v0.4.3

Gjoa v0.4.3 updates the browser engine to Firefox 153.0.1.

Highlights

• Updated to Firefox 153.0.1.
• Adapted Gjoa sidebar integration to Firefox 153.
• Fixed startup loading for browser windows already open when Gjoa initializes.
• Added Linux ARM64 and AppImage release artifacts.

Downloads

• Linux x86_64: tar.xz or AppImage
• Linux ARM64: tar.xz or AppImage
• macOS ARM64: DMG
• Windows x86_64: ZIP

v0.4.2

Highlights

Linux distribution expands in this release: native arm64 builds alongside x86_64, plus portable AppImage artifacts for both architectures. The README also has a refreshed “Why Gjoa” narrative.

Downloads

Platform	Archive	AppImage
Linux x86_64	gjoa-0.4.2-linux-x86_64.tar.xz	gjoa-0.4.2-x86_64.AppImage
Linux arm64	gjoa-0.4.2-linux-aarch64.tar.xz	gjoa-0.4.2-aarch64.AppImage
macOS (Apple Silicon)	gjoa-0.4.2-macos-arm64.dmg	—
Windows x86_64	gjoa-0.4.2-windows-x86_64.zip	—

Extract the .tar.xz or .zip archive before launching Gjoa. AppImages run directly after chmod +x. The artifacts are portable builds and do not use -march=native.

Full changelog: v0.4.1...v0.4.2

v0.4.1

Gjoa v0.4.1 is the first public release since v0.4.0.

Highlights

• Updates the browser base to Firefox 152.0.6 and pins the Beagle compiler/runtime to the stable 3e942ba revision.
• Improves dark-mode fidelity with native Border and Selection role routing, bounded completion-aware image-analysis retries, and chromatic-icon preservation.
• Adds backdrop-aware APCA normalization plus a deterministic 174-site contrast regression corpus and comparison tooling.
• Adds the LibreWolf-inspired, Balanced, and Minimal privacy profiles; positional Niri workspace matching; horizontal tab soundness fixes; and contextual floating-card/sidebar polish.
• Expands Vim-style browsing with configurable commands, link hints, in-page find, and visual selection.
• Hardens release reproducibility with pinned source checksums, provenance and patch-manifest gates, generated-chrome smoke verification, and Linux/macOS/Windows packaging.

Included pull requests

• #111 — move release builds to free GitHub-hosted runners
• #112 — privacy profile picker
• #113 — consolidate dark-mode design documentation
• #114 — deterministic dark-on-dark contrast regression suite
• #115 — 174-site contrast corpus and mode comparison tooling
• #116 — reliable dark-mode regression harness
• #117 — restore the test suite and add positional Niri workspace matching
• #118 — keep the compact sidebar expanded for context menus
• #119 — backdrop-aware APCA normalization
• #120 — pref-gated contrast normalization actor
• #121 — horizontal-mode tab soundness
• #122 — contextual floating-card layout and toolbar swap
• #123 — content-blocking comment framing
• #124 — tab close button polish

Full changelog: v0.4.0...v0.4.1

v0.4.0

gjoa's settings surface lands: a single about:gjoa hub with a curated LibreWolf-Inspired privacy profile*, the about:sovereignty egress trust panel, and a relational code-graph over gjoa's own source — plus four inherited-egress vectors closed and new patch/knob/projector pre-build gates. Built on Firefox 152.0.1.

Features

• knobs: preflight Gate N + real egress costs + PROFILES↔registry sync (#109)
• projector: relational code-graph over gjoa's own source (#108)
• verify: live about-pages + settings-pointer check via Marionette (#106)
• release: release-notes takes an optional end-ref (backfill past releases) (#105)
• settings: thin about:preferences pointer -> about:gjoa (no FF patch) (#101)
• settings: own the surface — about:gjoa settings hub (knobs promoted) (#100)
• knobs: LibreWolf-Inspired privacy profile + about:knobs dashboard (#83 core) (#99)
• build: pin the beagle compiler ref (visible drift + baked provenance) (#98)
• release: factual release-notes generator + CI-placeholder backstop (#97)
• sovereignty: publish the egress audit tools (open audit = the credibility) (#95)
• sovereignty: regenerate the egress manifest at import time (#94)
• sovereignty: about:sovereignty egress trust panel (#93)
• sovereignty: opt-in maximal-egress-lockdown toggle (default off) (#92)
• projector: rename-recovery — confidence-scored structural anchor matcher (#74 tail) (#83)
• projector: JS-on-Fram live store — round-trip through Fram + Datalog queries (#75) (#82)
• projector: JS-on-Fram — lossless CST -> Fram-format claim records (#75) (#81)
• tools: Firefox-API seam ratchet — drift monitor for the chrome API surface (#73) (#80)
• projector: claim-doc fallback for patch 0011 in the build (Phase 5 integration) (#79)
• projector: JS lossless-CST round-trip reflector + identity-anchored set-body (Phase 5 pilot) (#78)
• tools: Phase 3 — conflict forecast (pre-bump blast-radius, no build) (#75)

