nostr-bray 3.7.1 → 3.8.0

package/dist/bunker.d.ts

@@ -19,9 +19,21 @@ export interface BunkerOptions {
     heartwoodExtensions?: boolean;
     stateDir?: string;
     torProxy?: string;
+    /**
+     * Approve any client that sends `connect`, with no secret: the behaviour
+     * before connect secrets. Ignored when `authorizedKeys` is set.
+     */
+    open?: boolean;
+    /** Called with the new link each time a client uses up the connect secret. */
+    onUrlChange?: (url: string) => void;
 }
 export interface BunkerInstance {
-    url: string;
+    /** bunker:// URI for clients. Carries the current connect secret, so it changes once used. */
+    readonly url: string;
+    /** Client pubkeys approved in earlier runs (from approved-clients.json), at start. */
+    approvedClients: readonly string[];
+    /** Whether a new client needs the connect secret (false with authorizedKeys or open). */
+    requiresSecret: boolean;
     pubkey: string;
     npub: string;
     close: () => void;

package/dist/bunker.js

@@ -9,6 +9,7 @@
  * - Bunker responds with kind 24133 encrypted response
  * - All communication NIP-44 encrypted between client and bunker
  */
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { getConversationKey, encrypt, decrypt } from 'nostr-tools/nip44';
 import { finalizeEvent, getPublicKey, generateSecretKey } from 'nostr-tools/pure';
 import { npubEncode } from 'nostr-tools/nip19';
@@ -33,6 +34,50 @@ export function startBunker(opts) {
         ...cliAuthorizedKeys,
         ...bunkerApprovals,
     ]);
+    // Who may become a client. With --authorized-keys, only those keys (as
+    // before). Otherwise a new client needs the connect secret from the link,
+    // unless the daemon runs open. Clients approved earlier never need it.
+    const allowList = cliAuthorizedKeys.size > 0;
+    const requireSecret = !allowList && opts.open !== true;
+    // The unused secret is kept per bunker key, so a link handed out before a
+    // restart still works. Only for a persistent bunker key: an ephemeral one
+    // gets a new link every run anyway.
+    const SECRETS_FILE = 'bunker-secrets.json';
+    const persistSecret = requireSecret && opts.bunkerKeyHex !== undefined;
+    const newSecret = () => {
+        const secret = randomBytes(16).toString('hex');
+        if (persistSecret) {
+            const current = readStateFile(SECRETS_FILE, opts.stateDir);
+            current[bunkerPk] = secret;
+            writeStateFile(SECRETS_FILE, current, opts.stateDir);
+        }
+        return secret;
+    };
+    const savedSecret = persistSecret
+        ? readStateFile(SECRETS_FILE, opts.stateDir)[bunkerPk]
+        : undefined;
+    let connectSecret = requireSecret
+        ? (typeof savedSecret === 'string' && /^[0-9a-f]{32}$/.test(savedSecret) ? savedSecret : newSecret())
+        : undefined;
+    function secretMatches(given) {
+        if (connectSecret === undefined || typeof given !== 'string')
+            return false;
+        const a = Buffer.from(given);
+        const b = Buffer.from(connectSecret);
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    function approve(clientPk) {
+        authorizedKeys.add(clientPk);
+        if (bunkerApprovals.includes(clientPk))
+            return;
+        bunkerApprovals.push(clientPk);
+        // Merge with the file, so a key added meanwhile by `bunker authorize` stays.
+        const current = readStateFile(APPROVALS_FILE, opts.stateDir);
+        const onDisk = Array.isArray(current[bunkerPk]) ? current[bunkerPk] : [];
+        current[bunkerPk] = [...new Set([...onDisk, ...bunkerApprovals])];
+        writeStateFile(APPROVALS_FILE, current, opts.stateDir);
+        log(`Approved and persisted client: ${clientPk.slice(0, 12)}...`);
+    }
     // Sign in (NIP-42) with the bunker key when a relay asks, so a private
     // relay lets the bunker read requests addressed to it.
     const pool = new SimplePool({ websocketImplementation: webSocketFor(opts.torProxy) });
@@ -50,8 +95,8 @@ export function startBunker(opts) {
     });
     async function handleRequest(event) {
         const clientPk = event.pubkey;
-        // Check authorization — gate only activates when CLI --authorized-keys were set
-        if (cliAuthorizedKeys.size > 0 && !authorizedKeys.has(clientPk)) {
+        // With --authorized-keys, drop anyone else unanswered, as before.
+        if (allowList && !authorizedKeys.has(clientPk)) {
             log(`Rejected request from unauthorized key: ${clientPk.slice(0, 12)}...`);
             return;
