gabriel / muse public
feat patch task/high3-bip39-passphrase #1 / 1
AI Agent gabriel · 162 days ago · Apr 17, 2026 · Diff

feat: BIP-39 passphrase support for auth keygen and recover (HIGH-3)

Add --passphrase flag to 'muse auth keygen' and 'muse auth recover'. Also reads MUSE_BIP39_PASSPHRASE env var (flag takes priority).

The passphrase ('25th word') is mixed into the PBKDF2 seed derivation so the same mnemonic + different passphrase produces completely different Ed25519 keys. It is never stored — operators must supply it at every derivation.

_resolve_passphrase() helper centralises flag > env var > '' priority. Both the human-key and agent-key paths in run_keygen pass the passphrase through to mnemonic_to_seed(). run_recover does the same.

Tests (test_bip39_passphrase.py — 10 tests): I1-I3 keygen --passphrase produces different/deterministic fingerprints II1-2 MUSE_BIP39_PASSPHRASE env var fallback; flag wins over env var III1-3 recover with matching passphrase reproduces keygen fingerprint IV1-2 passphrase never appears in identity.toml or JSON stdout

sha256:421d52c5f90eae755ac6ffa6250f2f0975125c4347065e7daf79e974d8d55b04 sha
sha256:c31c80786c5a51a2332a31b0e67339e2f9e09ef1d65b9b849a9264570f6c2105 parent
+30 ~3 symbols
sha256:efb80f30f157d90b36b136686aa3145e554bc46e3e9f7d51016f77fd8c4eef93 snapshot
+30
symbols added
~3
symbols modified
0
dead code introduced
Semantic Changes 33 symbols
~ tests/test_bip39_passphrase.py .py 29 symbols added
+ TestKeygenPassphrase class class TestKeygenPassphrase L94–132
+ test_I1_passphrase_changes_fingerprint method method test_I1_passphrase_changes_fingerprint L95–109
+ test_I2_same_passphrase_deterministic method method test_I2_same_passphrase_deterministic L111–123
+ test_I3_different_passphrases_different_fingerprints method method test_I3_different_passphrases_different_fingerprints L125–132
+ TestKeygenPassphraseEnvVar class class TestKeygenPassphraseEnvVar L140–173
+ test_II1_env_var_used_when_flag_absent method method test_II1_env_var_used_when_flag_absent L141–159
+ test_II2_flag_takes_priority_over_env_var method method test_II2_flag_takes_priority_over_env_var L161–173
+ TestPassphraseNeverStored class class TestPassphraseNeverStored L236–259
+ test_IV1_passphrase_not_in_identity_toml method method test_IV1_passphrase_not_in_identity_toml L237–249
+ test_IV2_passphrase_not_in_json_stdout method method test_IV2_passphrase_not_in_json_stdout L251–259
+ TestRecoverPassphrase class class TestRecoverPassphrase L181–228
+ test_III1_recover_without_passphrase_differs_from_keygen_with_passphrase method method test_III1_recover_without_passphrase_differs_from_keygen_with_passphrase L182–196
+ test_III2_recover_with_same_passphrase_matches method method test_III2_recover_with_same_passphrase_matches L198–212
+ test_III3_recover_via_env_var_matches method method test_III3_recover_via_env_var_matches L214–228
+ _HUB variable variable _HUB L43–43
+ _MNEMONIC variable variable _MNEMONIC L44–47
+ _fingerprint function function _fingerprint L84–86
+ _keygen function function _keygen L75–76
+ _recover function function _recover L79–81
+ fixed_mnemonic function function fixed_mnemonic L68–72
+ CliRunner import import CliRunner L37–37
+ annotations import import annotations L30–30
+ id_module import import id_module L39–39
+ json import import json L32–32
+ kp_module import import kp_module L38–38
+ pathlib import import pathlib L33–33
+ pytest import import pytest L35–35
+ isolated function function isolated L56–64
+ runner variable variable runner L41–41
~ muse/cli/commands/auth.py .py 1 symbol added, 3 symbols modified
+ _resolve_passphrase function function _resolve_passphrase L153–162
~ register
~ run_keygen
~ run_recover
← Older Oldest on task/high3-bip39-passphrase
All commits
Newer → Latest on task/high3-bip39-passphrase

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:421d52c5f90eae755ac6ffa6250f2f0975125c4347065e7daf79e974d8d55b04 --body "your comment"