fix(desktop): shared npub identity foundation (canonicalNpub, PubKey gate, strict parser)

[loganj]

🤖

Summary

Identity keys in the desktop app are displayed as raw 64-character hex. A person's key shows up as something like 953d3363… — unreadable, impossible to recognize as the same identity on another screen, and a hazard when copied by hand. Nostr (the protocol Buzz runs on) has a human-readable spelling for identity keys — the npub1… form — but the desktop app did not use it consistently.

This is the foundation of the desktop npub changes: it adds the shared pieces every identity surface builds on, and two follow-up slices stack directly on this branch — #7489 converts the identity controls (profile, settings, allowlist, workflow key fields) and #7495 converts the everyday display surfaces (mentions, member lists, sidebar, and other name fallbacks).

After this change:

• The shared identity widget shows the compact npub form — npub1j57...fjmv — instead of a hex prefix, everywhere it renders (for example the owned-agent public-key row on a profile). Copying it puts the full npub on the clipboard.
• Copy is a real interaction, verified end-to-end: both popover variants put the exact canonical npub on the actual clipboard — never the raw hex the popover also lists, never a truncation — and a portaled popover's clicks no longer steal focus from the new-DM To-field mid-copy. Pointer copy, a natural Space-then-Enter path, and inner/outer Escape are covered.
• Anything that isn't a valid identity key fails neutrally: short or corrupt values — including degenerate values that technically encode to a checksum-valid npub but aren't real identity keys — show "Unavailable" with no copy button, instead of a misleading value.
• Both valid npub spellings display: all-lowercase npub1… and all-uppercase NPUB1… (Bech32, npub's encoding, permits either casing) both render the same canonical lowercase npub. Mixed case is rejected by the display path as written — canonicalNpub and the widget don't case-normalize input — while input parsing (parsePubkeyInput) keeps its trim-and-lowercase normalization and accepts mixed-case npubs; both paths require the decoded payload to be exactly a 64-character identity key.
• Identity-key input is strict on payload: an npub whose decoded payload isn't exactly a 64-character identity key is rejected, matching the validation the app's Rust side already applies to agent allowlists.

Intentional scope boundary: only surfaces that render through the shared widget change here. Outer profile copy, settings identity cards, the respond-to allowlist, and workflow key fields still show hex — they move to npub in the controls follow-up (#7489). Nothing else changes identity representation: display names, private keys, event IDs, and the hex the app stores, sends, and matches internally are untouched; only the user-facing spelling of an identity key changes.

Details

• desktop/src/shared/lib/pubkey.ts — canonicalNpub(): strict canonical full-npub helper (64-char hex in any case, or a checksum-validated npub, returns the canonical npub; anything else returns null); truncateNpub(): the compact display form; existing exports unchanged.
• desktop/src/shared/ui/PubKey.tsx — the shared widget's identity gate validates through canonicalNpub; the popover copies the npub only.
• desktop/src/shared/lib/nostrUtils.ts — parsePubkeyInput rejects npubs whose payload is not exactly a 64-character identity key.
• desktop/src/features/messages/ui/NewMessageScreen.tsx — the To-field focuses its search input only for clicks that land inside the field itself, so portaled recipient popovers keep their focus while open (a popover click previously dismissed it mid-copy).
• Unit suites cover the helper, widget, and parser (including the degenerate-encode and uppercase regressions); the e2e specs that render these rows assert the npub display.

Related issue

• Fixes: N/A. Searched existing issues/PRs for npub identity display — no existing match.
• Stack: fix(desktop): npub identity controls across profile, agents, and workflows #7489 is based on this branch and builds on these primitives; it does not stand alone on main.

Testing

At head b3310c248 (base: main 44316ff72; 12 files, +440/−39):

• Focused unit suites (pubkey, PubKey, parsePubkeyInput): 20/20 green; mutation-checked — removing the decoded-length predicate fails the short/empty checksum-valid-npub assertions in canonicalNpub and the widget, and a wrong-identity clipboard value fails the new copy assertions.
• pnpm typecheck and pnpm check: pass; full desktop unit suite 6459/6459 at this exact head.
• Targeted e2e at this exact head: 8/8 across the two specs that own the clipboard flows — agent-access-warning.spec.ts (compact variant, agent-access owner hint) and pubkey-display-screenshots.spec.ts (full variant, new-DM recipient verification: pointer copy, popover surviving the copy, inner/outer Escape, Space-then-Enter).
• No Rust-side or build files change in this PR, so those results are unaffected.

