋯ menu, alongside
Block) that publishes a signed kind-1984 report: a category picker
(spam / illegal / impersonation / other → NIP-56 report types) plus an
optional free-text reason, tagged with the flyer (e) and author (p) so
other clients and moderators can aggregate it. Reporting also hides the
flyer locally, pairing with the existing per-device blocklist. Requires a
usable signer (device key or NIP-07); pasted-nsec viewers get a clear
"connect to report" message, same as delete.
Adds 11 localized strings across all 14 languages (i18n parity passes).
Test: report publishes a kind-1984 event with the right p/e tags + type +
reason and hides the row, across all 6 engines. Full suite 342 passing.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The editor can now sign flyers via a NIP-46 remote signer: paste a
bunker:// link and the user's secret stays in their signer app
(nsec.app, Amber, …) while the browser holds only an ephemeral local
key. The vendored nostr-tools bundle has no nip46 module, so the client
is hand-rolled over a raw WebSocket — kind-24133 JSON-RPC encrypted with
NIP-44 (with a NIP-04 decrypt fallback), running connect →
get_public_key → sign_event. Connections are session-only; the bunker
token is never written to disk, so a reload returns to anonymous.
Switching to/from any other identity mode disconnects the signer, and a
successful connection mirrors the user pubkey to the board's connected
key. Adds 9 localized strings across all 14 languages (i18n parity test
passes).
Tested with a fake relay/signer doing real NIP-44 crypto: full connect →
get_public_key → sign_event → publish round-trip, across all 6 engines.
Full suite 312 passing.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Board trust filter now also includes follows-of-follows (degree 2): on
connect it fetches the viewer's NIP-02 follows, then the kind-3 lists of
those follows (capped at 150 authors), and trusts the union. Brand-new
keys still fall back to the curator seed; no-data still falls back to
show-all.
A deliberate editor identity choice (NIP-07 / imported / generated /
unlocked nsec / anonymous) now writes a shared local pubkey that the
board reads, so the same person sees a consistent identity across pages.
Tests: degree-2 inclusion (A direct, B friend-of-friend shown; stranger
C hidden) and editor→board key sync, across all 6 engines. Full suite
306 passing.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Three quick-ish wins:
- "My flyers" board filter: a checkbox that shows only the connected user's own
flyers (overrides the trust filter, since your own may not be in your follow
graph). New mine_only string × 14.
- Author display names: the board fetches authors' kind-0 metadata and shows
the display name (falling back to the npub) instead of a bare key. Names are
untrusted — escaped at render and length-capped. (NIP-05 verification is still
future.)
- Wrong-PIN lockout: after 3 bad PINs the editor refuses to unlock a remembered
nsec for a 30s cooldown, persisted across reloads so it isn't reset by a
refresh. A deterrent against casual on-device guessing (a leaked blob is still
offline-brute-forceable). New too_many_attempts string × 14.
Adds e2e for each; the i18n guard enforces the new strings in all 14 languages.
294 e2e across all six engines; roadmap updated.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Two quick, high-value wins:
- i18n guard (e2e/i18n.spec.js): a pure-Node test that fails if any NOSTR_UI /
BOARD_UI / locales dictionary is missing or has an extra key in some language.
It immediately caught field_too_long, which was English-only — so non-English
users saw the English "that field is too long" message. Added the missing
translation to all 13 other languages.
- Publish transparency: the confirmation modal now shows "Relays accepted: N / M"
(relays_accepted string × 14) and flags a zero-acceptance publish in red, so a
weak publish is visible immediately instead of discovered later.
276 e2e across all six engines; roadmap updated.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add inline management to the board for the connected viewer:
- On your own flyers: Edit (links to /?edit=1#<naddr>, which the main client
now honors by loading the flyer straight into the editor), Re-broadcast
(re-sends the already-signed event to all relays — no signing), and Delete
(replaceable tombstone + NIP-09, signed via the device key or NIP-07; a
pasted-nsec connection is pointed to the editor where the key is available).
- On flyers from others: Block — a per-device blocklist of author pubkeys
(voxvera_blocked_pubkeys) that always hides them, with a "Clear blocked"
control. This is roadmap #1's local blocklist direction.
The board hides tombstoned flyers (newest-version-wins so a delete can't be
undone by an older copy). New non-sortable actions column; a board delete-
confirm modal; 12 new strings × 14 languages. Adds e2e for block (hide/persist/
clear), own-vs-other actions, and board delete (tombstone + NIP-09 published),
plus a ?edit=1 deep link. 234 e2e across all six engines; docs updated.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Authors can now manage a published flyer from the editor when it's loaded from
an event (author-only — the active signing key must match the flyer's author):
- Edit: change fields and publish again; the same d-tag replaces in place.
