CLI: preserve public Nostr signature in messages get JSON

[BryanHarrisScripts]

Summary

buzz messages get --format json drops the public Nostr sig field while normalizing relay events. Downstream clients can therefore receive an event's id, pubkey, kind, content, created_at, and tags, but cannot independently verify the event's BIP-340 signature.

This blocks signed result collection in PlotPickle: the relay event is signed, but the CLI representation removes the proof needed to verify it.

Affected versions

Confirmed by source inspection in:

• Desktop v0.5.19
• Desktop v0.5.20
• Current main as of 2026-08-26

In crates/buzz-cli/src/client.rs, normalize_events constructs the JSON response with id, pubkey, kind, content, created_at, and tags, but not sig.

Expected behavior

The full/default JSON returned by:

buzz messages get --channel <channel-id> --format json

should preserve the relay event's public signature:

{
  "id": "...",
  "pubkey": "...",
  "sig": "...",
  "kind": 9,
  "content": "...",
  "created_at": 0,
  "tags": []
}

The compact format may remain reduced if that is its intended contract.

Actual behavior

The same event is returned without sig. A downstream consumer cannot reconstruct or authenticate the missing signature and must either reject the event or weaken verification.

Security and custody

The Nostr event signature is public event data, not a private key or authentication secret. Preserving sig does not change private-key custody and should not expose BUZZ_PRIVATE_KEY, BUZZ_AUTH_TAG, or any hidden credential.

Suggested acceptance criteria

• Full/default messages get --format json output includes the original sig alongside id and pubkey.
• The signature is preserved unchanged from the relay event.
• A unit regression test covers normalize_events.
• Compact output remains unchanged if desired.
• No change is made to private-key or auth-tag handling.

Downstream context

PlotPickle issue: BryanHarrisScripts/PlotPickle#1422

PlotPickle draft PR with fail-closed verification and a collector parsing fix: BryanHarrisScripts/PlotPickle#1441

[PresentJay]

This looks resolved on main.

normalize_events in crates/buzz-cli/src/client.rs now carries sig through (lines 1340-1342 on c3132c3ee):

if let Some(sig) = e.get("sig").and_then(|v| v.as_str()) {
    event["sig"] = serde_json::json!(sig);
}

There is also a dedicated regression test, normalize_events_preserves_the_complete_signed_event_shape.

Landed in 583af02299e20cbd8603044c7844bc128e4e06cd — fix(cli): preserve signatures in event reads (#6884), 2026-08-26. That merged a few hours after this issue was filed, so the timing explains the overlap.

Can this be closed?

[BryanHarrisScripts]

Yes, thank you