mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 08:27:04 +00:00
c9e8cd4e0ca212eb769572c91ccbcf66623f4ebc
589
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Claude
|
d571bee394 |
fix(store): rank multi-filter search REQs + harden merge from branch audit
Two-reviewer adversarial audit of the branch found no correctness/data-loss/ crash bugs. This closes one gap and applies three robustness fixes: - Multi-filter search ordering: a REQ whose filters all carry a search term (e.g. the client's search-across-kinds) was created_at-ordered via the union path. Now relevance-ordered — unionSubqueriesIfNeeded(projectRank) projects rank per branch, UNION ALL + GROUP BY row_id MIN(rank) dedups across branches keeping the best score. Only when every branch is a search branch; mixed search/non-search REQs and count/delete unions stay as before. - prepareAuthorStreams/prepareTagStreams build cursors via buildStreams, which closes already-prepared statements if a later prepare throws (was: stranded checked-out, un-reset handles holding read locks in the pooled connection). - Stream counts computed as Long so authors×kinds / values×kinds can't overflow Int back into the eligible band and route a huge fan-out into the merge. - Renamed CachedStatement.finalize() -> finalizeStatement(): a no-arg finalize() is the JVM Object.finalize, risking a GC double-close of the native handle. Tests: multi-filter search relevance + cross-branch dedup + count parity; existing merge/cache/search suites green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XqGuBuSUsRudGerPqDuoKA |
||
|
Claude
|
de114d1621 |
fix(store): relevance-order search+tag queries too, not just tag-free search
Any filter with a search term must be relevance-ranked (NIP-50), but only the tag-free shape (makeSimpleSearch) was — search + a tag fell through to the row-id-subquery path (prepareRowIDSubQueries/makeQueryIn), which ordered by created_at. prepareRowIDSubQueries gains projectRank: when a search filter joins event_fts, it also projects the bm25 score as a `rank` column and cuts its LIMIT by rank (most relevant, not newest); makeQueryIn(orderByRank) then presents the joined result by that rank, created_at DESC as tie-break. Off by default, so count/delete/union/negentropy (which must stay single-column and unranked) are untouched. toSql wires it on whenever the filter carries a search term. SearchRelevanceOrderTest adds a tag-scoped case (stronger-but-older outranks weaker-but-newer, wrong-tag and non-matching excluded, limit cuts by score). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XqGuBuSUsRudGerPqDuoKA |
||
|
Claude
|
8e7b1b63be |
fix(store): order NIP-50 search by relevance (bm25), not created_at
NIP-50: results are returned "in descending order by quality of search result ... not by the usual .created_at", with the limit applied after the score. The store sorted search by created_at DESC (pre-existing), so it returned the newest matches rather than the best ones. makeSimpleSearch (the search [+ kinds/authors/since/until] + limit shape) now orders by FTS5 bm25 (ORDER BY event_fts.rank, created_at DESC as a tie-break). Verified bm25 rank works on the contentless table through the join, and that a stronger-but-older match outranks a weaker-but-newer one. The rarer search+specific-tag shape and the negentropy snapshot still sort by created_at (the row-id subquery can't carry rank; negentropy is a sync set) — documented. This is a correctness fix, not a scaling one: bm25 scores every match, so search latency still grows with the match set. Tests: SearchRelevanceOrderTest, Fts5CapabilityProbe.bm25RankWorksOnContentlessTableInAJoin; QueryAssemblerTest search plans updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XqGuBuSUsRudGerPqDuoKA |
||
|
Claude
|
e6a8f80826 |
fix(store): drop non-compliant rowid search ordering, keep FTS delete/size wins
searchOrderByRowId ordered NIP-50 search by the FTS rowid (ingestion order) to get O(limit) search, but NIP-01's limit requires the newest events by created_at. Once ingestion diverges from created_at (any historical sync) that returns the wrong events under a limit — a spec violation — so the flag, its QueryBuilder branch, and its test are removed. Search stays created_at-ordered; corpus-independent search is an external-engine job, not this index. The contentless + rowid=row_id schema stays for the reasons that don't touch ordering: the delete trigger now seeks by rowid (O(log n)) instead of scanning by an FTS column (O(n)) — measured ~78× faster at 8k rows and widening, on a path every deletion hits — and the index is smaller. Benchmark reframed around the delete win and the honest (unchanged) search cost; plan doc updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XqGuBuSUsRudGerPqDuoKA |
||
|
Claude
|
c7670a52d4 |
perf(store): scale NIP-50 search and tag-watcher queries with corpus size
The scale-curve report showed the SQLite store degrading with corpus size on NIP-50 search (~18×) and the large-IN tag watcher, while point reads stayed flat. Three read/size changes (write path and index set unchanged): - FTS: rebuild event_fts as a contentless FTS5 table (content='', contentless_delete=1) keyed by rowid = event_headers.row_id. Drops the stored content copy (smaller index); external-content can't hold the derived indexable text, so contentless is the correct primitive. Adds an opt-in searchOrderByRowId strategy flag: ORDER BY event_fts.rowid DESC early-terminates (O(limit), corpus-independent) at the cost of ingestion-order results — flat ~0.22 ms vs created_at's 4.26 ms at 200k (~19×). reindexAll ends with 'optimize'; the periodic optimize() folds in a bounded segment 'merge'. DB version 4->5 with a drop-and-rebuild migration. - MergeQueryExecutor: extend the k-way merge to the tag path (kinds + #e IN [hundreds] + limit), one cursor per (value[,kind]) stream heap-merged to the limit, deduping events that carry several queried values. O(limit + streams) instead of collecting all matches and sorting. - StatementCachingConnection: pool multiple handles per SQL so the merge's many concurrent identical-SQL cursors all hit the cache (previously only the first did) and repeated polls reuse their per-stream statements. Tests: contentless migration (real v4 DB upgrade), rowid-order search, tag merge correctness (incl. cross-stream dedup), statement pool, FTS5 capability probe, and an FTS search-scaling benchmark. Plan in quartz/plans/2026-07-21-sqlite-query-scaling.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XqGuBuSUsRudGerPqDuoKA |
||
|
Claude
|
5f5356c0fe |
fix: complete PR clone multi-value, git-status auth spoofing, CLI robustness
Addresses review findings from a merge-time audit. - **Complete the headline multi-value `clone` fix for PRs** (was applied only to kind:30617). GitPullRequestEvent (1618) and GitPullRequestUpdateEvent (1619) carry `clone` with the same spec shape but still emitted repeated single-value tags and read only the first value — so the exact interop bug this branch set out to kill was still live for PRs, both directions (ngit keeps only the last repeated tag; we lost every URL after the first from ngit's multi-value tag). Now both emit one multi-value `["clone", …]` tag and read both forms. Verified on the wire + GitNip34InteropTest + CLI harness (40 checks). - **Android git-status spoofing (GitStatusIndex)**: newest-status-wins with no author check meant anyone could publish a kind-1632 and make someone else's issue render closed. Now filter statuses to the repository owner (from the status's own `a` tag), declared maintainers (from the cached announcement), or the target item's author — matching NIP-34 and the CLI's derivation. Pre-existing on main; this branch made the CLI/Android divergence visible. - **CLI robustness**: `git comment`/`git patch` no longer block forever reading stdin on an interactive TTY (amy is non-interactive — error instead). The local `git` subprocesses in `git init`/`git apply` now drain stdout on a side thread under a bounded `waitFor` + `destroyForcibly`, so a wedged git can't hang the CLI. Left as a follow-up (cosmetic): GitBrowseCommands.candidateUrls duplicates GitRepositoryBrowserViewModel's — worth lifting to shared code, not worth the cross-module coupling here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UKMaNoK5M2PQKCAxhxWzPr |
||
|
Claude
|
1a77c95531 |
fix(quartz): NIP-34 wire-format interop with ngit (clone/web, issue p, plain r)
Verified Amethyst's NIP-34 events byte-for-byte against the ngit reference implementation (DanConwayDev/ngit-cli) and the spec, and fixed three real interop divergences in quartz — so ngit/gitworkshop and Amethyst read each other's git repos, issues, patches, and PRs without losing data. - Repository announcement `clone`/`web` were emitted as REPEATED single-value tags (`["clone", a]`, `["clone", b]`). The spec and ngit use ONE multi-value tag (`["clone", a, b]`), and ngit's parser keeps only the LAST of repeated known tags — so multi-URL repos silently lost every URL but one in both directions. Now emitted as a single multi-value tag; `clones()`/`webs()` read BOTH the spec form and the legacy repeated form, so old events still parse. (`relays`/`maintainers` were already correct multi-value tags.) - Issues (kind 1621) were missing the `["p", <repo-owner>]` tag that patches and PRs already include — a maintainer watching `#p` wouldn't see them. The builder now adds it (fixes both the CLI and the Android issue-creation path, which both passed an empty notify list). - Patch / PR / PR-update `r` tags carried the `"euc"` marker (`["r", commit, "euc"]`). Per the spec and ngit that marker belongs only on the kind-30617 announcement; other `r` tags are plain `["r", commit]`. A `#r` filter matches either shape, so this is a spec-compliance/byte-parity fix. `alt` (NIP-31) tags are intentionally still omitted — quartz treats the generic alt client-hint as deprecated, and ngit/gitworkshop parse the structured tags, so it isn't required for interop. Adds `GitNip34InteropTest` (5 cases: multi-value write, tolerant read of both forms, issue p-tag, plain patch r-tag) and 4 wire-format assertions to the CLI git harness (37 offline). No regressions in the nip34 or Search suites. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UKMaNoK5M2PQKCAxhxWzPr |
||
 Vitor PamplonaandClaude Opus 4.8
|
a0ab3ec66d |
Merge PR: feat(compose): resolve NIP-05 (incl. Namecoin .bit) in the @-mention popover
Merges nostr proposal b07eb505 into main:
- feat(nip05): add Nip05Id.parseLenient for mention/text rendering
- feat(compose): wire NIP-05 popover mentions to nostr:nprofile1…
Also closes duplicate proposal 4b90b41f, which pointed at the same commits.