- Re-publish (keep-alive): re-sign + re-broadcast the current content so relays
that prune app-data don't age the flyer out. Partially addresses roadmap #4.
- Delete: belt-and-suspenders across relay behaviors —
1) a replaceable TOMBSTONE (same kind+d, payload deleted:true + a ["deleted"]
tag) that overwrites the flyer's content, so the board/viewer hide it even
on relays that ignore deletions, and
2) a NIP-09 deletion request (kind 5) for the addressable a-tag + event id.
Confirmed via a modal; framed as best-effort, not a guarantee.
Tombstone recognition: the board's parseFlyers keeps the newest event per
(pubkey, d) and skips it when that newest version is a tombstone (so a delete
can't be reversed by an older copy arriving later); the viewer renders a
localized "This flyer was removed." state.
Adds the loaded-flyer actions UI + a delete-confirm modal, 11 new strings ×
14 languages, a Python schema test for the tombstone payload, and e2e for the
delete flow, board hiding, and the viewer removed state. 216 e2e across all six
engines; docs (spec/roadmap/README) updated.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Link a small inline SVG (site/favicon.svg, a red tile with a white "V") from
both index.html and board.html via a root-absolute href, so it resolves from
"/" and from "/board/" under Vercel cleanUrls. With an icon link present,
browsers stop auto-requesting (and 404ing on) /favicon.ico. No binary asset and
no external dependency, consistent with the self-contained client.
e2e asserts both pages declare the favicon and that /favicon.svg is served as
valid SVG. Closes the last code-finishable item in the roadmap's smaller list.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add a "Shipped so far" summary (board login gate, web-of-trust filter, editor
publishing identity with PIN-encrypted nsec) and refresh the review footer:
the trust model is now implemented, so #3 (centralized client distribution) is
the highest-leverage untouched item.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Let authors publish a flyer under a stable, identifiable key when they want
one, while keeping anonymous-by-default. The editor now signs under one of
three identities, routed through activeIdentity()/signActiveEvent():
- Anonymous (default, unchanged): the per-device key, signed locally.
- NIP-07 extension: signs via window.nostr.signEvent; the secret never
enters the page.
- Imported nsec: decoded to a key used to sign. By default the secret lives
only in memory for the session. "Remember on this device" stores it
encrypted with a PIN (PBKDF2 SHA-256, 600k iterations, random salt ->
AES-GCM-256); the plaintext secret is never written to storage. On reload a
remembered key is locked until the PIN is entered; a session-only key falls
back to anonymous.
The signer pill, author npub, naddr, and poster URL all follow the active
identity. New identity controls are localized across all 14 languages.
Security note (also in docs): a short numeric PIN is brute-forceable offline
if the encrypted blob leaks, so it guards casual snooping, not a targeted
attacker — the NIP-07 path is stronger, and NIP-46 is a documented follow-up.
The minimum PIN is 4 digits but longer is allowed and encouraged.
Also updates README, the client spec (new "Publishing identity" section),
the roadmap (#1/#2 marked in progress with phases shipped), and the e2e
README. Covered by the cross-engine Playwright suite (default-anonymous,
NIP-07 connect + publish, session-only nsec without persistence, invalid
nsec, PIN encrypt -> lock on reload -> wrong/right PIN -> unlock, and forget).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Mark board moderation (#1) and authenticity (#2) as Planned and add a joint
"identity + web-of-trust on the board" direction:
- Login enables a trust-filtered view, not access control (you cannot gate
writes to public relays; you filter what the board displays).
- Keep anonymous creation + printing available; require identity only to
appear on the public board.
- Web-of-trust (NIP-02 follow graph) is the real spam defense, since keys are
free; login alone is just a soft deterrent.
- Support NIP-07 plus nsec import / NIP-46 / promoted anon key so mobile (the
scanned-QR audience) isn't locked out.
- Phased plan (identity → WoT filter → blocklist/report/NIP-05) and the two
open decisions: gate viewing or not, and which login methods at launch.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add docs/roadmap.md capturing product/threat-model gaps that are not code
bugs, in priority order: (1) bulletin board has no moderation/abuse story,
(2) anonymous keys give no authenticity, (3) client distribution is
centralized on one domain, (4) relay permanence is overstated, (5) minimal
content-safety guardrails, plus smaller items. Each entry notes the problem,
current mitigation, why it matters, and possible directions.
Link it from the README and the spec's bulletin board section.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
