nostr-bray 1.28.0 → 1.29.0

package/dist/cli.js

@@ -221,6 +221,8 @@ Quick examples:
   nostr-bray shell                            # interactive mode
 
 Flags:
+  --bunker <uri>                      Use bunker:// URI (overrides env/config)
+  --key <nsec|hex|mnemonic>           Use this secret key (overrides env/config)
   --json                              Output raw JSON (for piping/scripts)
   --human                             Force human-readable output
   --help                              Show help for a command
@@ -235,6 +237,20 @@ if (command === 'help' || command === '--help' || command === '-h') {
     console.log(HELP);
     process.exit(0);
 }
+// Allow key/bunker overrides on the command line
+// These are injected into env before loadConfig() so all loading logic stays centralised.
+// Note: loadConfig() deletes BUNKER_URI / NOSTR_SECRET_KEY from env after reading them.
+if (args.includes('--bunker')) {
+    process.env.BUNKER_URI = args[args.indexOf('--bunker') + 1];
+    // Remove from args so commands don't see it as a positional argument
+    const i = args.indexOf('--bunker');
+    args.splice(i, 2);
+}
+if (args.includes('--key')) {
+    process.env.NOSTR_SECRET_KEY = args[args.indexOf('--key') + 1];
+    const i = args.indexOf('--key');
+    args.splice(i, 2);
+}
 // Commands that work purely offline — no relay connection needed
 const OFFLINE_COMMANDS = new Set([
     'whoami', 'create', 'list', 'derive', 'persona', 'switch', 'prove',

package/dist/context.js

@@ -121,12 +121,27 @@ export class IdentityContext {
                 return;
             }
         }
-        // Not in cache — derive on the fly
-        const identity = derive(this.root, purposeOrName, index ?? 0);
+        // Not in cache — derive on the fly.
+        // If no colon, treat as a persona name (nostr:persona:{name}); otherwise raw purpose.
+        const isPersonaName = !purposeOrName.includes(':');
+        let identity;
+        let purpose;
+        let personaName;
+        if (isPersonaName) {
+            const persona = derivePersona(this.root, purposeOrName, index ?? 0);
+            identity = persona.identity;
+            purpose = persona.identity.purpose;
+            personaName = purposeOrName;
+        }
+        else {
+            identity = derive(this.root, purposeOrName, index ?? 0);
+            purpose = purposeOrName;
+        }
         const entry = {
             identity,
-            purpose: purposeOrName,
+            purpose,
             index: index ?? 0,
+            personaName,
             lastUsed: Date.now(),
         };
         this.putCache(identity.npub, entry);

package/dist/index.js

@@ -142,12 +142,10 @@ if (config.transport === 'stdio') {
 else {
     const { createServer } = await import('node:http');
     const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
-    const { randomUUID } = await import('node:crypto');
+    const { isInitializeRequest } = await import('@modelcontextprotocol/sdk/types.js');
+    const { randomUUID, timingSafeEqual } = await import('node:crypto');
     const token = process.env.BRAY_HTTP_TOKEN ?? randomUUID();
     console.error(`nostr-bray HTTP auth token: ${token}`);
-    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
-    await server.connect(transport);
-    const { timingSafeEqual } = await import('node:crypto');
     const expectedAuth = Buffer.from(`Bearer ${token}`);
     // Sliding window rate limiter (per-IP)
     const rateLimits = new Map();
@@ -163,6 +161,25 @@ else {
         entry.count++;
         return entry.count <= RATE_LIMIT;
     }
+    // Session map — each MCP session gets its own transport.
+    // The underlying McpServer is reused across sessions: when a session ends its
+    // transport closes, which sets server._transport = undefined, allowing the next
+    // session to call server.connect(newTransport).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const sessions = new Map();
+    async function createSession() {
+        // Close the current server connection so it can be reconnected below.
+        if (server.isConnected())
+            await server.close();
+        const t = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (id) => { sessions.set(id, t); },
+        });
+        t.onclose = () => { if (t.sessionId)
+            sessions.delete(t.sessionId); };
+        await server.connect(t);
+        return t;
+    }
     const httpServer = createServer(async (req, res) => {
         const clientIp = req.socket.remoteAddress ?? 'unknown';
         // Rate limiting
@@ -187,6 +204,7 @@ else {
             return;
         }
         // Parse body for POST requests (1MB limit)
+        let body;
         if (req.method === 'POST') {
             const MAX_BODY = 1_048_576;
             const chunks = [];
@@ -200,7 +218,6 @@ else {
                 }
                 chunks.push(chunk);
             }
-            let body;
             try {
                 body = JSON.parse(Buffer.concat(chunks).toString());
             }
@@ -209,11 +226,19 @@ else {
                 res.end(JSON.stringify({ error: 'Invalid JSON' }));
                 return;
             }
-            await transport.handleRequest(req, res, body);
         }
-        else {
-            await transport.handleRequest(req, res);
+        // Route to existing session or create a new one for initialize requests
+        const sessionId = req.headers['mcp-session-id'];
+        let transport = sessionId ? sessions.get(sessionId) : undefined;
+        if (!transport) {
+            if (req.method !== 'POST' || !isInitializeRequest(body)) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32000, message: 'Bad Request: no active session' }, id: null }));
+                return;
+            }
+            transport = await createSession();
         }
+        await transport.handleRequest(req, res, body);
     });
     httpServer.listen(config.port, config.bindAddress, () => {
         console.error(`nostr-bray HTTP on ${config.bindAddress}:${config.port}`);

