Cinderous v0.0.20

更新內容（繁體中文）

• 🔧 修正：分到不同中繼錨點的兩個人互相收不到訊息。 登入時會自動挑一座錨點，所以你和朋友可能落在不同座；之前寄信一律寄到自己那座，對方永遠收不到。現在會照對方分享字串裡寫的錨點寄；只有 npub、不知道對方在哪座時，每座各寄一份，對方回信後就只寄一座。上線狀態也一樣修好了。寄件人要更新到這一版才會生效。
• 🔧 修正：重新整理或剛開 App 時，對方要等好幾分鐘才看到你上線。 剛連上中繼、還沒完成身分認證時送出的上線信號、直連信令與「正在輸入」會被中繼拒收而消失；現在認證完成後會自動補送。
• 🔧 修正：兩人同時（或先後）打開對話時，對話裡跳出「⚠️ 信令處理失敗」、直連沒建立。 現在由一方讓步、卡住的協商會換新連線重談；直連失敗本來就會改走中繼，所以不再在對話裡顯示這類錯誤。
• 🔧 傳給別人的訊息若被對方的中繼明確拒收，會立刻標成失敗（紅色重試），不再等 30 秒後被當成已送出；被回「中繼滿了」時會改送其他中繼。
• 🔒 底層密碼學函式庫升級（@noble/@Scure 2.4.0）：簽章改為保證常數時間。訊息格式不變，新舊版互通；已用舊版建立的密碼鎖與聊天紀錄照常解得開。
• ℹ️ 已知：Android 版是測試版（debug 簽章，能接 USB 偵錯的人可讀取記憶體，請勿用它處理你真正在意的對話）；桌面版未經程式碼簽章，安裝時 Windows SmartScreen 會跳警告。和還沒更新的舊版之間，舊版那一側仍可能出現信令錯誤。

What's new (English)

• 🔧 Fix: two people on different relay anchors couldn't receive each other's messages. Sign-up picks an anchor automatically, so you and a friend may land on different ones; previously messages always went to your own anchor and never reached them. Messages now go to the anchor in the other person's share string; with only an npub, a copy goes to each anchor until they reply. Online status is fixed the same way. The sender needs this version for it to take effect.
• 🔧 Fix: after a reload or app start, others took minutes to see you online. Presence beacons, direct-connection signaling and typing indicators sent before the relay connection finished authenticating were rejected and lost; they are now resent once authentication completes.
• 🔧 Fix: "⚠️ Signaling failed" in the chat and no direct connection when both people open the conversation at the same time (or one after the other). One side now yields, and a stuck negotiation restarts on a fresh connection. A failed direct connection already falls back to the relay, so these errors are no longer shown in the chat.
• 🔧 Messages explicitly rejected by the recipient's relay are marked failed right away (red retry) instead of being treated as sent after 30 seconds; when a relay reports it is full, the message is sent to another relay.
• 🔒 Cryptography libraries upgraded (@noble/@Scure 2.4.0): signing is now guaranteed constant-time. Message formats are unchanged and old and new versions interoperate; passcode locks and chat history created with older versions still unlock as before.
• ℹ️ Known: the Android build is a test build (debug-signed; anyone with USB debugging can read its memory — don't use it for conversations you really care about); the desktop build is not code-signed, so Windows SmartScreen will warn on install. With older versions that haven't updated, the older side may still show signaling errors.

