mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 16:33:27 +00:00
Claude
2332384897
NIP-46 lets the remote-signer (transport) key differ from the user's identity key. Previously the bunker advertised and wrapped everything with the identity key, so anyone watching the inbox relays could see kind-24133 traffic addressed to the user's real npub and infer "this npub runs a bunker". Now each account gets a dedicated, persisted transport keypair: - NostrConnectSignerService wraps/unwraps the kind-24133 envelope with a `transportSigner`; BunkerRequestProcessor keeps the identity signer for the actual sign/encrypt/decrypt and answers get_public_key with the real npub (disclosed only to a connected client, over the encrypted channel). - The host mints + persists the transport key lazily (accounts that never enable the signer mint nothing), advertises it in bunker:// and the nostrconnect ack, and listens p-tagged to it. - AccountSettings/LocalPreferences persist nip46TransportKey so the advertised address stays stable across restarts. Bonus: because the envelope is now wrapped with a LOCAL key, external NIP-55 (Amber) accounts no longer round-trip the external app for envelope crypto — only the genuine signing request does. A new test asserts get_public_key returns the identity, never the transport key. Unreleased feature, so no migration needed. The CLI bunker keeps using the operator's own key (dev tool). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015FHr2mu5SiHwYNR7evYUuF