nostr-bray 3.8.0 → 3.9.0

package/dist/bunker.d.ts

@@ -27,10 +27,16 @@ export interface BunkerOptions {
     /** Called with the new link each time a client uses up the connect secret. */
     onUrlChange?: (url: string) => void;
 }
+/**
+ * Remove a client pubkey from every bunker key's approvals in
+ * approved-clients.json. A running daemon notices on the client's next
+ * request. Returns how many bunker keys had approved it.
+ */
+export declare function revokeClient(clientPk: string, stateDir?: string): number;
 export interface BunkerInstance {
     /** bunker:// URI for clients. Carries the current connect secret, so it changes once used. */
     readonly url: string;
-    /** Client pubkeys approved in earlier runs (from approved-clients.json), at start. */
+    /** Client pubkeys approved for this bunker key (approved-clients.json). A revoked key leaves this list at that client's next request. */
     approvedClients: readonly string[];
     /** Whether a new client needs the connect secret (false with authorizedKeys or open). */
     requiresSecret: boolean;

package/dist/bunker.js

@@ -15,7 +15,27 @@ import { finalizeEvent, getPublicKey, generateSecretKey } from 'nostr-tools/pure
 import { npubEncode } from 'nostr-tools/nip19';
 import { SimplePool } from 'nostr-tools/pool';
 import { webSocketFor } from './ws-safe.js';
-import { readStateFile, writeStateFile } from './state.js';
+import { readStateFile, readStateFileStrict, writeStateFile } from './state.js';
+/**
+ * Remove a client pubkey from every bunker key's approvals in
+ * approved-clients.json. A running daemon notices on the client's next
+ * request. Returns how many bunker keys had approved it.
+ */
+export function revokeClient(clientPk, stateDir) {
+    const file = readStateFileStrict('approved-clients.json', stateDir);
+    if (file === null)
+        throw new Error('approved-clients.json in the bray state directory is unreadable; fix it or move it aside, then retry');
+    let removed = 0;
+    for (const [bunker, list] of Object.entries(file)) {
+        if (!Array.isArray(list) || !list.includes(clientPk))
+            continue;
+        file[bunker] = list.filter(pk => pk !== clientPk);
+        removed++;
+    }
+    if (removed > 0)
+        writeStateFile('approved-clients.json', file, stateDir);
+    return removed;
+}
 export function startBunker(opts) {
     const { ctx, relays, quiet } = opts;
     const log = quiet ? () => { } : (...args) => console.error('[bunker]', ...args);
@@ -39,6 +59,9 @@ export function startBunker(opts) {
     // unless the daemon runs open. Clients approved earlier never need it.
     const allowList = cliAuthorizedKeys.size > 0;
     const requireSecret = !allowList && opts.open !== true;
+    // Open: any client is served and nothing is saved, so a stranger who found
+    // the link is not approved for a later daemon run without --open.
+    const openMode = !allowList && !requireSecret;
     // The unused secret is kept per bunker key, so a link handed out before a
     // restart still works. Only for a persistent bunker key: an ephemeral one
     // gets a new link every run anyway.
@@ -67,14 +90,22 @@ export function startBunker(opts) {
         return a.length === b.length && timingSafeEqual(a, b);
     }
     function approve(clientPk) {
+        if (openMode)
+            return;
         authorizedKeys.add(clientPk);
         if (bunkerApprovals.includes(clientPk))
             return;
         bunkerApprovals.push(clientPk);
-        // Merge with the file, so a key added meanwhile by `bunker authorize` stays.
-        const current = readStateFile(APPROVALS_FILE, opts.stateDir);
+        // Add just this key to the file, so a key added meanwhile by `bunker
+        // authorize` stays and a key removed by `bunker revoke` stays removed.
+        // An unreadable file is left alone rather than replaced by this one key.
+        const current = readStateFileStrict(APPROVALS_FILE, opts.stateDir);
+        if (current === null) {
+            log(`approved-clients.json is unreadable, so this approval is not saved; once the file is fixed this client needs a fresh link: ${clientPk.slice(0, 12)}...`);
+            return;
+        }
         const onDisk = Array.isArray(current[bunkerPk]) ? current[bunkerPk] : [];
-        current[bunkerPk] = [...new Set([...onDisk, ...bunkerApprovals])];
+        current[bunkerPk] = [...new Set([...onDisk, clientPk])];
         writeStateFile(APPROVALS_FILE, current, opts.stateDir);
         log(`Approved and persisted client: ${clientPk.slice(0, 12)}...`);
     }
@@ -93,8 +124,35 @@ export function startBunker(opts) {
             }
         },
     });
+    // `bunker revoke` edits the approvals file while the daemon runs, so a
+    // client approved in memory is checked against the file before each request.
+    function stillApproved(clientPk) {
+        if (cliAuthorizedKeys.has(clientPk))
+            return true;
+        const current = readStateFileStrict(APPROVALS_FILE, opts.stateDir);
+        if (current === null) {
+            // Fail closed, but keep the in-memory approval for when the file is fixed.
+            log(`approved-clients.json is unreadable, so refused: ${clientPk.slice(0, 12)}...`);
+            return false;
+        }
+        const onDisk = Array.isArray(current[bunkerPk]) ? current[bunkerPk] : [];
+        if (onDisk.includes(clientPk))
+            return true;
+        authorizedKeys.delete(clientPk);
+        const i = bunkerApprovals.indexOf(clientPk);
+        if (i >= 0)
+            bunkerApprovals.splice(i, 1);
+        log(`Client no longer in approved-clients.json, so refused: ${clientPk.slice(0, 12)}...`);
+        return false;
+    }
     async function handleRequest(event) {
         const clientPk = event.pubkey;
+        if (!openMode && authorizedKeys.has(clientPk) && !stillApproved(clientPk)) {
+            // A revoked client has left authorizedKeys and meets the gates below as
+            // a stranger. One still there could not be checked (unreadable file).
+            if (authorizedKeys.has(clientPk))
+                return;
+        }
         // With --authorized-keys, drop anyone else unanswered, as before.
         if (allowList && !authorizedKeys.has(clientPk)) {
             log(`Rejected request from unauthorized key: ${clientPk.slice(0, 12)}...`);
@@ -302,7 +360,7 @@ export function startBunker(opts) {
     }
     return {
         get url() { return buildUrl(); },
-        approvedClients: [...bunkerApprovals],
+        get approvedClients() { return [...bunkerApprovals]; },
         requiresSecret: requireSecret,
         pubkey: bunkerPk,
         npub: bunkerNpub,

