v0.0.39 - Remove qrexec one-shot (option 4) from interactive transport menu — only persistent listeners remain

plans/interactive_transport_selection.md

@@ -0,0 +1,143 @@
+# Plan: Interactive multi-transport selection at startup
+
+Status: design / ready for review.
+
+Related:
+- [`README.md`](../README.md) §7 Transport, §8.3 Qubes OS qube, §9 Usage
+- [`src/main.c`](../src/main.c) — argument parsing, main loop, TUI
+- [`src/server.c`](../src/server.c) — `server_ctx_t`, `server_start`, `server_handle_one`
+- [`plans/qrexec_persistent_bridge.md`](qrexec_persistent_bridge.md) — bridge design
+
+---
+
+## 1. Motivation
+
+The current CLI has many transport flags (`--listen`, `--socket-name`, `--bridge-source-trusted`, `--auth`, `--allow-all`) that the user must know in advance. For interactive use, this is unfriendly — the user just wants to answer "how should other programs reach this signer?"
+
+Additionally, the user may want **multiple transports active simultaneously** (e.g. unix socket for local clients + TCP for FIPS mesh clients + qrexec bridge for other qubes). Today only one `--listen` mode is supported at a time.
+
+---
+
+## 2. Design
+
+### 2.1 Interactive transport menu at startup
+
+After mnemonic entry and before the running phase, if no `--listen` flag was given (i.e. interactive mode), present a multi-select menu:
+
+```text
+Transport — how should other programs reach this signer?
+Select one or more (space to toggle, enter to confirm):
+
+  [x] 1. Local Unix socket (same machine/qube)
+  [ ] 2. Qubes qrexec bridge (other qubes via qrexec, no network)
+  [ ] 3. TCP listener (FIPS mesh or local network)
+  [ ] 4. Qrexec one-shot (legacy, one request per invocation)
+
+  [a] select all
+
+  (at least one must be selected)
+```
+
+Each selected transport gets configured with sensible defaults:
+
+| Choice | What it starts | Defaults |
+|---|---|---|
+| 1. Unix socket | `--listen unix` | socket name `nsigner` (or random if collision) |
+| 2. Qrexec bridge | `--listen unix --bridge-source-trusted` | socket name `nsigner`, accepts qrexec preamble |
+| 3. TCP | `--listen tcp:[::]:8080` | bind all interfaces, port 8080 |
+| 4. Qrexec one-shot | `--listen qrexec` | one request via stdin, then exit |
+
+**Choices 1 and 2 can coexist** — they're both unix listeners, just with different identity handling. Choice 2 implies choice 1's socket. If both are selected, the bridge-source-trusted flag is set on the single unix listener (it handles both local and bridge connections).
+
+**Choice 3 (TCP) can coexist with 1+2** — it's a separate listener on a different fd.
+
+**Choice 4 (qrexec one-shot) is mutually exclusive** with all others — it uses stdin/stdout and exits after one request. If selected alone, it runs the one-shot path. If selected with others, it's ignored with a warning (or: the user is told it can't combine).
+
+### 2.2 Multi-listener architecture
+
+Currently `main()` creates one `server_ctx_t` and polls `server.listen_fd` + `STDIN_FILENO`. To support multiple listeners:
+
+- Create an array of `server_ctx_t` (up to 3: unix, tcp, and optionally a second unix for bridge — though 1+2 collapse into one).
+- Each `server_ctx_t` gets its own `server_start()`.
+- The poll loop expands to poll all listener fds + STDIN_FILENO.
+- When a listener fd has activity, call `server_handle_one()` on that context.
+- The TUI status display shows all active transports.
+
+```text
+Connections
+listen: unix @nsigner (bridge-source-trusted)
+listen: tcp [::]:8080
+client: nsigner --socket-name nsigner client '<json>'
+```
+
+### 2.3 Coexistence with CLI flags
+
+- If `--listen` is given on the command line, **skip the interactive menu** (automation/scripting path unchanged).
+- If no `--listen` is given and stdin is a TTY, **show the interactive menu**.
+- If no `--listen` is given and stdin is NOT a TTY, **default to unix socket** (current behavior, for `--mnemonic-stdin` / `--mnemonic-fd` supervised launches).