Cinderous v0.0.19

更新內容（繁體中文）

• 🆕 可選的「公開聯絡方式」（預設關閉）。 設定→隱私與通知，有兩個各自獨立的開關：「讓知道我 npub 的人能聯絡我」與「公開我的名稱」。打開後，用其他 Nostr App（例如 0xchat、Amethyst）的人，只要知道你的 npub 就能私訊你、看到你的名稱，並和你來回對話。已用 0xchat 實機驗證。
• ⚠️ 打開＝公開，而且收不回。 打開後會把「你在哪座中繼收私訊」（以及你選擇公開的名稱）發布到公開的中繼站；之後關掉只能讓之後的人查不到，已被別人或其他中繼存下的副本收不回。頭像、狀態與頭銜不會公開。陌生人的訊息一律先進「訊息請求」，由你決定要不要回。企業身分不提供這兩個開關。
• 🔗 和其他 Nostr App 互通（一對一文字）。 你寄出的一對一訊息現在帶有標準的收件人標記，對方的 App 會把它放進正確的對話。回應、收回、檔案、通話與群組仍是 Cinderous 專屬，其他 App 看不懂。
• 📇 只輸入 npub 加好友時，會自動查對方公開的名稱與收件中繼（對方有公開才查得到）。查詢用一次性金鑰認證，被查的中繼站看不出是誰在查；每分鐘最多 10 次。
• 📱 手機版設定頁會顯示目前版本號。
• 🛠️ 中繼站端這段期間的改進（收件確認、容量預警、第三方應用車道等）已直接部署，不需要更新 App 也已生效。
• ℹ️ 已知：Android 版是測試版（debug 簽章，能接 USB 偵錯的人可讀取記憶體，請勿用它處理你真正在意的對話）；桌面版未經程式碼簽章，安裝時 Windows SmartScreen 會跳警告。

What's new (English)

• 🆕 Optional "public contact" (off by default). Settings → Privacy & notifications has two independent switches: "Let people who know my npub contact me" and "Make my name public". When on, people using other Nostr apps (e.g. 0xchat, Amethyst) can message you, see your name, and chat back and forth with just your npub. Verified on a real device with 0xchat.
• ⚠️ On means public, and it can't be taken back. Turning these on publishes which relay you receive direct messages on (and the name you chose to make public) to public relays; turning them off later only stops new lookups — copies already saved by others or other relays can't be recalled. Your avatar, status and title are never published. Messages from strangers always land in Message requests first; you decide whether to reply. Enterprise identities don't get these switches.
• 🔗 Interop with other Nostr apps (one-to-one text). One-to-one messages you send now carry the standard recipient tag, so other apps file them into the right conversation. Reactions, unsend, files, calls and groups remain Cinderous-only and other apps won't understand them.
• 📇 Adding a contact by bare npub now looks up their public name and inbox relays (only if they published them). Lookups authenticate with a throwaway key, so the relays queried can't tell who is asking; at most 10 per minute.
• 📱 The mobile settings page now shows the app version.
• 🛠️ Relay-side improvements from this period (inbox acknowledgements, capacity warnings, third-party app lanes, etc.) were deployed directly and already apply without updating the app.
• ℹ️ Known: the Android build is a test build (debug-signed; anyone with USB debugging access can read its memory — do not use it for conversations you actually care about). The desktop build is not code-signed, so Windows SmartScreen will warn during install.

Cinderous v0.0.18

更新內容（繁體中文）

• 🔴 請把你的每一台裝置都更新到這一版。 這一版開始，開了前向保密的對話會用新的加密方式。沒更新的那台裝置會解不開送來的訊息，而且是永久的——不是晚點會補上，是那台沒有對應的金鑰。手機、桌機、任何你還在用的裝置，一台都不要漏。
• 🧪 後量子加密已啟用（實驗性）。 上一版說「元件已就位、尚未啟用」，這一版把它打開了。它解決的是一個今天就在發生的問題：中繼站上的密文可能被側錄下來留著，等到未來有足夠強的量子電腦再解開。這一版起，那些密文在未來也解不開。
• ⚠️ 這不等於「量子安全」，請不要這樣理解。 換掉的只有「內容加密」那一半；簽章沒有改，所以一個擁有量子電腦的攻擊者仍然偽造得出訊息。買到的只有一件事：內容的機密性。
• ⚠️ 前向保密（含這次的後量子）仍是實驗性選項、預設關閉，且尚未經過外部密碼學審計。 我們用的組合方式是依標準做法自行組出來的，沒有照搬任何已經公開審查過的方案。要不要打開由你決定，設定→隱私。
• 📈 代價：每則訊息大約多 1.4 KB。 只在雙方都更新、且你開了前向保密時才會發生；對方沒更新就自動退回原本的方式，訊息照樣送得到。檔案本體走點對點，不受影響。
• 🔎 降級偵測跟著升級了。 如果某個聯絡人從較強的加密方式退回較弱的，你會看到提示；而單純收到對方的訊息不會再誤觸發那個提示（上一版的判斷會把「對方傳了一則訊息」誤讀成「對方退回較弱機制」）。
• ℹ️ 已知：Android 版是測試版（debug 簽章，能接 USB 偵錯的人可讀取記憶體，請勿用它處理你真正在意的對話）；桌面版未經程式碼簽章，安裝時 Windows SmartScreen 會跳警告。