package/dist/cli/commands/bunker.d.ts

@@ -1,6 +1,6 @@
 /**
  * Bunker command module.
- * bunker sign, bunker connect, bunker pair, bunker authorize, bunker status, and bunker daemon
+ * bunker sign, bunker connect, bunker pair, bunker authorize, bunker revoke, bunker status, and bunker daemon
  * are all dispatched BEFORE ctx/pool setup in index.ts, so this module does its
  * own config/context construction.
  */

package/dist/cli/commands/bunker.js

@@ -1,6 +1,6 @@
 /**
  * Bunker command module.
- * bunker sign, bunker connect, bunker pair, bunker authorize, bunker status, and bunker daemon
+ * bunker sign, bunker connect, bunker pair, bunker authorize, bunker revoke, bunker status, and bunker daemon
  * are all dispatched BEFORE ctx/pool setup in index.ts, so this module does its
  * own config/context construction.
  */
@@ -237,6 +237,53 @@ export async function dispatch(args) {
         console.log(JSON.stringify({ authorised: normalised, total: entries.length }, null, 2));
         process.exit(0);
     }
+    // ── bunker revoke <app-pubkey|npub> ─────────────────────────────────────────
+    // Withdraw a client's approval, the reverse of `bunker authorize` and of a
+    // client connecting with the secret. Removes it for every bunker key; a
+    // running daemon refuses the client from its next request.
+    if (args[1] === 'revoke') {
+        const usage = 'usage: bray bunker revoke <64-char-hex-pubkey|npub>';
+        const given = args[2];
+        if (!given || args.length > 3) {
+            console.error(usage);
+            process.exit(1);
+        }
+        let clientPk;
+        if (/^[0-9a-f]{64}$/i.test(given)) {
+            clientPk = given.toLowerCase();
+        }
+        else {
+            const { decode } = await import('nostr-tools/nip19');
+            try {
+                const decoded = decode(given);
+                if (decoded.type === 'npub')
+                    clientPk = decoded.data;
+            }
+            catch {
+                clientPk = undefined;
+            }
+        }
+        if (!clientPk) {
+            console.error(usage);
+            process.exit(1);
+        }
+        const { revokeClient } = await import('../../bunker.js');
+        let removed;
+        try {
+            removed = revokeClient(clientPk);
+        }
+        catch (err) {
+            console.error(`bunker revoke: ${err.message}`);
+            process.exit(1);
+        }
+        if (removed === 0) {
+            console.error(`bunker revoke: ${clientPk} is not an approved client (keys passed with --authorized-keys are set when the daemon starts; restart it without them)`);
+            process.exit(1);
+        }
+        console.error('A running bunker daemon refuses this client from its next request. A daemon started with --open serves any client, revoked or not; one started with --authorized-keys keeps the keys it was given.');
+        console.log(JSON.stringify({ revoked: clientPk, bunkers: removed }, null, 2));
+        process.exit(0);
+    }
     // ── bunker status ───────────────────────────────────────────────────────────
     // Report the saved bunker URI and its parsed details.  Does NOT attempt a
     // live connection (use `bunker connect` to verify reachability).
@@ -360,7 +407,7 @@ export async function dispatch(args) {
         console.error('The link carries a one-time secret for one new client. Treat it like a password.');
         console.error('It survives restarts until used; each new client needs the next link the daemon prints.');
         if (bunker.approvedClients.length > 0) {
-            console.error(`Clients approved earlier (they need no secret; remove any you do not recognise from approved-clients.json in bray's state directory):`);
+            console.error(`Clients approved earlier (they need no secret; remove any you do not recognise with "bray bunker revoke <pubkey>"):`);
             for (const pk of bunker.approvedClients)
                 console.error(`  ${pk}`);
         }

