WiltKey App 1.4.0 - critical BLE fix, wilting stories, sharing pixelart in chat

WiltKey v1.4.0 — Ephemeral Stories, In-Chat Pixel Art sharing & Critical BLE Pairing Fixes

WiltKey v1.4.0 is a major feature and stability update bringing 24-Hour Wilting Stories, In-Chat Pixel Art, Local Message Search, Private Contact Notes, and a critical fix for Bluetooth pairing.

---

🚨 Critical Bug Fix: Bluetooth (BLE) In-Person Pairing

• Resolved Instant Pairing Failures: Fixed a critical bug introduced in v1.3.5 where BLE pairing attempts could instantly fail immediately after pressing "Connect Devices" with errors like Bluetooth connection lost or PlatformException(requestMtu, device is disconnected).
• Robust GATT Handshake & MTU Negotiation: Overhauled BLE peripheral advertising, central scanner cleanup, and handshake state transitions. Connection timeouts and reconnections now clean up GATT services and subscriptions properly without leaving stale state that blocked pairing.
• Side-by-Side Exchange Reliability: Pad exchange and seed generation now proceed reliably across all supported Android devices.

---

✨ Major New Features & Enhancements

1. 24-Hour Wilting Stories (Zero-Knowledge Ephemeral Broadcasts)

• Contact-Keyed Ephemeral Posts: Share photos, pixel art, or styled text stories that automatically wilt and disappear after 24 hours.
• Zero-Knowledge Architecture: Stories are encrypted with an ephemeral 256-bit AES key wrapped individually for each mutual contact using their established metadata keys. The relay server cannot read story content, captions, or view media.
• Stories Reel: View active stories from mutual friends directly at the top of your Chats tab.

2. Full-Screen Story Studio & Creative Drawing Tools

• 9:16 Vertical Smartphone Ratio: Stories fit the full vertical screen of mobile devices without square clipping.
• Pan, Zoom & 90° Rotation: Scale, reposition, and rotate photos or pixel art artwork by 90° clockwise with one tap.
• Freehand Brush with Palette Integration: Draw freehand directly onto your stories using all unlocked and default color palettes (Classic, Pastel, Saturated, Edgy, Grasstoucher) with multiple brush sizes (S, M, L) and full Undo/Clear support.
• Draggable Themed Text Tags: Add multiple styled text stickers (Minimal, Cyberpunk, Matrix, Phosphor, Paper Scroll, Crimson) and drag them anywhere on the image.
• On-Device Flattening: The studio automatically rasterizes and compresses your entire composition into an optimized, zero-leakage WebP.

3. In-Chat Pixel Art & Avatars

• Direct Pixel Art Sharing: Draw and send custom 10x10 and 16x16 pixel drawings right inside 1:1 and group chats via the attachment sheet.
• Avatar Template Library: Save drawings to your template library for quick reuse.
• Interactive Message Actions: Long-press any pixel art message to apply it as your profile avatar, save it as a custom chat emoji, or export a high-resolution PNG to your gallery.

4. In-Chat Local Message Search

• Zero-Knowledge Search: Search message history and decrypted attachments in real-time inside any 1:1 or group chat.
• 100% On-Device: Search is performed strictly in local memory and SQLite database queries—no search terms or keywords are ever transmitted over the network.

5. Private Contact Notes & Custom Nicknames

• Local Notes: Keep private, encrypted notes for each contact (e.g., meeting location, pad recharge history, reminders).
• Custom Display Overrides: Assign local nicknames to contacts without altering their network identity.

---

🛠️ Additional Fixes & Improvements

• File Download Chronological Ordering: Fixed a bug where completed large file downloads jumped to the bottom as the newest message instead of replacing the in-place download placeholder.
• Weekly Social Budget Gauge: Fixed Unix epoch timestamp parsing for social quotas on the relay, restoring live meter feedback in Settings.
• Group Sync Resilience: Enhanced slot verification and lane offset tracking during multi-peer group chat synchronizations.

---

Verifying Downloads (FOSS APK)

• Download app-foss-release.apk below.
• SHA-256 checksums are attached to the release assets.

WiltKey v1.3.5 — QR Connect, Media Gallery, Storage Management & Integrity Verification

📱 WiltKey Client v1.3.5 (FOSS APK Release)

What's New

• ⚡ Instant QR Connect: Connect seamlessly with nearby or remote contacts by scanning a QR code or entering a 6-digit PIN over the blind relay. Remote connections automatically establish 7-day Time Wilt stream cipher chats (in-person BLE proximity pairing remains strictly required for permanent OTP pad recharging).
• 🖼️ Media, Voice & Links Gallery: Browse all shared photos, voice recordings, and external links per chat in a dedicated gallery with instant shimmer skeleton loading and zero UI stutter.
• 🧹 Message History Retention & Storage Pruning: Choose how many messages to keep locally per chat (keep last 100, 250, 500, or 1000 messages) or prune chat history on demand while preserving encryption keys.
• 🛡️ Client Integrity Verification Badges: Cryptographically verifiable build authenticity tags—Official Google Play builds display a Shield badge, while community/custom builds display an Open Source tinkerer badge.
• 🔄 Direct Update Checking: FOSS builds now automatically check GitHub Releases.
• 🛠️ Metadata Sync Fixes: Fixed metadata handshake timing during pairing.

