v1.4.1

Warning

Windows and Linux key-storage warning: The current builds use per-user credential services that do not isolate raw account keys or the database key to Ekubo Wallet. Same-user malware, including a prompt-injected local agent that can execute programs, can extract those keys and bypass wallet policy and review. Read the security model before installing.

Eighteen changes since 1.4.0, most of them about the two screens where the wallet asks you to decide something: the policy editor and the connection review.

Policy proposals

• A proposal now announces itself. An agent's proposed policy change used to wait until you happened to open the Policies screen. It raises a notification naming the account instead.
• Reviewing a proposal opens on the agent's case for it — the danger line first when the policy would sign everything, then the whole rationale, then a count of what changes. Reviewing the changes, editing the draft, and rejecting are each one press from there. The rationale was previously a fixed 180-pixel box on the diff screen that could not be scrolled at all, so a long one was cut off with no way to reach the rest.
• Taking up a proposal loads it into your editor as a draft, and now says so — on the case screen, in the editor that holds it, and in the button that leads back to it. Installing installs what is in the editor, so this is worth knowing before you edit.
• The permission diff aligns rules before describing them. A rule inserted at the top used to report every rule below it as rewritten, burying the one line that said what actually changed under a screen of lines that had not.
• A policy identical to the one already installed is refused. Installing one changed no permissions but still cancelled every transaction awaiting approval under the revision it repeated. An agent cannot propose one either, so a proposal that changes nothing never reaches you.
• An unrestricted allow is recognized by what it permits, not by how it is written. A redundant spelling of "allow everything" can no longer slip past the danger warning.
• A policy notification no longer pulls the tab out from under an open editor, which used to take an unsaved draft with it.
• Rejecting a proposal says so. A rejection you chose and a proposal vanishing underneath you used to draw the same screen: nothing. Only the failures ever spoke.

Reviewing a connection

• The connection review asks which account to expose before the warnings rather than below them. It used to sit off the first screen, so choosing an account cost a second full read of the document, and changing your mind cost a third.
• The read-before-approving gate is re-armed unless the document differs only in the account and address you just answered. Matching row shape alone was not evidence that nothing else had changed — warning and section text can change while the rows stay identical.

Connecting a dapp

• One press connects. The pairing link is read off the clipboard and the pairing starts; the text field and its separate Connect button are gone. The link is already on your clipboard by the time you reach the page, because copying it out of the dapp's dialog is how it leaves the dapp. A press with something else on the clipboard says so rather than looking inert.
• Cancel now sits beside that button rather than under it.

Portfolio

• Refresh moved to the footer, beside the line saying how old the balances are, as an icon next to the age it would replace. The button used to change its label to "Refreshing…" mid-refresh, which is wider than "Refresh" and pushed the header around while you waited.
• The tab says it counts token balances and not positions.

Elsewhere

• The refusal to point the wallet at a private RPC endpoint now says who can do it. Only the owner can, in the app; an agent may propose public endpoints only, because the endpoint decides what a simulation reports and what you are shown. The old message said only that the address was private, which read as the wallet being unable to reach it.
• The setup checklist comes back when you finish one of the things on it. Dismissing it means "not now", and someone who sends it away and then does one of its tasks is working the list.