package/dist/widgets/dm-thread.html

@@ -240,11 +240,11 @@ const { App } = globalThis.ExtApps;
   function sendReply() {
     const message = replyInput.value.trim();
     if (!message || !partnerPubkeyHex) return;
-    app.callServerTool("dm-send", { recipientPubkeyHex: partnerPubkeyHex, message: message });
+    app.callServerTool({ name: "dm-send", arguments: { recipientPubkeyHex: partnerPubkeyHex, message } });
     replyInput.value = "";
     // Refresh conversation after short delay
     setTimeout(() => {
-      app.callServerTool("dm-thread-widget", { withPubkeyHex: partnerPubkeyHex });
+      app.callServerTool({ name: "dm-thread-widget", arguments: { withPubkeyHex: partnerPubkeyHex } });
     }, 1500);
   }
 

package/dist/widgets/identity-picker-handler.d.ts

@@ -6,6 +6,7 @@ import type { SigningContext } from '../signing-context.js';
 import type { RelayPool } from '../relay-pool.js';
 export interface IdentityPickerEntry {
     npub: string;
+    purpose: string;
     personaName?: string;
     displayName?: string;
     pictureDataUri?: string;

package/dist/widgets/identity-picker-handler.js

@@ -25,6 +25,7 @@ export async function handleIdentityPickerWidget(ctx, pool) {
         catch { /* profile lookup may fail for new identities */ }
         entries.push({
             npub: id.npub,
+            purpose: id.purpose ?? 'master',
             personaName: id.personaName,
             displayName,
             pictureDataUri,

package/dist/widgets/identity-picker.html

@@ -110,7 +110,7 @@ const { App } = globalThis.ExtApps;
   app.ontoolresult = ({ content }) => {
     try {
       const data = JSON.parse(content[0].text);
-      render(data);
+      if (data.identities) render(data);
     } catch (e) {
       clearAndShowMessage("Failed to parse identity data.");
     }
@@ -119,6 +119,10 @@ const { App } = globalThis.ExtApps;
   await app.connect();
   const hostCtx = app.getHostContext();
   if (hostCtx) applyTheme(hostCtx.theme);
+  const caps = app.getHostCapabilities();
+  const canCallTools = !!caps?.serverTools;
+  console.debug("[identity-picker] hostCapabilities:", JSON.stringify(caps));
+  console.debug("[identity-picker] canCallTools:", canCallTools);
 
   function clearAndShowMessage(msg) {
     while (root.firstChild) root.removeChild(root.firstChild);
@@ -179,14 +183,21 @@ const { App } = globalThis.ExtApps;
         card.appendChild(badge);
       }
 
-      card.addEventListener("click", () => {
+      card.addEventListener("click", async () => {
         if (id.isActive) return;
-        const target = id.personaName || "master";
-        app.callServerTool("identity-switch", { target: target });
-        // Re-fetch identities after switch
-        setTimeout(() => {
-          app.callServerTool("identity-picker-widget", {});
-        }, 500);
+        if (!canCallTools) {
+          clearAndShowMessage(`Host doesn't support widget tool calls. Ask the AI to switch to "${id.personaName || id.purpose}".`);
+          return;
+        }
+        const target = id.personaName || id.purpose;
+        try {
+          await app.callServerTool({ name: "identity-switch", arguments: { target } });
+          const result = await app.callServerTool({ name: "identity-picker-widget", arguments: {} });
+          const data = JSON.parse(result.content[0].text);
+          render(data);
+        } catch (e) {
+          clearAndShowMessage("Switch failed: " + (e?.message ?? e));
+        }
       });
 
       grid.appendChild(card);

package/dist/widgets/social-feed.html

@@ -210,7 +210,7 @@ const { App } = globalThis.ExtApps;
       loadMore.className = "load-more";
       loadMore.textContent = "Load more";
       loadMore.addEventListener("click", () => {
-        app.callServerTool("social-feed-widget", { since: lastSince });
+        app.callServerTool({ name: "social-feed-widget", arguments: { since: lastSince } });
       });
       root.appendChild(loadMore);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",