@wlfi-agent/cli 1.4.17 → 1.4.18

package/packages/cache/src/service/index.test.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { describe, expect, it } from 'vitest';
-import { CacheError, cacheErrorCodes } from '../errors/index.js';
+import { cacheErrorCodes } from '../errors/index.js';
+import type { CacheError } from '../errors/index.js';
 import { RelayCacheService } from './index.js';
 
 class InMemoryCacheClient {
@@ -383,6 +384,87 @@ describe('RelayCacheService approval capability guards', () => {
     expect(synced?.metadata?.approvalCapabilityToken).not.toBe(originalToken);
   });
 
+  it('removes approvals omitted from a later daemon sync snapshot', async () => {
+    const client = new MutableInMemoryCacheClient();
+    const service = new RelayCacheService({
+      client: client as never,
+      namespace: 'test:relay',
+    });
+
+    const daemonId = '44'.repeat(32);
+    const retainedApprovalId = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd';
+    const removedApprovalId = 'eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee';
+    const activeApprovalKey = `test:relay:approval:${removedApprovalId}:active-update`;
+    const failureKey = `test:relay:approval:${removedApprovalId}:capability-failures`;
+
+    await service.syncDaemonRegistration({
+      daemon: {
+        daemonId,
+        daemonPublicKey: '12'.repeat(32),
+        ethereumAddress: '0x1212121212121212121212121212121212121212',
+        lastSeenAt: new Date().toISOString(),
+        registeredAt: new Date().toISOString(),
+        status: 'active',
+        updatedAt: new Date().toISOString(),
+      },
+      approvalRequests: [
+        {
+          approvalRequestId: retainedApprovalId,
+          daemonId,
+          destination: '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+          requestedAt: new Date().toISOString(),
+          status: 'pending',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+        {
+          approvalRequestId: removedApprovalId,
+          daemonId,
+          destination: '0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+          requestedAt: new Date().toISOString(),
+          status: 'pending',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+      ],
+    });
+
+    await client.forceSet(activeApprovalKey, 'stale-update-id');
+    await service.recordApprovalCapabilityFailure(removedApprovalId);
+
+    await service.syncDaemonRegistration({
+      daemon: {
+        daemonId,
+        daemonPublicKey: '12'.repeat(32),
+        ethereumAddress: '0x1212121212121212121212121212121212121212',
+        lastSeenAt: new Date().toISOString(),
+        registeredAt: new Date().toISOString(),
+        status: 'active',
+        updatedAt: new Date().toISOString(),
+      },
+      approvalRequests: [
+        {
+          approvalRequestId: retainedApprovalId,
+          daemonId,
+          destination: '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+          requestedAt: new Date().toISOString(),
+          status: 'pending',
+          transactionType: 'transfer_native',
+          updatedAt: new Date().toISOString(),
+        },
+      ],
+    });
+
+    await expect(service.getApprovalRequest(removedApprovalId)).resolves.toBeNull();
+    await expect(service.listApprovalRequests({ daemonId })).resolves.toMatchObject([
+      {
+        approvalRequestId: retainedApprovalId,
+      },
+    ]);
+    await expect(client.forceGet(activeApprovalKey)).resolves.toBeNull();
+    await expect(client.forceGet(failureKey)).resolves.toBeNull();
+  });
+
   it('rejects secure approval capability rotation for non-pending approvals', async () => {
     const service = new RelayCacheService({
       client: new InMemoryCacheClient() as never,
@@ -508,11 +590,16 @@ describe('RelayCacheService approval capability guards', () => {
       }),
     ).rejects.toThrow(/already has a queued operator update/);
 
-    const [claimed] = await service.claimEncryptedUpdates({
-      daemonId,
-      leaseSeconds: 30,
-      limit: 1,
-    });
+    const claimed = (
+      await service.claimEncryptedUpdates({
+        daemonId,
+        leaseSeconds: 30,
+        limit: 1,
+      })
+    )[0];
+    if (!claimed) {
+      throw new Error('expected a claimed update');
+    }
 
     await expect(
       service.submitUpdateFeedback({
@@ -597,10 +684,10 @@ describe('RelayCacheService approval capability guards', () => {
         targetApprovalRequestId: approvalRequestId,
         type: 'manual_approval_decision',
       }),
-    ).rejects.toMatchObject<Partial<CacheError>>({
+    ).rejects.toMatchObject({
       code: cacheErrorCodes.invalidPayload,
       message: `Approval '${approvalRequestId}' is 'approved' and cannot accept new updates`,
-    });
+    } satisfies Partial<CacheError>);
   });
 