package/dist/cli/index.js

@@ -251,6 +251,7 @@ Modes:
   bunker connect <bunker://…>              Save remote bunker URI for future commands
   bunker pair [--relay <url>] [--expect <npub>]  Pair with a signer app over nostrconnect:// and save it
   bunker authorize <hex-pubkey>           Pre-authorise an app pubkey on the local bunker
+  bunker revoke <hex-pubkey|npub>         Withdraw an app's approval, even from a running daemon
   bunker status                           Show saved bunker connection state
   bunker sign <file|->                    One-shot: sign an event template via the bunker (or the saved signer)
   bunker daemon [--profile N] [--persona N] [--authorized-keys pk,pk] [--open]  Start NIP-46 remote signer daemon

package/dist/help.js

@@ -93,7 +93,7 @@ export const COMMAND_HELP = {
     shell: { usage: 'shell', description: 'Start an interactive REPL with a persistent relay connection. Supports tab autocomplete. Type "help" for commands, "exit" to quit.', examples: ['nostr-bray shell'] },
     'key-encrypt': { usage: 'key-encrypt <nsec-or-hex> <password>', description: 'Encrypt a secret key with a password using NIP-49. Returns an ncryptsec string safe for storage. Also returns the derived pubkey for verification.', examples: ['nostr-bray key-encrypt nsec1... mypassword'], notes: 'WARNING: secret key is passed as a CLI argument. Use only on trusted systems.' },
     'key-decrypt': { usage: 'key-decrypt <ncryptsec> <password>', description: 'Decrypt an ncryptsec (NIP-49) with a password. Returns the pubkey for verification — never the raw secret key.', examples: ['nostr-bray key-decrypt ncryptsec1... mypassword'] },
-    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--open] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// key stays stable across restarts, since a per-identity connection key is persisted automatically. The printed link carries a one-time connect secret: a new client must connect with it, after which the daemon prints the next link, so one link cannot be shared between two apps. An unused secret survives restarts. Clients approved earlier reconnect without it and are listed at start.', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'With --authorized-keys, only those clients are accepted and no secret is used. --open approves any client that connects, with no secret, as earlier releases did; anyone who learns the link can then sign as you.' },
+    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--open] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// key stays stable across restarts, since a per-identity connection key is persisted automatically. The printed link carries a one-time connect secret: a new client must connect with it, after which the daemon prints the next link, so one link cannot be shared between two apps. An unused secret survives restarts. Clients approved earlier reconnect without it and are listed at start; `bunker revoke <pubkey>` withdraws one, and a running daemon refuses it from its next request (except with --open, which serves any client).', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'With --authorized-keys, only those clients are accepted and no secret is used. --open serves any client that connects, with no secret; anyone who learns the link can then sign as you. Clients that connect while it runs open are not saved, so a later daemon without --open still asks them for the secret.' },
     serve: { usage: 'serve [--port N] [--hostname H] [--events file.jsonl] [--quiet]', description: 'Start an in-memory Nostr relay for testing. Implements NIP-01 (events, subscriptions, EOSE) and NIP-11 (relay info). Events live in memory only — no persistence. Optionally pre-load events from a JSONL file.', examples: ['nostr-bray serve', 'nostr-bray serve --port 7777', 'nostr-bray serve --events test-data.jsonl', 'nostr-bray serve --port 7777 --quiet'] },
 };
 /** Get formatted help for a single command */

