Version 0.77.1

An embedded wallet is now closed the moment a different account signs in on the same tab.

The part of NMTS that does the encryption holds your account keys and your embedded wallet in the same place, and signing out dropped both. Signing in as somebody else replaced the account keys and left the wallet — so the app went on showing the previous account's wallet, would have signed with it, and would have handed out its private key behind a screen asking for the account code of the person now signed in, which had nothing to do with that wallet. A wallet now survives only a re-derivation onto its own account, which keeps it open across the silent sign-in that happens when a session pass expires, and drops it for anyone else. Keys are still made and kept only in your browser, and NMTS still never sees them.

The recovery tool's control window no longer reads a file that is not a recovery list.

The tool asks for your account code in the terminal and never in the browser, because a browser page is the one place on your machine that other software can look into. But the file picker in its control window read whatever file you chose, whole, and sent it to the program — and a recovery kit is a text file with your account code written in it, so choosing a kit there put the code through the browser and then refused it as not a recovery list. The window now looks at only the first few bytes and stops there if the file is not a list, so a kit is never read at all; it names the file for what it is and gives you the command that works, because someone who saved only the kit has no other file to offer. Published as recovery tool 0.3.1.