         }
@@ -67,19 +112,30 @@ export function startBunker(opts) {
             return;
         }
         log(`Request ${request.id}: ${request.method}`);
+        // A client not yet approved gets in only with the connect secret, which
+        // then works once: the daemon moves to a new one and reports the new link.
+        // Check, rotate and approve must stay free of `await`: two clients racing
+        // with the same secret then cannot both get in.
+        if (requireSecret && !authorizedKeys.has(clientPk)) {
+            if (request.method !== 'connect') {
+                log(`Ignored ${request.method} from unapproved client: ${clientPk.slice(0, 12)}...`);
+                return;
+            }
+            if (!secretMatches(request.params?.[1])) {
+                log(`Refused connect without the current secret: ${clientPk.slice(0, 12)}...`);
+                await respond(clientPk, conversationKey, request.id, '', 'connect refused: use the current bunker:// link from the daemon, which carries a one-time secret');
+                return;
+            }
+            connectSecret = newSecret();
+            approve(clientPk);
+            log('Connect secret used; moved to a new one');
+            opts.onUrlChange?.(buildUrl());
+        }
         let result;
         let error;
         switch (request.method) {
             case 'connect':
-                // Persist newly-approved client
-                if (!bunkerApprovals.includes(clientPk)) {
-                    bunkerApprovals.push(clientPk);
-                    authorizedKeys.add(clientPk);
-                    const current = readStateFile(APPROVALS_FILE, opts.stateDir);
-                    current[bunkerPk] = bunkerApprovals;
-                    writeStateFile(APPROVALS_FILE, current, opts.stateDir);
-                    log(`Approved and persisted client: ${clientPk.slice(0, 12)}...`);
-                }
+                approve(clientPk);
                 result = 'ack';
                 break;
             case 'ping':
@@ -210,10 +266,12 @@ export function startBunker(opts) {
                 result = '';
                 error = `unsupported method: ${request.method}`;
         }
-        // Encrypt and send response
+        await respond(clientPk, conversationKey, request.id, result, error);
+    }
+    async function respond(clientPk, conversationKey, id, result, error) {
         const response = error
-            ? JSON.stringify({ id: request.id, result: '', error })
-            : JSON.stringify({ id: request.id, result });
+            ? JSON.stringify({ id, result: '', error })
+            : JSON.stringify({ id, result });
         const encrypted = encrypt(response, conversationKey);
         const responseEvent = finalizeEvent({
             kind: 24133,
@@ -222,22 +280,30 @@ export function startBunker(opts) {
             content: encrypted,
         }, bunkerSk);
         await Promise.any(pool.publish(relays, responseEvent));
-        log(`Response ${request.id}: ${error ?? 'ok'}`);
+        log(`Response ${id}: ${error ?? 'ok'}`);
     }
     // Build bunker:// URI
     const relayParams = relays.map(r => `relay=${encodeURIComponent(r)}`).join('&');
-    const bunkerUrl = `bunker://${bunkerPk}?${relayParams}`;
+    const buildUrl = () => connectSecret === undefined
+        ? `bunker://${bunkerPk}?${relayParams}`
+        : `bunker://${bunkerPk}?${relayParams}&secret=${connectSecret}`;
     log(`Bunker started: ${bunkerNpub}`);
-    log(`URI: ${bunkerUrl}`);
+    // The secret stays out of the log; the caller shows the link (bunker.url).
+    log(`URI: bunker://${bunkerPk}?${relayParams}${connectSecret === undefined ? '' : ' (plus a connect secret)'}`);
     log(`Signing as: ${ctx.activeNpub}`);
-    if (cliAuthorizedKeys.size > 0) {
+    if (allowList) {
         log(`Authorized keys: ${authorizedKeys.size} (${cliAuthorizedKeys.size} CLI + ${bunkerApprovals.length} persisted)`);
     }
+    else if (requireSecret) {
+        log(`New clients need the secret in this link; it works once. ${bunkerApprovals.length} client(s) approved earlier.`);
+    }
     else {
-        log('WARNING: No authorized keys set — accepting requests from anyone');
+        log('WARNING: running open (--open): any client that connects is approved');
     }
     return {
-        url: bunkerUrl,
+        get url() { return buildUrl(); },
+        approvedClients: [...bunkerApprovals],
+        requiresSecret: requireSecret,
         pubkey: bunkerPk,
         npub: bunkerNpub,
         close: () => {

