Built-in dev wallet for testing without MetaMask

Adds -dev flag that enables:
- /api/dev/sign endpoint: signs messages with a built-in test key
  (anvil account 0: 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266)
- dev-wallet.js: browser shim that provides window.ethereum compatible
  interface, activated by ?dev-wallet URL parameter
- Dev wallet banner shows at bottom of page when active

Usage:
  ./bitwrap -port 8088 -dev          # start with dev mode
  open http://localhost:8088/poll?dev-wallet  # use dev wallet in browser

Also fixes ecRecover v-parity bug: v=0/1 encodes R.y parity,
not the rare rx+N case. Both devSign and cast wallet sign now
produce signatures that RecoverAddress correctly verifies.

The dev wallet calls /api/dev/sign server-side to avoid implementing
ECDSA in JavaScript. Endpoint is gated behind -dev flag and returns
403 in production.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stackdump

cmd/bitwrap/main.go

@@ -26,6 +26,7 @@ func main() {
 	noProver := flag.Bool("no-prover", false, "Disable ZK prover (faster startup)")
 	noSolgen := flag.Bool("no-solgen", false, "Disable Solidity generation endpoints")
 	keyDir := flag.String("key-dir", "", "Directory for persistent circuit keys (enables fast restarts)")
+	devMode := flag.Bool("dev", false, "Enable dev mode (built-in test wallet, /api/dev/* endpoints)")
 	compile := flag.String("compile", "", "Compile a .btw file and output JSON schema to stdout")
 	validate := flag.String("validate", "", "Validate a .btw file: compile → generate Solidity → forge build → forge test → deploy")
 	output := flag.String("output", "", "Save generated Foundry project to this directory (use with -validate)")
@@ -67,6 +68,7 @@ func main() {
 		EnableProver:   !*noProver,
 		EnableSolidity: !*noSolgen,
 		KeyDir:         *keyDir,
+		DevMode:        *devMode,
 	})
 
 	addr := fmt.Sprintf(":%d", *port)
@@ -78,6 +80,9 @@ func main() {
 	if *noSolgen {
 		log.Printf("Solidity generation: disabled")
 	}
+	if *devMode {
+		log.Printf("Dev mode: enabled (add ?dev-wallet to poll URL for built-in wallet)")
+	}
 	if err := http.ListenAndServe(addr, srv); err != nil {
 		log.Fatalf("Server failed: %v", err)
 	}

internal/server/auth.go

@@ -2,14 +2,106 @@ package server
 
 import (
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"math/big"
+	"net/http"
 	"strings"
 
 	"golang.org/x/crypto/sha3"
 )
 
+// devPrivateKey is a well-known test key (anvil account 0). Only used in dev mode.
+var devPrivateKey = fromHex("ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80")
+
+// handleDevSign signs a message with the built-in dev key.
+// Only available when server is started with -dev flag.
+func (s *Server) handleDevSign(w http.ResponseWriter, r *http.Request) {
+	if !s.opts.DevMode {
+		http.Error(w, "dev mode not enabled (start with -dev flag)", http.StatusForbidden)
+		return
+	}
+
+	var req struct {
+		Message string `json:"message"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.Message == "" {
+		http.Error(w, "message field required", http.StatusBadRequest)
+		return
+	}
+
+	sig, addr := devSign(req.Message)
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{
+		"signature": sig,
+		"address":   addr,
+	})
+}
+
+// devSign signs a message with the dev private key using EIP-191 personal_sign.
+func devSign(message string) (string, string) {
+	// EIP-191 prefix
+	prefix := fmt.Sprintf("\x19Ethereum Signed Message:\n%d", len(message))
+	hash := keccak256(append([]byte(prefix), []byte(message)...))
+	z := new(big.Int).SetBytes(hash)
+
+	// Deterministic k (RFC 6979 simplified)
+	kMat := make([]byte, 64)
+	copy(kMat[:32], devPrivateKey.Bytes())
+	copy(kMat[32:], hash)
+	k := new(big.Int).SetBytes(keccak256(kMat))
+	k.Mod(k, new(big.Int).Sub(secp256k1N, big.NewInt(1)))
+	k.Add(k, big.NewInt(1))
+
+	rx, ry := ecMul(secp256k1Gx, secp256k1Gy, k)
+	r := new(big.Int).Mod(rx, secp256k1N)
+	s := new(big.Int).Mul(r, devPrivateKey)
+	s.Add(s, z)
+	s.Mod(s, secp256k1N)
+	s.Mul(s, new(big.Int).ModInverse(k, secp256k1N))
+	s.Mod(s, secp256k1N)
+
+	// Recovery id
+	v := byte(27)
+	if ry.Bit(0) == 1 {
+		v = 28
+	}
+
+	// Low-s normalization (EIP-2)
+	halfN := new(big.Int).Rsh(secp256k1N, 1)
+	if s.Cmp(halfN) > 0 {
+		s.Sub(secp256k1N, s)
+		if v == 27 {
+			v = 28
+		} else {
+			v = 27
+		}
+	}
+
+	sigBytes := make([]byte, 65)
+	rBytes := r.Bytes()
+	sBytes := s.Bytes()
+	copy(sigBytes[32-len(rBytes):32], rBytes)
+	copy(sigBytes[64-len(sBytes):64], sBytes)
+	sigBytes[64] = v
+
+	sigHex := "0x" + hex.EncodeToString(sigBytes)
+
+	// Derive address
+	pubX, pubY := ecMul(secp256k1Gx, secp256k1Gy, devPrivateKey)
+	pubBytes := make([]byte, 64)
+	pxBytes := pubX.Bytes()
+	pyBytes := pubY.Bytes()
+	copy(pubBytes[32-len(pxBytes):32], pxBytes)
+	copy(pubBytes[64-len(pyBytes):64], pyBytes)
+	addrHash := keccak256(pubBytes)
+	addr := "0x" + hex.EncodeToString(addrHash[12:])
+
+	return sigHex, addr
+}
+
 // secp256k1 curve parameters
 var (
 	secp256k1P  = fromHex("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F")
@@ -76,14 +168,11 @@ func RecoverAddress(message string, signature string) (string, error) {
 // ecRecover recovers the public key from an ECDSA signature on secp256k1.
 // Returns (pubX, pubY) or error.
 func ecRecover(hash []byte, r, s *big.Int, v byte) (*big.Int, *big.Int, error) {
-	// Calculate R point x-coordinate
+	// R point x-coordinate is just r (the rx += N case is for v >= 2, extremely rare)
 	rx := new(big.Int).Set(r)
-	if v == 1 {
-		rx.Add(rx, secp256k1N)
-	}
 