A note on skipping so many version builds:
As WiltKey rapidly approaches its official release-ready state, FOSS release builds on GitHub will become more frequent!

📖 Full Changelog & Details: https://wiltkey.org/patchnotes.html

WiltKey Server v1.3.5

WiltKey Relay v1.3.5 — Play Integrity Attestation & Security Updates

This release of the WiltKey blind relay introduces Google Play Integrity verdict verification, Ed25519 client attestation signing, and PostgreSQL/Redis attestation caching, alongside routing and gap-auditing optimizations.

Self-hosters can update their relay binary with the matching build below.

What changed

• Play Integrity Token Verification: Added /api/v1/integrity/challenge and /api/v1/integrity/attest endpoints to verify Play Integrity tokens with anti-replay nonces.
• Ed25519 Attestation Signing: The relay issues signed client attestation badges (WILTKEY_ATTESTATION:<userId>:...) verifiable offline by all peers.
• Postgres & Redis Caching: Attestation records are cached in PostgreSQL (client_attestations) and nonces in Redis to prevent replay attacks and minimize external API calls.
• Zero-Knowledge Privacy Maintained: Google never receives contact graphs, message ciphertext, or metadata. FOSS/community clients remain fully supported with zero degradation.
• Live Relay Status: Already running on api.wiltkey.org.

Which file do I need?

File	Platform
wiltkey-relay-linux-amd64	Linux x86-64 (most VPS/servers)
wiltkey-relay-linux-arm64	Linux ARM64 (Raspberry Pi 4/5 64-bit, ARM VPS)
wiltkey-relay-windows-amd64.exe	Windows x64
wiltkey-relay-darwin-amd64	macOS (Intel)
wiltkey-relay-darwin-arm64	macOS (Apple Silicon)

Run it

# Linux/macOS (chmod +x first)
chmod +x ./wiltkey-relay-linux-amd64
PORT=8090 REDIS_ADDR=localhost:6379 REDIS_DB=1 ./wiltkey-relay-linux-amd64

# Windows
$env:PORT="8090"; $env:REDIS_ADDR="localhost:6379"; .\wiltkey-relay-windows-amd64.exe

For production deployment instructions and reverse proxy configurations, see:
https://wiltkey.org/docs/relay-server.html#self-hosting

Verify your download

Checksums are in SHA256SUMS.txt:

sha256sum -c SHA256SUMS.txt

Built from source with -trimpath -ldflags="-s -w".

WiltKey App 1.0.1+10

Full patchnotes at the website

WiltKey v1.0.1

Everything new since the first public build (1.0.0). This is the Google-free FOSS
build — grab the .apk below. Still an early, actively-developed app, so expect the odd
rough edge; issues and suggestions welcome.

---

✨ New features

• 🎙️ Voice messages — hold the mic to record, and tap it first to pick the quality,
  from crisp down to charmingly lo-fi. Each theme plays them back its own way.
• 🖼️ Full-screen image viewer — tap any image to open it, then pinch to zoom and pan.
• ⬇️ Opt-in image download — when sending a photo you can now let the recipient save it.
  They can then download it to their gallery and pick the format (JPEG, PNG or WebP).
  Images sent without this stay view-only.
• 😀 Message reactions — react to any message with an emoji, including your custom ones.
• 🩹 Stickers — hold any emoji (custom ones too) to send it big and on its own.
• 🎨 Custom-emoji editor upgrades — erase to transparent, rotate your image, and undo
  steps while making an emoji.
• 🔔 In-app message banner — a tappable heads-up slides in when a message lands while
  you're using the app but not in that chat.
• 📲 Optional real-time push (Play build only) — a content-free wake-up so messages
  arrive instantly without a constant background connection. The FOSS build stays 100%
  Google-free and alerts entirely on-device.
• 🧭 Dedicated Security settings tab — fingerprint unlock, PIN, and identity reset in
  one place, separate from Profile customization.

🔒 Privacy & security

• Screenshot & screen-record blocking is back on for release builds — the OS captures a
  blank frame and hides the app in the recent-apps preview. (Debug builds stay capturable.)
• Anti-tapjacking — the app ignores taps while another app draws an overlay on top of it.
• Accessibility-service warning — a dismissible heads-up if a third-party accessibility
  service that can read the screen is active. This is normal for tools like screen readers or
  password managers; it's just so you're never unaware one is running.