Beyond the feature, this replaces the unvalidated `Nip05Id("_", prefix)` raw
constructor in UserSuggestionState with `Nip05Id.parseLenient(prefix)`, closing
a hole where a typed mention such as `evil.com#x.bit` produced a GET to an
arbitrary host via `toUserUrl()`'s bare interpolation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Vitor PamplonaandClaude Opus 4.8
|
8913af7a79 |
fix(concord)!: enforce CORD-04 rank gating on the Banlist fold
Closes the privilege escalation: any BAN holder could ban the authorities above
them — including the owner — because the Banlist gate checked only the BAN bit.
Once banned, a member loses all authority (`hasPermission` is `!isBanned && ..`)
and honest clients drop their events, so a single edition from the most junior
moderator permanently silenced every admin above them.
CORD-04 §3 requires the rank half: "One hard rule binds every action: the actor
must hold the required bit and strictly outrank its target — equal cannot act on
equal (an admin cannot ban a peer admin)", restated as §5 step 3. Only §4, which
defines the Banlist, states the bit half alone — which is why both this client
and Armada shipped the same rank-blind gate.
§3 is stated per TARGET while the Banlist is one whole-list document, so it is
enforced as a DELTA rule: an edition may only add or remove npubs its signer
strictly outranks, judged against the roster settled behind it; the owner is
never a valid target (position 0 is "supreme and unremovable"); and entries the
signer may not act on are IGNORED rather than rejecting the edition, so one bad
entry cannot discard the bulk-ban §4 recommends as the collision remedy, and a
rogue cannot grief the list by forcing rejections.
ConcordModeration.currentBanned now reads the honored banlist through the
resolver instead of decoding the raw head. Besides picking up the fork healing
it was missing, this closes a laundering path: our own next ban/unban would
otherwise re-publish an entry our fold refuses, under our signature.
BREAKING (consensus): Armada has not shipped this rule, so banlists can differ
between clients until it does — we now ignore a ban Armada honors whenever the
signer did not outrank the target. Shipping the spec-conformant behaviour was
judged better than continuing to honor an escalation. Write-up to send upstream
is docs/concord-banlist-rank-conformance.md.
The three tests added in
|
||
|
Vitor PamplonaandClaude Opus 4.8
|
0ae6bc6698 |
fix(concord): rank-gate the Ban and Remove affordances
Ban/Remove were offered to any BAN holder against any non-owner, ignoring rank — unlike the role picker, which routes through `canActOn`. Both the Members roster and the message-level path (`Account.concordBanTarget`, the chokepoint for the quick-action menu, the note dropdown, the note action sections and the chat action sheet) now require `canActOn(me, target, BAN)`. This is NOT the no-op it first looked like. The premise that the fold would drop such a ban is wrong, and a test proves it: BANLIST is a single whole-list entity, so `authorizedHeads`/`banGate` gate on the author's BAN bit alone and never rank-check the list's *contents*. A rank-5 moderator's ban of a rank-1 admin is therefore ACCEPTED by every client, and the admin then loses every permission, since `hasPermission` is `!isBanned && ..`. It is privilege escalation, not a silent no-op. The fold is deliberately left alone. Armada has the identical gap — its `banlistGate` calls the rank-blind `isAuthorized(.., Permissions.BAN)` while its role path uses the rank-aware `canActOnPosition` — so rank-gating our fold would make us ignore bans every other client honors, splitting the banlist across clients. Closing it needs a spec change, like CORD-05. Refusing to AUTHOR such a ban restricts only what we write, never what we accept, so it cannot diverge consensus. Three `@Ignore`-d tests in AuthorityResolverTest state the fold-level invariant and currently fail by design; two companions assert the gate does not over-correct (a moderator still bans a plain member; the owner still bans anyone). Un-ignore the first three when the spec closes the gap. The owner short-circuits the check rather than going through `canActOn`, which begins at `hasPermission` and is false while banned — since a rogue BAN holder *can* currently banlist the owner, routing them through it would let them be locked out of moderating their own community. Device-verified on Amethyst QA Concord as Dr. Edo (QA Lead, rank 2): Bob (Admin, rank 1) now offers only the disabled "Roles… / You don't outrank this member" where Ban and Remove used to be enabled, while the Helper (rank 5) still offers Roles…, Ban and Remove. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
62440748a7 |
fix(concord): stop a rejected edition orphaning the honest ones after it
An unauthorized control edition in the middle of an entity's chain
permanently froze that entity. Observed on device for a member's GRANT:
v0 owner (grant mods)
v1 owner (grant admins) <- fold stopped here, forever
v2 MIDTIER (escalation, correctly rejected)
v3,v4,v5 owner orphaned, unreachable
`AuthorityResolver` filtered unauthorized editions out BEFORE calling
`EditionFold.foldEntity`, and the walk only advances when the next
version cites the current head's hash. Removing v2 severed the chain, so
every honest edition above it was lost. Any member could permanently
freeze any member's role assignment — including the owner's ability to
change it — with a single event, recoverable only by a Refounding. It
predates the recent rank gates (verified with a zero-role identity); the
gates only widen which editions can poison.
Armada does not have this bug, and its approach settles the design.
Reading its control-plane fold (read for semantics only — Armada is
AGPLv3, Amethyst is MIT, no code taken): the chain walk runs over the
UNFILTERED set, producing an ordered candidate list — chain-verified head
first, then every remaining edition version-descending — and authority is
applied AFTERWARDS, per candidate, picking the first admissible one. A
rejected edition is skipped during the ascending admissibility walk
without truncating it. For the chain above, Armada picks v5.
So the fix is not to filter later but to gate later: `EditionFold` gains
candidate-based gated folding, and the resolver and community state now
gate per candidate instead of pre-filtering the pool. Authority checks
themselves are unchanged — only WHEN they run moved. Applied to ROLE,
GRANT, BANLIST, CHANNEL, METADATA and the authorized-head map.
The writer had to be fixed too, for a sharper reason than expected. With
an ungated `headOf`, a rogue banlist edition at the tip is read as
current state, so the owner's next ban REPUBLISHES THE ROGUE'S CONTENT
UNDER THE OWNER'S SIGNATURE — an unauthorized empty banlist laundered
into an owner-signed one the moment the owner bans anyone else. Tolerant
reading cannot heal that, because the resulting edition is genuinely
authorized. `ConcordModeration.headOf` now folds the authority-gated
heads, and `owner` is a REQUIRED parameter rather than defaulted, since a
silently-wrong default here is a consensus footgun.