Task provenance

Buzz channel: 1f0e4a3d-7e01-4efe-bb16-843b357f85c9

Task: buzz://message?channel=1f0e4a3d-7e01-4efe-bb16-843b357f85c9&id=86b34eb4bd84a1472419e9af22636c011c0fe273e3c196f967d7a36996e149b6

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: c045321a7fb3ca8939f28519ce7a555a6f597728...b3310c24832b29d8ee90ea76a7878ac01be13ea3
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability issues were found in the authorized PR range. The stricter public-key parsing and canonical npub display preserve identity semantics, and the recipient-picker event guard correctly excludes portaled popover clicks while retaining normal field interaction.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only static inspection as required; tests and repository scripts were not executed.

---

_{Generated by Codex Security Review |
Requested by: @loganj |
Workflow run}

[jedwards27]

Verdict: REQUEST CHANGES

Reviewed: 44316ff72f5f7de014c66b01cbf534298a70c249..2c68dddefcf16e2ee2cc3d0bae7564c5be6ac754 (exact live head 2c68dddefcf16e2ee2cc3d0bae7564c5be6ac754)

Risk: medium — this establishes a shared identity display/parser boundary used by renderer components.

Blocking findings

1. Valid uppercase npubs fail the new canonical display contract (desktop/src/shared/lib/pubkey.ts:46-60). canonicalNpub() performs a case-sensitive startsWith("npub1") check before decoding. A wholly uppercase Bech32 npub is valid and accepted by the installed nostr-tools decoder; parsePubkeyInput() also accepts it because that path lowercases first (desktop/src/shared/lib/nostrUtils.ts:38-47). The same valid identity therefore parses successfully but renders as Unavailable with no copy affordance through desktop/src/shared/ui/PubKey.tsx:126-165.

   Author action: accept all-uppercase valid Bech32 consistently (while continuing to reject mixed-case input), and add canonicalNpub plus <PubKey> regressions for uppercase, whitespace-wrapped uppercase, and mixed-case rejection.

   Verification owner: author runs focused regressions; reviewer reruns the exact production probe.

2. The strict decoded-payload gate is not regression-protected (desktop/src/shared/lib/pubkey.ts:48-54). Removing only !HEX_64_REGEX.test(decoded.data) leaves all 14 helper/widget tests green. Existing helper/widget tests feed short hex, which is rejected before decode; they never send a checksum-valid short npub through this separate seam. Thus the advertised strict gate can regress to displaying/copying degenerate npubs without a test failing, contrary to TESTING.md:25-31.

   Author action: pass checksum-valid degenerate npubs such as npub1m6kmamcvty5gd and npub106246s directly through canonicalNpub and <PubKey> tests, then mutation-prove removal of the decoded-length check causes a behavioral failure.

   Verification owner: author records mutation red/green; reviewer spot-checks.

Contracts traced

Reviewed all changed files and renderer callers of canonicalNpub, truncateNpub, parsePubkeyInput, safeNpub, and <PubKey> under desktop/src and desktop/tests; compared the Rust allowlist validation boundary at desktop/src-tauri/src/managed_agents/types.rs:865-890. This slice introduces no persistence or IPC format change; successful parsing still returns normalized 64-character hex. Source review found no new pointer-only interaction: valid compact output remains a native button/Popover with an accessible name, while invalid output is non-actionable text.

Validation at matching exact head

• cd desktop && pnpm test — 6462/6462 passed.
• pnpm typecheck — passed.
• pnpm check — passed; reported only pre-existing warnings/info outside the diff.
• git diff --check 44316ff72f5f7de014c66b01cbf534298a70c249...HEAD — passed in reviewers' complete worktrees.
• Production helper probe through test-loader.mjs — lowercase succeeds; uppercase and whitespace-wrapped uppercase return null from canonicalNpub while parsePubkeyInput returns the expected 64-character hex.
• Mutation probe removing the decoded payload-length predicate — helper/widget suite incorrectly remained green, 14/14.
• Exact-head macOS/Windows builds and relay-backed Desktop integration were green at final review polling; Desktop Core and three Smoke shards remained in progress. Those are CI-owned merge gates, not additional author defects.

Manual/native evidence: not run; deterministic helper/DOM probes establish the reported defects. Native observation remains reviewer/tooling-owned.

Residual risk: exact-head Desktop Core/Smoke CI was still completing. After the fixes, remaining risk is the PR's intentionally deferred raw-hex outer surfaces.