What's new (English)

• 🔴 Update every device you use to this version. From this release, conversations with forward secrecy enabled use a new encryption scheme. A device left on an older version will not be able to decrypt incoming messages, permanently — it is not a delay, that device simply does not have the matching key. Phone, desktop, anything you still use: do not skip one.
• 🧪 Post-quantum encryption is now on (experimental). The previous release said the pieces were in place but not switched on; this one switches them on. It addresses something happening today: ciphertext sitting on relays can be recorded and kept until a large enough quantum computer exists. From this version, that recorded ciphertext stays unreadable.
• ⚠️ This is not "quantum-safe", please do not read it that way. Only the content encryption changed; signatures are unchanged, so an attacker with a quantum computer could still forge messages. What you gain is confidentiality of content, and nothing else.
• ⚠️ Forward secrecy, including this post-quantum work, remains an experimental option, off by default, and has not been externally audited. The construction follows standard practice but is assembled by us; it is not a copy of any publicly reviewed scheme. Whether to turn it on is your call: Settings → Privacy.
• 📈 The cost: roughly 1.4 KB more per message. Only when both sides have updated and you have forward secrecy on; if the other side has not updated it falls back to the previous scheme and messages still arrive. File contents travel peer-to-peer and are unaffected.
• 🔎 Downgrade detection was upgraded with it. If a contact falls back from a stronger scheme to a weaker one, you will be told; and simply receiving a message from them no longer triggers that warning by mistake (the previous version could read "they sent a message" as "they fell back to a weaker scheme").
• ℹ️ Known: the Android build is a test build (debug-signed; anyone with USB debugging access can read its memory — do not use it for conversations you actually care about). The desktop build is not code-signed, so Windows SmartScreen will warn during install.

Cinderous v0.0.17

更新內容（繁體中文）

• 🔴 修正：把照片「拖」進對話窗時，位置資訊沒有被清除。 按迴紋針選檔會清，拖放不會——而拖放是更常用的那一個。⚠️ 先前用拖放送出的照片已經帶著拍攝位置出去了，那無法回收；收件者手上那份就是原檔。這一版起兩種方式都會清。
• ⚠️ 很大的圖片（超過 32 MB）仍然不會清除位置資訊，因為重新編碼那麼大的圖會讓 App 當掉。這一版起送出前會先問你一次，不再是靜悄悄地送出去。想清掉的話，先縮圖再傳。
• 📶 收檔終於看得到進度。 以前對方傳大檔給你時，畫面上寫的是「檔案在你另一台裝置」——那句話是錯的，檔案正在傳進來。現在會顯示接收進度。
• 📱 手機版補上一批一直缺的提示：傳檔進度與失敗原因、通話打不通的原因（限制網路下建議改用 Wi-Fi）、本機空間已滿的警告、雲端備份的狀況、以及同事更新金鑰後的接續提示。這些桌面版一直都有。
• 💾 「雲端備份已開啟」不再等於「備份成功」。 設定頁現在會顯示上次成功備份的時間；如果從來沒成功過，它會說出來——以前那是完全安靜的，要到換機還原那天才發現。
• ✉️ 送出的訊息若對方一直沒收到，現在看得出來。 中繼站只保存 7 天，超過就刪除。超過保存期仍沒收到送達回條的訊息會標成「可能未送達」，並建議重傳。
• 🕳 離線太久回來時會提醒你可能漏了訊息。 那段期間別人傳給你的東西可能已經在中繼站上過期消失，不會補送，也查不出漏了哪些。
• 🗂 匯出紀錄不再有大小限制。 用了很久的人匯出時可能會失敗，現在改成逐塊寫入，多大都行。
• 🖥 桌面版選很大的檔案不再吃光記憶體；網頁版的暫存檔也終於會被回收（以前會一直累積到空間滿了連訊息都存不下來）。
• 🔒 加密機制的版本協商變嚴謹了：如果對方從較強的加密方式退回較弱的，你會看到提示。以前這種情況是看不出來的。
• 🧪 內部準備：後量子加密的基礎元件已就位，但尚未啟用，目前不影響任何加密行為。它需要先讓大多數人更新到這一版之後才能打開——所以請更新。⚠️ 完成之後保護的是訊息內容的機密性，不是身分真實性；而且與現有的前向保密一樣尚未經過外部密碼學審計。
• ℹ️ 已知：Android 版是測試版（debug 簽章，能接 USB 偵錯的人可讀取記憶體，請勿用它處理你真正在意的對話）；桌面版未經程式碼簽章，安裝時 Windows SmartScreen 會跳警告。

