2020117-agent 0.6.7 → 0.6.9

package/dist/agent.js

@@ -79,7 +79,7 @@ for (const arg of process.argv.slice(2)) {
             break;
     }
 }
-import { randomBytes } from 'crypto';
+import { randomBytes, createHash } from 'crypto';
 import { createConnection } from 'net';
 import { SwarmNode, topicFromKind } from './swarm.js';
 import { createProcessor } from './processor.js';
@@ -827,21 +827,91 @@ function markSeen(eventId) {
     }
     return true;
 }
+/**
+ * Decode payment_hash from a bolt11 invoice (bech32, tagged field type 1).
+ * Returns hex string or undefined if decoding fails.
+ */
+function decodeBolt11PaymentHash(bolt11) {
+    try {
+        // Strip prefix (lnbc/lntb/lnbcrt + amount)
+        const lower = bolt11.toLowerCase();
+        const sepIdx = lower.lastIndexOf('1');
+        if (sepIdx < 0)
+            return undefined;
+        const data5 = lower.slice(sepIdx + 1, -6); // strip checksum
+        // Bech32 charset
+        const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+        const decoded5 = [];
+        for (const c of data5) {
+            const v = CHARSET.indexOf(c);
+            if (v < 0)
+                return undefined;
+            decoded5.push(v);
+        }
+        // Convert 5-bit groups to 8-bit bytes
+        let acc = 0, bits = 0;
+        const bytes = [];
+        for (const v of decoded5) {
+            acc = (acc << 5) | v;
+            bits += 5;
+            while (bits >= 8) {
+                bits -= 8;
+                bytes.push((acc >> bits) & 0xff);
+            }
+        }
+        // Skip timestamp (35 bits = 7 x 5-bit groups at start, already in bytes[0..4])
+        // Parse tagged fields: type(5b) len(10b) data
+        let i = 7; // bytes 0-4 = timestamp, skip
+        while (i < bytes.length - 32) {
+            const type = bytes[i];
+            const len = (bytes[i + 1] << 5) | bytes[i + 2];
+            i += 3;
+            if (type === 1 && len === 52) {
+                // payment_hash: 52 x 5-bit = 260 bits → 32 bytes
+                const hash5 = decoded5.slice(/* recalculate offset */ 0);
+                // Simpler: just look for the 32-byte hash in the byte stream at this position
+                const hashBytes = bytes.slice(i, i + 32);
+                if (hashBytes.length === 32)
+                    return Buffer.from(hashBytes).toString('hex');
+            }
+            i += len;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Verify Lightning payment preimage: SHA256(preimage_hex) should equal payment_hash_hex */
+function verifyPreimage(preimageHex, paymentHashHex) {
+    try {
+        const preimageBytes = Buffer.from(preimageHex, 'hex');
+        const computed = createHash('sha256').update(preimageBytes).digest('hex');
+        return computed === paymentHashHex.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}
 /** Send a billing tick to the customer — generate Lightning invoice.
  *  Prefers NWC make_invoice (if nwc_uri configured), falls back to LNURL-pay. */
 async function sendBillingTick(node, session, amount, label) {
     const tickId = randomBytes(4).toString('hex');
     try {
         let bolt11;
+        let paymentHash;
         if (state.nwcParsed) {
             // NWC make_invoice: wallet generates invoice directly — no lightning address needed
             const result = await nwcMakeInvoice(state.nwcParsed, amount * 1000, `2020117 session ${session.sessionId}`);
             bolt11 = result.bolt11;
+            paymentHash = result.payment_hash;
         }
         else {
             // Fallback: LNURL-pay via lightning address
             bolt11 = await generateInvoice(LIGHTNING_ADDRESS, amount);
+            paymentHash = decodeBolt11PaymentHash(bolt11);
         }
+        session.pendingPaymentHash = paymentHash;
         node.send(session.socket, {
             type: 'session_tick',
             id: tickId,
@@ -919,6 +989,7 @@ async function startSwarmListener(label) {
                 sats_per_minute: satsPerMinute,
                 payment_method: paymentMethod,
                 pubkey: state.sovereignKeys?.pubkey,
+                proxy_mode: proxyMode,
             });
             if (proxyMode) {
                 if (billingAmount <= 0 || (!LIGHTNING_ADDRESS && !state.nwcParsed)) {
@@ -945,10 +1016,27 @@ async function startSwarmListener(label) {
             if (!session)
                 return;
             if (msg.preimage) {
+                // Verify preimage: SHA256(preimage) must equal the invoice's payment_hash
+                if (session.pendingPaymentHash) {
+                    if (!verifyPreimage(msg.preimage, session.pendingPaymentHash)) {
+                        console.log(`[${label}] Session ${session.sessionId}: invalid preimage — ending session`);
+                        node.send(session.socket, { type: 'error', id: msg.id, message: 'Invalid payment preimage' });
+                        endSession(node, session, label);
+                        return;
+                    }
+                    session.pendingPaymentHash = undefined;
+                }
                 const amount = msg.amount || 0;
                 session.totalEarned += amount;
                 session.lastPaidAt = Date.now();
-                console.log(`[${label}] Session ${session.sessionId}: invoice payment received (+${amount}, total: ${session.totalEarned} sats)`);
+                console.log(`[${label}] Session ${session.sessionId}: payment verified (+${amount}, total: ${session.totalEarned} sats)`);
+            }
+            else {
+                // No preimage provided — reject
+                console.log(`[${label}] Session ${session.sessionId}: session_tick_ack missing preimage — ending session`);
+                node.send(session.socket, { type: 'error', id: msg.id, message: 'Payment preimage required' });
+                endSession(node, session, label);
+                return;
             }
             // Proxy mode: switch to raw TCP pipe after first payment confirmed
             if (session.proxyMode && !session.proxyStarted) {