+
+This preserves backward compatibility: all existing flags and scripts work unchanged. The menu is purely an interactive convenience.
+
+### 2.4 TUI implementation
+
+The menu uses the existing TUI rendering helpers (`tui_render_content_screen`, `tui_print`). It appears after mnemonic acceptance and before the status display. Navigation:
+
+- `1`-`4` or space: toggle a choice
+- `a`: select all (except 4, which is mutually exclusive)
+- `a`: select all (except 4, which is mutually exclusive)
+- `enter`: confirm and proceed to running phase (at least one must be selected)
+
+After confirmation, the selected listeners are started and the status display renders.
+
+### 2.5 Security considerations
+
+- The menu is purely a UX layer — it doesn't change the security model. Each transport still goes through the same policy/approval pipeline.
+- `--bridge-source-trusted` is only set if the user explicitly selects the qrexec bridge option. It's never silently enabled.
+- TCP listener still requires auth envelopes (existing behavior).
+- The menu doesn't offer `--allow-all`; that remains a CLI flag for users who want it.
+
+---
+
+## 3. Implementation checklist
+
+### 3.1 Multi-listener support in `main.c`
+- [ ] Replace single `server_ctx_t server` with an array (e.g. `server_ctx_t servers[3]`).
+- [ ] Add a `server_count` variable.
+- [ ] Expand the poll loop to poll all `servers[i].listen_fd` + STDIN_FILENO.
+- [ ] On activity, call `server_handle_one(&servers[i], ...)` for the matching fd.
+- [ ] `server_stop()` all on shutdown.
+
+### 3.2 Interactive menu
+- [ ] Add `prompt_transport_selection()` function in `main.c` (after mnemonic load, before server start).
+- [ ] Returns a bitmask of selected transports.
+- [ ] Only called when `listen_mode` was not set by CLI and stdin is a TTY.
+- [ ] Uses `tui_render_content_screen` + `read_line_stdin` for input.
+
+### 3.3 Transport setup from menu selection
+- [ ] Unix: `server_init` + `server_start` with `NSIGNER_LISTEN_UNIX`, socket name `nsigner`.
+- [ ] Qrexec bridge: same as unix + `server_set_bridge_source_trusted(&server, 1)`.
+- [ ] TCP: `server_init` + `server_start` with `NSIGNER_LISTEN_TCP`, target `tcp:[::]:8080`.
+- [ ] Qrexec one-shot: existing `NSIGNER_LISTEN_QREXEC` path (stdin, one request, exit).
+
+### 3.4 TUI status display
+- [ ] Update `render_status()` to show multiple active listeners.
+- [ ] Show `(bridge-source-trusted)` annotation on unix listeners that have it.
+
+### 3.5 Testing
+- [ ] Interactive: start nsigner with no `--listen`, select unix+TCP, verify both listeners work.
+- [ ] Interactive: select qrexec bridge, verify bridge connections get `qubes:<vm>` identity.
+- [ ] CLI: `--listen tcp:[::]:8080` still works (skips menu).
+- [ ] CLI: `--listen unix --bridge-source-trusted` still works (skips menu).
+- [ ] Non-TTY: `--mnemonic-stdin` without `--listen` defaults to unix (no menu).
+
+---
+
+## 4. Open questions
+
+1. **Should the menu remember the last selection?** n_signer has no config files (by design). We could store the preference in an env var or a `/tmp` file, but that violates the zero-filesystem-footprint principle. **Decision: no persistence — the menu appears fresh each time.**
+
+2. **Should there be a hotkey to add/remove transports at runtime?** E.g. press `t` in the TUI to bring up the transport menu again. This is a nice-to-have but adds complexity. **Decision: defer — the menu is startup-only for now.**
+
+3. **TCP port selection in the menu?** The menu could ask for a port number if TCP is selected. **Decision: default to 8080, let the user override with `--listen tcp:...` if they need a different port. Keep the menu simple.**
+
+4. **Socket name selection?** Same — default to `nsigner`, override with `--socket-name` if needed. **Decision: default, no prompt.**

src/main.c

@@ -412,6 +412,9 @@ typedef struct {
 } caller_identity_t;
 