   it('rejects manual approval updates that target another daemon approval', async () => {
@@ -652,10 +739,10 @@ describe('RelayCacheService approval capability guards', () => {
         targetApprovalRequestId: approvalRequestId,
         type: 'manual_approval_decision',
       }),
-    ).rejects.toMatchObject<Partial<CacheError>>({
+    ).rejects.toMatchObject({
       code: cacheErrorCodes.invalidPayload,
       message: `Approval '${approvalRequestId}' belongs to daemon '${approvalDaemonId}', not '${updateDaemonId}'`,
-    });
+    } satisfies Partial<CacheError>);
   });
 
   it('keeps the original active slot intact after rejecting a duplicate manual approval update', async () => {
@@ -774,12 +861,10 @@ describe('RelayCacheService approval capability guards', () => {
       type: 'daemon_status',
     });
 
-    await expect(service.removeEncryptedUpdate('20'.repeat(32), update.updateId)).rejects.toMatchObject<
-      Partial<CacheError>
-    >({
+    await expect(service.removeEncryptedUpdate('20'.repeat(32), update.updateId)).rejects.toMatchObject({
       code: cacheErrorCodes.notFound,
       message: `Unknown update '${update.updateId}' for daemon '${'20'.repeat(32)}'`,
-    });
+    } satisfies Partial<CacheError>);
     await expect(service.getEncryptedUpdate(update.updateId)).resolves.toMatchObject({
       daemonId: '10'.repeat(32),
       updateId: update.updateId,
@@ -813,11 +898,17 @@ describe('RelayCacheService approval capability guards', () => {
       type: 'manual_approval_decision',
     });
 
-    const [claimed] = await service.claimEncryptedUpdates({
-      daemonId,
-      leaseSeconds: 30,
-      limit: 1,
-    });
+    const claimed = (
+      await service.claimEncryptedUpdates({
+        daemonId,
+        leaseSeconds: 30,
+        limit: 1,
+      })
+    )[0];
+    if (!claimed) {
+      throw new Error('expected a claimed update');
+    }
+
     const activeApprovalKey = `test:relay:approval:${approvalRequestId}:active-update`;
     await client.forceSet(activeApprovalKey, 'other-update-id');
 
@@ -835,4 +926,59 @@ describe('RelayCacheService approval capability guards', () => {
 
     await expect(client.forceGet(activeApprovalKey)).resolves.toBe('other-update-id');
   });
+
+  it('rejects feedback for an expired claim lease even when the claim token still matches', async () => {
+    const client = new MutableInMemoryCacheClient();
+    const service = new RelayCacheService({
+      client: client as never,
+      namespace: 'test:relay',
+    });
+
+    const daemonId = '66'.repeat(32);
+    const update = await service.createEncryptedUpdate({
+      daemonId,
+      metadata: {
+        source: 'test-seed',
+      },
+      payload: {
+        algorithm: 'x25519-xchacha20poly1305-v1',
+        ciphertextBase64: 'aa',
+        encapsulatedKeyBase64: 'bb',
+        nonceBase64: 'cc',
+        schemaVersion: 1,
+      },
+      type: 'daemon_status',
+    });
+
+    const claimed = (
+      await service.claimEncryptedUpdates({
+        daemonId,
+        leaseSeconds: 30,
+        limit: 1,
+      })
+    )[0];
+    if (!claimed) {
+      throw new Error('expected a claimed update');
+    }
+
+    await client.forceSet(
+      `test:relay:update:${update.updateId}`,
+      JSON.stringify({
+        ...claimed,
+        claimUntil: new Date(Date.now() - 1_000).toISOString(),
+      }),
+    );
+
+    await expect(
+      service.submitUpdateFeedback({
+        claimToken: claimed.claimToken ?? '',
+        daemonId,
+        status: 'applied',
+        updateId: update.updateId,
+      }),
+    ).rejects.toMatchObject({
+      code: cacheErrorCodes.invalidPayload,
+      message: `Claim for update '${update.updateId}' has expired`,
+    });
+  });
 });

