2026-05-25 - 2026-08-25
Overview
19 pull requests merged by 1 user
Merged
#53 docs(backend): pin get_public_key as an intentional, load-bearing ACL exception (#26)
Merged
#51 fix(admin): clear pending callbacks on ACL timeout/response — stop the leak (review AD-1/CS-2)
Merged
#50 fix(transport): harden RelayPool — connect timeout, stop-race, cross-relay dedup (review RP-1/2/4)
Merged
#49 fix(admin): harden the boot DM — await a connected relay + guard teardown/rejection (#48, review CS-3)
Merged
#47 refactor: port the CLI off NDK and drop @nostr-dev-kit/ndk entirely
Merged
#45 refactor: remove @nostr-dev-kit/ndk from the daemon entirely (#44)
Merged
#43 fix(transport): swap the relay layer NDK → nostr-tools so subscriptions survive reconnects (#42, fixes #41)
Merged
#40 fix(admin): make create_new_key idempotent — never clobber an existing key (#39)
Merged
#38 fix(acl): hard-reject a lapsed token binding instead of prompting (#36)
Merged
#34 feat(acl): per-rule windowed usage caps enforced live at sign time (#28)
Merged
#33 test(acl): DB-backed integration tests for checkIfPubkeyAllowed (#29)
Merged
#32 docs: migration & DB-maintenance runbook (never full-wipe nsecbunker.db)
Merged
#27 fix(acl): enforce token grant lifecycle live at sign time (#24, #25)
Merged
#23 fix(backend): pin per-key kind:24133 subscription to explicit relays (#21)
Merged
#22 fix(daemon): keep retrying relay reconnect indefinitely, overriding NDK give-up (#20)
Merged
#17 feat(#16): boot-time autounlock of encrypted keys from a configured passphrase source
Merged
#15 feat(#14): bump @nostr-dev-kit/ndk 2.8.1 → 3.0.3 + nostr-tools v1 → v2.20 + acl wire-name vocabulary
Merged
#13 feat(#11): live-policy auth + 6 companion admin RPCs + Token.revokedAt
Merged
#10 fix(#9): close race between create_new_key and NIP-46 connect
23 issues closed from 1 user
Closed
#44 Remove @nostr-dev-kit/ndk from the daemon entirely (follow-up to #43)
Closed
#7 Investigate NDK echo issue — RPC responses unreliably reach client subscriptions on custom relays
Closed
#42 Swap daemon relay transport from NDK to nostr-tools (root fix for the resubscribe-on-reconnect bug, #41)
Closed
#26 NDK NIP-46 backend: get_public_key bypasses the permit callback — pubkey disclosure is ungated/unauditable through our ACL seam
Closed
#48 Boot-DM publish fails on startup — wait for a connected relay instead of a fixed sleep
Closed
#41 Watchdog reconnect re-opens the socket but never replays subscriptions → bunker goes silently deaf after a relay flap
Closed
#39 create_new_key clobbers an existing key — silent, unrecoverable identity loss on re-pair
Closed
#36 ACL: an expired/exhausted bound token should hard-reject (false), not fall through to prompt-admin (undefined) — clients time out instead of re-pairing
Closed
#28 Enforce PolicyRule.maxUsageCount live at sign time (needs a durable signing log)
Closed
#29 Add a DB-backed test harness + integration tests for checkIfPubkeyAllowed
Closed
#12 Trim applyToken SigningCondition fan-out once override layer is rarely-consulted
Closed
#25 Design discussion / RFC: enforce token + grant lifecycle at sign time (the root behind #24)
Closed
#24 Token expiresAt (TTL) is not enforced post-bind — sign-time ACL ignores it
Closed
#21 Per-key Backend kind:24133 subscription sometimes fails to register on relay after a fresh boot
Closed
#20 NDK gives up reconnecting to admin relay after ~3 ECONNREFUSED retries — bunker stays disconnected forever
Closed
#16 Boot-time autounlock of encrypted keys from a configured passphrase source
Closed
#14 Bump @nostr-dev-kit/ndk 2.8.1 → 3.0.3 — unlocks nip44 backend + 2yr of upstream
Closed
#11 Permissions are unmodifiable after issue: shift sign-time auth from materialized SigningCondition snapshots to live policy lookup
Closed
#9 create_new_key races: backend listener not ready when caller proceeds to NIP-46 connect