-	// Decompress R point: find y from x on secp256k1
-	ry := decompressPoint(rx, v%2 == 1)
+	// v encodes the parity of R.y: v=0 → even, v=1 → odd
+	ry := decompressPoint(rx, v == 1)
 	if ry == nil {
 		return nil, nil, errors.New("invalid signature: R not on curve")
 	}

internal/server/devsign_test.go

@@ -0,0 +1,50 @@
+package server
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestDevSignRecovery(t *testing.T) {
+	msg := "bitwrap-create-poll:hello"
+
+	// Test devSign → RecoverAddress round trip
+	sig, addr := devSign(msg)
+	recovered, err := RecoverAddress(msg, sig)
+	if err != nil {
+		t.Fatalf("RecoverAddress(devSign): %v", err)
+	}
+	t.Logf("devSign addr:   %s", addr)
+	t.Logf("recovered addr: %s", recovered)
+
+	if recovered != addr {
+		t.Errorf("devSign/RecoverAddress mismatch")
+	}
+
+	// Also test with cast-generated signature if cast is available
+	castBin, err := exec.LookPath("cast")
+	if err != nil {
+		t.Log("cast not installed, skipping cast parity test")
+		return
+	}
+
+	privKey := "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
+	cmd := exec.Command(castBin, "wallet", "sign", "--private-key", privKey, msg)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("cast wallet sign: %v\n%s", err, out)
+	}
+	castSig := strings.TrimSpace(string(out))
+
+	castRecovered, err := RecoverAddress(msg, castSig)
+	if err != nil {
+		t.Fatalf("RecoverAddress(cast sig): %v", err)
+	}
+	t.Logf("cast recovered: %s", castRecovered)
+	t.Logf("expected:       0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266")
+
+	if !strings.EqualFold(castRecovered, "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266") {
+		t.Errorf("RecoverAddress failed for cast signature too — RecoverAddress is broken")
+	}
+}

internal/server/server.go

@@ -26,6 +26,7 @@ type Options struct {
 	EnableProver   bool
 	EnableSolidity bool
 	KeyDir         string // directory for persistent circuit keys (empty = no persistence)
+	DevMode        bool   // enable dev endpoints (e.g., /api/dev/sign for wallet-free testing)
 }
 
 // Server is the bitwrap HTTP server.
@@ -112,6 +113,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.handleVK(w, r)
 	case r.URL.Path == "/api/compile" && r.Method == http.MethodPost:
 		s.handleCompile(w, r)
+	case r.URL.Path == "/api/dev/sign" && r.Method == http.MethodPost:
+		s.handleDevSign(w, r)
 
 	// Poll routes
 	case r.URL.Path == "/api/polls" && r.Method == http.MethodPost: