nostr-bray 1.40.0 → 1.41.0

package/dist/config.js

@@ -70,6 +70,15 @@ export async function loadConfig() {
     const keyFilePath = process.env.NOSTR_SECRET_KEY_FILE ?? file.secretKeyFile;
     const keyEnvVar = process.env.NOSTR_SECRET_KEY;
     let secretKey;
+    // A local key source is an explicit choice to sign locally. A bunker URI
+    // saved by `bunker connect` is only a fallback and must not override that
+    // choice in the CLI, MCP server or SDK, all of which prefer bunkerUri when
+    // it is present. Explicit bunker configuration still takes precedence.
+    const hasLocalKeySource = !!(keyFilePath
+        || keyEnvVar
+        || process.env.NOSTR_NCRYPTSEC_FILE
+        || process.env.NOSTR_NCRYPTSEC
+        || file.ncryptsecFile);
     let bunkerUri;
     if (process.env.BUNKER_URI_FILE) {
         bunkerUri = readSecretFile(process.env.BUNKER_URI_FILE);
@@ -80,8 +89,9 @@ export async function loadConfig() {
     else if (file.bunkerUriFile) {
         bunkerUri = readSecretFile(file.bunkerUriFile);
     }
-    else {
-        // Fall back to URI saved by `bunker connect`
+    else if (!hasLocalKeySource) {
+        // Fall back to the URI saved by `bunker connect` only when the caller has
+        // not selected local signing for this invocation.
         const { readStateFile } = await import('./state.js');
         const saved = readStateFile('bunker-uri');
         if (saved.uri)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",