n_signer/plans/nsigner_browser_extension.md

nsigner Browser Extension — NIP-07 frontend over nsigner

Project: subtree of n_signer at browser-extension/ (may spin out later).

Status: Planning. This document describes a WebExtension that exposes NIP-07 window.nostr and forwards calls to a running nsigner instance.

Authoritative signer behavior: ../README.md

1. What this is

A Chrome/Firefox/Brave WebExtension (Manifest V3) that:

1. injects a standard NIP-07-compatible window.nostr surface
2. forwards each call to nsigner over native-messaging, TLS, or relay fallback transport
3. applies per-origin permission policy and per-origin role pinning

The extension is not a wallet and holds no private keys.

2. Important compatibility note with multi-purpose roles

nsigner role entries now carry explicit purpose/curve metadata (see ../README.md). For browser NIP-07 operations, the extension must request only roles whose purpose resolves to nostr. If a role is configured for another purpose (e.g. bitcoin/ssh/age), extension UI must hide or reject it for NIP-07 signing/encryption calls instead of forwarding an invalid request.

3. Architecture (unchanged high level)

• page -> content script -> service worker
• service worker -> chosen transport -> nsigner
• policy and user prompts in extension UI

4. NIP-07 surface mapping

Standard NIP-07 calls map to nsigner request verbs:

• getPublicKey
• signEvent
• nip04.encrypt / nip04.decrypt
• nip44.encrypt / nip44.decrypt

The extension attaches role selector options when needed, but role choices must remain purpose-compatible with Nostr operations.

5. Transport options

1. Native messaging bridge (primary)
2. TLS to local/nearby nsigner
3. Relay-based fallback

6. Permission model

Per-origin policy remains the control point:

• allow/deny by verb/kind/origin
• origin-level role pinning
• explicit prompts for sensitive operations

7. Security constraints

• no private key/mnemonic persistence in extension storage
• no plaintext decrypt cache
• strong defaults for decrypt operations
• role purpose compatibility checks before forwarding signer requests

8. Implementation phases (extension-specific)

1. native helper
2. MVP extension with native path
3. role-aware UI
4. TLS transport
5. management/audit UX
6. relay fallback transport
7. browser polish and release

9. Repo location

Planned extension subtree remains:

• browser-extension/extension/
• browser-extension/native-bridge/
• browser-extension/install/
• browser-extension/tests/

10. Open questions

• extension coexistence with other NIP-07 providers
• multi-profile signer selection UX
• mobile constraints without native messaging
• hardware-token pending-confirmation UX in popup