 /* Server context */
+#define INDEX_WHITELIST_MAX 256
+#define INDEX_WHITELIST_BITMAP_SIZE (INDEX_WHITELIST_MAX / 8)
+
 typedef struct {
     char socket_name[SERVER_SOCKET_NAME_MAX]; /* abstract namespace name (without \0 prefix) */
     char last_error[256];
@@ -424,6 +427,9 @@ typedef struct {
     int socket_name_explicit;
     int auth_mode;
     int auth_skew_seconds;
+    int bridge_source_trusted;
+    int index_whitelist_active;
+    unsigned char index_whitelist[INDEX_WHITELIST_BITMAP_SIZE];
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
@@ -457,6 +463,9 @@ void server_set_prompt_always_allow(int enabled);
 /* Mark the unix listener as a trusted bridge socket (qrexec source preamble) */
 void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled);
 
+/* Set the nostr_index whitelist from a spec string ("all", "1,3,4", "0-3", "0-3,7,9") */
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec);
+
 /* Configure non-interactive prompt fallback: -1 disabled, POLICY_ALLOW, or POLICY_DENY */
 void server_set_noninteractive_prompt_default(int decision);
 
@@ -494,8 +503,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 35
-#define NSIGNER_VERSION "v0.0.35"
+#define NSIGNER_VERSION_PATCH 39
+#define NSIGNER_VERSION "v0.0.39"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */
@@ -799,6 +808,8 @@ static void print_usage(const char *program_name) {
     tui_print("  --mnemonic-fd N     Read mnemonic from inherited fd N (one line) at startup");
     tui_print("  --allow-all, -A     Allow all policy prompts for this server session");
     tui_print("  --bridge-source-trusted  Accept qrexec_source preamble on unix connections (bridge mode)");
+    tui_print("  --allow-index SPEC  Restrict which nostr_index values this session can access");
+    tui_print("                      SPEC: 'all' (default), '1,3,4', '0-3', or '0-3,7,9'");
 }
 
 static int extract_nsigner_socket_from_proc_line(const char *line,
@@ -1591,6 +1602,75 @@ static void apply_test_overrides(policy_table_t *policy) {
     }
 }
 
