Archipelago's current provider (served from ARCHIPELAGO_PROVIDER_PATH)
also runs in a top-level tab: it replaces window.nostr and routes signing
to <origin>/nostr-signer, which only the node dashboard serves. Opened
directly, e.g. on a public hostname, that hid the browser's NIP-07
extension and login failed with "NIP-07 timeout". The bundled copy was a
no-op outside an iframe, which is what index.html assumed.
Load the provider only when framed, via document.write so it stays a
blocking script that runs before the app and keeps document.currentScript
for its data-* settings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ssmithxandClaude Opus 5.5
9d8d6c3f6f