JoinMarket-NG 0.41.0

Updated maker coin selection algorithms (no more UTXO bloat), BIP39 passphrase support in the TUI and jmwalletd, a new --version option for all commands, and several bug fixes and security hardening improvements.

Added

• Add --version to all JoinMarket NG commands (a5d27457)
• Unlock BIP39 passphrase wallets in the TUI, with the wallet fingerprint shown for confirmation and in the main menu. (5eb181a9)
• The maker service started from the TUI also receives the BIP39 passphrase. (5eb181a9)
• The TUI can save the BIP39 passphrase in config.toml when selecting a wallet or starting the maker, after you confirm the wallet fingerprint. (1e0fb695)
• Remove a saved BIP39 passphrase from the TUI Config Center. (b8b6128d)
• BIP39 passphrase prompts are opt-in through [wallet] bip39_passphrase_enabled (off by default), so wallets without a passphrase see no new questions. (17551b40)
• With prompting enabled, commands stop before any wallet activity when no passphrase is supplied and no terminal is available to ask for one. (17551b40)
• Turn BIP39 passphrase prompting on or off from the TUI Config Center (Configure BIP39 Onboarding). (906c8855)
• The TUI shows seed words only after fully unlocking and checking the selected wallet. (a891b574)
• Remember each wallet's fingerprint and whether it needs a BIP39 passphrase (never the passphrase itself), so a mistyped passphrase is rejected instead of silently opening an empty wallet. (2a272211)
• history, list-bonds, and registry-show read a confirmed wallet without unlocking it, and honor an explicitly supplied BIP39 passphrase. (2a272211)
• jmwalletd (JAM backend) users need no action: existing wallets open as before, without migration or rescanning. The daemon log only notes that their identity is unconfirmed. (116745ef)
• Create, recover, and unlock jmwalletd wallets with an optional BIP39 passphrase. Clients must send it on every unlock, and wallets created with one cannot be opened by older daemon versions. (116745ef)
• Makers now limit UTXO growth automatically by occasionally adding an extra input during normal CoinJoins, more often as the wallet holds more coins. Existing configurations keep working; no action needed. (d2372871)
• Add the greediest merge algorithm and align gradual, greedy, and random coin selection with the reference implementation. (d2372871)
• A wallet confirmed as needing a BIP39 passphrase always asks for it, even with passphrase prompting disabled. (7df64022)
• The maker service started from the TUI only runs the wallet whose fingerprint was staged with its credentials. Existing maker setups need no action. (7df64022)

Fixed

• Identify address-history RPC failures in ordinary logs without exposing private error details (96e7e181)
• Validate send destinations before prompting for wallet secrets (a6c48b37)
• Remove jm-maker generate-address; use jm-wallet address new instead (d2610fbe)
• Warn that imported-wallet history recovery is not yet verified (d2af11a5)
• Reject known address reuse in generated outputs before signing (53bec10f)
• Allow sub-1 sat/vB CoinJoins by default when local fee policy permits, with an option to ignore fee estimation (0a3c1808)
• Make the TUI follow global logging by default and clarify when log-level changes take effect (33c31565)
• Wallet settings written by the TUI no longer end up below the next section's comment banner in config.toml. (5bc9045f)
• A BIP39 passphrase staged for the maker service is tied to its wallet fingerprint, so switching the active wallet can never start the maker on the wrong wallet. (c65717d9)
• Close a brief window where the maker env file holding the wallet password could be world-readable before chmod (c9b46c23)
• Protect maker wallet passwords when replacing existing environment files (af0e608a)
• Wallet passwords and BIP39 passphrases containing newlines are kept intact when the TUI unlocks the wallet or stages the maker service. (bfd72d42)
• The jm-ng TUI runs with its own installation instead of an outdated default virtual environment, and its Update option no longer upgrades a different installation than the one running. If you have several installations, see "Multiple Installations" in the update guide. (6af8048f)
• Upgrading needs no action: on first unlock, a wallet matching the fingerprint recorded by the previous release is confirmed automatically, with or without a BIP39 passphrase. Otherwise commands keep working with a warning until you run jm-wallet identity register. (971567ef)
• Fix jm-wallet info basic view showing wrong per-mixdepth (544488ee)
• TUI update confirmations (running-maker warning and final confirm) now default to "No" (074f0249)
• Default the TUI Confirm Send dialog to No so a stray Enter aborts the transaction instead of broadcasting it (6058c59c)
• Correct pending taker CoinJoin outputs displayed as change (75001ab5)
• Fix wallet import follow-up commands and address derivation when OpenSSL lacks RIPEMD160 (5fea1a3b)
• Remove the stray DEBUG process hardening line printed by every CLI command (0bc72f57)

Configuration Changes

Existing config.toml files are not updated automatically. Review the bundled template changes below and apply the relevant options manually.

