From 82a6260c573841a98a72b4592a9f7d0cd565bdb3 Mon Sep 17 00:00:00 2001 From: The Daniel Date: Sat, 5 Sep 2026 23:43:49 -0400 Subject: [PATCH] docs: bring the README up to 1.12.0 Notifications gained replying in place and the web-of-trust sort, and the bullet still described only the bell and mute lists. The relay bullet now mentions per-relay icons and the health check. NIP-42 was described as signing AUTH challenges automatically, which undersold the fix and oversold the scope: it is answered for the account's own relays only, and it now covers reads, which is what was actually broken. Two rows were missing from the protocol table: NIP-11, which is where the relay icons and health verdicts come from, and NIP-22, which has carried web comments since 1.7.0 and now also carries replies to them. --- README.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 78644d0..ff9dd8e 100644 --- a/README.md +++ b/README.md @@ -41,10 +41,10 @@ Connect) and a composer for posting notes directly from the panel. - **Multiple accounts** — store as many nsecs as you like, drag to reorder, switch the active one in a click. Importing shows a profile preview (name + avatar) so you can confirm the right key before saving. Generating a new key runs a quick guided setup (name, photo, bio). Reveal a key behind your PIN — with a QR for quick sign-in on mobile clients. - **PIN-protected** — every private key is encrypted at rest (PBKDF2 → AES-GCM, WebCrypto) under a PIN of at least 8 characters, with a live strength and match check when you set it. Nothing is stored in plaintext, and the keystore re-locks automatically. A paste guard blocks dropping an nsec anywhere except the import field. - **In-extension signing** — implements the full NIP-07 surface: `getPublicKey`, `signEvent`, `nip04`/`nip44` encrypt & decrypt, and `getRelays`. -- **Per-site permissions** — approve or reject each site, per method, with a clear prompt that previews what you're signing (human-readable event-kind labels, plus a heads-up on unusual or unrecognized kinds). Relay auth (NIP-42) signs automatically so clients stay connected. A burst of requests queues visibly — you can see how many are waiting and clear the whole backlog in one tap — and nothing is silently lost if the panel closes or the extension restarts. The prompt appears on the browser window you're actually using, and repetitive background work — app-settings syncs, loading a DM inbox — is handled without a prompt for each, while notes, reactions, and DMs still confirm. +- **Per-site permissions** — approve or reject each site, per method, with a clear prompt that previews what you're signing (human-readable event-kind labels, plus a heads-up on unusual or unrecognized kinds). Relay sign-in (NIP-42) is answered for your own relays, for reading as well as posting, so relays that gate reads stop returning nothing. A burst of requests queues visibly — you can see how many are waiting and clear the whole backlog in one tap — and nothing is silently lost if the panel closes or the extension restarts. The prompt appears on the browser window you're actually using, and repetitive background work — app-settings syncs, loading a DM inbox — is handled without a prompt for each, while notes, reactions, and DMs still confirm. - **Per-site account binding & wrong-account guard** — each site stays pinned to the account it logged in with (no NIP-07 desync), and you can move a site to another account from **Connected Sites**. When a site is signed in with more than one of your accounts — as multi-login clients like Jumble, YakiHonne, and Primal allow — every content sign confirms who's posting, so a client's own account switcher can't silently sign as the wrong key. After you switch the active account, Sidecar offers to reload the open client so the change takes effect there. - **Identity from your profile** — account names and avatars are imported from your kind 0 metadata; view and edit your profile, see your following count, and publish kind 0. If your profile's lightning address doesn't match your connected wallet, Sidecar offers a one-tap sync. -- **Outbox relays (NIP-65)** — view, edit, and publish your relay list (kind:10002) with per-relay read/write markers, right from your profile. +- **Outbox relays (NIP-65)** — view, edit, and publish your relay list (kind:10002) with per-relay read/write markers, right from your profile. Each relay carries its own icon (from its NIP-11 document), and an on-demand health check reports whether it answers, gates on payment or login, or holds none of your notes. - **Backups** — encrypt your profile, follows, and mute list to your own key and store them on your relays (NIP-78), or export a signed JSON bundle. Back up a single account's key as an `nsec` or a password-encrypted NIP-49 `ncryptsec`, each