package/dist/cli/commands/bunker.js

@@ -339,9 +339,32 @@ export async function dispatch(args) {
         bunkerKeyHex,
         quiet: args.includes('--quiet'),
         torProxy: config.torProxy,
+        open: args.includes('--open'),
+        onUrlChange: url => {
+            console.error('A new client connected, so that secret is used up. Give the next new client this link:');
+            console.error(url);
+        },
     });
+    if (authorizedKeys && args.includes('--open')) {
+        console.error('--open is ignored with --authorized-keys: only the listed clients are accepted.');
+    }
     console.error(`nostr-bray bunker running`);
     console.error(`URI: ${bunker.url}`);
+    if (authorizedKeys) {
+        console.error('Only the --authorized-keys clients (and clients approved earlier) are accepted.');
+    }
+    else if (!bunker.requiresSecret) {
+        console.error('Running open: any client that connects is approved. Anyone with the link can sign as you.');
+    }
+    else {
+        console.error('The link carries a one-time secret for one new client. Treat it like a password.');
+        console.error('It survives restarts until used; each new client needs the next link the daemon prints.');
+        if (bunker.approvedClients.length > 0) {
+            console.error(`Clients approved earlier (they need no secret; remove any you do not recognise from approved-clients.json in bray's state directory):`);
+            for (const pk of bunker.approvedClients)
+                console.error(`  ${pk}`);
+        }
+    }
     console.error(`Signing as: ${bCtx.activeNpub}`);
     console.error('Press Ctrl+C to stop');
     process.on('SIGINT', () => { bunker.close(); bCtx.destroy(); process.exit(0); });

package/dist/cli/index.js

@@ -253,7 +253,7 @@ Modes:
   bunker authorize <hex-pubkey>           Pre-authorise an app pubkey on the local bunker
   bunker status                           Show saved bunker connection state
   bunker sign <file|->                    One-shot: sign an event template via the bunker (or the saved signer)
-  bunker daemon [--profile N] [--persona N] [--authorized-keys pk,pk]  Start NIP-46 remote signer daemon
+  bunker daemon [--profile N] [--persona N] [--authorized-keys pk,pk] [--open]  Start NIP-46 remote signer daemon
   shell                               Interactive REPL (persistent relay connection)
 
