Relay privacy over Tor, encrypted account backup, and a recoverable restore

[anthonyonazure]

Attribution first

Ten of the twelve commits here are @BIMbeamFLX's work, from their feat/relays-over-tor branch. They had not opened a PR, so this rebases their branch onto current main and adds two commits of my own on top. Authorship is preserved per commit.

What it does

Relay privacy (@BIMbeamFLX). File transfers already go over Tor — transfer.rs refuses any offer without a valid v3 onion. What still went out in the clear were the Nostr relay connections, which let a relay operator tie a home IP to an identity key, its searches, and its published catalogue. This routes those through the bundled Tor as an opt-in mode, defaulting to off.

It fails closed: if Tor will not start, the connection errors rather than silently falling back to clearnet. Two smaller leaks are closed alongside it — the GitHub update check becomes cache-only in privacy mode, and img-src no longer permits arbitrary remote hosts (nothing renders remote images today, so this costs nothing).

Also from @BIMbeamFLX: encrypted account backup and restore via NIP-49, browsing a seeder's full shared library from their profile, sortable result columns, a working file-type filter, seeder and delivery counts, shuffle playback, and plainer status copy.

My two commits address one defect in that backup feature. Restoring a backup overwrote the keyring identity on the same click that submitted the passphrase. The dialog warned in prose, but never named the account being replaced and offered no second chance, so a mistaken restore destroyed an identity that is unrecoverable by design.

• inspect_identity_backup decrypts only to report whose account a file holds, storing nothing. The destructive import now runs from a separate confirmation step naming both keys.
• Replacing an account archives the outgoing key to a dated keyring entry first, surfaced as "Previous accounts on this computer" with a switch-back button that itself archives what it displaces. Restore is no longer destructive.
• Exporting records which account a backup file covers, so the confirmation can state the real consequence: an exported account is merely set aside, while a never-exported one will exist only in that computer's keychain. Each case requires ticking its matching acknowledgement.

Merge notes

Rebasing across the 15 commits to v0.2.0 produced 19 conflicts. Four were substantive:

• save_settings was restructured upstream; the Tor setting is folded into the new shape.
• The service wiring gained the mobile service; the Tor handle is passed through it.
• The format dropdown became an audiobook switch upstream and a file-type filter in the fork. Both meanings now coexist, and the fork's filter still applies through mergeSearchResults.
• The shared library gained a folder picker, audiobook banners, and paging. Upstream's structure is kept, with the fork's seeder-count and delivery columns re-applied.

Verification

• 48 Rust tests pass, including 3 new ones covering the preview, the archive records, and the backed-up marker.
• svelte-check clean across 158 files.
• cargo clippy --all-targets: 15 lints, every one of which reproduces verbatim on main. This branch adds none.
• gitleaks clean; osv-scanner reports one fewer advisory than main, and the branch adds no new crates (only the nip49 feature on the existing nostr-sdk).
• Built and run on macOS arm64 against the live network, and the restore flow driven by hand end to end.

That manual pass found three defects in my own commits, now fixed in b7caefd: the dialog would not close after a successful restore (its dismissal guard also blocked completion), the archived-account list loaded before the native bridge was ready and so stayed permanently empty, and restoring blocked on reconnecting to every relay before returning. None were reachable by the type checker or the test suite — all three were lifecycle and ordering faults that only surfaced by clicking. Worth knowing if you review the earlier commits in isolation.

Still unverified: the "switch back" path from the archived-account list, and the wording of the two acknowledgement variants under a real screen reader.

🤖 Generated with Claude Code