What's new (English)

• 🔴 Fixed: photos dragged into a conversation did not have their location stripped. Picking a file with the paperclip stripped it; dragging did not — and dragging is the more common action. ⚠️ Photos you sent this way already went out with their capture location, and that cannot be undone; the recipient has the original. From this version both paths strip it.
• ⚠️ Very large images (over 32 MB) still do not get their location stripped, because re-encoding something that large would destabilise the app. From this version you are asked first instead of it happening silently. To strip it, resize the image before sending.
• 📶 Receiving a file finally shows progress. Previously an incoming transfer said "file is on your other device" — which was simply wrong, the file was arriving. It now shows a progress indicator.
• 📱 The mobile app gained a batch of notices it had been missing: transfer progress and failure reasons, why a call could not connect (switch to Wi-Fi on restricted networks), a warning when local storage is full, cloud backup status, and continuity after a colleague rotates their key. The desktop app had all of these already.
• 💾 "Cloud backup is on" no longer implies "backup is working". Settings now shows when the last successful backup happened, and says so plainly if there has never been one — previously that was entirely silent until the day you restored onto a new device.
• ✉️ You can now tell when a message you sent was never picked up. Relays only hold offline messages for 7 days. A message with no delivery receipt after that window is marked "may not have been delivered", with a suggestion to resend.
• 🕳 Coming back after a long time offline now warns you that you may have missed messages. Anything sent to you during that window may have expired on the relay; it is not redelivered and there is no way to tell what was lost.
• 🗂 Exporting your records no longer has a size limit. Long-time users could hit a failure; it now writes in chunks, at any size.
• 🖥 Picking a very large file on desktop no longer exhausts memory, and the browser build finally reclaims its temporary files (they used to accumulate until storage filled up and messages could not even be saved).
• 🔒 Encryption version negotiation is stricter: if a contact rolls back from a stronger scheme to a weaker one, you are told. That case was previously invisible.
• 🧪 **Groundwork: the building blocks for post-quantum encryption are in place, but not enabled — nothing about encryption behaves differently yet. Turning it on requires most people to be on this version first, so please update. ⚠️ When it does land it protects the confidentiality of message contents, not the authenticity of identities; and like the existing forward secrecy it has not been externally audited.
• ℹ️ Known limitations: the Android build is a test build (debug-signed — anyone who can attach USB debugging can read its memory, so do not use it for conversations you actually care about); the desktop build is not code-signed, so Windows SmartScreen will warn on install.

Cinderous v0.0.16

更新內容（繁體中文）

• 🔐 更換了中繼站清單的簽章金鑰。舊的那把曾經短暫存在於自動化流程中（2026-07-03 至 07-23），雖然沒有跡象顯示它外流，但既然無法排除，就換掉。這一版起你的 App 會認新的金鑰。
• ⚠️ 請更新到這一版。舊版本仍然可以用，但它只認得舊金鑰，會逐漸收不到中繼站清單的更新。
• 📦 傳整個資料夾。把資料夾拖進對話窗就能傳；檔案超過 8 個時也會自動打包成一份，不再是幾十則訊息洗版。收到的人可以先看裡面有什麼，再決定要不要解開。
• ⚠️ 打包傳送時，裡面的相片不會像單獨傳送那樣清除位置資訊——送出前會先問你一次。
• 🔄 大檔案斷線後接得回去。傳到一半斷線，重連後從斷點繼續，不必整個重來。傳完會比對整檔的雜湊，確認接對了。
• 🛠 App 裡就能建立自己的中繼站。設定 → 連線與備份 → 建立我的節點，跟著五個畫面走完，大約三分鐘。它跑在你自己的 Cloudflare 帳號上。
• 🐛 修正：檔案傳到一半被移走時，那個對話之後就什麼都送不出去，而畫面只是停在「傳送中」。
• 📖 官網新增完整的自架教學。
• ℹ️ 已知：Android 版是測試版（debug 簽章，能接 USB 偵錯的人可讀取記憶體，請勿用它處理你真正在意的對話）；桌面版未經程式碼簽章，安裝時 Windows SmartScreen 會跳警告。

What's new (English)

• 🔐 The signing key for the relay list has been replaced. The old one briefly lived in our automation (2026-07-03 to 07-23). There is no sign it leaked, but we cannot rule it out, so we replaced it. From this version your app trusts the new key.
• ⚠️ Please update to this version. Older builds keep working, but they only recognise the old key and will gradually stop receiving relay list updates.
• 📦 Send a whole folder. Drag it into the conversation. More than 8 files are packed into one bundle too, instead of flooding the chat with separate messages. The recipient can list what is inside before deciding to extract it.
• ⚠️ Photos inside a bundle do not get their location data stripped the way they do when sent individually — you are asked to confirm before sending.
• 🔄 Large transfers survive a dropped connection. Reconnecting resumes from where it stopped instead of starting over, and the whole file is hash-checked on arrival.
• 🛠 Run your own relay from inside the app. Settings → Connection and backup → Run my own node. Five screens, about three minutes. It runs on your own Cloudflare account.
• 🐛 Fixed: if a file was moved or deleted mid-transfer, that conversation could no longer send anything, while the screen just sat on "sending".
• 📖 A full self-hosting guide is now on the website.
• ℹ️ Known limitations: the Android build is a test build (debug-signed — anyone who can attach USB debugging can read its memory, so do not use it for conversations you actually care about); the desktop build is not code-signed, so Windows SmartScreen will warn on install.

Cinderous v0.0.15

更新內容（繁體中文）

• 我的裝置：看得到這個身分曾在哪些裝置上出現，手機掉了可以從另一台把它移除——移除後那台就讀不到之後的新訊息。⚠ 已經收到的歷史救不回來；而且如果外流的是你的身分鑰匙本身（不只是一台裝置），移除擋不住
• 裝置鑰匙進了系統保管庫：桌面走作業系統金鑰庫、Android 走安全晶片，磁碟被複製也解不開。設定頁會如實顯示這台在哪一級——瀏覽器版只到「已加密」，那句話直接寫在畫面上
• 斜線指令：在輸入框打「/」開快捷選單；Enter 要送出還是換行現在可以自己設定（預設送出）
• 公司政策在手機上也生效了，並且會條列告訴你哪些功能被公司停用——先前手機端完全沒有套用，而且被停用時看起來只像是壞掉
• 手機的外觀、語言與主色現在會記住，重開 App 不再回到預設
• 手機的雲端備份改為每個身分各自獨立——先前是整台裝置一個開關，工作身分開了，個人身分也跟著開著
• 前向保密（實驗性選項、預設關閉、尚未經外部審計）：啟用後每週自動換一次鑰匙，可以隨時停用，保護範圍從一對一文字擴大到群組訊息、檔案名稱、共享行程與訊息回應。並修正一個多裝置的問題——先前在一台按「關閉」，會被另一台的備份翻回開啟

What's new (English)