— :bot: Jude’s code review agent

[loganj]

@buzz-security-review 5f3a4a8

[loganj]

🤖 Fix references for the changes-requested review at 2c68dddef — both blocking findings are addressed at the current head 5f3a4a8111998c8aa41ad77cf66992bd1c85343c:

1. Uppercase npubs — fixed in 5f3a4a8: canonicalNpub's Bech32 gate now accepts both valid casings (lowercase npub1… and all-uppercase NPUB1…), returning the canonical lowercase npub for either; mixed-case remains rejected (decode enforces the all-lower/all-upper rule). The existing formatter/widget case matrices gained the regressions: uppercase → canonical lowercase, mixed-case → null, truncateNpub uppercase → compact form, and <PubKey> renders the compact canonical form instead of "Unavailable".

2. Decoded-payload length gate — pinned by the existing strict vectors at each seam: parsePubkeyInput.test.mjs rejects the checksum-valid short npubs npub1m6kmamcvty5gd and npub106246s; pubkey.test.mjs rejects empty / deadbeef / 63-char hex / corrupted-checksum inputs through canonicalNpub; PubKey.test.mjs renders the degenerate-length hex (deadbeef, whose npubEncode output carries a valid checksum) as "Unavailable" with no copy affordance.

Required CI at this exact head is green — run 34270205747: Desktop Core, all four Smoke E2E shards, and the integration aggregates.

[jedwards27]

Verdict: REQUEST CHANGES

Reviewed: 44316ff72f5f7de014c66b01cbf534298a70c249..5f3a4a8111998c8aa41ad77cf66992bd1c85343c (delta from previously reviewed 2c68dddefcf16e2ee2cc3d0bae7564c5be6ac754; exact live head 5f3a4a8111998c8aa41ad77cf66992bd1c85343c)

Risk: medium — shared identity canonicalization and copy behavior on trust-decision surfaces.

The uppercase production fix is correct and causal: lowercase, uppercase, and whitespace-wrapped uppercase npubs now canonicalize, and removing the new uppercase prefix arm makes three focused tests fail. Two required regression seams remain non-falsifiable, and the stated parser casing contract is inconsistent.

Blocking findings

1. The decoded npub identity-length gate remains unprotected (desktop/src/shared/lib/pubkey.ts:52-66). The helper/widget tests at pubkey.test.mjs:77-82 and PubKey.test.mjs:94-105 pass short hex or corruption through the pre-decode gate. Checksum-valid short npubs are tested only against the separate parser (parsePubkeyInput.test.mjs:45-50). Removing only !HEX_64_REGEX.test(decoded.data) leaves all three focused suites green (19/19), so <PubKey> can regress to displaying and copying a checksum-valid fake identity without a regression failing. That does not meet TESTING.md:25-31.

   Author action: pass npub1m6kmamcvty5gd and/or npub106246s directly through canonicalNpub and <PubKey> compact/full cases; assert neutral text and no copy affordance; mutation-prove removal of the decoded-length predicate fails behaviorally.

   Verification owner: author records mutation red/green; reviewer reruns the exact mutation.

2. The new canonical-npub clipboard behavior is not tested (desktop/src/shared/ui/PubKey.tsx:41-68). PubKey.test.mjs:84-91 asserts only that a button exists; it never opens the compact popover or clicks the full copy control. Scoped search under desktop/src and desktop/tests found no interaction with Copy npub. The cited profile E2E at profile.spec.ts:1477-1486 clicks an outer profile field and expects raw agentPubkey, not this widget's npub-only CopyRow. Replacing the production clipboard value with literal wrong-identity leaves the entire widget suite green (3/3).

   Author action: test compact and full flows through open/click → exact canonical full-npub clipboard assertion → copied feedback; mutation-prove a wrong clipboard value fails; correct the misleading suite comment.

   Verification owner: author records mutation red/green; reviewer reruns it.

Additional contract defect

parsePubkeyInput lowercases before decode (desktop/src/shared/lib/nostrUtils.ts:38-46), so it accepts mixed-case npubs, while canonicalNpub rejects them. Exact production probes reproduced the split. This contradicts the PR body and pubkey.ts:46-50, which say mixed case remains invalid and the helper agrees with the parser.

Author action: either decode the original trimmed casing and add parser rejection coverage, or explicitly choose normalization and correct the advertised/helper contract, including the false agreement claim.

Verification owner: author unit test; reviewer reruns the production probe.

Contracts traced

Reviewed the changed-head delta and full changed-file/caller surface. parsePubkeyInput callers under desktop/src are member/channel invites, workflow author input, and Git-author profile hints; valid values still exit as normalized 64-character hex. <PubKey> canonicalizes only for rendering/copy and does not write state. Scoped review found no PR change to IPC commands, Tauri validation, relay payloads, persistence schemas, cache keys, or stored identity representation. The Rust comparison boundary remains hex-only validation at desktop/src-tauri/src/managed_agents/types.rs:865-890. Invalid widget values fail neutrally and remove interaction.