+/* Transport selection bitmask for interactive menu */
+#define TRANSPORT_UNIX          0x01
+#define TRANSPORT_QREXEC_BRIDGE 0x02
+#define TRANSPORT_TCP           0x04
+#define TRANSPORT_QREXEC_ONESHOT 0x08
+
+/*
+ * Interactive transport selection menu.
+ * Shown after mnemonic entry when no --listen flag was given and stdin is a TTY.
+ * Returns a bitmask of selected transports, or 0 on error/no selection.
+ */
+static int prompt_transport_selection(void) {
+    int selected = TRANSPORT_UNIX;  /* default: local unix socket */
+    char input[32];
+
+    for (;;) {
+        tui_render_content_screen(NULL, "Transport — how should other programs reach this signer?");
+        printf("Select one or more (type a number to toggle, 'a' for all, Enter to confirm):\n\n");
+        printf("  [%s] 1. Local Unix socket (same machine/qube)\n",
+               (selected & TRANSPORT_UNIX) ? "x" : " ");
+        printf("  [%s] 2. Qubes qrexec bridge (other qubes via qrexec, no network)\n",
+               (selected & TRANSPORT_QREXEC_BRIDGE) ? "x" : " ");
+        printf("  [%s] 3. TCP listener (FIPS mesh or local network)\n",
+               (selected & TRANSPORT_TCP) ? "x" : " ");
+        printf("\n  [a] select all    Enter = confirm\n");
+        printf("> ");
+        fflush(stdout);
+
+        if (read_line_stdin(input, sizeof(input)) != 0) {
+            return 0;
+        }
+
+        /* Trim trailing whitespace */
+        {
+            size_t len = strlen(input);
+            while (len > 0 && (input[len-1] == '\n' || input[len-1] == '\r' ||
+                               input[len-1] == ' ' || input[len-1] == '\t')) {
+                input[--len] = '\0';
+            }
+        }
+
+        if (input[0] == '\0') {
+            /* Enter pressed — confirm current selection */
+            if (selected == 0) {
+                printf("At least one transport must be selected.\n");
+                continue;
+            }
+            break;
+        }
+
+        if (input[0] == 'a' || input[0] == 'A') {
+            selected = TRANSPORT_UNIX | TRANSPORT_QREXEC_BRIDGE | TRANSPORT_TCP;
+            continue;
+        }
+
+        if (input[0] == '1') {
+            selected ^= TRANSPORT_UNIX;
+        } else if (input[0] == '2') {
+            selected ^= TRANSPORT_QREXEC_BRIDGE;
+        } else if (input[0] == '3') {
+            selected ^= TRANSPORT_TCP;
+        } else {
+            printf("Invalid input. Type 1-3, 'a', or Enter to confirm.\n");
+        }
+    }
+
+    return selected;
+}
+
 int main(int argc, char *argv[]) {
     mnemonic_state_t mnemonic;
     role_table_t role_table;
@@ -1598,13 +1678,14 @@ int main(int argc, char *argv[]) {
     policy_table_t policy;
     server_ctx_t server;
     key_store_t key_store;
-    struct pollfd pfds[2];
+    struct pollfd pfds[3];  /* max: 2 listeners (unix+tcp) + stdin */
     uid_t owner_uid;
     int derived_count;
     const char *socket_name = NSIGNER_DEFAULT_SOCKET_NAME;
     char generated_socket_name[SERVER_SOCKET_NAME_MAX];
     int socket_name_explicit = 0;
     int listen_mode = NSIGNER_LISTEN_UNIX;
+    int listen_mode_explicit = 0;
     const char *listen_target = NSIGNER_DEFAULT_SOCKET_NAME;
     int argi = 1;
     const char *preapprove_specs[POLICY_MAX_ENTRIES];
@@ -1613,6 +1694,7 @@ int main(int argc, char *argv[]) {
     int auth_skew_seconds = AUTH_DEFAULT_SKEW_SECONDS;
     int allow_all = 0;
     int bridge_source_trusted = 0;
+    const char *allow_index_spec = NULL;
     mnemonic_source_t mnemonic_source = { MNEMONIC_SOURCE_TUI, -1 };
 
     while (argi < argc) {
@@ -1633,6 +1715,7 @@ int main(int argc, char *argv[]) {
                 fprintf(stderr, "Missing value for %s\n", argv[argi]);
                 return 1;
             }
+            listen_mode_explicit = 1;
             if (strcmp(argv[argi + 1], "unix") == 0) {
                 listen_mode = NSIGNER_LISTEN_UNIX;
             } else if (strcmp(argv[argi + 1], "stdio") == 0) {
@@ -1722,6 +1805,15 @@ int main(int argc, char *argv[]) {
             argi += 1;
             continue;
         }
+        if (strcmp(argv[argi], "--allow-index") == 0) {
+            if (argi + 1 >= argc) {
+                fprintf(stderr, "Missing value for %s\n", argv[argi]);
+                return 1;
+            }
+            allow_index_spec = argv[argi + 1];
+            argi += 2;
+            continue;
+        }
         break;
     }
 
@@ -1853,6 +1945,51 @@ int main(int argc, char *argv[]) {
 
     dispatcher_init(&dispatcher, &role_table, &mnemonic, &key_store);
 