Banlist healing is preserved with one necessary change: the ancestry walk
now runs over the full pool rather than the authorized subset. Ancestry is
structural — walking only authorized editions stops at the rejected one
and misreads genuine ancestors as concurrent forks, resurrecting bans an
unban had cleared.
Six regression tests, each verified to fail without the fix. Two process
notes worth recording: the first "without the fix" run reported BUILD
SUCCESSFUL because Gradle served a stale up-to-date `jvmTest` — trusting
it would have meant concluding the tests were worthless. And the
forged-edition test initially passed both ways because the forgery's
content coincided with the honest outcome; it was rewritten so the
mid-chain arm genuinely discriminates.
The rank-gate, rogue-higher-version, floor and rollback tests all pass
unchanged.
Known gap: `headOf` gates through the per-kind permission map, which is
coarser than the resolver's rank gates, so the writer can still pick a
head the reader rejects when an in-permission but out-of-rank edition
sits at the tip. Tolerant reading makes that benign, but it is not an
exact reader/writer match; tightening it needs the resolver to expose
per-entity heads.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
Vitor PamplonaandClaude Opus 4.8
|
73d59a29bf |
fix(nip46): gate identity reads on pairing; make decrypt consent informed
Two problems in the remote signer, both about a client getting something
without the user meaningfully agreeing to it.
**`get_public_key` and `get_relays` answered anyone.** Every other method
runs through `ifAuthorized`; these did not, and nothing required a prior
successful `connect`. The service decrypts and dispatches any well-formed
kind-24133 envelope, so anyone holding the `bunker://` URI — pasted into a
malicious app, posted for support, leaked in a screenshot — could ask it
which account it belongs to, without the secret and without connecting.
`get_relays` additionally handed over the inbox relay set. That defeated
the transport/identity split, which otherwise works: the relay-visible
traffic really is anonymous, since the p-tag and author are a transport
key and the payload is NIP-44.
Both now require the client to be paired. The authorizer interface gains
`isPaired` with NO default, so a future authorizer has to state its own
rule rather than silently inheriting "everyone is paired".
`ping` is deliberately left open. It reveals nothing the caller does not
already have — a signer is alive at a pubkey they hold — and first-party
behaviour could be confirmed but third-party clients that ping before
connecting could not be ruled out. Breaking a legitimate handshake to
close a minor oracle is a bad trade. The choice is pinned by a test that
also asserts the pairing check is never consulted, so it stays deliberate
rather than drifting back by accident.
**Decrypt consent showed nothing at all.** The bridge populated the
content preview and raw data only for signing requests, so a decrypt
request produced an empty preview block — no ciphertext, no counterparty,
not even the "Show event" toggle — leaving "AppName wants to read your
private messages" with *Allow always* as the primary button. Meanwhile
the coordinator documented the opposite: "Amethyst decrypts first, then
asks permission to expose." That was never implemented.
Now:
- The counterparty is resolved and shown, so the prompt reads "…read your
private messages **with Alice**". It never degrades to nothing —
cached name, else a shortened npub. Knowing *whose* messages is a
categorically different decision.
- The message is decrypted BEFORE prompting and the plaintext is the
preview, as documented. It is a local operation and nothing is exposed
until approval. Failure, blank and hang all collapse to an explanatory
string under a timeout, so the dialog is never empty and cannot stall.
- A narrower grant is offered ALONGSIDE the broad one, not instead of it:
`DecryptFrom(counterparty)` keyed `decrypt:<hex>` next to `Decrypt`.
The dialog's primary button becomes "Always allow for Alice" with the
broad option demoted. Because the ledger stores an opaque op key, no
persisted decision migrates and the storage format is untouched.
Scoping decrypt per counterparty *instead* would have been worse than
the bug: a DM client would prompt once per conversation, training users
to approve everything. A narrow option beside the broad one gives
granularity without the prompt explosion.
Also fixes a latent bug found on the way: `AllowForSession` recorded the
*requested* op rather than the *granted* one, which would have widened a
narrow session grant back to broad.
Verified by three sabotage passes; the tests that stayed green under them
are the intended negative guards. One existing test asserted the buggy
behaviour outright ("public reads are never gated") and was rewritten.
Not done: the batched consent sheet still records the broad op for
"remember" — offering the narrow choice per row there is a UX design
question, not a mechanical change.
Needs a device check before release: the decrypt preview runs the account
signer before consent. That is free for a local key, but an account backed
by an external NIP-55 signer (Amber) may show Amber's own prompt ahead of
Amethyst's.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
Vitor PamplonaandClaude Opus 4.8
|
5c23f8490d |
fix(concord): stop destroying other clients' data in the community list
The private community list (kind 13302) is documented as wire-compatible with Armada's `communityList.ts`, whose entry type ends in `[k: string]: unknown` — unknown keys are part of the contract, and `ConcordJson`'s own KDoc says shapes are "deliberately client-extensible (CORD-03/04)". But `ignoreUnknownKeys = true` plus closed `@Serializable` DTOs meant decode dropped every unmodelled key and encode never restored it, so **every Amethyst write of a user's list silently stripped fields another client had written**, across every community in it. Already proven, not hypothetical: `JoinMaterialWire` declared a `refounder` field that nothing in the repo reads, so it was parsed and destroyed on the first write. We only avoided destroying Armada's `invite_ref`/`excluded_at_epoch` because those were modelled hours ago, for stranded recovery — the anchor recovery depends on would otherwise have been deleted on every write. Each wire DTO's compiler-generated serializer is now wrapped in a shared `JsonTransformingSerializer` that lifts unknown keys into a bag on decode and merges them back on encode, with declared fields winning on conflict. The known-key set is read from the descriptor rather than hand-listed, so it cannot drift from the DTO. Preserved at the document root, each entry, the `current` join material, each channel, each held_root, each tombstone, and everything nested inside `seed`. `refounder`'s typed field is removed so it round-trips generically. Two further data-loss bugs surfaced while doing it, both fixed here: - **`seed` was overwritten with `current` on every write**, destroying the immutable join anchor. It is now kept and re-emitted verbatim as a raw JsonObject — we never hydrate from it while `current` exists, so we have no business rewriting it, and keeping it raw preserves everything nested inside for free. - **`tombstones` were re-encoded as an empty list**, which did not just lose their unknown keys: it RESURRECTED communities another client had deliberately removed. They are now carried verbatim. Verified by four separate sabotage passes (no-op the transform, re-mint `seed`, restore the empty-tombstone write, flip the merge order); each new test fails under at least one, and every mechanism is covered. Control-plane re-serialization was audited too and is NOT fixed here: `compactControlPlane` is safe (it re-wraps the original seal verbatim), but the user-facing *edit* paths — `editConcordMetadata`, `grant`, and the channel edits — construct fresh typed entities and re-encode, so they drop extensions the same way. Fixing those means merging into the head edition's raw JsonObject on each edit path, which is a larger change than this should carry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
f8d8a2b135 |
feat(concord): recover a membership stranded by a Refounding
