Tests the StringIndexOutOfBoundsException fix in Url.getPart() by directly
constructing Url objects with UrlMarker indices that exceed the trimmed
originalUrl length — the exact scenario that occurs when readEnd() strips
a trailing character (e.g. ':') while the PORT/QUERY marker still points
to the original buffer position.
https://claude.ai/code/session_013rJ9iYndYVJgpYK2VazxL2
Tests cover the StringIndexOutOfBoundsException in Url.getPart() that
occurred when readEnd() trimmed trailing characters (e.g. ':') from a
detected URL but urlMarker indices remained pointing past the trimmed
string's end.
- UrlMarkerTest: three cases testing PORT/QUERY index at or beyond
string length (the boundary conditions fixed by minOf clamping and
the startIndex >= length guard)
- UrlsDetectorTest: regression for "今北産業" (no crash, 0 URLs) and
for a bare "example.com:" host
- UrlParserTest: end-to-end regression for "今北産業" and "example.com:"
https://claude.ai/code/session_013rJ9iYndYVJgpYK2VazxL2
Replace the requireAuth: Boolean parameter in NostrServer with a
pluggable AuthPolicy interface. Each policy has trigger points for
EVENT (acceptEvent), REQ (acceptReq with filter rewriting), COUNT
(acceptCount), and live event delivery (canSendToSession).
Built-in policies: OpenPolicy (allow all) and RequireAuthPolicy
(require auth for all commands, matching the previous behavior).
https://claude.ai/code/session_017vdjbdxdYK1oJMH66koVZE
Add server-side AUTH challenge/response handling per NIP-42 spec:
- RelaySession generates a unique challenge per connection and tracks
authenticated pubkeys (multiple users can auth on one session)
- NostrServer gains relayUrl and requireAuth parameters; when requireAuth
is true, EVENT/REQ/COUNT are rejected with auth-required: prefix
- AUTH handler validates kind 22242, created_at within 10 min, challenge
and relay tag matching
- AuthCmd now accepts Event (not just RelayAuthEvent) so the server can
gracefully reject wrong-kind auth attempts
- 11 new tests covering auth success, wrong challenge/relay/kind/timestamp,
multi-user auth, and requireAuth gating
https://claude.ai/code/session_017vdjbdxdYK1oJMH66koVZE
Add NwcTransactionMetadata parser that extracts comment, payer_data,
recipient_data, and nostr zap data from the untyped metadata field.
The transaction list UI now shows the Nostr user profile picture and
name for zap senders/recipients, falls back to payer name/email or
lightning address, and displays comment when it differs from description.
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Add tests using exact JSON payloads from Alby Hub's test suite:
- Real bolt11 invoice strings from Alby's mock data
- pay_keysend with TLV records and preimage
- make_invoice with nested metadata objects
- make_hold_invoice with 64-char payment hash
- settle_hold_invoice with preimage
- list_transactions with unpaid_outgoing filter
- create_connection with isolated=true
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
- Add get_budget, sign_message, create_connection request/response types
- Add NwcTransactionType (incoming/outgoing) and NwcTransactionState
(PENDING/SETTLED/FAILED/ACCEPTED) constants
- Add missing error codes: BAD_REQUEST, NOT_FOUND, EXPIRED
- Add settle_deadline field to NwcTransaction
- Add total_count to ListTransactionsResult
- Add metadata and lud16 to GetInfoResult
- Add unpaid_outgoing and unpaid_incoming to ListTransactionsParams
- Update Jackson deserializers for new method types
- Add AlbyInteropTest with 25+ tests verifying compatibility with
Alby Hub's JSON formats for all request/response types
- Update existing tests for new constants and error codes
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Covers all 10 request methods (create, serialize, deserialize), all success
and error response types, notification deserialization, EncryptionTag and
NotificationsTag parse/assemble/isTag, NwcInfoEvent build and capabilities,
NwcNotificationEvent structure, LnZapPaymentRequestEvent create/decrypt
with NIP-04 and NIP-44, and Nip47WalletConnect URI parsing and serialization.
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Implements a pure-Kotlin (commonMain) parser for the BUD-10 blossom: URI
scheme, which allows sharing blob references with discovery hints.
Format: blossom:<sha256>.<ext>[?xs=<server>&as=<pubkey>&sz=<bytes>]
- BlossomUri data class holds sha256, extension, servers (xs), authors (as), size (sz)
- BlossomUri.parse() returns null for non-blossom URIs or invalid SHA-256
- Supports repeated xs/as params (multiple servers and authors)
- Percent-encodes server URLs on serialisation; decodes on parse
- BlossomUri.toUriString() round-trips back to a canonical URI
- Includes commonTest coverage for all parsing cases
https://claude.ai/code/session_01T4jyLbkNWd3f7i6MwsBcD4
Per Amber maintainer: connect never returns a pubkey — response is
"ack" or the secret string. Rewrote ConnectResponse.parse() to check
result/error fields directly on base BunkerResponse (matching Jackson
deserialization). connect() is now a pure protocol handshake; callers
call getPublicKey() separately as a domain concern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two bugs in quartz's NIP-46 remote signer:
1. FixedKey.getEncoded() returned the raw byte array reference. javax.crypto.Mac
zeroes the key via destroy() after HMAC computation, corrupting the NIP-44
saltPrefix ("nip44-v2") after the first computeConversationKey call. All
subsequent NIP-44 decryptions with different key pairs fail with Invalid Mac.
Fix: return key.copyOf() instead of key.
2. NostrSignerRemote.connect() only handled pubkey responses. Amber (and other
signers) may respond with "ack" or "already connected" error. Added
ConnectResponse parser that maps these to success and falls back to
getPublicKey() to retrieve the actual pubkey.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Vitor Pamplona