• My devices: see which devices this identity has appeared on, and remove one from another device if a phone is lost — a removed device can no longer read new messages. ⚠ History it already received cannot be clawed back, and if what leaked was your identity key itself (not just one device), removal does not help
• Device keys now live in the system vault: the OS keystore on desktop, the secure element on Android — a copied disk cannot open them. Settings states which tier this machine is actually on; the browser build only reaches "encrypted", and it says so on screen
• Slash commands: type "/" in the composer for a quick menu; whether Enter sends or inserts a newline is now yours to choose (sends by default)
• Company policy now applies on mobile too, and settings lists which features your company has disabled — previously mobile ignored policy entirely, and a disabled feature just looked broken
• Appearance, language and accent colour are now remembered on mobile; reopening the app no longer resets them
• Cloud backup on mobile is now per identity — it used to be one switch for the whole device, so turning it on for work turned it on for personal too
• Forward secrecy (experimental, off by default, not yet externally audited): once enabled it rotates keys weekly, can be turned off at any time, and now covers group messages, file names, shared events and reactions in addition to one-to-one text. Also fixes a multi-device problem — turning it off on one device used to be flipped back on by another device's backup

---

🔴 Android APK 是 debug 簽章版，而且可被偵錯（自 v0.0.14 的首發即如此；ADR-0335）

• 安裝時開發者會顯示「不明」——APK 以 Android SDK 的通用 debug 憑證簽署，那把金鑰每台開發機都一樣，不代表任何人。首次安裝也需允許「安裝未知來源的應用程式」。
• ⚠️ 更重要的是 debuggable 屬性：任何能接上 adb 的人可以附著到 App 的行程並讀取記憶體，其中包含你的私鑰與前向保密的子鑰。
• ⇒ 請勿在已 root、或長期開啟 USB 偵錯的裝置上，用它處理你真正在意的對話。
• 修法是改用正式的 release 簽章金鑰，尚未進行（見 docs/OPERATOR-TODO.md）。這一點先前只寫成「需允許未知來源」，那說的是安裝不便、不是安全後果——這裡補上。

🔴 Android APK is debug-signed and debuggable (true since the first Android release in v0.0.14; ADR-0335)

• The installer shows the developer as unknown — the APK is signed with the Android SDK's generic debug certificate, which is identical on every developer machine and identifies nobody.
• ⚠️ The debuggable flag matters more: anyone who can attach adb may hook into the app's process and read its memory, which includes your private key and forward-secrecy subkeys.
• ⇒ Do not use it for conversations you actually care about on a rooted device, or one with USB debugging left on.
• The fix is a proper release signing key; not done yet (see docs/OPERATOR-TODO.md). This was previously worded only as "allow unknown sources" — that describes an installation inconvenience, not a security consequence.

⚠️ 桌面版尚未程式碼簽章，Windows SmartScreen 會出現警告；那是發佈面的已知殘餘，不是安裝檔有問題（見 docs/SECURITY.md）。

🔴 前向保密是實驗性選項、預設關閉、尚未經任何外部密碼學審計。 啟用前會再確認一次。請勿在生命安全等級的高風險情境倚賴它。

Cinderous v0.0.14

更新內容（繁體中文）

• Android App 首次登場：可安裝的 APK，聊天、通話、群組、行事曆等功能與桌面同源
• 手機拍照直接傳：對話中點 📷 開相機，拍完立即送出
• 背景保持連線：以常駐通知讓訊息在 App 進背景時仍收得到——不使用任何第三方推播服務，沒有人會知道你何時收到訊息（可於設定關閉）
• 隱私修復：傳送圖片時自動清除 EXIF 等中繼資料——先前照片會連 GPS 座標、拍攝時間與裝置型號一起送出，現在只保留畫面內容（桌面與手機都已修正）
• 圖片傳送順帶壓縮：上傳更快、更省流量

What's new (English)

• Android app, first release: an installable APK — chat, calls, groups and calendar all share the same core as desktop
• Take a photo and send it right away: tap 📷 in a conversation to open the camera
• Stay connected in the background: an ongoing notification keeps messages arriving while the app is backgrounded — no third-party push service is used, so nobody learns when you receive messages (can be turned off in settings)
• Privacy fix: image metadata (EXIF) is now stripped on send — photos previously carried GPS coordinates, capture time and device model; only the picture itself is sent now (fixed on both desktop and mobile)
• Images are also compressed on send: faster uploads, less data

---

📱 關於 Android 版 / About the Android build

初次釋出，以 debug 簽章打包（預覽用途）。安裝需允許「安裝未知來源應用程式」；
日後改用正式簽章時需先解除安裝再安裝（簽章不同無法直接覆蓋升級）。

First Android release, packaged with a debug signature (preview). You'll need to allow
"install from unknown sources". When we move to a release signature you'll need to uninstall
first — Android won't upgrade across different signing keys.

