nostr-bray 3.9.0 → 3.10.0

package/dist/bunker.js

@@ -145,8 +145,20 @@ export function startBunker(opts) {
         log(`Client no longer in approved-clients.json, so refused: ${clientPk.slice(0, 12)}...`);
         return false;
     }
+    // `bunker authorize` adds to the approvals file while the daemon runs, so a
+    // client not yet approved in memory is looked up there before the gates.
+    function approvedOnDisk(clientPk) {
+        const current = readStateFileStrict(APPROVALS_FILE, opts.stateDir);
+        return current !== null && Array.isArray(current[bunkerPk]) && current[bunkerPk].includes(clientPk);
+    }
     async function handleRequest(event) {
         const clientPk = event.pubkey;
+        if (!openMode && !authorizedKeys.has(clientPk) && approvedOnDisk(clientPk)) {
+            authorizedKeys.add(clientPk);
+            if (!bunkerApprovals.includes(clientPk))
+                bunkerApprovals.push(clientPk);
+            log(`Client found in approved-clients.json (bunker authorize): ${clientPk.slice(0, 12)}...`);
+        }
         if (!openMode && authorizedKeys.has(clientPk) && !stillApproved(clientPk)) {
             // A revoked client has left authorizedKeys and meets the gates below as
             // a stranger. One still there could not be checked (unreadable file).

package/dist/cli/commands/bunker.js

@@ -20,6 +20,21 @@ export async function applyBunkerPersona(ctx, args) {
     }
     return undefined;
 }
+/** A pubkey given as 64-character hex or npub, as lowercase hex; undefined if neither. */
+async function parsePubkeyArg(given) {
+    if (!given)
+        return undefined;
+    if (/^[0-9a-f]{64}$/i.test(given))
+        return given.toLowerCase();
+    const { decode } = await import('nostr-tools/nip19');
+    try {
+        const decoded = decode(given);
+        return decoded.type === 'npub' ? decoded.data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function dispatch(args) {
     // Accept `bunker daemon` as alias for `bunker` (start daemon)
     if (args[1] === 'daemon')
@@ -200,41 +215,92 @@ export async function dispatch(args) {
             process.exit(1);
         }
     }
-    // ── bunker authorize <app-pubkey> ───────────────────────────────────────────
-    // Pre-authorise an app's hex pubkey so it can use the bunker daemon without
-    // going through the interactive connect flow.  Reads the saved bunker URI for
-    // the bunker transport pubkey (used as the key in approved-clients.json) then
-    // writes the new entry — no network connection required.
+    // ── bunker authorize <app-pubkey|npub> [which daemon] ──────────────────────
+    // Pre-approve an app's pubkey on the local bunker daemon, so it connects
+    // without the one-time secret. The approval is keyed by the daemon's own
+    // bunker key, found the way the daemon finds it: --bunker-key-file,
+    // --bunker-key, or the key bray keeps for --persona, --profile or the
+    // default identity. --daemon-pubkey names the daemon's pubkey directly. A running daemon picks it up from the
+    // app's next request. No network connection is made.
     if (args[1] === 'authorize') {
-        const appPubkey = args[2];
-        if (!appPubkey || !/^[0-9a-f]{64}$/i.test(appPubkey)) {
-            console.error('usage: bray bunker authorize <64-char-hex-pubkey>');
+        const usage = 'usage: bray bunker authorize <64-char-hex-pubkey|npub> [--persona <name> | --profile <name> | --bunker-key-file <file> | --bunker-key <hex> | --daemon-pubkey <hex|npub>]';
+        const clientPk = await parsePubkeyArg(args[2]);
+        const opt = (name) => {
+            const i = args.indexOf(name);
+            return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : undefined;
+        };
+        if (!clientPk) {
+            console.error(usage);
             process.exit(1);
         }
-        const { readStateFile, writeStateFile } = await import('../../state.js');
-        const { parseBunkerUri } = await import('../../bunker-context.js');
-        // The bunker transport pubkey keys the approvals file.  It is the pubkey
-        // encoded in the saved bunker URI (bunker://<pubkey>?…), OR falls back to
-        // the BUNKER_URI env var so the command also works without a saved URI.
-        const saved = readStateFile(BUNKER_URI_FILE);
-        const bunkerUriStr = saved.uri ?? process.env.BUNKER_URI;
-        if (!bunkerUriStr) {
-            console.error('bunker authorize: no saved bunker URI — run `bunker connect` or `bunker pair` first, or set BUNKER_URI');
-            process.exit(1);
+        const { getPublicKey } = await import('nostr-tools/pure');
+        const { readStateFile, readStateFileStrict, writeStateFile } = await import('../../state.js');
+        let bunkerPk;
+        let which;
+        if (args.includes('--daemon-pubkey')) {
+            bunkerPk = await parsePubkeyArg(opt('--daemon-pubkey'));
+            which = 'the --daemon-pubkey daemon';
+            if (!bunkerPk) {
+                console.error(usage);
+                process.exit(1);
+            }
+        }
+        else if (args.includes('--bunker-key-file')) {
+            const file = opt('--bunker-key-file');
+            const { readFileSync } = await import('node:fs');
+            let hex = '';
+            try {
+                hex = file ? readFileSync(file, 'utf-8').trim() : '';
+            }
+            catch {
+                hex = '';
+            }
+            if (!/^[0-9a-f]{64}$/i.test(hex)) {
+                console.error('bunker authorize: --bunker-key-file must name a file holding a 64-character hex key');
+                process.exit(1);
+            }
+            bunkerPk = getPublicKey(Buffer.from(hex, 'hex'));
+            which = 'the key in --bunker-key-file';
+        }
+        else if (args.includes('--bunker-key')) {
+            const hex = opt('--bunker-key') ?? '';
+            if (!/^[0-9a-f]{64}$/i.test(hex)) {
+                console.error('bunker authorize: --bunker-key must be a 64-character hex key');
+                process.exit(1);
+            }
+            bunkerPk = getPublicKey(Buffer.from(hex, 'hex'));
+            which = 'the --bunker-key daemon';
+        }
+        else {
+            const persona = opt('--persona');
+            const profile = opt('--profile');
+            const label = persona ?? profile ?? 'default';
+            const startHint = persona ? ` --persona ${persona}` : profile ? ` --profile ${profile}` : '';
+            const keys = readStateFile('bunker-keys.json');
+            const hex = keys[label];
+            if (typeof hex !== 'string' || !/^[0-9a-f]{64}$/i.test(hex)) {
+                console.error(`bunker authorize: no bunker daemon key for "${label}" yet. Start the daemon once (bray bunker${startHint}), or pass --daemon-pubkey <the daemon's pubkey>.`);
+                process.exit(1);
+            }
+            bunkerPk = getPublicKey(Buffer.from(hex, 'hex'));
+            which = label === 'default' ? 'the default daemon' : `the daemon for "${label}"`;
         }
-        const { pubkey: bunkerPk } = parseBunkerUri(bunkerUriStr);
         const APPROVALS_FILE = 'approved-clients.json';
-        const current = readStateFile(APPROVALS_FILE);
-        const entries = current[bunkerPk] ?? [];
-        const normalised = appPubkey.toLowerCase();
-        if (entries.includes(normalised)) {
-            console.error(`bunker authorize: ${normalised} is already authorised`);
+        const current = readStateFileStrict(APPROVALS_FILE);
+        if (current === null) {
+            console.error('bunker authorize: approved-clients.json in the bray state directory is unreadable; fix it or move it aside, then retry');
+            process.exit(1);
+        }
+        const entries = Array.isArray(current[bunkerPk]) ? current[bunkerPk] : [];
+        const { npubEncode } = await import('nostr-tools/nip19');
+        if (entries.includes(clientPk)) {
+            console.error(`bunker authorize: ${clientPk} is already authorised for ${which}`);
             process.exit(0);
         }
-        entries.push(normalised);
-        current[bunkerPk] = entries;
+        current[bunkerPk] = [...entries, clientPk];
         writeStateFile(APPROVALS_FILE, current);
-        console.log(JSON.stringify({ authorised: normalised, total: entries.length }, null, 2));
+        console.error(`Authorised for ${which}. A running daemon accepts this app from its next request.`);
+        console.log(JSON.stringify({ authorised: clientPk, bunker: npubEncode(bunkerPk), total: current[bunkerPk].length }, null, 2));
         process.exit(0);
     }
     // ── bunker revoke <app-pubkey|npub> ─────────────────────────────────────────
@@ -248,21 +314,7 @@ export async function dispatch(args) {
             console.error(usage);
             process.exit(1);
         }
-        let clientPk;
-        if (/^[0-9a-f]{64}$/i.test(given)) {
-            clientPk = given.toLowerCase();
-        }
-        else {
-            const { decode } = await import('nostr-tools/nip19');
-            try {
-                const decoded = decode(given);
-                if (decoded.type === 'npub')
-                    clientPk = decoded.data;
-            }
-            catch {
-                clientPk = undefined;
-            }
-        }
+        const clientPk = await parsePubkeyArg(given);
         if (!clientPk) {
             console.error(usage);
             process.exit(1);