+    /*
+     * Interactive transport selection: if no --listen flag was given and
+     * stdin is a TTY, show the multi-select transport menu. This lets the
+     * user choose how other programs reach the signer without memorizing
+     * CLI flags. CLI flags skip the menu (backward compatible).
+     */
+    int transport_mask = 0;
+    int multi_listen = 0;  /* set when multiple persistent listeners are active */
+    server_ctx_t servers[2];  /* max: unix + tcp */
+    int server_count = 0;
+    int unix_server_idx = -1;
+    int tcp_server_idx = -1;
+
+    if (!listen_mode_explicit && isatty(STDIN_FILENO) &&
+        mnemonic_source.kind == MNEMONIC_SOURCE_TUI) {
+        transport_mask = prompt_transport_selection();
+        if (transport_mask == 0) {
+            fprintf(stderr, "No transport selected. Exiting.\n");
+            crypto_wipe(&key_store);
+            nostr_cleanup();
+            mnemonic_unload(&mnemonic);
+            return 1;
+        }
+
+        /* Persistent listeners — configure from menu selection */
+        multi_listen = 1;
+
+        /* Unix socket (with or without bridge-source-trusted) */
+        if (transport_mask & (TRANSPORT_UNIX | TRANSPORT_QREXEC_BRIDGE)) {
+            /* Use fixed name "nsigner" for scripted access */
+            socket_name = "nsigner";
+            socket_name_explicit = 1;
+            listen_mode = NSIGNER_LISTEN_UNIX;
+            listen_target = socket_name;
+            if (transport_mask & TRANSPORT_QREXEC_BRIDGE) {
+                bridge_source_trusted = 1;
+            }
+        }
+
+        /* TCP listener */
+        if (transport_mask & TRANSPORT_TCP) {
+            /* Will be started as a second listener */
+        }
+    }
+
     if (listen_mode == NSIGNER_LISTEN_UNIX && !socket_name_explicit) {
         if (socket_name_random(generated_socket_name, sizeof(generated_socket_name)) != 0) {
             fprintf(stderr, "Failed to generate random socket name\n");
@@ -1898,6 +2035,16 @@ int main(int argc, char *argv[]) {
    if (bridge_source_trusted) {
        server_set_bridge_source_trusted(&server, 1);
    }
+   if (allow_index_spec != NULL) {
+       if (server_set_index_whitelist(&server, allow_index_spec) != 0) {
+           fprintf(stderr, "Invalid --allow-index spec: %s\n", allow_index_spec);
+           fprintf(stderr, "Expected: 'all', '1,3,4', '0-3', or '0-3,7,9'\n");
+           crypto_wipe(&key_store);
+           nostr_cleanup();
+           mnemonic_unload(&mnemonic);
+           return 1;
+       }
+   }
    if (server_start(&server) != 0) {
         if (listen_mode == NSIGNER_LISTEN_UNIX) {
             fprintf(stderr, "Failed to start server on @%s: %s\n", socket_name, server_last_error(&server));
@@ -1914,6 +2061,44 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    /*
+     * Multi-listener: if interactive menu selected TCP in addition to unix,
+     * start a second server context for TCP. The primary server (unix) is
+     * already running. Both share the same dispatcher and policy.
+     */
+    if (multi_listen && (transport_mask & TRANSPORT_TCP)) {
+        const char *tcp_target = "tcp:[::]:8080";
+        tcp_server_idx = server_count;
+        server_init(&servers[tcp_server_idx],
+                    tcp_target,
+                    0,  /* socket_name_explicit = 0 for TCP */
+                    NSIGNER_LISTEN_TCP,
+                    NSIGNER_AUTH_REQUIRED,
+                    auth_skew_seconds,
+                    &dispatcher,
+                    &policy);
+        if (allow_index_spec != NULL) {
+            server_set_index_whitelist(&servers[tcp_server_idx], allow_index_spec);
+        }
+        if (server_start(&servers[tcp_server_idx]) != 0) {
+            fprintf(stderr, "Failed to start TCP server on %s: %s\n",
+                    tcp_target, server_last_error(&servers[tcp_server_idx]));
+            server_stop(&server);
+            crypto_wipe(&key_store);
+            nostr_cleanup();
+            mnemonic_unload(&mnemonic);
+            return 1;
+        }
+        server_count++;
+    }
+
+    /* Copy the primary (unix) server into the array for unified polling */
+    if (multi_listen) {
+        unix_server_idx = server_count;
+        servers[unix_server_idx] = server;  /* struct copy */
+        server_count++;
+    }
+
     (void)signal(SIGINT, handle_signal);
     (void)signal(SIGTERM, handle_signal);
     /*
@@ -1935,7 +2120,22 @@ int main(int argc, char *argv[]) {
 
         connection_info_clear();
 