package/dist/session.js

@@ -50,6 +50,7 @@ import { randomBytes } from 'crypto';
 import { createServer } from 'http';
 import { createInterface } from 'readline';
 import { mkdirSync, writeFileSync } from 'fs';
+import * as net from 'net';
 import { WebSocketServer, WebSocket as WsWebSocket } from 'ws';
 // --- Config ---
 const KIND = Number(process.env.DVM_KIND) || 5200;
@@ -87,6 +88,8 @@ const state = {
     startedAt: 0,
     httpServer: null,
     shuttingDown: false,
+    isProxyMode: false,
+    proxyReady: null,
     pendingRequests: new Map(),
     chunkBuffers: new Map(),
     activeWebSockets: new Map(),
@@ -195,7 +198,12 @@ function setupMessageHandler() {
                     try {
                         const { preimage } = await nwcPayInvoice(nwcParsed, msg.bolt11);
                         state.totalSpent += amount;
-                        log(`Paid ${amount} sats via NWC (total: ${state.totalSpent}, ~${estimatedMinutesLeft()} min left)`);
+                        if (state.isProxyMode) {
+                            log(`Paid ${amount} sats — activating TCP proxy...`);
+                        }
+                        else {
+                            log(`Paid ${amount} sats via NWC (total: ${state.totalSpent}, ~${estimatedMinutesLeft()} min left)`);
+                        }
                         state.node.send(state.socket, {
                             type: 'session_tick_ack',
                             id: msg.id,
@@ -203,6 +211,11 @@ function setupMessageHandler() {
                             preimage,
                             amount,
                         });
+                        // Proxy mode: payment done, signal TCP pipe is ready
+                        if (state.isProxyMode && state.proxyReady) {
+                            state.proxyReady();
+                            state.proxyReady = null;
+                        }
                     }
                     catch (e) {
                         warn(`NWC invoice payment failed: ${e.message} — ending session`);
@@ -351,6 +364,57 @@ function startHttpProxy() {
         });
     });
 }
+// --- 4a. TCP proxy (proxy mode) ---
+// After payment, the Hyperswarm socket becomes a raw TCP pipe to provider's backend.
+// We start a local TCP server and forward bytes between local clients and the provider socket.
+function startTcpProxy() {
+    return new Promise((resolve, reject) => {
+        const rawSocket = state.socket;
+        // Remove SwarmNode's JSON framing — from here on it's raw bytes
+        rawSocket.removeAllListeners('data');
+        let currentClient = null;
+        // Forward provider data to whatever client is currently connected
+        rawSocket.on('data', (chunk) => {
+            if (currentClient && !currentClient.destroyed) {
+                currentClient.write(chunk);
+            }
+        });
+        rawSocket.on('end', () => {
+            if (currentClient && !currentClient.destroyed)
+                currentClient.end();
+        });
+        rawSocket.on('error', (err) => {
+            warn(`Provider socket error: ${err.message}`);
+            if (currentClient && !currentClient.destroyed)
+                currentClient.destroy();
+            cleanup();
+        });
+        const server = net.createServer((clientSocket) => {
+            if (currentClient && !currentClient.destroyed) {
+                // Only one connection at a time — reject new ones