A rotation carries only (newRoot, newEpoch, rotator) — no recipient list — so a member simply left out of the recipient set receives nothing and is stranded on the dead epoch forever while everyone else moves on. It applies to any member, the owner included, and cannot be prevented on the receive side: there is nothing to check. Armada does not prevent it either; it recovers, and this follows the same approach. The invite link a membership was joined through is stored as the anchor, and when that link later resolves to a HIGHER epoch, the membership merges forward. Uses Armada's exact wire names so the kind-13302 list stays compatible in both directions: `invite_ref` (the link in bare `<naddr>#<fragment>` form, host-stripped so a link minted by a different front end reduces to the same anchor) and `excluded_at_epoch`, both at the entry level. Details that decide whether this works at all: - `merge()` lets a higher-epoch winner inherit the loser's `invite_ref` when it has none. Without it a two-device merge silently discards the only anchor recovery has, disarming it permanently. - `adoptConcordRoot` carries `invite_ref`/`excluded_at_epoch` through a rotation; it rebuilt the entry field-by-field and would have dropped them at exactly the moment they matter. - Merging forward preserves `heldRoots`, so prior-epoch history the member legitimately holds is not lost by recovering. - Recovery requires a strictly higher epoch and a matching community id, so it is monotonic and cannot be steered by an unrelated bundle. Hooked onto the existing Concord revision tick immediately after `drainConcordRekeys`, because the two are halves of one problem: a rotation you were included in arrives as a rekey to drain, one you were excluded from produces no message at all and can only be found by polling the link. Rate-limited to 15 minutes per community; an idle tick costs a map lookup. Only a Live bundle recovers — an expired or revoked link is not a missed rotation. Verified by mutating the production code eight ways (dropping the anchor, dropping heldRoots, dropping the epoch comparison, renaming the wire keys, removing the merge inheritance, breaking bare-form parsing) and confirming each produced exactly the expected failures. Two things this surfaced, both left for their own change: - Our parser does NOT round-trip unknown JSON keys — `ignoreUnknownKeys` plus closed DTOs — while Armada's format ends in `[k: string]: unknown`. So every Amethyst write of the community list silently strips fields Armada added that we do not model; it already discards the `refounder` field we parse but never re-emit. That is live interop data loss, caused by us, independent of this work. - `mergeForward` keeps the entry's existing private-channel grants rather than adopting the bundle's, matching what `joinConcordViaInvite` already does. If a recovered member should pick up new-epoch grants, both paths need it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
fac1bf5b5d |
feat(concord): refuse Control-Plane rollbacks with a version floor
`ConcordRefounding.compactControlPlane` re-wraps one edition per entity when a community rotates epoch, and the ROTATOR chooses which one survives. The receiving side had no memory: `refold()` folds only the wraps at the current epoch's Control-Plane address and discards the prior epoch's buffer, and `EditionFold` accepts whatever it is handed (its no-genesis fallback anchors at the lowest version present). So a rotator could publish only version 1 of a chain and omit version 2 — restoring a revoked role, clearing a banlist, reverting metadata. Every signature is genuine; this is rollback by omission, not forgery. Adds a per-entity floor: the version AND hash last successfully folded. - **No floor (fresh joiner)** — unchanged: genesis anchor, else the lowest-version edition as the legitimate compaction bootstrap. - **With a floor** — the walk is anchored AT the floor: the offered set must contain the exact edition already folded (version and hash; a same-version sibling is a fork, not our chain), then walks up. A head below the floor is structurally unreachable. - **Gap** (the floor edition is absent) — refuse, and keep the known head. Refusing by *retaining* matters here: this fold is recomputed from scratch each time, so letting an entity vanish would itself be a rollback — a dropped banlist is an unban. The floor needs no new persistence. It is derived from `heldRoots`, the rotated-out access roots already persisted in the NIP-44 self-encrypted kind-13302 list: the session derives each prior epoch's Control-Plane address from them, folds oldest-first, and takes the resulting heads as the floor. That survives both a process restart and the session rebuild `ConcordSessionRegistry.sync` performs at exactly the moment of a Refounding — which would have destroyed any in-session floor. If the old planes are not served, there is no floor and behaviour is as before. Floors are built from AUTHORITY-GATED heads, not raw ones. Without that, any ex-member still holding a rotated-out root could mint a high-version edition on the old plane and freeze the entity for every honest client — a denial of service this change would otherwise have introduced. Covered by a test. Verified by disabling both enforcement points: 7 of 12 quartz tests and the end-to-end commons test fail, and the ones that still pass are exactly the non-regression cases (fresh joiner, honest compaction, pass-through without floors). Known limit: `AuthorityResolver.resolve` folds authorized SUBSETS of the edition pool and does not carry floors itself; gating happens at the pool level before the resolver sees anything. Sound, but connectivity checked on the full set is a weaker precondition than on each subset — passing floors into the resolver's three folds is worth a follow-up. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
0f53eb09a2 |
fix(concord): gate revokes on target rank; drop the owner rotation refusal
Reviewed the previous commit's authority changes against Armada
(gitlab.com/soapbox-pub/armada), the reference Concord client we interop
with. Read for its rules only — Armada is AGPLv3 and Amethyst is MIT, so
no code was taken from it.
It confirmed the role rank gate (Armada checks both directions too: the
author must outrank the position being minted AND the standing position
being replaced) and the banlist check on rotation. It also showed one of
our rules was wrong and one gate was missing.
**Removes the owner's refusal of foreign rotations.** The previous commit
made the owner ignore any rotation it did not author, reasoning that a
BAN-holder could otherwise carry the owner onto a root of their choosing.
Armada does the opposite on purpose — "authority is the roster, never key
possession" — and it is right: an admin legitimately rotating to remove a
spammer would leave the owner alone on the dead epoch, self-inflicting
the strand the rule was meant to prevent, and diverging from the
reference implementation forks communities across clients. The threat is
better answered by the rank gate: with role editions gated, nobody can
escalate themselves to BAN, so BAN-holders are people the owner
deliberately trusted.
**Adds the missing rank gate on grants.** A grant was authorized if the
granter outranked every role it handed out — but a REVOKE carries no role
ids, and `all {}` over an empty list is vacuously true. So any
MANAGE_ROLES holder could strip anyone's roles, the owner's admins
included: promotion was gated, demotion was free. Armada treats a grant
as an action ON the member and requires outranking the target's standing
rank; this now does the same.
Both new tests were verified to fail with the corresponding check
disabled, and each has a companion asserting the legitimate case still
works (an admin can still revoke a moderator beneath it).
Also records what Armada does about exclusion, since we cannot prevent it
receiver-side: it does not try to. A rotation carries no recipient list
there either, so a stranded member instead re-resolves the invite link
they joined through and merges forward to the higher epoch ("stranded
recovery"). Amethyst has no equivalent, so a stranded member stays
stranded — noted at the call site as follow-up work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
Vitor PamplonaandClaude Opus 4.8
|
c9c91a8c98 |
fix(concord): rank-gate role editions and harden rotation authority
Two authority holes, plus the limit that remains. **Role editions had no rank gate.** Grant editions are correctly gated — a granter must hold MANAGE_ROLES *and* strictly outrank every role it hands out. Role editions checked only that the author held MANAGE_ROLES. Nothing stopped an authorized signer editing a role at or above its own rank, including the role it holds itself. So a moderator at position 5 with MANAGE_ROLES could publish one edition on their own role's chain claiming position 1 and every permission bit, then a second demoting the real admins beneath them — reaching full authority over everyone but the owner in two editions. The rogue-higher-version defence added earlier does not cover this: it drops editions from *unauthorized* signers, and this signer is authorized. Role editions are now gated in both directions: an author may not claim a position at or above its own rank, may not touch a role that already sits at or above it, and may not hand a role permission bits it does not hold itself. Deleting keeps only the second rule, so retiring a role beneath you still works. The owner is unaffected. **A banned moderator could still rotate the community.** The rekey receive path authorized the rotator with `effectivePermissions(...)`, which ignores the banlist, rather than `hasPermission(...)`, which excludes banned members. Now uses the latter. **The owner no longer adopts a root someone else minted.** A rotation replaces the community root, so a rotator who *includes* the owner as a recipient hands themselves the keys to the owner's own community — the owner would follow them onto an attacker-chosen epoch. The owner changes epoch only by rotating themselves. **Known limit, documented at the call site.** A rotation carries only (newRoot, newEpoch, rotator) — no recipient list — so a receiver cannot tell who was omitted. A BAN-holder can therefore still evict the owner by leaving them out: everyone else adopts, the owner is stranded on the old epoch. That is not fixable in the receive path; it needs a protocol change (a recipient commitment the receiver can check, or owner co-signing). Tracked for CORD-06. The escalation test was verified to fail with the gate disabled, and a companion test asserts an admin can still edit a role beneath it, so the gate is not merely blocking everything. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