-        if (listen_mode == NSIGNER_LISTEN_UNIX) {
+        if (multi_listen) {
+            /* Multi-listener mode: show all active transports */
+            if (transport_mask & (TRANSPORT_UNIX | TRANSPORT_QREXEC_BRIDGE)) {
+                if (bridge_source_trusted) {
+                    connection_info_add("listen: unix @%s (bridge-source-trusted)", socket_name);
+                } else {
+                    connection_info_add("listen: unix @%s", socket_name);
+                }
+                connection_info_add("client: nsigner --socket-name %s client '<json>'", socket_name);
+                printf("System is ready and waiting for connections on @%s.\n", socket_name);
+            }
+            if (transport_mask & TRANSPORT_TCP) {
+                connection_info_add("listen: tcp [::]:8080");
+                printf("System is ready and waiting for connections on tcp:[::]:8080.\n");
+            }
+        } else if (listen_mode == NSIGNER_LISTEN_UNIX) {
             connection_info_add("listen: unix @%s", socket_name);
             connection_info_add("client: nsigner --socket-name %s client '<json>'", socket_name);
             printf("System is ready and waiting for connections on @%s.\n", socket_name);
@@ -2013,13 +2213,26 @@ int main(int argc, char *argv[]) {
         tui_install_resize_handler();
         render_status(&role_table, &mnemonic, derived_count, socket_name);
 
-        pfds[0].fd = server.listen_fd;
-        pfds[0].events = POLLIN;
-        pfds[1].fd = STDIN_FILENO;
-        pfds[1].events = POLLIN;
+        /* Set up poll fds: listener(s) + stdin */
+        int npfds = 0;
+        if (multi_listen) {
+            for (int si = 0; si < server_count; si++) {
+                pfds[npfds].fd = servers[si].listen_fd;
+                pfds[npfds].events = POLLIN;
+                npfds++;
+            }
+        } else {
+            pfds[npfds].fd = server.listen_fd;
+            pfds[npfds].events = POLLIN;
+            npfds++;
+        }
+        pfds[npfds].fd = STDIN_FILENO;
+        pfds[npfds].events = POLLIN;
+        npfds++;
+        int stdin_pfd_idx = npfds - 1;
 
         while (g_running && server.running) {
-            int prc = poll(pfds, 2, 200);
+            int prc = poll(pfds, npfds, 200);
             if (prc < 0) {
                 if (errno == EINTR) {
                     continue;
@@ -2031,15 +2244,31 @@ int main(int argc, char *argv[]) {
                 render_status(&role_table, &mnemonic, derived_count, socket_name);
             }
 
-            if (prc > 0 && (pfds[0].revents & POLLIN)) {
-                int hrc = server_handle_one(&server, activity_log_cb, NULL);
-                if (hrc < 0) {
-                    break;
+            /* Check all listener fds for activity */
+            if (prc > 0) {
+                if (multi_listen) {
+                    for (int si = 0; si < server_count; si++) {
+                        if (pfds[si].revents & POLLIN) {
+                            int hrc = server_handle_one(&servers[si], activity_log_cb, NULL);
+                            if (hrc < 0) {
+                                g_running = 0;
+                                break;
+                            }
+                            render_status(&role_table, &mnemonic, derived_count, socket_name);
+                        }
+                    }
+                } else {
+                    if (pfds[0].revents & POLLIN) {
+                        int hrc = server_handle_one(&server, activity_log_cb, NULL);
+                        if (hrc < 0) {
+                            break;
+                        }
+                        render_status(&role_table, &mnemonic, derived_count, socket_name);
+                    }
                 }
-                render_status(&role_table, &mnemonic, derived_count, socket_name);
             }
 
-            if (prc > 0 && (pfds[1].revents & POLLIN)) {
+            if (prc > 0 && (pfds[stdin_pfd_idx].revents & POLLIN)) {
                 char ch = '\0';
                 if (read(STDIN_FILENO, &ch, 1) > 0) {
                     char lower = (char)tolower((unsigned char)ch);
@@ -2083,7 +2312,13 @@ int main(int argc, char *argv[]) {
         server_set_approval_cb(NULL, NULL);
     }
 