🐛 Fixes & improvements

• Smarter battery-saver notifications: checks quickly right after you close the app, eases
  off while it's quiet, and speeds back up the moment a message arrives.
• Instant mode now recovers on its own if Android or your battery manager kills the
  background connection, so alerts keep coming through.
• Tapping a message notification reliably opens the right chat, and the alert clears once
  you've seen it instead of lingering.
• Messages no longer go missing after reopening the app — added a manual Sync button in
  the chat header, and delivery status now catches up on reopen (even before you unlock).
• Bluetooth-off warning on the pair screens (fixes group creation hanging with Bluetooth off).
• Fixed the send button disappearing in group chats when typing very long messages.
• Chat now scrolls with the keyboard so the latest message stays visible, plus a
  scroll-to-bottom button.
• Group creation shows a progress popup and can't be accidentally triggered twice.
• Smoother custom-emoji background erasing, and the editor controls no longer overflow on
  small screens.
• PIN change is now a clear two-step screen (fixes the confirm field overlapping the button
  on smaller phones); smoother PIN entry during setup.
• Back button / gesture now closes the emoji picker first instead of leaving the chat.
• Navigation buttons no longer block the chat input.
• Fixed a chat disappearing from a device after a one-sided nuke and re-pairing.
• Message alignment and assorted chat-UI polish.
• Added a copy-debug button and pairing warnings to make bug reports easier.

---

📥 Install

• Download app-foss-release.apk below — the Google-free build. It installs alongside
  the Play build (it uses a separate app id), so having both is fine.
• Requires Android 7.0+.
• The app builds in two flavors from the same code, this release is foss; the Play Store
  build adds the optional content-free push. See the README for building it yourself.

WiltKey Server v1.1

WiltKey Server Relay 1.1 — Security Hardening

A security-focused release of the WiltKey blind relay. Self-hosters should replace
their relay binary with the matching build below. No client/app update is required —
all changes are server-side.

What changed

• Fixed a critical flaw where a malicious client could crash the entire relay
  or silently hijack/deny another user's message delivery. The unused legacy code path
  responsible (ephemeral tunnels) was removed entirely, and the message-send path was
  made panic-safe.
• Abuse protections added: per-connection flood limiting (token bucket), bounded &
  self-purging offline queues (can't be inflated to exhaust memory), and per-sender
  rate-limiting on remote-wipe (nuke) signals with a shortened block window.
• Restored per-IP rate limiting & bans behind a reverse proxy by reading the real
  client IP (X-Real-IP/X-Forwarded-For, trusted only from the loopback proxy).
• Hardened the HTTP message-post endpoint: single-use vouchers and stronger
  proof-of-work.

Confidentiality was never affected — the relay only ever handles opaque hashes and
end-to-end-encrypted payloads it deletes on delivery. These fixes are about
availability and abuse resistance.

Which file do I need?

File	Platform
wiltkey-relay-linux-amd64	Linux x86-64 (most VPS/servers)
wiltkey-relay-linux-arm64	Linux ARM64 (Raspberry Pi 4/5 64-bit, ARM VPS)
wiltkey-relay-windows-amd64.exe	Windows x64
wiltkey-relay-darwin-amd64	macOS (Intel)
wiltkey-relay-darwin-arm64	macOS (Apple Silicon)

Run it

# Linux/macOS (chmod +x first)
chmod +x ./wiltkey-relay-linux-amd64
PORT=8090 REDIS_ADDR=localhost:6379 REDIS_DB=1 ./wiltkey-relay-linux-amd64

# Windows
$env:PORT="8090"; $env:REDIS_ADDR="localhost:6379"; .\wiltkey-relay-windows-amd64.exe

For a production, internet-facing relay (TLS, reverse proxy that forwards the real IP,
firewalling Redis), follow the Setup & Security Guide:
https://wiltkey.org/docs/relay-server.html#self-hosting

Verify your download

Checksums are in SHA256SUMS.txt:

sha256sum -c SHA256SUMS.txt

Built from source with -trimpath -ldflags="-s -w".

WiltKey App 1.0.0

WiltKey 1.0

Initial release of the app, not much extra to tell you about

Features currently:

• bluetooth pairing to add contacts
• 1on1 chats
• groupchats
• otp encryption for chats
• custom emojis
• chat nuking
• image sending
• metadata updates
• byte borrowing if one side runs out
• pixelart profile pictures
• theme system with 3 themes
• English and Hungarian hand translated, Polish is partially hand translated rest is AI translated and need refinement

You can read the README.md for more details

WiltKey Server v1.0

Initial backend server release for the wiltkey app