c8be65a02e |
fix(concord): require consent for invite links, enforce expiry, fold the head
Three fixes to the Concord invite and moderation paths. **Invite deep links redeemed with zero consent.** `ConcordInviteScreen` called `joinConcordViaInvite` from a `LaunchedEffect` on open, and the manifest registers `https://amethyst.social/invite/` as BROWSABLE. So a link on any web page — or a QR code, or a push — silently caused a connection to up to three ATTACKER-CHOSEN relay URLs decoded from the URL fragment (disclosing the user's IP to a third party), a Guestbook JOIN signed by the user's identity published to those relays, and a write to their private community list. No tap, no preview. The screen now opens in an awaiting-consent state and only joins from an explicit Join button. The preview is built entirely from the link itself — base64url and NIP-19 decoding, both pure in-memory — and touches the network for nothing: no relay connection, no signing, no publishing. It shows the relays it would contact so the user can see whom they'd be talking to. The community name lives inside a bundle only those relays can serve, so it is honestly reported as unknown until joining rather than fetched. **Invite expiry was decorative.** `ConcordInviteBundle.isExpired` had no production callers at all — the only ones were in a test — so an expired invite redeemed forever. Expiry is now enforced at `classify`, the choke point every redeem path funnels through, with its own result and message so the user knows to ask for a fresh link. **Moderation read the wrong edition.** `ConcordModeration` used `firstOrNull` over `controlEditions()`, which is in wrap-ARRIVAL order, not the folded head. Once an entity had two or more editions the next one chained off a stale predecessor, forking the chain at an already-used version, and `EditionFold` then resolved the fork by `minByOrNull` on the rumor id — a coin flip. Bans were masked by a down-only healing union; UNBANS and role revocations were not, so they could silently fail to apply. Both call sites now fold to the true head. Regression tests assert the fold-head behaviour under two arrival orders — a single order accidentally puts the head first and passes against the buggy code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
5fd8be64fd |
fix(podcast): clamp V4V fee splits so a feed cannot multiply payments
`computeShares` paid each fee recipient `totalMilliSats * split / 100` with no upper bound on `split`, and `split` comes verbatim from a kind-30054 episode event that anyone can publish (`ValueTag.parse` is a bare `fromJson` with no validation). A single `fee:true, split:1000` recipient was therefore paid TEN TIMES the amount the user chose. The `remainder` clamp looked like a safety net but only zeroed the honest recipients; it never touched the fee recipients themselves. Proven by test before fixing: `split:1000` pays 10x, and two fee recipients at 60% each pay 1,200,000 millisats for a 1,000,000 zap. This was reachable in the worst possible place. Streaming V4V pays every minute, automatically, so a modest multiplier stays under a typical NWC budget and simply runs — and the on-screen running total tracks the INTENDED amount, so it reads "100 sats" while 1,000 left the wallet, while the streaming error handler suppresses the toast. The ordinary zap button reroutes through the same path for any note carrying a value block, so it was not limited to the streaming toggle. Fees are a percentage off the top, so each is now clamped to 100% and the cumulative total to the remaining budget: the payout can never exceed what the user chose. The existing test asserted the right invariant (`sum <= total`) but only ever ran it on well-formed input, which is why this survived. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
 Vitor PamplonaandGitHub
|
035c50421c |
Merge pull request #3642 from vitorpamplona/claude/cli-module-deep-review-le4dsj
amy CLI overhaul: exit-code/JSON contract v1, per-command help, contract tests, docs, and thin-layer extractions |
||
|
Claude
|
4efb2cca98 |
fix(quartz,cli): audit fixes — bounded drains, no event loss, honest verdicts, false-reject traps
Adversarial audit of the PR's own changes (8 finder angles, verified before fixing). Quartz core: - fetchAll-family drains get a wall-clock ceiling (maxTotalMs, default 10x the idle window, delay()-watchdog: cancellable and virtual-time testable). The pure idle window was unbounded when a relay trickled events forever — sandboxed napplet queries, set -e fetches, and marmot await stuck inside one drain. Streaming relays still finish. - The suspending onEvent hook no longer runs inside a cancellable timeout scope (an expiring window could cancel verifyAndStore mid-write and silently drop a received event); the timeout is armed only when the channels are dry (no per-message timeout-job churn). - fetchAll is a projection over fetchAllWithHooks: fixes its unsynchronized events/seenIds mutation from concurrent socket threads and deletes the duplicate loop + per-event activity channel. - publishAndConfirmDetailed regains its only-responders contract (synthetic no-response entries no longer render as 'relay rejected your message' in app callers); results built by pure associateWith; shared failure-reason constants + PublishResult.isTransportFailure. - NIP-65 mutations: split read+write r-tags for the same URL now merge to BOTH instead of last-wins dropping a facet (+ test). - TcpProber's 128-thread pool drains after 60s idle. CLI: - publishGuard: all-transport failure exits 124 as timeout; rejected/1 is reserved for an actual OK-false answer. - --help anywhere in argv is hoisted centrally; 'amy notes post "x" --help' prints usage instead of publishing. - rejectUnknown false-reject traps fixed: geochat --no-fetch behind an early return, and 13 elvis-alias short-circuit sites read eagerly. - Aliases load once per Context and only match name-shaped inputs (no shadowing a real npub/NIP-05/hex); stderr color requires a positively-known terminal (TERM sniff polluted captured logs). - Relay-CSV strictness unified on RawEventSupport.relayFlag (post, graperank publish/followers/register no longer silently drop malformed URLs); Args.timeoutMs(+OrNull) replaces 27 hand-rolled conversions, all strict; offer/debit --timeout > 3600 rejected with a 'looks like milliseconds' hint; NPub.create idiom; stale jq .id in the marmot reactions harness; printUsage drift (offer pay --with, profile --clink-offer, search --kind). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CP4kfLCa3wWtE8Khy21Pkj |
||
|
Claude
|
962d1706dc |
fix(quartz): fetchAll-family timeouts are idle windows, not absolute deadlines
The fetchAll/fetchAllWithHooks accessories wrapped their whole collection loop in one withTimeoutOrNull, so a relay actively streaming a large backlog was cropped mid-delivery the moment the absolute deadline hit — even though the loop already has proper terminal conditions (per-relay EOSE / CLOSED / cannot-connect) and the timeout's only real job is stall detection. timeoutMs now measures the delta since the LAST message: every event or terminal signal resets the window (fetchAll gains a conflated activity ping so event progress is visible to its wait loop), and only a full window of silence ends the fetch early. fetchFirst/count keep absolute waits (single-response — idle and absolute coincide), and subscribe's duration timeout stays absolute by design (a live stream has no terminal state). Since the pages/pool helpers delegate to fetchAll, pagination inherits the semantics. This also changes app-side callers of these accessories — in their favor: the timeout only ever fired on slow relays, exactly when cropping loses data. New commonTest suite pins the behavior: a relay emitting every 200ms under a 300ms window streams to completion (10/10 events); a stall ends one window after the last message, not after the start; EOSE still returns immediately. CLI docs reworded (--timeout = idle window). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CP4kfLCa3wWtE8Khy21Pkj |
||
|
Vitor PamplonaandGitHub
|
43704772a7 |
Merge pull request #3641 from vitorpamplona/claude/nip29-group-load-perf-wz4yca
NIP-29 group chat: split state (always-on) from content (paginated) |
||
|
Vitor PamplonaandClaude Opus 4.8
|
e66550091d |
fix(relay): send an unresolvable host straight to the long backoff
A relay whose domain no longer exists (lapsed registration, decommissioned host) was treated like a busy relay: the backoff doubled from 1s and spent about ten dials climbing to the ceiling it was always going to reach. An HTTP upgrade rejection already jumps straight there; a name that does not resolve deserves the same. Matching is on the exception type rather than the message because the message is localized and platform-specific — Android says `Unable to resolve host "x"`, JVM on macOS says `nodename nor servname provided, or not known` — while the class name is stable. That is why onCannotConnect appends it in the first place. Neither message ends with "Host unreachable", so the existing check never caught DNS failures. Being this eager is only safe because the verdict is cheap to revisit: a DNS answer is a property of the network, not of the relay (a captive portal or a filtering resolver forges NXDOMAIN), and both a network-identity change and a transport change now clear the backoff outright. The test pins that round trip, not just the classification. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Vitor PamplonaandClaude Opus 4.8
