Sidecar 1.9.1

Printable, scannable key backup; an account overview drawer; consent-first wallet reads and global name search; "Forget all sites"; drafts encrypted at rest - on top of a full external security-audit remediation round.

New

• A printable backup sheet for a new key - a one-page PDF styled as an old-fashioned telegram: the nsec as selectable text and as a QR, plus a serial number to tell sheets apart. Generated entirely in the browser.
• Import a key by scanning that sheet - from a photo, the PDF itself, the clipboard, or live with your camera. The camera runs in its own window (a side panel can't surface the permission prompt); decoding is local.
• A locked second page in the sheet - the key as a password-encrypted ncryptsec, typeset to pass for a masquerade invitation. Safe to file next to the paper original.
• Account overview - a drawer under the active account showing what's actually set up: follows, unread alerts, relays, NIP-05, Lightning address, wallet connected *and* backed up.
• Your relays, if you want them - once you publish a relay list, Sidecar offers to drop the bootstrap defaults and use only yours, per account.
• "Forget all sites" - one button in the Activity tab erases every record tying sites to your identities. Accounts, keys, wallets, and drafts are untouched; sites simply ask again.
• A way out of a stuck payment - a zap unconfirmed after 15 seconds offers to stop waiting. It stops the watching, not the payment.
• relay-doctor - a command-line NIP-65 auditor that reports healthy / gated / auth-gated / not-serving / down per relay.

Fixed

• The wallet no longer dies on a dropped connection - the NWC client cached a pool whose socket had closed and reused it forever; recovery was accidental, which is why it read as intermittent.
• NIP-65 only is now per account - as a single global switch it failed closed, leaving every other identity unable to post.
• The overview's relay count names its source - an account reading through bootstrap relays no longer shows a 0 that reads as broken.
• The Accounts overview no longer goes stale after connecting or removing a wallet.
• Profile's Backup & restore no longer lets a data backup pose as a key backup - the key export lives in the same section, clearly named.
• The composer previews a quote nested inside a quoted note (previously blank).

Changed

• WebLN reads ask first - balance, node info, and invoice creation now ask once per site per session; a page you never approved can't silently check your balance.
• The global name index is opt-in - the first @-mention search that would query it asks, and a chip shows whether you're searching your follows or everyone.
• Unsent drafts and payment notes are encrypted at rest, under the same key that protects your secrets.
• Approvals say what they cover - trusting a site with decryption states plainly that it can read every future DM until revoked.
• The help guide's section list is a dropdown - it had grown long enough to push the guide off the screen.

Security

This release folds in the full remediation of an external security audit: the RPC host always derives from the sender's own origin; externally_connectable is denied outright with extension-page sender gates on the sensitive handlers; LNURL-pay callbacks must be https and the QR-image fetch passes the private-network guard; the raw NWC connection string never leaves the worker; crafted ncryptsec work factors are rejected before they can demand gigabytes of memory.

Install: download the zip for your browser, unzip, and load unpacked. Chrome users can also update from the Chrome Web Store (pending review). Firefox users from AMO.