revealed behind your PIN with an auto-hiding QR. - **Vault backup** — export every account *and* its wallet connection into one password-encrypted file, and restore it on another device (separate from a single account's key backup). - **Follow-list recovery** — if a buggy client overwrites your follows with an empty or shorter list, scan your relays for an earlier kind:3 and republish a healthy version. Powered by [Mutable](https://mutable.top). @@ -54,7 +54,7 @@ Connect) and a composer for posting notes directly from the panel. - **Link previews** — plain URLs show an OG meta card (title, description, thumbnail) fetched through the extension with no third-party service. - **Media upload** — attach images and video; uploads go to your own Blossom servers (from your kind:10063 list) when available, falling back to nostr.build. - **Client tag, your call** — posts carry a `client` tag attributing them to Sidecar; turn it off in Settings to post untagged. -- **Notifications** — a bell in the header shows replies, mentions, reposts, reactions, and zaps for the active account — each with the sender's name, a content preview, and a tap-through that opens the note in your preferred client. Muted users (public and private mute lists) are filtered out. +- **Notifications** — a bell in the header shows replies, mentions, reposts, reactions, and zaps for the active account — each with the sender's name, a content preview, and a tap-through that opens the note in your preferred client. Replies and comments can be answered without leaving the panel: the composer opens with what you're answering held above the editor, through the preview and the review countdown both, and follows NIP-10 for notes and NIP-22 for page comments. A web-of-trust sort puts your follows (and anyone ten of them follow) first, gathering everyone else into a counted group at the bottom rather than hiding them — a denylist can't outrun key rotation, but an allowlist that hides is how you miss the one reply that mattered. Muted users (public and private mute lists) are filtered out. - **Lightning wallet (NWC)** — connect any self-custody Lightning wallet over Nostr Wallet Connect. Send (BOLT11 or lightning address via LNURL-pay), receive (invoice or your lightning address, with a QR — also surfaced as a card on the wallet page), view live balance (auto-updating via NIP-47 notifications) and paginated history, and back up the connection to your relays — or export it (PIN-gated, with a QR) to move it to another app. New to Lightning? Built-in **wallet suggestions** point you to NWC-capable options. Sidecar never holds your funds. - **WebLN provider** — web apps can pay and make invoices through your connected wallet (`window.webln`), gated by an approval prompt with an optional per-site daily budget you can edit or revoke any time. - **Pay invoices from any page** — when a Nostr client you're signed into shows a Lightning invoice, a **Pay with Sidecar** card appears so you can pay in a tap. You can also right-click a `lightning:` link, a selected BOLT11 invoice, or a QR image. @@ -170,12 +170,14 @@ dedicated, named support for: | [07](https://nips.nostr.com/7) | `window.nostr` capability | The signer interface itself | | [09](https://nips.nostr.com/9) | Event Deletion Request | Recognized and flagged in the signing prompt | | [10](https://nips.nostr.com/10) | Text Notes and Threads | Reply/mention recognition in notifications | +| [11](https://nips.nostr.com/11) | Relay Information Document | Relay icons and health verdicts in the relay editor | | [18](https://nips.nostr.com/18) | Reposts | Repost and quote-repost recognition | | [19](https://nips.nostr.com/19) | bech32-encoded entities | npub/nsec/note/nevent/naddr encode & decode throughout | | [21](https://nips.nostr.com/21) | `nostr:` URI scheme | Mention/embed rendering in the composer | +| [22](https://nips.nostr.com/22) | Comment | Commenting on any web page, and replying to those comments from notifications | | [25](https://nips.nostr.com/25) | Reactions | Reaction notifications | | [27](https://nips.nostr.com/27) | Text Note References | Inline `nostr:` mention rendering | -| [42](https://nips.nostr.com/42) | Authentication of clients to relays | Relay AUTH challenges are signed automatically | +| [42](https://nips.nostr.com/42) | Authentication of clients to relays | Relay AUTH challenges answered for the account's own relays, for reads as well as writes | | [44](https://nips.nostr.com/44) | Encrypted Payloads (Versioned) | `nip44.encrypt`/`.decrypt` NIP-07 methods; preferred encryption for backups and mute lists | | [47](https://nips.nostr.com/47) | Nostr Wallet Connect | The built-in Lightning wallet | | [49](https://nips.nostr.com/49) | Private Key Encryption (`ncryptsec`) | Password-encrypted key import/export |