v0.14.0

Highlights

A co-signer's human can take their time to approve (#1173). When a co-signer's approval hook answers "pending", the signing round now stays open while the person decides, instead of timing out under them. The coordinator waits up to a hard cap per attempt, the whole request is bounded at 188 seconds across failovers, and a decision that arrives after the deadline is dropped rather than signed.

The phone shows what it is co-signing (#1166, #1171). A Bitcoin co-sign prompt now lists every output with its amount and address, the total consumed and the fee, and a Nostr event prompt shows its kind and a sanitized content preview. Only sighash flags that commit to every output are described, and a request that cannot be described is refused before the phone is asked. With that prompt in place, the phone can now approve taproot key-path spends, which it refused outright before.

An unreadable share is set aside, not deleted (#1174, #1175). A share the device cannot decrypt is moved aside and shown to the owner, who can retry it. It is destroyed only when the platform proves it can never be read again: the key is gone or permanently invalidated, or the stored record fails authentication, is truncated or is empty. A cancelled prompt, a transient fault or anything unclassified leaves it in place. Discarding and removing report exactly what happened, including whether the active account was cleared.

Security

• A NIP-55 sign approval no longer approves a peer's co-sign of the same event (#1177). NIP-55 approvals now live in their own map that only the NIP-55 sign path reads. Before, an approval left unclaimed (by a rate limit, an account mismatch or an abandoned call) could let a peer's co-sign request for that exact event through with no prompt, skipping the NIP-55 audit row, notification and velocity count.
• A pre-approved hash no longer skips the prompt for any Bitcoin request (#1171). A pre-approval is a bare hash with nothing showing what it spends, so Bitcoin requests and key-path spends always reach the spend prompt.
• A phone backup blocks every peer of a relay config it cannot read (#1172). An unreadable relay config used to be left out of the backup silently, so a restore enforced none of its peer blocks. The backup now carries the fail-closed record instead: default relays, no NIP-46 grants, and every share index the device does not hold blocked. backup_relay_config_gaps lists the groups this applies to so the app can warn first.
• Lockfiles outside the main workspace refreshed past their advisories (#1170): rustls, rustls-webpki, bytes and rand in the fuzz targets, js-yaml in keep-agent-ts, and postcss and nanoid in the keep-web UI.

Fixes

• The phone's owner is not prompted again for retries of their own approved NIP-55 sign (#1176). When the phone's own NIP-55 request becomes a co-sign round, its share approves that round without a second prompt, but only for the request in flight, and never for a request that moves funds.

Upgrading

• No vault migration. A vault opened by v0.13.3 opens unchanged.
• Mobile bindings change, so regenerate them with the library:
  • SecureStorage gains quarantine_share_by_key, restore_quarantined_share, list_quarantined_share_keys and probe_share_by_key, which the platform must implement. probe_share_by_key returns ShareProbe::Lost only on positive proof the share can never be decrypted, and Unknown for everything else.
  • New calls for the app: discard_lost_share, which returns a QuarantineDiscard outcome and errors only on a real fault, the UnreadableShareRemoval outcome with cleared_active_pointer, and backup_relay_config_gaps.
  • SignRequestMetadata.spend is new and defaults to null, so existing bindings keep working.
• An app that pre-approves a Bitcoin request by hash now sees the spend prompt for it.
• pre_approve_nostr_event no longer approves peer co-signs. A peer co-sign pre-approval comes only from set_signing_pre_approved.

Verifying this release

Download SHA256SUMS and the files you want into one folder:

sha256sum --ignore-missing -c SHA256SUMS

Look for OK for each file. Binaries are built reproducibly from the tagged commit, and the tag is signed with key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38, so git verify-tag v0.14.0 checks the source they were built from.

Full Changelog: v0.13.3...v0.14.0