package/dist/state.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Read a JSON state file that holds an object. Returns `{}` if the file is
+ * missing, and null if it exists but cannot be read or is not a JSON object,
+ * so a caller can refuse to overwrite it.
+ */
+export declare function readStateFileStrict<T extends object = Record<string, unknown>>(name: string, stateDir?: string): T | null;
 /** Read and parse a JSON state file. Returns `{}` if missing or corrupt. */
 export declare function readStateFile<T = Record<string, unknown>>(name: string, stateDir?: string): T;
 /**

package/dist/state.js

@@ -3,6 +3,23 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { randomBytes } from 'node:crypto';
 const DEFAULT_STATE_DIR = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'bray');
+/**
+ * Read a JSON state file that holds an object. Returns `{}` if the file is
+ * missing, and null if it exists but cannot be read or is not a JSON object,
+ * so a caller can refuse to overwrite it.
+ */
+export function readStateFileStrict(name, stateDir = DEFAULT_STATE_DIR) {
+    const path = join(stateDir, name);
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Read and parse a JSON state file. Returns `{}` if missing or corrupt. */
 export function readStateFile(name, stateDir = DEFAULT_STATE_DIR) {
     const path = join(stateDir, name);

package/llms-full.txt

@@ -39,7 +39,7 @@ Single-process MCP server (stdio or HTTP transport) with 261 tools in 29 groups.
 *Authentication tiers (use exactly one):
 1. **Bunker** (NIP-46) -- most secure, keys never leave the signer
    For a signer app (Amber, nsec.app), `npx nostr-bray bunker pair --relay <wss://…>` prints a nostrconnect:// URI to paste or scan into the app. Once the app answers, bray saves the signer (a secret-free bunker:// URI marked paired, plus the client key the app approved) in its state directory, and the MCP server and CLI sign through it with no BUNKER_URI. Options: `--relay` (repeatable; defaults to NOSTR_RELAYS, then the config file relays), `--timeout <seconds>` (default 300), `--expect <npub>` (refuse any other account), `--yes` (skip the y/N prompt). In a terminal bray shows the account the signer offers and asks y/N before saving; outside one, `--expect` or `--yes` is required. The URI is a one-time credential: whoever answers it first becomes the signer. With TOR_PROXY set, pairing goes through the proxy and only .onion relays are accepted unless ALLOW_CLEARNET_WITH_TOR=1. `bunker status` reports `paired`; if the app forgets bray, start-up fails with a hint to run `bunker pair` again. An explicit BUNKER_URI or key takes precedence; `bunker connect` replaces the saved signer. A paired signer is checked with get_public_key on start, not sent connect again.
-   bray can also be the signer: `npx nostr-bray bunker` runs a NIP-46 daemon holding your key and prints a bunker:// link with a one-time connect secret. A new client must connect with that link; the daemon then prints the next link, so one link serves one app. An unused secret survives restarts. Clients approved earlier reconnect without the secret and are listed at start. `--authorized-keys pk1,pk2` accepts only those clients; `--open` approves any client that connects, as earlier releases did, so anyone who learns the link can sign as you.
+   bray can also be the signer: `npx nostr-bray bunker` runs a NIP-46 daemon holding your key and prints a bunker:// link with a one-time connect secret. A new client must connect with that link; the daemon then prints the next link, so one link serves one app. An unused secret survives restarts. Clients approved earlier reconnect without the secret and are listed at start; `npx nostr-bray bunker revoke <pubkey|npub>` withdraws one, and a running daemon refuses it from its next request. `--authorized-keys pk1,pk2` accepts only those clients; `--open` serves any client that connects, so anyone who learns the link can sign as you; clients served while open are not saved as approved.
 2. **ncryptsec** (NIP-49) -- password-encrypted key, decrypted at startup
 3. **File** -- secret read from disk, deleted from process.env after parsing
 4. **Env var** -- quickest start, lowest security

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "3.8.0",
+  "version": "3.9.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr MCP server, CLI and TypeScript SDK for AI agents and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",
@@ -180,7 +180,7 @@
     "farrier-kit": "1.1.3",
     "nostr-attestations": "^3.0.1",
     "nostr-tools": "2.24.1",
-    "nostr-veil": "^0.30.0",
+    "nostr-veil": "^0.31.1",
     "nsec-tree": "^1.4.2",
     "signet-protocol": "^1.1.0",
     "socks-proxy-agent": "^10.0.0",