blockyard 0.0.9 → 0.1.1

package/server/config.js

@@ -27,9 +27,13 @@ Defaults are Bitcoin Core's own, so \`npm start\` works against a stock local no
 
 const DEFAULTS = {
   server: {
-    // Multi-user means the LAN has to reach it, so it binds broadly by default.
-    // Set BLOCKYARD_BIND=127.0.0.1 to keep it on this machine only.
-    host: '0.0.0.0',
+    // THIS MACHINE ONLY, out of the box (2026-09-15, after the first outside review of 0.0.9:
+    // "Default is 0.0.0.0 with auth disabled, so anyone that can hit port 21000 gets node state
+    // plus the read RPC console ... I would run it only bound to 127.0.0.1, with BLOCKYARD_AUTH=1,
+    // behind SSH/TLS" -- operator: "Update the default setup to be hardened"). It bound 0.0.0.0
+    // because multi-user means the LAN has to reach it; now reaching it from elsewhere is a
+    // decision you make -- BLOCKYARD_BIND=0.0.0.0, or a LAN address, or `blockyard setup`.
+    host: '127.0.0.1',
     // 21000 (operator, 2026-09-13: "make default web port 21000 for access"). It was 8088, which
     // sits in the range every other monitor on a box reaches for; this one is ours.
     port: 21000,
@@ -37,15 +41,19 @@ const DEFAULTS = {
     allowCidrs: [],
     trustProxy: false,
     // TLS is off unless both files are named, and then it is on for every listener.
-    // It stays opt-in because this box is a LAN monitor whose certificate has no
-    // issuer: a self-signed cert produces a browser warning on every address change,
-    // and the alternative already documented (an SSH tunnel to 127.0.0.1, or a
-    // reverse proxy that owns the cert) is better on a machine you control.
-    // What was missing until 2026-09-09 was the option at all -- serving a session
-    // cookie and every RPC reply over plain HTTP on a LAN is not a gap you get to
-    // call "documented, therefore fine".
+    // It was opt-in because a self-signed certificate produces a browser warning per
+    // address and an SSH tunnel or a reverse proxy that owns a real certificate is better
+    // on a machine you control. What was missing until 2026-09-09 was the option at all --
+    // serving a session cookie and every RPC reply over plain HTTP on a LAN is not a gap
+    // you get to call "documented, therefore fine".
+    // HTTPS BY DEFAULT since 2026-09-15 (operator: "make https the forced default"): with
+    // no certificate of your own named, the server makes a self-signed one on first start
+    // (server/tls/selfsigned.js, kept under <data>/tls) naming the addresses it is reached
+    // on, and serves HTTPS with it. BLOCKYARD_TLS=0 (server.tls.enabled: false) is the way
+    // to plain HTTP, for a reverse proxy that terminates TLS in front.
     tls: {
-      cert: null,   // PEM; BLOCKYARD_TLS_CERT
+      enabled: true,
+      cert: null,   // PEM; BLOCKYARD_TLS_CERT -- your own certificate, instead of the made one
       key: null,    // PEM; BLOCKYARD_TLS_KEY
       // Sent over TLS responses only. Two days, not the usual year: a LAN address
       // can be reissued to something else, and HSTS is the header that cannot be
@@ -193,10 +201,11 @@ const DEFAULTS = {
     auditKeep: 5,
   },
   auth: {
-    // OPEN BY DEFAULT, like a block explorer: anyone who can reach the listen
-    // addresses reads the dashboard with no account. This is a posture decision, not
-    // a convenience -- see README "Open by default" and the boot warning, which names
-    // the addresses this leaves readable.
+    // SIGN-IN BY DEFAULT (2026-09-15, the same review): the first start creates an `admin`
+    // account and prints its password once (or takes BLOCKYARD_ADMIN_PASSWORD). It shipped OPEN,
+    // like a block explorer, so that anyone who could reach the port could read; that is still
+    // available -- BLOCKYARD_AUTH=0, or auth.enabled: false -- as a posture you choose, announced
+    // by the boot warning that names the addresses it leaves readable.
     //
     // What "open" is bounded by, in server/http/server.js:
     //   * the anonymous role is `viewer` and the ceiling is not configurable; user
@@ -207,9 +216,9 @@ const DEFAULTS = {
     //     should discover by accident);
     //   * rate limits key on the IP, so one noisy tab cannot spend everyone's bucket.
     //
-    // Set BLOCKYARD_AUTH=1 (or auth.enabled in config/local.json) for accounts, roles,
-    // sessions, CSRF and the audit trail-by-user.
-    enabled: false,
+    // Accounts, roles, sessions, CSRF and the audit trail-by-user are on; BLOCKYARD_AUTH=0
+    // (or auth.enabled: false in config/local.json) opens the monitor to readers.
+    enabled: true,
     dataDir: null,
     // THE LONG ONE IS THE ABSOLUTE LIFETIME, the short one the idle ceiling -- which is the way
     // round the names read, and the opposite of what shipped until 2026-09-13. With an 8 h
@@ -225,6 +234,12 @@ const DEFAULTS = {