--- config.toml.template (0.40.0)
+++ config.toml.template (0.41.0)
@@ -258,6 +258,10 @@ [wallet]

 # Mnemonic file settings (optional defaults)
 # mnemonic_file = ""            # Path to mnemonic file
+# Enable BIP39 onboarding and prompting for unregistered wallets. Default: false.
+# Registered passphrase wallets still require their passphrase when this is false.
+# Recorded history uses the selected identity without unlocking either credential.
+# bip39_passphrase_enabled = false
 #
 # SECURITY WARNING: mnemonic_password is stored IN PLAIN TEXT in this file.
 # Anyone who can read config.toml can decrypt the wallet, which defeats the
@@ -265,6 +269,18 @@ [wallet]
 # and you trust the security of this machine. Prefer leaving it unset and
 # entering the password interactively when prompted by jm-wallet / jm-maker.
 # mnemonic_password = ""        # Password for encrypted mnemonic (plaintext!)
+#
+# SECURITY WARNING: bip39_passphrase is stored IN PLAIN TEXT in this file.
+# Anyone who can read config.toml can derive your wallet together with your
+# seed backup. Only set it when you need unattended maker operation with a
+# passphrase-protected wallet and you trust the security of this machine.
+# Prefer leaving it unset and entering the passphrase interactively when
+# prompted by jm-wallet / jm-maker.
+# bip39_passphrase = ""         # BIP39 passphrase for the mnemonic (plaintext!)
+#
+# Compatibility: wallet_with_passphrase is accepted as an input alias for
+# bip39_passphrase_enabled. Keep one spelling per source; conflicts within one
+# source are rejected. Normal CLI/environment/config precedence applies across aliases.

 # ============================================================================
 # Logging Settings
@@ -372,10 +388,14 @@ [maker]
 # value may make jm-ng makers fingerprintable).
 # min_size = 100000

-# Do not sign CoinJoins below this miner fee floor. Full-node makers combine
-# this with the local mempool minimum and a conservative estimate; Neutrino
-# makers cannot verify foreign prevout values and therefore cannot enforce it.
-# min_fee_rate_sat_vb = 1.0
+# Full-node makers reject CoinJoins below the highest available fee floor:
+# an optional static floor, the local mempool minimum, and a block-target estimate.
+# The static floor is disabled by default (0). Set min_fee_block_target = -1
+# to skip estimation, including the backend's fallback when estimation fails.
+# The local mempool minimum remains enforced. With no available source and no
+# static floor, no positive minimum is imposed. Neutrino makers cannot verify
+# foreign prevout values and therefore cannot enforce this policy.
+# min_fee_rate_sat_vb = 0.0
 # min_fee_block_target = 10

 # IMPORTANT: offer_type determines which fee setting is used.
@@ -427,7 +447,18 @@ [maker]
 # gated by taker_utxo_age (default 5).
 # min_confirmations = 1

-# UTXO merge algorithm: "default", "gradual", "greedy", "random"
+# Maker UTXO selection: "default", "gradual", "greedy", "greediest", "random".
+# default: smallest sufficient coin, otherwise largest-first. With probability
+# (n-2)/n, top up to three inputs using randomly selected extras (n > 2 eligible
+# coins in the authorized source pool). Funding already needing >=3 is unchanged.
+# gradual/greedy/greediest: reference-style smallest-first policies, respectively
+# pruned subtarget prefix, pruned prefix favoring small coins, unpruned subtarget
+# prefix. Neither greedy nor greediest means spending every eligible coin.
+# random: shuffle until funded, randomly prune unnecessary inputs, then shuffle
+# disclosure order. This does not guarantee consolidation or a five-input limit.
+# Extra inputs reveal more co-owned coins to the taker and increase its mining
+# fees. Randomization and consolidation do not guarantee privacy. All policies
+# preserve frozen/bond exclusions, confirmations, locks, and md0 restrictions.
 # merge_algorithm = "default"

 # Source mixdepth selection policy:
@@ -680,9 +711,11 @@ [tui]
 # ============================================================================

 [tui]
-# Log level for CLI output inside the TUI.
-# "WARNING" = only errors and warnings (default, clean output)
+# Optional log level override for CLI commands launched inside the TUI.
+# By default, follow [logging] level (INFO when unset).
+# "WARNING" = only errors and warnings (clean output)
 # "INFO"    = show progress messages (e.g. "Connecting to directory servers...")
 # "DEBUG"   = verbose output for troubleshooting
 # Can be overridden per session: LOGGING__LEVEL=INFO jm-ng
+# Changes apply to subsequently launched commands, not already-running makers.
 # log_level = "WARNING"