Security & hardening

• prefs: close 4 Firefox inherited-egress vectors (#91)
• prep: validate version in pin-firefox before URL/path use (#89)
• supply-chain: GPG-mandatory pin creation + fix gpg-absent crash (#88)
• tabs: load picker favicons via page-icon: cache, not the page URL (#87)
• prep: validate version strings + reject claim-doc path traversal (#86)

Fixes

• drawer: remove dead js/import lines emitting invalid import() into chrome (#90)

Refactors

• compression dedup — shared NAV-JS + sh helper (#85)
• chrome: cross-module declare-extern Any -> real :require imports (#77)

Docs

• why-beagle: cover the modern beagle/fram/claims affordances + link from README (#107)
• readme: sharper headline — the power-user extension stack is native (#104)
• readme: clarify the build flavors — portable builds ARE for sharing (#103)
• readme: compress + polish; add sailboat logo + new-tab screenshot (#102)

Chores

• sovereignty: drop arrow-objlit workaround (beagle PR #8 fixed it) (#96)
• prep: if-with-nil-else -> when/when-not (18 sites) (#84)
• harden externs — typed stdlib statics + prune dead Any-externs (#76)

Generated from the merged commit log — factual changelog, not announcement copy.

* LibreWolf-Inspired is a curated subset of LibreWolf's privacy defaults — not LibreWolf itself (its compile-time disables and ~20 C++ patches aren't here). The trade-offs are shown on the profile in about:gjoa.

v0.3.3

Build, CI, and pre-build-gate hardening — on Firefox 152.0.1.

Pre-build gates (preflight)

• Gate K — engine-currency: refuse a build if engine/ is stale vs source (#70)
• Gate L — surface contracts: catch upstream-dependency drift before the build (#72)
• Gate A fuzz/offset early-warning + DEP-3 provenance (#71)
• Seam-cost scorer — rung × upstream-churn, to rank patch fragility (#73)

Build & release

• Firefox 152.0 → 152.0.1 (security point release) (#74)
• Tag-driven release pipeline — builds all three platforms + drafts the release (#68)
• CI on Blacksmith runners — Linux/Windows ~5× faster, macOS ~3× (#67, #69)

Factual changelog from the merged commit log (v0.3.2..v0.3.3).

v0.3.2

New-tab & home page restored

gjoa's custom forced-dark navigator page is back as the new-tab and home page.

Firefox 152 replaced the new-tab override mechanism gjoa relied on with a new internal redirector that ignored that setting, so the home and new-tab pages had silently fallen back to the default Firefox start page (search box plus sponsored tiles). gjoa now redirects at the channel layer instead:

• about:newtab and about:home both render the dark navigator page — one page, not two separate ones.
• The unused activity-stream startup cache is disabled, removing a startup error it raised in the process.

v0.3.1

Dark mode — readable text over image heroes

A refinement to the dark mode introduced in v0.3.0. Pages with a full-bleed hero image and light caption text could invert that text to near-black over the untouched dark image, leaving it unreadable. The engine is now backdrop-aware:

• A dark scrim is composited over full-bleed background images so text on top stays legible.
• Light text authored over an image hero is preserved instead of being inverted to dark; dark text over a hero is lifted to light so it reads against the scrim.
• Detection is scoped to genuine raster heroes (cover/contain, non-tiled) — gradients, tiled textures, and decorative images are left untouched.

Inversion continues to run once at the style-resolution stage — cached, with no per-frame repaint cost.

v0.3.0

Dark mode, done right

gjoa is dark-first — and dark mode now ships on by default, driven by your system theme.

• Per-site hybrid. Sites with a real dark theme (GitHub, Reddit, …) get their own designed dark theme. Everything else is inverted at the engine's style-resolution stage — cached, zero per-frame cost, none of Dark Reader's repaint tax.
• No flash. A pre-paint polarity flip brings themeless pages up dark on the first paint — no white flash before the invert lands.
• System-driven, with escape hatches. Follows your OS light/dark setting; discrete on / off / hybrid modes are a keystroke away as overrides.
• Curated per-site fixes. A registry pins the tricky sites so they look designed, not merely inverted — with a pre-paint seed that kills transient flips. Hacker News in particular is now first-class.
• Dark Reader → gjoa tool. Ports Dark Reader's per-site fix corpus into gjoa's engine-exact format, so curated coverage can grow fast.