|
b1b6190d2f |
fix(relay): forgive reconnect backoff when the network or transport changes
A relay's reconnect backoff was process-global and network-blind: the delay earned on one network was still being served out on the next. The only reset signal was OkHttpClient reference identity, which is rebuilt off the metered bit, so it fired for wifi<->cellular and nothing else. Wifi A -> wifi B, a VPN coming up, a captive portal clearing, and metered-wifi -> cellular all left every relay parked on a penalty earned against a network the device had left — up to five minutes of silence on a network that might reach the relay instantly. The transient Off that would have reset things is swallowed by the 200ms debounce in ConnectivityFlow, so it never rescued those cases. Key the decision on ConnectivityStatus.Active.networkId instead, which is the same signal SurgeDns already uses to stale its cache, and treat a genuine network change as a full pool rebuild: every socket is bound to an interface that no longer carries traffic, and needsToReconnect() cannot see that because it only compares the proxy and the timeouts. Also treat a Tor policy flip as a transport change. Flipping a Tor toggle while Tor is already up leaves both OkHttpClient references identical, so a relay whose transport just changed kept waiting out a backoff earned on the other transport. Only TorRelaySettings is compared, not the relay sets that TorRelayEvaluation also carries — those churn while an account's relay lists load (observed firing three times in one cold start), and forgiving the whole pool every time any list updates is far more damage than it repairs. Adds IRelayClient.resetBackoff() (default no-op, so the existing fakes and BleNostrClient are unaffected) rather than reusing ignoreRetryDelays, which only skips the gate for a single attempt and still doubles the stored delay — a relay that failed that one dial came back worse off than before. INostrClient.resetBackoff() is deliberately separate from reconnect(): the latter debounces, so folding this into a coalescing command would let a later request silently drop the reset. The decision table moves into RelayProxyClientConnector.apply() so it can be exercised directly, without a debounce and a shared StateFlow in the way. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Claude
|
7ea6920679 |
refactor(nip65): move read/write-marker merge semantics from the CLI into quartz
The kind:10002 facet-merge rules (adding a write marker to a read-only relay promotes it to BOTH; removing one facet of BOTH demotes to the other; removing the last facet drops the relay) lived as private helpers in the CLI's RelayCommands. Any frontend that edits a NIP-65 list needs them, so they now live in quartz nip65RelayList as AdvertisedRelayListMutations (applyFacet/addFacet/removeFacet/setFacet) with commonTest coverage. Behavior unchanged; the CLI rewires to the shared functions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CP4kfLCa3wWtE8Khy21Pkj |
||
|
Claude
|
9bc436b0c2 |
feat(blossom): BUD-07 confirm-then-pay for paid-server mirroring
Adds a confirm-then-pay flow so a 402 from a paid Blossom server can be settled from the app instead of only being reported. - quartz: BlossomPaymentProof (settled Cashu token / lightning preimage) with the X-Cashu / X-Lightning retry headers; BlossomClient.mirror accepts a proof. - BlossomPaymentHandler (Android): pays the challenge's BOLT-11 invoice via the account's existing NIP-47 (NWC) wallet and returns the preimage — it never handles keys or funds itself, only drives the connected wallet. Decodes the invoice amount for display. - Blob manager: a mirror that hits 402 now raises a payment prompt; a dialog shows the amount and, on confirm, pays and retries the mirror, then continues with the remaining servers. Cancel leaves the blob unmirrored. Cashu-only servers and the composer upload path still surface a clear message; auto-settlement there can reuse this handler next. Not yet validated against a live paid server. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ckbnz1N94W1hnNC9xpsCNP |
||
|
Claude
|
bb03cd2a3c |
feat(blossom): full-client protocol support across quartz, commons, CLI and Android
Extends Blossom support toward a full client on both the CLI and the mobile app. Quartz (protocol): - BlossomAuthorizationEvent: add t=media auth (BUD-05) and optional BUD-11 `server` domain scoping on every factory (stops replayable upload/delete tokens) - BlossomServerUrl: mirror/media/list/report path builders, BUD-06 preflight and BUD-07 payment header constants, and a lowercase bare-domain helper - BlossomUploadResult: parse `ox` (BUD-05 original hash) and `nip94` (BUD-08) - BlossomPaymentRequired: BUD-07 402 challenge model (Cashu/Lightning) - BlossomReport: BUD-09 kind-1984 blob report reusing NIP-56 tag builders Commons (shared JVM client, now in jvmAndroid so Android shares it too): - BlossomClient gains mirror (BUD-04), list/delete (BUD-02), media (BUD-05), preflight/has (BUD-06/01), report (BUD-09) and typed 402 handling - BlossomAuth: media/list/delete passthroughs with server scoping CLI (first-class): - amy blossom now routes all HTTP through the shared client and adds `media` and `report` verbs; auth tokens are scoped to --server Android (first-class): - uploads mirror to the user's other Blossom servers (BUD-04) best-effort - new "Manage stored files" screen: per-server presence matrix (BUD-02 list + BUD-01 HEAD), delete, mirror-to-missing, and report actions Tests: quartz URL/auth/descriptor/payment parsing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ckbnz1N94W1hnNC9xpsCNP |
||
|
Vitor PamplonaandGitHub
|
cd5060e5dc |
Merge pull request #3626 from vitorpamplona/claude/graperank-algorithm-improvements-oco5ue
Add follower crawl and trusted-follower metrics to GrapeRank |
||
|
Vitor PamplonaandGitHub
|
60d492e2bc |
Merge pull request #3619 from vitorpamplona/claude/nip-84-tag-rendering-0o9owh
NIP-84: Support W3C TextQuoteSelector for highlight context |
||
|
Claude
|
db586e30d3 |
feat: render NIP-84 highlights from web highlighter clients
Web-based highlighter clients publish kind:9802 highlights with W3C Web Annotation selectors (textquoteselector / textpositionselector / rangeselector) instead of a NIP-84 `context` tag. These were previously ignored, so the highlight rendered without its surrounding paragraph and the "jump to page" link couldn't disambiguate repeated quotes. - Parse the W3C textquoteselector into TextQuoteSelectorTag (exact/prefix/ suffix; a "-" or empty exact is treated as a placeholder since the quote lives in .content). - HighlightEvent.contextOrReconstructed() prefers an explicit `context` tag and otherwise rebuilds the paragraph from prefix + content + suffix, so the in-context bolding still works. - Build a disambiguated Text Fragment URL (`#:~:text=prefix-,exact,-suffix`) from the selector's prefix/suffix so the source link scrolls to the correct occurrence. The position/range selectors are left unparsed; they only matter for an in-app live-page re-highlighter, which we don't have. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Di4UurD9SQGrpScX7uy2Kh |
||
|
Vitor PamplonaandGitHub
|
3254b90b19 |
Merge pull request #3618 from vitorpamplona/claude/amy-nip46-bunker-concord-epoch-diag
fix(nip46): remote-signer pubKey is the user identity + amy Concord epoch tooling |
||
|
Vitor PamplonaandClaude Opus 4.8
|
f0c21f3513 |
fix(nip46): remote-signer pubKey is the user identity, not the transport key
NostrSignerRemote extended NostrSigner(signer.pubKey), where `signer` is the
ephemeral NIP-46 transport keypair — so `pubKey` returned the transport key,
not the user's identity. Every self-encryption / self-authorship site keys off
`signer.pubKey`, so for bunker accounts this silently broke:
- private NIP-51 lists (private bookmarks / mute / follows / hashtags) and
NIP-37 drafts — an `if (signer.pubKey != event.pubKey)` guard short-circuits
(desktop: private bookmarks always empty);
- NIP-44 self-encrypted data (Concord list, Cashu) sealed to / read against
the wrong peer key.
Android is unaffected (no bunker path); desktop and CLI were affected.
Make `NostrSigner.pubKey` open and have `NostrSignerRemote` return the
bunker-resolved user key: `getPublicKey()` now caches it, and `bindUserPubkey()`
sets it eagerly for a reloaded account / stored identity. Internal transport
(the response-subscription `p` filter, request addressing) keeps using the
transport keypair explicitly, so it is unchanged. No-op for local/external
signers, where signer.pubKey already equals the account key.
Wired: desktop AccountManager.loadBunkerAccount binds the resolved pubkey; CLI
Context binds identity.pubKeyHex. amy's Concord-list decrypt workaround is
dropped — `newest.decrypt(ctx.signer)` now works for a bunker. Verified live:
`amy concord import` over a bunker account decrypts the kind-13302 list and
recovers Soapbox heldRoots [0,1].