package/packages/cache/src/service/index.ts

@@ -295,6 +295,10 @@ export class RelayCacheService {
       }
 
       if (input.approvalRequests) {
+        const approvalIndexKey = this.daemonApprovalsKey(profile.daemonId);
+        const existingApprovalIds = new Set(await this.client.zrange(approvalIndexKey, 0, -1));
+        const nextApprovalIds = new Set<string>();
+
         for (const approvalRequest of input.approvalRequests) {
           const existing = await this.readJson<RelayApprovalRequestRecord>(
             this.approvalKey(approvalRequest.approvalRequestId),
@@ -303,13 +307,26 @@ export class RelayCacheService {
             { ...approvalRequest, daemonId: profile.daemonId },
             existing,
           );
+          nextApprovalIds.add(normalized.approvalRequestId);
           await this.writeJson(this.approvalKey(normalized.approvalRequestId), normalized);
           await this.client.zadd(
-            this.daemonApprovalsKey(profile.daemonId),
+            approvalIndexKey,
             Date.parse(normalized.requestedAt),
             normalized.approvalRequestId,
           );
         }
+
+        const staleApprovalIds = [...existingApprovalIds].filter(
+          (approvalRequestId) => !nextApprovalIds.has(approvalRequestId),
+        );
+        if (staleApprovalIds.length > 0) {
+          await this.client.zrem(approvalIndexKey, ...staleApprovalIds);
+          for (const approvalRequestId of staleApprovalIds) {
+            await this.client.del(this.approvalKey(approvalRequestId));
+            await this.client.del(this.activeApprovalUpdateKey(approvalRequestId));
+            await this.client.del(this.approvalCapabilityFailuresKey(approvalRequestId));
+          }
+        }
       }
 
       return {
@@ -734,6 +751,7 @@ export class RelayCacheService {
   ): Promise<RelayEncryptedUpdateRecord> {
     const key = this.updateKey(input.updateId);
     const record = await this.readJson<RelayEncryptedUpdateRecord>(key);
+    const nowMs = Date.now();
 
     if (!record || record.daemonId !== input.daemonId) {
       throw new CacheError({
@@ -744,6 +762,25 @@ export class RelayCacheService {
       });
     }
 
+    if (record.status !== 'inflight') {
+      throw new CacheError({
+        code: cacheErrorCodes.invalidPayload,
+        key,
+        message: `Update '${input.updateId}' is '${record.status}' and is not currently claimed`,
+        operation: 'submitUpdateFeedback',
+      });
+    }
+
+    const claimUntilMs = record.claimUntil ? Date.parse(record.claimUntil) : Number.NaN;
+    if (!Number.isFinite(claimUntilMs) || claimUntilMs <= nowMs) {
+      throw new CacheError({
+        code: cacheErrorCodes.invalidPayload,
+        key,
+        message: `Claim for update '${input.updateId}' has expired`,
+        operation: 'submitUpdateFeedback',
+      });
+    }
+
     if (!record.claimToken || record.claimToken !== input.claimToken) {
       throw new CacheError({
         code: cacheErrorCodes.invalidPayload,

package/packages/config/.turbo/turbo-build.log

@@ -10,9 +10,9 @@
 CLI Target: node20
 CLI Cleaning output folder
 ESM Build start
-ESM dist/index.cjs     36.27 KB
-ESM dist/index.cjs.map 66.36 KB
-ESM ⚡️ Build success in 22ms
+ESM dist/index.cjs     35.92 KB
+ESM dist/index.cjs.map 65.75 KB
+ESM ⚡️ Build success in 8ms
 DTS Build start
-DTS ⚡️ Build success in 400ms
+DTS ⚡️ Build success in 377ms
 DTS dist/index.d.ts 5.23 KB

package/packages/config/dist/index.cjs

@@ -52,23 +52,6 @@ var BUILTIN_TOKENS = {
       arbitrum: { chainId: 42161, isNative: true, decimals: 18 }
     }
   },
-  usdc: {
-    symbol: "USDC",
-    chains: {
-      ethereum: {
-        chainId: 1,
-        isNative: false,
-        address: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
-        decimals: 6
-      },
-      base: {
-        chainId: 8453,
-        isNative: false,
-        address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
-        decimals: 6
-      }
-    }
-  },
   usd1: {
     name: "USD1",
     symbol: "USD1",