+                clientSocket.destroy();
+                return;
+            }
+            currentClient = clientSocket;
+            clientSocket.on('data', (chunk) => {
+                if (!rawSocket.destroyed)
+                    rawSocket.write(chunk);
+            });
+            clientSocket.on('close', () => { currentClient = null; });
+            clientSocket.on('error', () => { currentClient = null; });
+        });
+        server.on('error', (err) => {
+            if (!state.httpServer)
+                reject(err);
+            else
+                warn(`TCP proxy error: ${err.message}`);
+        });
+        server.listen(PORT, () => {
+            state.httpServer = server;
+            resolve();
+        });
+    });
+}
 // --- 4b. WebSocket tunnel (via ws library) ---
 function setupWebSocketProxy(server) {
     const wss = new WebSocketServer({ noServer: true });
@@ -772,21 +836,43 @@ async function main() {
     state.sessionId = ackResp.session_id;
     state.startedAt = Date.now();
     providerPubkey = ackResp.pubkey || null;
+    state.isProxyMode = !!ackResp.proxy_mode;
     // If the provider dictated a different rate, use it
     if (ackResp.sats_per_minute && ackResp.sats_per_minute !== satsPerMinute) {
         state.satsPerMinute = ackResp.sats_per_minute;
         log(`Provider adjusted rate: ${ackResp.sats_per_minute} sats/min`);
     }
     log(`Session started: ${state.sessionId}`);
-    log(`Billing: ${state.satsPerMinute} sats/min via ${paymentMethod}`);
-    // 6. Start HTTP proxy
-    try {
-        await startHttpProxy();
-        log(`Web proxy ready at http://localhost:${PORT}`);
+    if (state.isProxyMode) {
+        log(`Mode: TCP proxy (one-time fee, raw HTTP passthrough)`);
     }
-    catch (e) {
-        warn(`Failed to start HTTP proxy on port ${PORT}: ${e.message}`);
-        warn('Continuing without HTTP proxy');
+    else {
+        log(`Billing: ${state.satsPerMinute} sats/min via ${paymentMethod}`);
+    }
+    // 6. Start proxy
+    if (state.isProxyMode) {
+        // Proxy mode: wait for payment, then switch socket to raw TCP pipe
+        const proxyReadyPromise = new Promise(resolve => { state.proxyReady = resolve; });
+        log('Waiting for invoice from provider...');
+        try {
+            await proxyReadyPromise;
+            await startTcpProxy();
+            log(`TCP proxy ready at http://localhost:${PORT}`);
+        }
+        catch (e) {
+            warn(`Failed to start TCP proxy on port ${PORT}: ${e.message}`);
+            warn('Continuing without proxy');
+        }
+    }
+    else {
+        try {
+            await startHttpProxy();
+            log(`Web proxy ready at http://localhost:${PORT}`);
+        }
+        catch (e) {
+            warn(`Failed to start HTTP proxy on port ${PORT}: ${e.message}`);
+            warn('Continuing without HTTP proxy');
+        }
     }
     // 7. Show ready message and start REPL
     log("Type 'help' for commands");

package/dist/swarm.d.ts

@@ -47,6 +47,7 @@ export interface SwarmMessage {
     duration_s?: number;
     payment_method?: 'invoice';
     pubkey?: string;
+    proxy_mode?: boolean;
     bolt11?: string;
     preimage?: string;
     method?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "2020117-agent",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "2020117 agent runtime — Nostr-native relay subscription + Hyperswarm P2P + Lightning payments",
   "type": "module",
   "bin": {