Closed
#1 Dockerfile uses npm install but project declares workspace:* deps (pnpm-only)
Closed
#4 pingOrDie self-watchdog false-positives → bunker exits every 30s on non-public relays
Closed
#3 @nostr-dev-kit/ndk declared as workspace:* with no workspace setup
Closed
#8 startKey passes bech32 nsec to NDKPrivateKeySigner — every newly-created key fails to load
34 issues created by 1 user
Opened
#1 Dockerfile uses npm install but project declares workspace:* deps (pnpm-only)
Opened
#2 pnpm-lock.yaml is out of date vs package.json — frozen install fails
Opened
#3 @nostr-dev-kit/ndk declared as workspace:* with no workspace setup
Opened
#4 pingOrDie self-watchdog false-positives → bunker exits every 30s on non-public relays
Opened
#5 getKeys throws on passphrase-encrypted entries — nip19.decode({iv, data}) fails
Opened
#6 Docker Hub image pablof7z/nsecbunkerd:latest is arm64-only — fails on amd64 hosts
Opened
#7 Investigate NDK echo issue — RPC responses unreliably reach client subscriptions on custom relays
Opened
#8 startKey passes bech32 nsec to NDKPrivateKeySigner — every newly-created key fails to load
Opened
#9 create_new_key races: backend listener not ready when caller proceeds to NIP-46 connect
Opened
#11 Permissions are unmodifiable after issue: shift sign-time auth from materialized SigningCondition snapshots to live policy lookup
Opened
#12 Trim applyToken SigningCondition fan-out once override layer is rarely-consulted
Opened
#14 Bump @nostr-dev-kit/ndk 2.8.1 → 3.0.3 — unlocks nip44 backend + 2yr of upstream
Opened
#16 Boot-time autounlock of encrypted keys from a configured passphrase source
Opened
#18 relayConnectionWatchdog: make threshold + poll-interval env-configurable + add soft-fail mode (don't process.exit on transient partitions)
Opened
#19 deps: refresh runtime deps to current stable (pnpm, prisma, nodejs, NDK, fastify, …)
Opened
#20 NDK gives up reconnecting to admin relay after ~3 ECONNREFUSED retries — bunker stays disconnected forever
Opened
#21 Per-key Backend kind:24133 subscription sometimes fails to register on relay after a fresh boot
Opened
#24 Token expiresAt (TTL) is not enforced post-bind — sign-time ACL ignores it
Opened
#25 Design discussion / RFC: enforce token + grant lifecycle at sign time (the root behind #24)
Opened
#26 NDK NIP-46 backend: get_public_key bypasses the permit callback — pubkey disclosure is ungated/unauditable through our ACL seam
Opened
#28 Enforce PolicyRule.maxUsageCount live at sign time (needs a durable signing log)
Opened
#29 Add a DB-backed test harness + integration tests for checkIfPubkeyAllowed
Opened
#30 flake devShell exports prisma-engines 7.x — breaks prisma migrate/validate in the dev shell
Opened
#31 Remove the redundant, always-failing npm run prisma:migrate step in start.js
Opened
#35 SigningLog retention/pruning — the usage-cap log grows unbounded
Opened
#36 ACL: an expired/exhausted bound token should hard-reject (false), not fall through to prompt-admin (undefined) — clients time out instead of re-pairing
Opened
#37 SigningLog retention/prune reaper (unbounded growth from #28 usage caps)
Opened
#39 create_new_key clobbers an existing key — silent, unrecoverable identity loss on re-pair
Opened
#41 Watchdog reconnect re-opens the socket but never replays subscriptions → bunker goes silently deaf after a relay flap
Opened
#42 Swap daemon relay transport from NDK to nostr-tools (root fix for the resubscribe-on-reconnect bug, #41)
Opened
#44 Remove @nostr-dev-kit/ndk from the daemon entirely (follow-up to #43)
Opened
#46 Upgrade the admin DM from NIP-04 to NIP-17 (gift-wrapped) — analysis
Opened
#48 Boot-DM publish fails on startup — wait for a connected relay instead of a fixed sleep
Opened
#52 Transport-refactor review — deferred findings (CLI + low/info backlog)