Native tracking & ad blocking, deeper

Beyond network-level blocking, gjoa now neutralizes the class of first-party ad and tracking payloads that network blockers can't reliably reach — those delivered inline from a vendor's own origin. A document-start scriptlet runs in the page's main world (privileged, CSP-immune) and prunes ad descriptors before the page reads them, backed by adblock-rust's full scriptlet engine (use_resources) and the complete uBO scriptlet library — so every +js() rule any filter list ships now works.

A real new tab — and home page

A navigator's station at polar night: the sailboat mark over a cyan aurora, a faint starfield, a monospace chronometer. Forced-dark, pure-CSS, zero per-frame cost, wired at the engine level (AboutNewTab.newTabURL). It's your home / startup page too — the home button, new windows, and home-based startup all land here.

Tabs & spaces

• Horizontal↔vertical orientation toggle no longer corrupts your tab trees across spaces.
• Dragging a tab onto a group nests it below the group (was stranding it above).
• vim T (all-windows tab search) searches every open space.
• Spaces mirror your niri OS workspace name onto the active gjoa space.
• Resolved the deferred tab/space audit bugs (session-restore, compact re-entry, …).

Chrome & discoverability

• : ex-commands are now listed in the ? / :help overlay — the command set is self-documenting.
• Nav-bar paints the chrome surface under vertical tabs (an FF152 regression); removed the white toolbox seam.
• Cosmetic ad-blocking coalesces its dynamic-element scanning on script-heavy sites.

Under the hood

• Intelligent test architecture: fast / slow / network lanes, per-subsystem + changed-file runs, a metrics ledger, and caches that cut the Racket-startup tax on every run.
• Frozen-build fix: serde_json pinned in Cargo.lock for --frozen builds.

---

Built on Firefox 152.0.

v0.2.0

Native ad-blocking — no extension, Manifest-V3-immune

gjoa now blocks ads, trackers, and cosmetic page junk natively in the engine, off the in-tree Brave adblock-rust filtering engine. No uBlock, no WebExtension, nothing for Manifest V3 to take away.

Download

macOS — Apple Silicon (M1–M4): gjoa-152.0.en-US.mac.dmg
Open the .dmg, drag Gjoa into Applications. First launch only: right-click Gjoa.app → Open → Open (unsigned build, one-time Gatekeeper step). Intel Macs not supported.

Linux — x86_64 (glibc: Pop!_OS / Ubuntu / Fedora / Arch / …): gjoa-152.0.linux-x86_64.portable
Self-contained and relocatable — no install, no Nix on the target:

chmod +x gjoa-152.0.linux-x86_64.portable
./gjoa-152.0.linux-x86_64.portable

What's blocked

• Network — ad/tracker requests killed before they load (EasyList + EasyPrivacy, ~137k rules).
• Cosmetic — leftover ad containers, banners, and placeholders hidden via element-hiding rules (the ##.selector half of uBlock), both at page load and for dynamically-injected ads.

How it works

A native XPCOM service feeds filter lists to adblock-rust; a JSWindowActor injects a page-CSS-proof user stylesheet (display:none!important) for cosmetic hiding. A global toggle (Disable Blocking in the drawer) and per-site allow-listing are wired in.

Notes

• Includes everything from v0.1.x: tree-style tabs, vim keys, workspaces, dark mode.
• First-party blocking and scriptlet injection are intentionally off (site-breakage / provenance boundaries).
• Built on Firefox 152.0. Licensed MPL-2.0, same as Firefox.

v0.1.1

Bug-fix + polish release over v0.1.0. Based on Firefox 152.

Download

macOS — Apple Silicon (M1/M2/M3/M4): gjoa-macos-arm64.dmg

1. Open the .dmg, drag Gjoa into Applications.
2. First launch only: right-click Gjoa.app → Open → Open (unsigned build, one-time Gatekeeper step).

• Intel Macs not supported.

Linux — x86_64: not shipped in this release — Linux landed in v0.2.0 (latest); grab it there.

Fixed since v0.1.0

• Vim keybindings work — were entirely dead (a leader-key regression routed every key into a never-matching path).
• :restore / :history no longer crash — corrupt history snapshots are skipped instead of throwing a JSON error.
• :space picker selects the right command — title now ranks above description in the fuzzy matcher.
• Real sailboat logo on the new-tab page (was a clipped emoji placeholder).

Built on Firefox 152.0. Tree-style tabs, vim keys, workspaces, engine-level dark mode.