 Environment:

package/dist/help.js

@@ -93,7 +93,7 @@ export const COMMAND_HELP = {
     shell: { usage: 'shell', description: 'Start an interactive REPL with a persistent relay connection. Supports tab autocomplete. Type "help" for commands, "exit" to quit.', examples: ['nostr-bray shell'] },
     'key-encrypt': { usage: 'key-encrypt <nsec-or-hex> <password>', description: 'Encrypt a secret key with a password using NIP-49. Returns an ncryptsec string safe for storage. Also returns the derived pubkey for verification.', examples: ['nostr-bray key-encrypt nsec1... mypassword'], notes: 'WARNING: secret key is passed as a CLI argument. Use only on trusted systems.' },
     'key-decrypt': { usage: 'key-decrypt <ncryptsec> <password>', description: 'Decrypt an ncryptsec (NIP-49) with a password. Returns the pubkey for verification — never the raw secret key.', examples: ['nostr-bray key-decrypt ncryptsec1... mypassword'] },
-    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// stays stable across restarts — a per-identity connection key is persisted automatically.', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'Without --authorized-keys, accepts requests from anyone. Set authorized keys for production use.' },
+    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--open] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// key stays stable across restarts, since a per-identity connection key is persisted automatically. The printed link carries a one-time connect secret: a new client must connect with it, after which the daemon prints the next link, so one link cannot be shared between two apps. An unused secret survives restarts. Clients approved earlier reconnect without it and are listed at start.', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'With --authorized-keys, only those clients are accepted and no secret is used. --open approves any client that connects, with no secret, as earlier releases did; anyone who learns the link can then sign as you.' },
     serve: { usage: 'serve [--port N] [--hostname H] [--events file.jsonl] [--quiet]', description: 'Start an in-memory Nostr relay for testing. Implements NIP-01 (events, subscriptions, EOSE) and NIP-11 (relay info). Events live in memory only — no persistence. Optionally pre-load events from a JSONL file.', examples: ['nostr-bray serve', 'nostr-bray serve --port 7777', 'nostr-bray serve --events test-data.jsonl', 'nostr-bray serve --port 7777 --quiet'] },
 };
 /** Get formatted help for a single command */

package/llms-full.txt

@@ -39,6 +39,7 @@ Single-process MCP server (stdio or HTTP transport) with 261 tools in 29 groups.
 *Authentication tiers (use exactly one):
 1. **Bunker** (NIP-46) -- most secure, keys never leave the signer
    For a signer app (Amber, nsec.app), `npx nostr-bray bunker pair --relay <wss://…>` prints a nostrconnect:// URI to paste or scan into the app. Once the app answers, bray saves the signer (a secret-free bunker:// URI marked paired, plus the client key the app approved) in its state directory, and the MCP server and CLI sign through it with no BUNKER_URI. Options: `--relay` (repeatable; defaults to NOSTR_RELAYS, then the config file relays), `--timeout <seconds>` (default 300), `--expect <npub>` (refuse any other account), `--yes` (skip the y/N prompt). In a terminal bray shows the account the signer offers and asks y/N before saving; outside one, `--expect` or `--yes` is required. The URI is a one-time credential: whoever answers it first becomes the signer. With TOR_PROXY set, pairing goes through the proxy and only .onion relays are accepted unless ALLOW_CLEARNET_WITH_TOR=1. `bunker status` reports `paired`; if the app forgets bray, start-up fails with a hint to run `bunker pair` again. An explicit BUNKER_URI or key takes precedence; `bunker connect` replaces the saved signer. A paired signer is checked with get_public_key on start, not sent connect again.
+   bray can also be the signer: `npx nostr-bray bunker` runs a NIP-46 daemon holding your key and prints a bunker:// link with a one-time connect secret. A new client must connect with that link; the daemon then prints the next link, so one link serves one app. An unused secret survives restarts. Clients approved earlier reconnect without the secret and are listed at start. `--authorized-keys pk1,pk2` accepts only those clients; `--open` approves any client that connects, as earlier releases did, so anyone who learns the link can sign as you.
 2. **ncryptsec** (NIP-49) -- password-encrypted key, decrypted at startup
 3. **File** -- secret read from disk, deleted from process.env after parsing
 4. **Env var** -- quickest start, lowest security

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr MCP server, CLI and TypeScript SDK for AI agents and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",