Two things:
1. Platform fee address → [email protected] (verified live:
allowsNostr + nostrPubkey, 1-sat min, working callback). coinos is
Nostr-native and PUBLISHES zap receipts, unlike strike.me whose flaky LNURL
+ never-published receipts caused the platform-share pay timeouts and the
missing zap tallies. The 30% platform fee is unchanged — only the rail.
2. Double-pay guard (bug found while diagnosing): on a `pay_invoice` timeout,
nwcClient's nip44->nip04 encryption-fallback resent the request — but a
timeout is ambiguous (the wallet may already be paying), so the resend
could DOUBLE-SPEND. shouldRetryWithFallback now refuses to auto-resend any
spending method (pay_invoice/pay_keysend/multi_pay_*) on timeout; read-only
methods and explicit unsupported-encryption rejections (wallet never paid)
stay retryable. The manual "Send again" retry is the safe path for a real
payment timeout.
Tests: tests/nwc-pay-timeout-no-double-spend.test.mjs (4). Lint + build green.
Co-Authored-By: Claude Fable 5 <[email protected]>
Set the default policy to hide-foreign for live feel-testing: foreign/ingested
cards stay hidden until a source verifies (no flash of dead strangers), while
native/own cards keep showing instantly. Revert to "show-pending" if it feels
worse.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Makes the card liveness-visibility behavior switchable so it can be A/B
feel-tested, and probes ahead of the scroll for a snappier result.
- CARD_LIVENESS_POLICY (config/instance-config.js): "show-pending" (default,
unchanged) | "hide-foreign" (foreign/ingested cards hidden until a source
verifies; native cards stay show-pending) | "hide-all". Owner's own cards are
always visible. Flip live for testing without a rebuild:
window.__BITVID_CARD_LIVENESS_POLICY__ = "hide-foreign" then refresh/scroll.
Implemented via a data-foreign provenance flag on the card +
getCardLivenessPolicy() in cardSourceVisibility.js.
- LIVENESS_PROBE_PREFETCH_MARGIN (default 600px): both liveness probes were
already viewport-gated (IntersectionObserver, on-screen-first, WebTorrent
priority-queued + concurrency-capped); this expands their rootMargin so cards
just below the fold verify before the user reaches them.
- Tests: three policy scenarios in tests/video-card-source-visibility.test.mjs;
also un-broke 3 pre-existing VideoCard tests by adding the missing
IntersectionObserver JSDOM stub.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Deep dive into the "nothing loads / Fetching recent videos… hangs" symptom
found the real blocker: it was NOT the moderation/WoT stage (that uses
cached reads and passes unknown authors through clean). It was the feed's
resolve-posted-at stage.
resolveVideoPostedAt() short-circuits when a video has nip71.publishedAt,
otherwise it does a per-video `nostrClient.hydrateVideoHistory()` network
fetch (looking up kind-30078 history). Foreign NIP-71 videos have no such
history, and the ingest adapter wasn't setting nip71.publishedAt — so a
burst of ~32 ingested videos triggered ~32 blocking history fetches that
stalled the render and flooded relays.
Fix: the ingest adapter now surfaces nip71.publishedAt from the NIP-71
published_at tag (falling back to created_at). The feed short-circuits and
never fetches history for ingested videos. Re-enables FEATURE_NIP71_INGEST
by default now that the hang is addressed.
Tests: adapter published_at extraction + created_at fallback;
mutation-verified. 1237/1238 unit (known UploadModal flake).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Ingest's data path is verified working (subscribe -> fetch -> adapt ->
inject -> survives the whitelist filter), but surfacing a burst of
ingested authors pushes bitvid's moderation/WoT stage to hydrate trust +
report data (kind 30000 / 1984) for many cold authors at once, storming
relays and stalling the feed render ("nothing loads"). The native feed
avoids this only because it trickles authors in gradually.
Flip FEATURE_NIP71_INGEST default to false to restore a stable feed for
launch. All ingest code stays in place behind the admin toggle; re-enable
once moderation/WoT hydration is bounded/non-blocking for an author
influx, or whitelisted authors are treated as pre-trusted (skipping the
WoT fetch). Tracked as the next NIP-71 increment.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Foundation for inbound NIP-71 ingest. Adds a single admin switch in the
instance config (config/instance-config.js, default true), re-exported
through config.js and surfaced as a runtime-overridable flag in
constants.js — same pattern as FEATURE_NIP71_MIRROR / ALLOW_NSFW_CONTENT.