Cinderous v0.0.13

更新內容（繁體中文）

• 共享行程：在對話裡揪時間、RSVP 回覆、本機提醒（零中繼成本）；行事曆有月／週／日／清單四種檢視，預設本月月曆
• 訊息搜尋：對話內搜尋並跳到命中處、聯絡人清單搜尋、封存舊訊息也能搜（逐塊解密、不留索引）
• 無障礙：高對比模式（WCAG AA，可與深／淺色並用）、介面尺寸五段縮放、色覺友善色票
• 網址安全：訊息中的連結比對開源威脅情報（純本地比對，網址不外送），可自訂清單、嚴格模式或關閉
• 真隱身模式：隱身時完全停止在線廣播，連中繼都看不到你在線
• 經典 MSN 佈局：統一聯絡人列與狀態訊息、可收合分組、左側固定主視窗＋右側浮動對話窗
• 自訂 emoji／貼圖：匯入圖片自製 emoji、打 :短碼: 插入、批次匯入 Slack 式 emoji 包、收到自動收藏並加密保存
• 動畫 GIF emoji：支援會動的 GIF；大圖走內容定址傳遞、省頻寬
• emoji／貼圖庫跨裝置同步：你自己的資產庫（含刪除）在各裝置間保持一致
• 多裝置同步強化：聯絡人／群組的刪除與解封會傳播，暱稱、標籤與偏好也跨裝置一致
• 訊息互動：一鍵複製、點文字開對話串、收回訊息加上所有權驗證與確認（可無痕收回）
• 通話更可靠：打不通時自動改走中繼（TURN），並在介面明確標示
• 正在聽：點 ♪ 可自動偵測目前播放的音樂（Windows 桌面版、預設關閉）
• 群組發言者名字有各自顏色，深／淺／高對比模式下都保證看得清楚
• 自架節點：中繼站提供 NIP-11 資訊文件、支援 NIP-62「立即清除我的資料」、可設定贊助入口
• 更新提示：有新版時在 app 內提示（可關閉自動檢查）
• 通知更細緻：事件細分開關＋每對話靜音
• 安全強化：匯入圖片格式與尺寸把關、供應鏈離線簽章、相依弱點掃描納入 CI
• 官網改版：預設英文＋淺色、新增企業版與產品比較頁、行動裝置可用性改善
• 內部：全平台版號統一（單一來源）＋app 內可顯示版本與本次更新內容

What's new (English)

• Shared plans: schedule inside a conversation, RSVP, and local reminders (zero relay cost); the calendar offers month / week / day / list views, defaulting to this month
• Message search: search within a conversation and jump to hits, search the contact list, and search archived history (decrypt-and-discard, no index kept)
• Accessibility: high-contrast mode (WCAG AA, combines with light/dark), five UI size steps, and colour-vision-friendly accents
• Link safety: links in messages are checked against open-source threat intelligence entirely on your device (URLs are never sent anywhere); custom lists, strict mode, or off
• True invisible mode: going invisible stops all presence broadcasts — even relays can't see you online
• Classic MSN layout: unified contact list with status message, collapsible groups, fixed main window + floating chat windows
• Custom emoji/stickers: import images as your own emoji, type :shortcode: to insert, bulk-import Slack-style packs, and received ones are saved encrypted automatically
• Animated GIF emoji: GIFs stay animated; large ones use content-addressed transfer to save bandwidth
• Emoji/sticker library syncs across your devices, deletions included
• Better multi-device sync: contact/group deletions and unblocks now propagate, and nicknames, labels and preferences stay consistent
• Message interactions: one-click copy, tap text to open a thread, and unsend with ownership verification and confirmation (traceless option)
• More reliable calls: automatically falls back to relayed media (TURN) when a direct connection fails, clearly indicated in the UI
• Now playing: click ♪ to auto-detect the music you're playing (Windows desktop, off by default)
• Group speakers get their own name colours, guaranteed readable in light, dark and high-contrast modes
• Self-hosting: relays now serve a NIP-11 info document, support NIP-62 "vanish my data", and can advertise a sponsorship link
• Update prompts: get notified in-app when a new version is out (auto-check can be turned off)
• Finer notifications: per-event toggles plus per-conversation mute
• Hardening: image format/size validation on import, offline supply-chain signing, and dependency vulnerability scanning in CI
• Website refresh: English + light theme by default, new Enterprise and product comparison pages, better mobile usability
• Internal: unified versioning across all platforms (single source) with in-app version and what's-new