Plan: quartz/plans/2026-07-17-nip46-remote-signer-self-pubkey.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Claude
|
c8ff1bb18f |
feat(graperank): persist follower count and hop distance on trust cards
Each kind:30382 GrapeRank card now carries two more public tags alongside `rank`: - `followers` — the number of the target's followers whose own score clears a threshold (`--followers-threshold`, default 0.02), mirroring Brainstorm's trusted-follower cutoff. - `hops` — the shortest follow-graph distance from the observer (1 = a direct follow), matching the `hops` field on Brainstorm's ScoreCard. New `HopsTag` (the `followers`/`FollowerCountTag` already existed) is wired through the ContactCardEvent tag accessors/builders. TrustGraph gains `hopsFrom` (a follow-only BFS over the compact int-CSR) and `trustedFollowerCounts`; the out-CSR now packs the relation code so a forward walk can filter FOLLOW edges. The publisher's `reconcileLocal` takes a richer `ScoredCard` and diffs the full (rank, followers, hops) triple, so a card re-signs when any of them moves and older cards migrate onto the new tags once. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xc3Wm4qVCrAGvSAotTUVt4 |
||
|
Vitor PamplonaandGitHub
|
d1f267a2a3 |
Merge pull request #3613 from vitorpamplona/feat/relay-req-refusal-suppression
feat(relay): stop re-sending REQs relays structurally refuse |
||
|
Vitor PamplonaandClaude Opus 4.8
|
10d88afea3 |
feat(relay): stop re-sending REQs relays structurally refuse
Relays that can't serve a request (a NIP-50 search-only relay pulled into
the feed, a write-only relay, a relay whose filter shape is rejected) were
being hammered with the same doomed REQs. Observed on a 40s cold start:
search.nos.today CLOSED 13-14x ("error: search filter is required") across
6 subscriptions, plus repeated "restricted: does not accept REQs" and
"unsupported: too many filters". The reconnect path replayed refused REQs on
every reconnect, and many different subscriptions kept hitting the same
capability wall.
Two complementary, purely-quartz mechanisms (so the app and Amy both benefit
with zero wiring):
- Per-subscription refusal memory (RequestSubscriptionState + PoolRequests):
a filter a relay CLOSES is not replayed to that relay across reconnects
until it meaningfully changes or a REQ succeeds (EOSE/event). Never applies
to auth-required (the auth subsystem re-signs and replays) or rate-limited
(the adaptive limiter spaces it out).
- Per-relay capability block (RelayReqRefusals): after 2 refusals, classify a
relay SEARCH_ONLY (suppress only non-search filters; genuine search REQs
still flow) or NO_READS (suppress all), from narrow substring markers that
deliberately avoid auth-conditional messages. A fully-blocked relay is
dropped from PoolRequests.desiredRelays so the pool disconnects it, closing
the idle socket rather than keeping it open with every REQ suppressed. A
SEARCH_ONLY relay stays connected while any subscription carries a search
filter for it, so the separate search path is unaffected.
Adds UNSUPPORTED to MachineReadablePrefix (relays send "unsupported:"; parse()
returned null on it before).
Device-verified: search.nos.today now Connecting -> OnOpen -> 2x Closed ->
Disconnected; sendit.nosflare.com (NO_READS) -> 3x Closed -> Disconnected;
feed event volume unchanged (kind-1 from 17 relays) - no coverage loss.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Claude
|
1d8b7d7c8f |
feat(nip46): batched consent via concurrent request dispatch
Third refinement from the Primal comparison — and the one that needed an architecture change, not just UI. Quartz: NostrConnectSignerService now fans each request into a child coroutine under a Semaphore(maxConcurrentHandles=16) instead of handling them inline, so a request awaiting a consent prompt no longer blocks other clients' auto-allowed traffic and several prompts can be pending at once. Intake (dedup, staleness, rate-limit, seen-id persistence) stays on the single consumer. Two guards keep it safe: BunkerRequestProcessor serializes the actual crypto with a Mutex (authorization — the prompt — runs unlocked, only sign/encrypt/decrypt holds the lock) so an external NIP-55 signer never sees concurrent IPC ops; and Nip46PermissionAuthorizer serializes first-connect consent so two connects can't stack dialogs. Covered by BunkerRequestProcessorConcurrencyTest (crypto never overlaps; a blocked prompt doesn't stall another client's signing). Amethyst: SignerConsentCoordinator is now a shared pending StateFlow; one SignerConsentActivity observes it and shows the rich single-request dialog (1 pending) or a batched checkbox list with select-all + a Remember toggle + Allow/Deny selected (>1). Dismissing the sheet denies every still-open request (fail closed). Needs on-device validation (burst batching, no concurrent external-signer IPC, fail-closed on dismiss) — see the device checklist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
00ec826e8b |
feat(nip46): refuse requests when the account can no longer sign
Reject sign/encrypt/decrypt when the identity signer is not writeable — the account was logged out, is read-only, or lost its external (NIP-55) signer — returning an `account unavailable` error instead of prompting the user or hanging on a key that can't be used. Checked before authorization, so no dialog is raised for a key we can't sign with. Public reads (get_public_key, ping, get_relays) stay ungated. Test: a non-writeable signer refuses a sign request without invoking the signer or the authorizer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
5fa8a0a2aa |
feat(nip46): persist serviced request ids so a restart never re-signs replays
The 30s window shrank the restart re-sign problem but couldn't close it: a relay replays stored ephemeral requests on re-subscribe, and the in-memory dedup set is wiped on restart, so anything within the window came back. Persist the recently-serviced kind-24133 event ids (bounded to 128) and seed the service's dedup set from them on start, so a replay after an app restart is dropped by EXACT event id. Chosen over a created_at high-water mark on purpose: a global timestamp floor would wrongly drop a second connected app whose clock lags behind another's, whereas id-matching is immune to client clock skew. The `since` filter still bounds how far back relays replay. - AccountSettings.nip46SeenRequestIds (persisted via putStringSet) + host-side bounded LinkedHashSet, fed to NostrConnectSignerService.initialSeen and advanced through onHandledId. - Tests: a fresh request whose id was serviced last session is not repeated; the serviced id is reported for persistence. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
cdf43db0eb |
fix(nip46): ignore stale/replayed sign requests by age
Users on multiple relays were being asked to sign the same request repeatedly, some minutes old. Root cause: kind-24133 is ephemeral, but many relays store and REPLAY it every time the signer re-subscribes (a relay-set change, reconnect, toggle, or rotation), and the in-memory dedup set is scoped to one run() call so it's wiped on restart — the old requests then get signed again. Gate requests by created_at (default 120s window): - a `since` on the subscription filter so compliant relays never replay old stored events, and - a receive-side staleness drop for relays that ignore `since`. The window must exceed realistic client/relay clock skew so a genuinely fresh request is never dropped. Also corrected the seenCap KDoc, which called the event-id dedup set a "request-id" set. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
2332384897 |
feat(nip46): use a dedicated transport key so the bunker doesn't reveal the user
NIP-46 lets the remote-signer (transport) key differ from the user's identity key. Previously the bunker advertised and wrapped everything with the identity key, so anyone watching the inbox relays could see kind-24133 traffic addressed to the user's real npub and infer "this npub runs a bunker". Now each account gets a dedicated, persisted transport keypair: - NostrConnectSignerService wraps/unwraps the kind-24133 envelope with a `transportSigner`; BunkerRequestProcessor keeps the identity signer for the actual sign/encrypt/decrypt and answers get_public_key with the real npub (disclosed only to a connected client, over the encrypted channel). - The host mints + persists the transport key lazily (accounts that never enable the signer mint nothing), advertises it in bunker:// and the nostrconnect ack, and listens p-tagged to it. - AccountSettings/LocalPreferences persist nip46TransportKey so the advertised address stays stable across restarts. Bonus: because the envelope is now wrapped with a LOCAL key, external NIP-55 (Amber) accounts no longer round-trip the external app for envelope crypto — only the genuine signing request does. A new test asserts get_public_key returns the identity, never the transport key. Unreleased feature, so no migration needed. The CLI bunker keeps using the operator's own key (dev tool). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