A deployer flips one constant to disable all inbound ingest if it ever
causes problems (spam, low-quality content, performance). The ingest
adapter + service (gated on this flag) land in follow-up commits; its
behavioral test will assert the service is inert when the flag is off.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Added a new configuration variable `ENABLE_NIP17_RELAY_WARNING` to `config/instance-config.js` (defaulting to `false`) to control the display of NIP-17 relay fallback warnings. Updated `js/ui/profileModalController.js` and `js/app.js` to respect this setting.
This change allows instance operators to disable "Privacy warning: direct messages are using your default relays because no NIP-17 relay list is available" and related notifications.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add explicit security comment to config/instance-config.js
- Add regression test to verify IS_VERBOSE_DEV_MODE is false
- Verify IS_DEV_MODE is false
Note: The configuration file was found to be already set to `false` in the environment. This change enforces the policy.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduces a race condition between the primary playback source (URL or Torrent) and a configurable timeout. If the primary source fails to reach the 'playing' state within the timeout window, the system automatically falls back to the alternative source.
- Adds `DEFAULT_PLAYBACK_START_TIMEOUT` to instance config (3000ms).
- Updates `PlaybackService` to implement timeout logic using `withTimeout` wrapper.
- Ensures proper cleanup of stalled attempts (resetting video element, destroying torrent client).
- Added `DEFAULT_PLAYBACK_SOURCE` to `config/instance-config.js` to allow choosing between "url" (default) and "torrent" priority.
- Updated `js/constants.js` to derive `URL_FIRST_ENABLED` flag from the configuration.
- Refactored `PlaybackService.execute()` in `js/services/playbackService.js` to robustly support "Torrent First" logic with fallback to URL, while maintaining "URL First" with fallback to Torrent.
- Added unit tests in `tests/services/playbackService_order.test.mjs` to verify playback order and fallback mechanics.
- Add `js/s3-quick.js` with `uploadWithManifest` and `uploadWithKeys`.
- Update `components/upload-modal.html` to add "Use presigned manifest" toggle and warning.
- Update `js/ui/components/UploadModal.js` to wire up the manifest upload flow.
- Add local persistence for quick S3 settings (though mainly handled by existing storage settings).
- Ensure keys are only used for client-side uploads or replaced by manifest flow.
This change introduces `LOCKDOWN_TITLE` and `LOCKDOWN_MESSAGE` constants in `config/instance-config.js` and exposes them via `js/config.js`. It updates `components/lockdown-modal.html` to include IDs for the title and message elements, and modifies `js/index.js` to dynamically populate these elements with the configured text when initializing the lockdown interface. This allows instance operators to customize the maintenance mode appearance.
No new tests were added as this is a configuration and UI text update, but `tests/auth-service.test.mjs` was run to ensure no regressions in auth logic during lockdown.
- Updated `DEFAULT_TRUSTED_MUTE_HIDE_THRESHOLD` in `config/instance-config.js` from 1 to 20.
- Updated `tests/moderation/trusted-mute-lists.test.mjs` to explicitly override the threshold to 1 for tests verifying the hide mechanism.
- Updated documentation (`docs/moderation/*.md`, `docs/instance-config.md`, `content/community-guidelines.md`) to reflect the new default and upstream examples.
- Verified that existing blurring logic in `js/feedEngine/stages.js` and `js/ui/components/VideoCard.js` handles the intermediate state (1-19 mutes) correctly.
- Removed `WATCH_HISTORY_LEGACY_KIND` (30078) support from watch history fetch and config.
- Removed `WATCH_HISTORY_LEGACY_LIST_IDENTIFIERS` from config.
- Removed `LEGACY_EVENTS_STORAGE_KEY` (bitvidEvents) migration logic from client.
- Removed `loadLegacyAdminState` and `LEGACY_STORAGE_KEYS` from admin list store.
- Updated tests to remove references to legacy kinds.
Migrates watch history persistence from Kind 30078 (Application Data) to Kind 30003 (Bookmark List) to resolve blocking issues on some relays. Updates fetch logic to query both kinds for backward compatibility.