package/dist/cli/index.js

@@ -250,7 +250,7 @@ Modes:
                                       (--auth requires NIP-42; --eager-auth also challenges on connect)
   bunker connect <bunker://…>              Save remote bunker URI for future commands
   bunker pair [--relay <url>] [--expect <npub>]  Pair with a signer app over nostrconnect:// and save it
-  bunker authorize <hex-pubkey>           Pre-authorise an app pubkey on the local bunker
+  bunker authorize <hex-pubkey|npub> [--persona N | --profile N | --bunker-key-file F | --daemon-pubkey P]  Pre-approve an app on the local daemon, even while it runs
   bunker revoke <hex-pubkey|npub>         Withdraw an app's approval, even from a running daemon
   bunker status                           Show saved bunker connection state
   bunker sign <file|->                    One-shot: sign an event template via the bunker (or the saved signer)

package/dist/help.js

@@ -93,7 +93,7 @@ export const COMMAND_HELP = {
     shell: { usage: 'shell', description: 'Start an interactive REPL with a persistent relay connection. Supports tab autocomplete. Type "help" for commands, "exit" to quit.', examples: ['nostr-bray shell'] },
     'key-encrypt': { usage: 'key-encrypt <nsec-or-hex> <password>', description: 'Encrypt a secret key with a password using NIP-49. Returns an ncryptsec string safe for storage. Also returns the derived pubkey for verification.', examples: ['nostr-bray key-encrypt nsec1... mypassword'], notes: 'WARNING: secret key is passed as a CLI argument. Use only on trusted systems.' },
     'key-decrypt': { usage: 'key-decrypt <ncryptsec> <password>', description: 'Decrypt an ncryptsec (NIP-49) with a password. Returns the pubkey for verification — never the raw secret key.', examples: ['nostr-bray key-decrypt ncryptsec1... mypassword'] },
-    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--open] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// key stays stable across restarts, since a per-identity connection key is persisted automatically. The printed link carries a one-time connect secret: a new client must connect with it, after which the daemon prints the next link, so one link cannot be shared between two apps. An unused secret survives restarts. Clients approved earlier reconnect without it and are listed at start; `bunker revoke <pubkey>` withdraws one, and a running daemon refuses it from its next request (except with --open, which serves any client).', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'With --authorized-keys, only those clients are accepted and no secret is used. --open serves any client that connects, with no secret; anyone who learns the link can then sign as you. Clients that connect while it runs open are not saved, so a later daemon without --open still asks them for the secret.' },
+    bunker: { usage: 'bunker [--profile <name>] [--persona <name>] [--bunker-key-file <f>] [--authorized-keys pk1,pk2] [--open] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec. --profile <name> loads the master from an nsec-tree-cli profile (~/.nsec-tree/profiles/<name>.json); --persona <name> signs as a derived sub-identity (the same key as nsec-tree-cli "export nsec <name>"). The bunker:// key stays stable across restarts, since a per-identity connection key is persisted automatically. The printed link carries a one-time connect secret: a new client must connect with it, after which the daemon prints the next link, so one link cannot be shared between two apps. An unused secret survives restarts. Clients approved earlier reconnect without it and are listed at start; `bunker authorize <pubkey>` pre-approves an app without the secret (pass the same --persona, --profile, --bunker-key-file or --bunker-key as the daemon, or --daemon-pubkey) and `bunker revoke <pubkey>` withdraws one; a running daemon applies either from the next request that app sends (--open serves any client regardless).', examples: ['nostr-bray bunker', 'nostr-bray bunker --profile master --persona magazine', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'With --authorized-keys, only those clients, plus any saved as approved (earlier connections or bunker authorize), are accepted and no secret is used. --open serves any client that connects, with no secret; anyone who learns the link can then sign as you. Clients that connect while it runs open are not saved, so a later daemon without --open still asks them for the secret.' },
     serve: { usage: 'serve [--port N] [--hostname H] [--events file.jsonl] [--quiet]', description: 'Start an in-memory Nostr relay for testing. Implements NIP-01 (events, subscriptions, EOSE) and NIP-11 (relay info). Events live in memory only — no persistence. Optionally pre-load events from a JSONL file.', examples: ['nostr-bray serve', 'nostr-bray serve --port 7777', 'nostr-bray serve --events test-data.jsonl', 'nostr-bray serve --port 7777 --quiet'] },
 };
 /** Get formatted help for a single command */