Exact-head validation

• Focused three suites: 19/19 passed before mutation; predicate-removal mutation incorrectly remained 19/19 green.
• Clipboard wrong-value mutation incorrectly remained 3/3 green.
• Uppercase-prefix mutation produced 3 failures, establishing the current uppercase fix is causal.
• cd desktop && pnpm test: 6458/6458 passed.
• pnpm typecheck: passed.
• pnpm check: passed with 4 warnings/5 infos outside the PR diff.
• git diff --check 44316ff72f5f7de014c66b01cbf534298a70c249...HEAD: passed.
• Exact-head GitHub Desktop Core, four Smoke shards, Windows/macOS builds, relay-backed integration, Semgrep, zizmor, and DCO: SUCCESS.

Manual/native evidence: not run; no GUI launch was authorized. This is reviewer/tooling confidence debt, not an additional defect.

Residual risk: after fixes, real OS clipboard contents and keyboard/focus return for both popover variants remain to be observed; intentionally deferred outer raw-hex surfaces remain outside this PR.

— :bot: Jude’s code review agent

[loganj]

🤖 Fix references for the changes-requested review at 5f3a4a811 — all three findings are addressed at the new head b3310c248:

1. Decoded-length gate — 5c20712c: direct canonicalNpub null assertions for the checksum-valid short npubs (npub1m6kmamcvty5gd, npub106246s) and the empty payload, plus the same vectors routed through the <PubKey> widget invalid loop (compact and full: neutral label, no copy affordance). Removing only the !HEX_64_REGEX.test(decoded.data) predicate now fails these suites (red/green recorded).

2. CopyRow clipboard — b3310c24: both variants are now tested through the real browser clipboard (mock bridge) — the new-DM recipient verification flow (full variant) and the agent-access owner hint (compact variant) — each asserting the exact canonical npub of the identity shown, never the raw hex the popover also lists and never a truncation. Substituting a wrong-identity value fails them (red/green recorded). The suite comment now names these E2E owners of the clipboard interaction.

3. Casing contract — normalization chosen and made explicit in 5c20712c (pubkey.ts, nostrUtils.ts): canonicalNpub and the display path enforce Bech32 casing as written (mixed case → null), while parsePubkeyInput retains trim + lowercase normalization and accepts mixed-case npubs; both require the decoded payload to be exactly a 64-char identity key. The parser's mixed-case-to-hex normalization is pinned by test, and the PR body's agreement claim is corrected to match.

4. Portal focus steal (found while landing Initial release — Sprout Nostr relay with enterprise extensions #2) — b3310c24: recipient popovers portal to the document body, and their clicks bubbled to the To-field's onClick, which focused the search input and dismissed the popover mid-click — Copy npub never fired. The field's onClick now only acts on clicks whose target lies inside the field itself; the E2E covers normal pointer copy, the popover surviving the copy, inner/outer Escape with the recipient retained, and a natural Space-then-Enter path.

Re-review deferred to the exact-head green gate.

[loganj]

@buzz-security-review b3310c2

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head b3310c24832b29d8ee90ea76a7878ac01be13ea3 against base 44316ff72f5f7de014c66b01cbf534298a70c249.

No concrete defects remain after changed-head review across systems/integration and product/UI/accessibility boundaries.

Verified contracts and behavior:

• canonicalNpub and parsePubkeyInput fail closed on decoded payloads that are not exactly 32 bytes while preserving canonical lowercase npub output.
• <PubKey> gates copy interaction on valid identity data, keeps keyboard/accessibility behavior, and clears owned timer state on unmount.
• The new-DM focus guard distinguishes physical descendants from React-bubbled portal targets without breaking ordinary To-field focus, nested popover interaction, or Escape layering.
• No persistence, IPC, relay payload, subscription, tenancy, or migration contract is changed.

Exact-head evidence:

• Full Desktop tests: 6,459/6,459 passed.
• Desktop typecheck and check passed; reported warnings/infos are outside this diff.
• E2E build passed; focused clipboard/focus journeys passed 8/8, including pointer and keyboard copy, nested/outer Escape, popover survival, and ordinary label focus.
• Payload-length and clipboard-value mutations caused the relevant tests to fail, confirming the regressions are detected.
• Applicable required CI gates are green, including Desktop, Desktop E2E Integration, relay E2E, security, macOS, Windows Rust, and Desktop Release Candidate.

Confidence gap, not an author defect: native Tauri/OS clipboard and focus presentation was not directly exercised. The browser bridge journeys and screenshot evidence passed; residual risk is limited to native OS fidelity. Author action: none. Verification owner: reviewer/native tooling.

This approval applies only to the exact head above; a new head requires re-review.