-    server_stop(&server);
+    if (multi_listen) {
+        for (int si = 0; si < server_count; si++) {
+            server_stop(&servers[si]);
+        }
+    } else {
+        server_stop(&server);
+    }
     crypto_wipe(&key_store);
     nostr_cleanup();
     mnemonic_unload(&mnemonic);

src/server.c

@@ -415,6 +415,9 @@ typedef struct {
 } caller_identity_t;
 
 /* Server context */
+#define INDEX_WHITELIST_MAX 256  /* nostr_index range 0-255 */
+#define INDEX_WHITELIST_BITMAP_SIZE (INDEX_WHITELIST_MAX / 8)  /* 32 bytes */
+
 typedef struct {
     char socket_name[SERVER_SOCKET_NAME_MAX]; /* abstract namespace name (without \0 prefix) */
     char last_error[256];
@@ -428,6 +431,8 @@ typedef struct {
     int auth_mode;
     int auth_skew_seconds;
     int bridge_source_trusted;  /* when set, unix connections send a qrexec_source preamble */
+    int index_whitelist_active;  /* 1 if index whitelist is set (not "all") */
+    unsigned char index_whitelist[INDEX_WHITELIST_BITMAP_SIZE];  /* bitmap of allowed nostr_index values */
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
@@ -444,6 +449,15 @@ void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_exp
  * identity is composed as qubes:<vm>. */
 void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled);
 
+/* Set the nostr_index whitelist from a parsed spec string.
+ * Spec format: "all" (no restriction), or comma-separated list of
+ * indices and ranges, e.g. "1,3,4" or "0-3" or "0-3,7,9".
+ * Returns 0 on success, -1 on parse error. */
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec);
+
+/* Check if a nostr_index is in the whitelist. Returns 1 if allowed, 0 if not. */
+int server_index_whitelist_allows(const server_ctx_t *ctx, int nostr_index);
+
 /* Start listening. Returns 0 on success, -1 on error. */
 int server_start(server_ctx_t *ctx);
 
@@ -1058,6 +1072,8 @@ void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_exp
     ctx->auth_mode = auth_mode;
     ctx->auth_skew_seconds = (auth_skew_seconds > 0) ? auth_skew_seconds : AUTH_DEFAULT_SKEW_SECONDS;
     ctx->bridge_source_trusted = 0;
+    ctx->index_whitelist_active = 0;
+    memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
     if (!g_auth_nonce_cache_inited) {
         auth_nonce_cache_init(&g_auth_nonce_cache);
         g_auth_nonce_cache_inited = 1;
@@ -1071,6 +1087,87 @@ void server_set_bridge_source_trusted(server_ctx_t *ctx, int enabled) {
     ctx->bridge_source_trusted = enabled ? 1 : 0;
 }
 
