Enclave Bridge

About

BrightNexus is a SwiftUI status-bar app for macOS on Apple Silicon that bridges Node.js and the BrightChain stack to Apple's Secure Enclave and hosts the BrightLink agent for the bsh shell. It opens a single Unix domain socket in the user's home directory, with no network surface, and serves the Enclave Bridge Protocol (EBP/1) on it as plain UTF-8 JSON requests and responses. Supported operations include ECDSA-SHA256 signing with a non-extractable Secure Enclave P-256 key, ECIES decryption with a host-resident secp256k1 key using AES-256-GCM and HKDF-SHA256, and optional TOTP-gated key export. The reference client is @digitaldefiance/enclave-bridge-client.

The app was previously published as Enclave Bridge and was renamed to reflect its broader role as both the BrightLink agent and a BrightChain hardware nexus. The EBP/1 wire surface is unchanged, so existing Node clients continue to work. For backward compatibility, the app also binds a secondary socket at ~/.enclave/enclave-bridge.sock and routes traffic from both sockets into the same protocol handler. On first launch it migrates the secp256k1 key and TOTP configuration from ~/.enclave/ into ~/.brightchain/brightnexus/ using atomic renames, preserving existing keys.

The documentation describes two trust domains: Secure Enclave P-256 keys that never leave the hardware, and a host-resident secp256k1 key stored with 0600 permissions. The EBP/1 protocol defines fourteen commands, including HEARTBEAT, VERSION, STATUS, LIST_KEYS, ENCLAVE_SIGN, ENCLAVE_DECRYPT, ENABLE_TOTP, and EXPORT_KEY. Two commands, ENCLAVE_GENERATE_KEY and ENCLAVE_ROTATE_KEY, are reserved and return errors in EBP/1.