d06b1c7f2c |
feat(nip46): rate-limit flooding clients + clean up on logout
Follow-ups to the audit: - Abuse protection: the signer service now bounds its event queue (DROP_LATEST) and rate-limits per author BEFORE decrypting — decryption can be an external-signer (NIP-55) IPC round-trip, so a looping or hostile client can no longer force one per event or grow the queue without limit. Fixed window (default 40 requests / 10s per author, oldest authors evicted). The limiter is touched only by the single consumer coroutine, so it needs no locking. Covered by a headless test. - logout now clears the client's persisted metadata/relays too (not just the ledger grant), so a disconnected app stops being listened for after restart. Not changed: get_public_key/ping stay ungated — gating them behind a prior connect risks breaking clients that discover the pubkey at connect time, and the pubkey is already public, so the enumeration leak is negligible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
d46ac987e8 |
feat(quartz): harden signer service, add logout + end-to-end loopback test
- NostrConnectSignerService now bounds its request-id dedup set (LinkedHashSet with an evicting cap) so a long-lived bunker can't leak memory on the ids it has seen. - Add NIP-46 `logout`: the processor recognises the method, acks it, and calls a new Nip46RequestAuthorizer.onLogout hook (default no-op) so a host can revoke the app's grant when it disconnects. - New NostrConnectSignerServiceTest drives full request→reply round trips (connect/sign/logout + drop-if-not-addressed) through the service over a fake relay client with passthrough signers — headless proof of the subscribe → decrypt → dispatch → publish wiring. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
b1227fa7cb |
feat(quartz): add signer-side NIP-46 processor, service and URI codec
Adds the bunker/signer half of NIP-46 as reusable, signer-agnostic quartz components so Amethyst can act as a remote signer for other apps: - BunkerRequestProcessor: turns a decrypted BunkerRequest into the BunkerResponse the client expects, performing the work through whatever NostrSigner the account uses (local keypair or NIP-55 external app). Signing/encryption/decryption are gated through a Nip46RequestAuthorizer; public reads (get_public_key/ping/get_relays) are not. - Nip46RequestAuthorizer: the permission boundary the host app plugs its own trust model into (connect validation + per-op authorization). - NostrConnectSignerService: subscribes to kind-24133 requests on a relay set, decrypts, dispatches to the processor, and publishes the reply. - NostrConnectURI: KMP-safe parse/build for bunker:// and nostrconnect:// pairing URIs (percent-encoded), shared by CLI/desktop/Android. Unit tests cover the dispatch/authorization matrix with a fake signer (no crypto) and the URI round-trips. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF |
||
|
Claude
|
7d7fe0899e |
fix(concord): open CORD-05 invites with keyless channels and string icons
A live relayop.xyz kind-33301 invite bundle (vsk=6) decrypted correctly but
failed to open: its JSON diverged from quartz's CommunityInvite model on two
CORD-05 wire details, so decodeOrNull returned null and the invite reported
Unreadable ("This invite link can't be opened...") instead of joining.
- InviteChannel.key was required; a public channel (e.g. an unencrypted
`general`) carries no delivered grant key and some reference clients omit
the field. Default it to "" so a keyless channel no longer rejects the
whole bundle.
- icon was modeled strictly as an ImagePointer object; relayop emits a bare
public URL string for an unencrypted icon. Add LenientImagePointerSerializer
(a JsonTransformingSerializer) that lifts a string into ImagePointer(url=...)
on read while still serializing the canonical object form on write.
Adds a regression test driving the real live bundle + its fragment token,
asserting it now classifies as Live. This is a distinct interop case from the
existing vsk=8 mis-posted-registry test: here the sub-kind, token, and crypto
are all correct — only the JSON schema was too strict.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018iLfo68yVtG2ALkKB8tpAa
|
||
|
Claude
|
420fdfea53 |
Merge remote-tracking branch 'origin/main' into claude/bitchat-ephemeral-interop-8epkek
# Conflicts: # amethyst/src/main/java/com/vitorpamplona/amethyst/model/LocalCache.kt |
||
|
Claude
|
452a1c8186 |
fix: harden LIMITS parsing and dedup, per audit
Addresses the four findings from the branch audit:
- Make the kotlinx codec (LimitsKSerializer, the iOS/native incoming path)
as lenient as the Jackson path: mistyped fields degrade to null, non-int
array elements are skipped, and a payload-less ["LIMITS"] frame yields an
empty message instead of throwing. Guard the payload access in
MessageKSerializer and MessageDeserializer likewise.
- Make the Jackson reads (LimitsDeserializer) type-checked so an explicit
JSON null or wrong-typed value stays null ("unspecified — keep previous")
instead of coercing to false/0. Both codecs now behave identically.
- LimitsMessage -> data class, so StateFlow.distinctUntilChanged in
RelayLimitsTracker suppresses no-op emissions when a relay re-advertises
identical limits, and tests get value equality.
- Drop the stale "NIP-22" labels (LIMITS is nostr-protocol/nips#1434, not
NIP-22) from LimitsKSerializer, MessageKSerializer and MessageSerializer.
Tests: added mistyped/null-field and payload-less coverage on both the
Jackson and kotlinx paths, plus a value-equality check. quartz:jvmTest
(RelayWireErgonomicsTest 11, KotlinSerializationMapperTest 57,
RelayLimitsTrackerTest 5) and amethyst play compile green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01464jkunWPtYhTReoc3fUQQ
|
||
|
Claude
|
041abf9e37 |
refactor: reconcile duplicate LIMITS code and rename client accessory
Cleanup after adding LimitsMessage + the client-side cache: - Remove the unused experimental LIMITS prototype (experimental/limits/Limits.kt + LimitProcessor.kt). Its @Serializable model duplicated LimitsMessage (minus auth_for_read/auth_for_write and the Message wiring); the processor's clamp/reject logic is superseded by the server-side LimitsPolicy and will be reincarnated as pure helpers on LimitsMessage. Both were prototypes with no references (preserved in git history). - Rename the client accessory RelayLimits -> RelayLimitsTracker so it no longer collides on simple name with the relay-server-side nip01Core.relay.server.policies.RelayLimits (the operator-configured limits a relay enforces and advertises). Updates AppModules and the test. No behavior change. quartz:jvmTest (RelayLimitsTrackerTest 5/5) and amethyst play-flavor compile are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01464jkunWPtYhTReoc3fUQQ |
||
|
Claude
|
9daa0b3e48 |
feat: cache and expose relay LIMITS per relay
Adds RelayLimits, a passive connection-listener accessory (modeled on RelayAuthenticator) that caches the latest LIMITS each relay advertises and publishes it as a Compose-stable StateFlow, so consumers can read a relay's current rights/limits instead of only observing the raw message. - RelayLimits: caches LimitsMessage per NormalizedRelayUrl, exposes limitsFlow (StateFlow), get(url) and snapshot(); connection-scoped (entry dropped on disconnect so stale limits don't leak). - LimitsMessage marked @Immutable for Compose stability in the flow map. - Wired into AppModules next to relayStats (Amethyst.instance.relayLimits). - Tests: per-relay caching, later-replaces-earlier, independent relays, drop-on-disconnect, and ignore non-LIMITS messages. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01464jkunWPtYhTReoc3fUQQ |
||
|
Claude
|
94c9dc7f77 |
feat: parse relay LIMITS message (NIP relay limits)
Adds support for the relay-to-client LIMITS frame, which advertises the connection's current rights and limits (can_read/can_write, auth requirements, max_message_length, max_subscriptions, max_filters, max_limit, POW, rate limits, required tags, etc.). Relays such as wss://pipe.imwald.eu/ send it on connect and whenever rights change, and Amethyst previously logged it as an unsupported message. - New LimitsMessage model in quartz commonMain with every optional field. - Jackson decode/encode (LimitsDeserializer + MessageSerializer) and the kotlinx-serialization path (LimitsKSerializer + MessageKSerializer). - Logs a summary line in RelayLogger. - Tests: production payload parse, array/tag fields, empty object, and round-trip parity between the Jackson and kotlinx codecs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01464jkunWPtYhTReoc3fUQQ |