+static void whitelist_set_bit(unsigned char *bitmap, int index) {
+    if (index >= 0 && index < INDEX_WHITELIST_MAX) {
+        bitmap[index / 8] |= (1 << (index % 8));
+    }
+}
+
+static int whitelist_get_bit(const unsigned char *bitmap, int index) {
+    if (index < 0 || index >= INDEX_WHITELIST_MAX) {
+        return 0;
+    }
+    return (bitmap[index / 8] >> (index % 8)) & 1;
+}
+
+int server_set_index_whitelist(server_ctx_t *ctx, const char *spec) {
+    char buf[256];
+    char *p;
+    char *token;
+
+    if (ctx == NULL || spec == NULL) {
+        return -1;
+    }
+
+    /* "all" means no restriction */
+    if (strcmp(spec, "all") == 0) {
+        ctx->index_whitelist_active = 0;
+        memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
+        return 0;
+    }
+
+    strncpy(buf, spec, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = '\0';
+
+    /* Parse comma-separated entries: "1,3,4" or "0-3" or "0-3,7,9" */
+    memset(ctx->index_whitelist, 0, sizeof(ctx->index_whitelist));
+    p = buf;
+    while (p != NULL && *p != '\0') {
+        char *comma = strchr(p, ',');
+        if (comma != NULL) {
+            *comma = '\0';
+        }
+
+        /* Parse token: either "N" or "N-M" (range) */
+        char *dash = strchr(p, '-');
+        if (dash != NULL) {
+            *dash = '\0';
+            char *endptr1 = NULL, *endptr2 = NULL;
+            long lo = strtol(p, &endptr1, 10);
+            long hi = strtol(dash + 1, &endptr2, 10);
+            if (*endptr1 != '\0' || *endptr2 != '\0' || lo < 0 || hi < 0 ||
+                lo >= INDEX_WHITELIST_MAX || hi >= INDEX_WHITELIST_MAX || lo > hi) {
+                return -1;
+            }
+            for (long i = lo; i <= hi; i++) {
+                whitelist_set_bit(ctx->index_whitelist, (int)i);
+            }
+        } else {
+            char *endptr = NULL;
+            long idx = strtol(p, &endptr, 10);
+            if (*endptr != '\0' || idx < 0 || idx >= INDEX_WHITELIST_MAX) {
+                return -1;
+            }
+            whitelist_set_bit(ctx->index_whitelist, (int)idx);
+        }
+
+        p = (comma != NULL) ? comma + 1 : NULL;
+    }
+
+    ctx->index_whitelist_active = 1;
+    return 0;
+}
+
+int server_index_whitelist_allows(const server_ctx_t *ctx, int nostr_index) {
+    if (ctx == NULL) {
+        return 1;  /* no ctx = allow (shouldn't happen) */
+    }
+    if (!ctx->index_whitelist_active) {
+        return 1;  /* "all" mode = no restriction */
+    }
+    return whitelist_get_bit(ctx->index_whitelist, nostr_index);
+}
+
 int server_start(server_ctx_t *ctx) {
     int fd;
     struct sockaddr_un addr;
@@ -1569,6 +1666,24 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
         }
     }
 
+    /*
+     * Index whitelist enforcement: if the request specifies a nostr_index
+     * and the whitelist is active (not "all"), check that the index is
+     * allowed. This is a hard deny — it happens before policy/approval,
+     * so even an approved caller cannot access a non-whitelisted index.
+     * We set hard_selector_error to a sentinel so the policy_check branch
+     * is skipped.
+     */
+    if (hard_selector_error == 0 && selector_req.has_nostr_index &&
+        !server_index_whitelist_allows(ctx, selector_req.nostr_index)) {
+        (void)snprintf(role_name, sizeof(role_name), "nostr_idx_%d", selector_req.nostr_index);
+        response = strdup("{\"id\":\"null\",\"error\":{\"code\":2002,\"message\":\"index_not_allowed\"}}");
+        pchk = POLICY_DENY;
+        verdict = "DENIED";
+        source_label = "index-whitelist";
+        hard_selector_error = -100;  /* sentinel: skip policy_check */
+    }
+
     if (hard_selector_error == SELECTOR_ERR_AMBIGUOUS) {
         response = strdup("{\"id\":\"null\",\"error\":{\"code\":1001,\"message\":\"ambiguous_role_selector\"}}");
         pchk = POLICY_DENY;
@@ -1578,9 +1693,11 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
     } else if (hard_selector_error == SELECTOR_ERR_NOT_FOUND) {
         response = strdup("{\"id\":\"null\",\"error\":{\"code\":1002,\"message\":\"unknown_role\"}}");
         pchk = POLICY_DENY;
-    } else {
+    } else if (hard_selector_error == 0) {
+        /* Normal path: run policy_check (skip if whitelist already denied) */
         pchk = policy_check(ctx->policy, caller.caller_id, method, role_name, purpose, &policy_src);
     }
+    /* else: hard_selector_error == -100 (whitelist deny) — keep pchk=POLICY_DENY */
 
     if (pchk == POLICY_PROMPT) {
         pchk = prompt_for_policy_decision(&caller, method, role_name, purpose, pending_derivation);