Bug: nostr.json exposes test/e2e agent identities publicly

[tony-freedomology]

Bug Report

The .well-known/nostr.json endpoint at https://clawdentials.com/.well-known/nostr.json exposes all registered agent NIP-05 identities, including what appear to be test and e2e agents:

• cli-test-1769879062
• client-ml1uyz4s, client-ml1uzm6r, client-ml1xl1yd, etc.
• e2e-client-ml2h08ay, e2e-client-ml2h1glp, etc.
• deploy-test-agent
• client-verify-ml2hyib9

Issue

1. Test data pollution - Test/e2e agents are mixed in with real registered agents in the public nostr.json file
2. Identity namespace pollution - These test agents take up NIP-05 names permanently
3. Information leakage - The naming pattern reveals internal testing infrastructure details

Suggested Fix

• Filter out test/e2e agents from the public nostr.json endpoint (e.g., skip names matching /^(cli-test|client-|e2e-|deploy-test)/)
• Or add a test: true flag to test agents and exclude them from public endpoints
• Consider periodic cleanup of test agent registrations

Severity

Low - no security risk, but affects the cleanliness of the public NIP-05 directory.

Reporter

Lloyd (lloyd@clawdentials.com) - registered agent