Cinderous v0.0.12

Cinderous v0.0.12

本次重點：P2P 直連的可視化與可靠性，以及多身分登入的便利性。

✨ 新功能

• 對話標題列新增「直連品質」晶片（ADR-0213）

  • ⚡ 直連（綠）＝與對方已建立點對點直連，檔案／通話／輸入中走 P2P，更快、不經中繼。
  • ⚪ 直連未建立（灰）＝尚未建立直連、已降級走中繼；文字訊息照常送達、完全不受影響。
  • 滑過晶片有說明文字；僅一對一對話、對方非離線時顯示。

• 解鎖畫面可直接「用其他身分登入」（ADR-0211）

  • 多身分使用者在解鎖畫面就能切換要用哪一個身分（輸入顯示名稱挑私鑰、密碼解鎖），不必先解鎖目前身分。順帶解決「只有單一鎖定身分時、解鎖前無法新建身分」的死角。

🔧 改進與修正

• 跨網路 P2P 現在真的連得起來（ADR-0210）
  • 一般模式加入預設 STUN，讓不同網路的兩端能蒐集到公網候選並直連（先前無 STUN＝只有同一區網才連得起來）。
  • 不再跳誤導性的「⚠️ P2P 連線失敗」——P2P 失敗只影響檔案／通話這類加值通道，文字訊息一律走中繼、不受影響。
  • 企業強制 TURN 模式維持 relay-only、不外洩 IP（隱私不變）。

⬇️ 下載

• Cinderous_0.0.12_x64-setup.exe — NSIS 安裝版（建議一般使用者）
• Cinderous_0.0.12_x64_en-US.msi — MSI（企業派送；支援 WIPEDATA=1 反安裝清空）
• Cinderous_0.0.12_x64_portable.exe — 免安裝可攜版

Windows x64；未簽章，首次執行 SmartScreen 會提示，選「其他資訊 → 仍要執行」。

---

🤖 Generated with Claude Code

Cinderous v0.0.11

Cinderous v0.0.11

桌面 UI 三項修正（三欄模式與標題列）。

變更

• 自動隱藏標題列改「推開內容」（ADR-0205）：滑鼠移到頂端揭示標題列時，介面往下讓位而非被覆蓋層蓋住；滑開即彈回。
• 設定彈窗固定高度（ADR-0205）：切換分頁時整窗高度不再跳動，長分頁走內文卷軸。
• 三欄模式：身分元件上移標題列（ADR-0206）：身分切換器（人 icon 併入）、＋新增身分、🔒 解鎖隱藏、🗂 名冊管理整合進標題列——
  • 隨標題列動作：自動隱藏、按鈕風格一起套用。
  • 可拖曳：在「設定 → 標題列」拖曳編輯器裡與視窗控制一起排列（可跨左右帶）。
  • 只在三欄模式生效；經典模式維持原本身分列。

下載

• 安裝版（建議）：Cinderous_0.0.11_x64-setup.exe
• MSI（企業派送，反安裝清空用 WIPEDATA=1）：Cinderous_0.0.11_x64_en-US.msi
• 免安裝 portable：Cinderous_0.0.11_x64_portable.exe

僅 Windows x64、未程式碼簽章（首次執行 SmartScreen 選「仍要執行」）。