v0.6.0

Privacy

• Omaweb sends the Global Privacy Control signal. Every request carries Sec-GPC: 1, and navigator.globalPrivacyControl reads true in every frame. Every Space and Private window sends it. It is on by default, and a switch at the top of Settings' privacy section turns it off for the whole browser.
• A WebRTC call on a page now sees only your public interface, the address of the default route. It no longer learns your LAN address or the address a VPN hides, and calls still connect. The switch is "Keep calls off your other addresses", after Global Privacy Control, and it is on by default. Turn it off when the peer of a call is on your own network.

Content blocking

With the default lists, browserleaks.com/proxy now detects both EasyList and EasyPrivacy. Before this release it detected neither.

• Generic cosmetic rules reach elements a page adds after it loads, such as an ad slot a script fills. Each frame, subframes included, watches its document and asks only about class and id names it has not seen. It reports at most once per 100 ms and stops after 32 reports. Before, only the main frame was checked, once, after its load.
• An element whose request Content blocking refused now collapses with display: none. This covers images, frames, objects, embeds, video and audio, and elements answered with a Substitute resource. You no longer see a broken-image icon where an ad was. A request that failed for any other reason is left as the engine draws it, and the Refusal tally does not change.
• EasyList Cookie, the list that hides consent banners, is a Known list. Settings' content blocking section names it with its source and license, and one action subscribes it. A first run does not subscribe it. In testing it compiled to 25131 rules, none invalid.

Search keywords in the Omnibar

• Type a keyword and a space, and the Omnibar shows its engine as a chip. Beneath the field it reads out the destination, such as "Search Google for rust lifetimes". Backspace on empty terms turns the chip back into text.
• A typed prefix offers the keywords it could become as rows beneath the history.
• A keyword alone opens the engine's front page. g then Return opens Google, not a search for the letter g.
• Keywords match case-insensitively, so G is g. Saving two keywords that differ only in case is refused. If your engine list already holds both, the second engine stays and loses its keyword.
• All seven preset engines ship with a keyword: d, g, b, br, k, e and sp. DuckDuckGo is the default. An existing list gets the presets it lacks once, so an engine you delete afterwards stays deleted. Your own keyword wins over a shipped one.

Fonts

• Set the size of Omaweb's own type in Settings, under Interface. It steps up and down, and reset returns to the theme's size. Every window changes at once, Private windows included. A theme switch changes the size only while you have no override. Page zoom does not change.
• The same section sets the fonts a page gets when it names none: a standard family, a fixed-width family, a default size and a minimum size. Each shows the engine's own value until you set it. The families come from the fonts on your machine, and the fixed-width list also offers the interface's family. Every Space and the Private windows use the same values.
• A family or default size restyles open pages at once. A minimum size alone takes effect on the page's next layout, such as a reload. Tab zoom multiplies the minimum.
• These settings are kept in ~/.config/omaweb/interface.json.

Media keys and the bar

• Omaweb announces the Sounding tab over MPRIS as org.mpris.MediaPlayer2.omaweb. The media keys and the bar's media widget reach the tab making sound, in any Space. The player appears while a tab makes sound and goes when none does. It was checked against Omarchy 4's omarchy.media bar widget.
• The desktop is told the title, artist, album and artwork the page declares, or the tab's title when the page declares nothing. Omaweb passes the artwork address on and does not fetch it.
• Play, pause, next and previous reach the page's own media handlers. A page that registered none is answered by the element that is sounding.
• With two tabs playing, the one started last is the Sounding tab. A paused tab gives way to one still playing. When nothing plays, the paused tab keeps the player for the next key press.
• A Private window announces playback and the controls, and nothing about what is playing.

Your theme on pages that ask

A page with <meta name="omaweb-palette"> in its head gets the window's palette as custom properties on its root element: --omaweb-bg, --omaweb-sidebar, --omaweb-fg, --omaweb-accent, --omaweb-urgent and --omaweb-muted. The page's own definitions win, and the values change in place when the theme changes. A page that does not ask gets nothing. The Omaweb website asks, so in Omaweb it comes up in your theme, shipped or custom, before its first paint.

Fixes

• A site reached through a cross-site redirect keeps its own cookies. QtWebEngine reported them as third-party, and Omaweb refused them. The claude auth login flow, which redirects from claude.com to claude.ai, lost its session and now completes. A cookie must be for the arriving host or one above or below it. A sibling host, such as api.example.com on www.example.com, is still refused.
• Content blocking runs each document's own rules. A cross-site redirect target used to run the rules of the address the load set out from. A reload during a load could run a scriptlet after you had turned blocking off for the site.
• A page that sets no background paints on white. It used to come up on the theme's dark window colour, with black text. A page that declares color-scheme: dark keeps a dark canvas. The theme colour shows only until a new document first paints.
• The wheel no longer scrolls the page beneath a sheet or overlay. It leaked under Settings, History, the Start page over a page, the Omnibar, the dialogs, the Glance's scrim, the context menu and the page prompt bar. Over Site information it scrolled the outline beneath.
• Omaweb's own scroll, media and press reports no longer fill the console in Developer tools. They go at the debug level, which the inspector hides by default. A page can no longer read or forge them. The scroll report goes only when the page moved, not once a second.
• The page prompt bar clears its answer, username and password fields whenever a prompt closes, by any route. A password typed for one site used to stay in a hidden field until the next prompt. When two tabs prompted at once, the second prompt's field held the first tab's password.
• About now reads "Alpha. Expect bugs. The Security section states what this build verifies and what it leaves to you." It used to say "Pre-alpha. Do not use it for sensitive browsing yet."

Full changelog: https://github.com/villekivela/omaweb/compare/v0.5.1...v0.6.0