Bark

通过 NIP-46 进行远程 Nostr 签名。密钥绝不进入浏览器。适用于任何 bunker;Heartwood 还支持派生身份。

Bark bridges window.nostr to a remote NIP-46 signer, so Nostr web apps can request signatures without your private key ever entering the browser. Your keys stay on your signer: a Heartwood hardware device, your own self-hosted bunker (such as heartwoodd), or a hosted service like nsec.app. Only signatures cross the wire. NO KEYS IN THE BROWSER. EVER. Bark never generates, stores, or touches private key material. There is no key import, no seed phrase screen, and nothing for a malicious page or a browser compromise to steal. Every signing and encryption request travels over the encrypted NIP-46 protocol to a signer you control, and only the result comes back. WORKS WITH ANY NIP-46 BUNKER Bark is a standard NIP-07 provider backed by standard NIP-46. It works with Heartwood, heartwoodd, nsecBunker, Amber, nsec.app, and any other compliant signer. Three ways to pair: • Paste a bunker:// URI from any signer. • Pair by QR: Bark generates a nostrconnect:// URI and QR code with a fresh key and secret per attempt; scan it with your signer and it connects back over the relay. The QR carries the permissions Bark will need up front — read pubkey, encryption, and the common event kinds — so a permission-aware signer can show you the whole surface and you approve it once, at pairing. Signers that need a browser approval step (such as nsec.app) get an "Open approval page" button. • Enter a local Heartwood device address for HTTP pairing (Firefox; on Chrome, pair the device by bunker URI or QR). IDENTITIES ARE CONFIRMED, NOT ASSUMED Pairing and identity refresh answers from a local-network signer are treated as untrusted input. When they would add an identity or change a stored key, Bark stages the change and shows you the keys to compare against your signer device before anything is saved — and an import never silently switches which identity is active. NOTHING SIGNS WITHOUT YOUR SAY The first time a site asks for your identity, a signature, or encryption, Bark asks you. Allow the request once, trust the site for routine signing, or deny it. Sensitive event kinds (your profile, contact list, and relay list) keep asking even on trusted sites unless you explicitly override them. If the browser opens the approval window out of sight, an unmistakable in-page Bark notice tells you approval is waiting and its "Review in Bark" button brings the window forward. Concurrent requests queue in order with a toolbar badge instead of failing. POLICY CONTROL DOWN TO METHOD AND EVENT KIND The policy editor gives every site an allow/ask/deny rule, and each rule can override individual methods (for example, deny nip44.decrypt on one site while allowing signing) and individual event kinds. Sensible defaults protect newcomers; full control is there when you want it. PRIVACY MODE Turn on privacy mode and Bark reveals window.nostr only to sites you have a rule for. Every other page sees nothing: no provider object, no error responses, no way to fingerprint that a Nostr extension is installed. HEARTWOOD IDENTITIES Paired with a Heartwood signer, Bark lists, derives, and switches unlimited identities derived from a single seed, each with its own keys. Post as different personas without ever exposing a key. With any other bunker, Bark works as a clean single-identity signer. Bark is the browser end of the family. On Android, Cambium registers as a NIP-55 signer and proxies requests to the same Heartwood, so Amethyst, Primal, and friends sign through your device too. Sapwood manages the signer itself. ENCRYPTION SUPPORT NIP-44 and legacy NIP-04 encrypt/decrypt are forwarded to your signer, so DMs and encrypted app data work everywhere your signer does. BUILT TO STAY OUT OF THE WAY • Multiple signer instances with one-click switching. • Keep-alive pings hold the relay connection open while you browse, so actions stay fast. • Provider injected before page scripts run: apps never see window.nostr as undefined. • Pending approvals stay visible with a temporary in-page notice and one-click return to Bark. • Localised into 53 languages. MINIMAL FOOTPRINT Bark declares no host permissions at all. Out of the box its content script runs only on a named list of popular Nostr clients; any other site works the moment you click Enable in the popup, for that visit, on that tab, and nowhere else. No browsing history, no remote code, no analytics, no tracking, no accounts, no wallet. The script does not read page content. It only exposes the standard NIP-07 interface and, while one of that site's requests awaits approval, adds a temporary Bark notice. Nothing is sent anywhere except NIP-46 traffic to your own signer. The extension is fully open source (MIT) at github.com/forgesworn/bark, with a CI-tested build you can reproduce yourself. Bark is the protective outer layer of Heartwood, the ForgeSworn open-source hardware signer, and works just as well without it.