package/dist/veil/scoring.js

@@ -38,14 +38,18 @@ export class VeilScoring {
         let ringEndorsements = 0;
         // 4. Parse assertions and count endorsements
         for (const event of events) {
+            // The relay may return anything; count only kind 30382 assertions about
+            // this pubkey, so a valid proof about someone else adds nothing.
+            if (event.kind !== 30382)
+                continue;
             const parsed = parseAssertion(event);
-            if (parsed.subject === pubkey) {
-                endorsements++;
-            }
+            if (parsed.subject !== pubkey)
+                continue;
+            endorsements++;
             // 5. Check for veil-sig tags and verify ring proofs
             const hasVeilSig = event.tags.some((t) => t[0] === 'veil-sig');
             if (hasVeilSig) {
-                const verification = verifyProof(event);
+                const verification = verifyProof(event, { expectedKind: 30382 });
                 if (verification.valid) {
                     ringEndorsements += verification.distinctSigners;
                     if (!flags.includes('ring proof verified')) {

package/llms-full.txt

@@ -39,7 +39,7 @@ Single-process MCP server (stdio or HTTP transport) with 261 tools in 29 groups.
 *Authentication tiers (use exactly one):
 1. **Bunker** (NIP-46) -- most secure, keys never leave the signer
    For a signer app (Amber, nsec.app), `npx nostr-bray bunker pair --relay <wss://…>` prints a nostrconnect:// URI to paste or scan into the app. Once the app answers, bray saves the signer (a secret-free bunker:// URI marked paired, plus the client key the app approved) in its state directory, and the MCP server and CLI sign through it with no BUNKER_URI. Options: `--relay` (repeatable; defaults to NOSTR_RELAYS, then the config file relays), `--timeout <seconds>` (default 300), `--expect <npub>` (refuse any other account), `--yes` (skip the y/N prompt). In a terminal bray shows the account the signer offers and asks y/N before saving; outside one, `--expect` or `--yes` is required. The URI is a one-time credential: whoever answers it first becomes the signer. With TOR_PROXY set, pairing goes through the proxy and only .onion relays are accepted unless ALLOW_CLEARNET_WITH_TOR=1. `bunker status` reports `paired`; if the app forgets bray, start-up fails with a hint to run `bunker pair` again. An explicit BUNKER_URI or key takes precedence; `bunker connect` replaces the saved signer. A paired signer is checked with get_public_key on start, not sent connect again.
-   bray can also be the signer: `npx nostr-bray bunker` runs a NIP-46 daemon holding your key and prints a bunker:// link with a one-time connect secret. A new client must connect with that link; the daemon then prints the next link, so one link serves one app. An unused secret survives restarts. Clients approved earlier reconnect without the secret and are listed at start; `npx nostr-bray bunker revoke <pubkey|npub>` withdraws one, and a running daemon refuses it from its next request. `--authorized-keys pk1,pk2` accepts only those clients; `--open` serves any client that connects, so anyone who learns the link can sign as you; clients served while open are not saved as approved.
+   bray can also be the signer: `npx nostr-bray bunker` runs a NIP-46 daemon holding your key and prints a bunker:// link with a one-time connect secret. A new client must connect with that link; the daemon then prints the next link, so one link serves one app. An unused secret survives restarts. Clients approved earlier reconnect without the secret and are listed at start; `npx nostr-bray bunker authorize <pubkey|npub> [--persona <name>]` pre-approves an app for that daemon without the secret, `npx nostr-bray bunker revoke <pubkey|npub>` withdraws one, and a running daemon applies either from that app's next request. `--authorized-keys pk1,pk2` accepts only those clients; `--open` serves any client that connects, so anyone who learns the link can sign as you; clients served while open are not saved as approved.
 2. **ncryptsec** (NIP-49) -- password-encrypted key, decrypted at startup
 3. **File** -- secret read from disk, deleted from process.env after parsing
 4. **Env var** -- quickest start, lowest security

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "mcpName": "dev.forgesworn/bray",
   "description": "Trust-aware Nostr MCP server, CLI and TypeScript SDK for AI agents and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",
@@ -180,7 +180,7 @@
     "farrier-kit": "1.1.3",
     "nostr-attestations": "^3.0.1",
     "nostr-tools": "2.24.1",
-    "nostr-veil": "^0.31.1",
+    "nostr-veil": "^0.32.0",
     "nsec-tree": "^1.4.2",
     "signet-protocol": "^1.1.0",
     "socks-proxy-agent": "^10.0.0",