     lockoutMs: 600000,
     cookieName: 'blockyard_sid',
     secureCookie: false, // forced true at boot when TLS is on
+    // OPEN MODE'S NODE CONNECTION IS SET FROM THIS MACHINE ONLY (audit 2026-09-16, M1/M2). With
+    // accounts off, the node-connection save and test are answered only for a loopback caller: the
+    // open-mode cross-site check stops a browser, never a script, and a script on the LAN could point
+    // the saved connection -- and with it the datadir cookie, after the next restart -- at itself, or
+    // make this server fetch its internal URLs. `true` restores the old reach, knowingly.
+    openNodeConfigFromNetwork: false,
   },
   actions: {
     // Anything that can change node or machine state is off unless explicitly
@@ -273,7 +288,11 @@ const DEFAULTS = {
   },
   // The Markets tab (server/collect/markets.js): public exchange APIs over HTTPS -- the one
   // outbound connection that is not the node. Polled only while someone has the tab open, and
-  // parked idleAfterMs after the last request. BLOCKYARD_MARKETS=0 turns it off.
+  // parked idleAfterMs after the last request. BLOCKYARD_MARKETS=0 removes it altogether.
+  // POLLING IS OFF OUT OF THE BOX regardless (operator, 2026-09-15: "disable markets by default so
+  // we can claim true zero telemetry out of the box" ... "an app wide 'Enable Market Polling'
+  // checkbox"): the feed is built here but asks nobody anything until the switch in Display
+  // settings -> Markets & Price -> Enable market polling is on (http/api.js marketsPollingOn).
   markets: {
     enabled: true,
     tickerMs: 15000,
@@ -389,12 +408,14 @@ export function loadConfig({ configFile = defaultConfigFile(), ifaces = null, no
     'BLOCKYARD_DATA': ['store.dir', String],
     'BLOCKYARD_AUTH': ['auth.enabled', Boolean],
     'BLOCKYARD_ALLOW_WRITES_WITHOUT_AUTH': ['actions.allowWritesWithoutAuth', Boolean],
+    'BLOCKYARD_OPEN_NODE_CONFIG_FROM_NETWORK': ['auth.openNodeConfigFromNetwork', Boolean],
     // Run on RPC alone: 0 turns the log tail off for every node. Measured why is
     // in server/collect/monitor.js and MEASUREMENTS 3/4 -- bandwidth and per-peer
     // bytes work on builds that publish them and do not on the deployed one.
     'BLOCKYARD_LOG_SOURCE': ['log.enabled', Boolean],
     'BLOCKYARD_MARKETS': ['markets.enabled', Boolean],
     'BLOCKYARD_SECURE_COOKIE': ['auth.secureCookie', Boolean],
+    'BLOCKYARD_TLS': ['server.tls.enabled', Boolean],
     'BLOCKYARD_TLS_CERT': ['server.tls.cert', String],
     'BLOCKYARD_TLS_KEY': ['server.tls.key', String],
     'BLOCKYARD_ACTIONS': ['actions.allow', (v) => v.split(',').map((s) => s.trim()).filter(Boolean)],
@@ -493,8 +514,12 @@ export function configProblems() { return problems; }
 function validateTls(cfg, now = Date.now()) {
   const tls = cfg.server.tls ?? {};
   cfg.server.tls = tls;
-  cfg.tls = Boolean(tls.cert || tls.key);
-  if (!cfg.tls) return;
+  if (tls.enabled === false) { cfg.tls = false; cfg.__tlsAuto = false; return; }   // plain HTTP, chosen
+  cfg.tls = true;
+  // no certificate named: the server makes its own at boot (main.js, ensureSelfSigned) and
+  // inspects it then -- so nothing below applies yet
+  if (!tls.cert && !tls.key) { cfg.__tlsAuto = true; return; }
+  cfg.__tlsAuto = false;
   if (!tls.cert || !tls.key) {
     problems.push(`server.tls needs BOTH cert and key (got ${tls.cert ? 'cert only' : 'key only'}); a half-configured TLS would fall back to plaintext on a port you believe is HTTPS`);
     return;
@@ -507,6 +532,12 @@ function validateTls(cfg, now = Date.now()) {
     }
   }
   if (problems.length) return;
+  inspectTls(cfg, tls, now);
+}
+
+// read the certificate: fingerprint, expiry, whether it is self-signed; problems for an
+// unparseable or expired one, a note for one about to expire
+export function inspectTls(cfg, tls, now = Date.now()) {
   try {
     const x = new crypto.X509Certificate(fs.readFileSync(tls.cert, 'utf8'));
     tls.fingerprint = x.fingerprint256;
@@ -530,7 +561,7 @@ function validate(cfg, ifaces = null, now = Date.now()) {
   if (!Number.isInteger(cfg.server.port) || cfg.server.port < 1 || cfg.server.port > 65535) problems.push('server.port invalid');
   // `hosts` is the truth: one address, a comma list, or an array all normalise here.
   // `host` stays populated with the first entry for anything that still reads it.
-  cfg.server.hosts = hostList(cfg.server.hosts ?? cfg.server.host ?? '0.0.0.0');
+  cfg.server.hosts = hostList(cfg.server.hosts ?? cfg.server.host ?? '127.0.0.1');
   cfg.server.host = cfg.server.hosts[0];
   if (!cfg.server.hosts.length) problems.push('server.hosts is empty; nothing would be served');
   // A hostname here binds whatever DNS says at boot, and fails at listen() with a

package/server/http/api.js

@@ -4,7 +4,7 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { classifyMethod, allowlistSummary, ACTIONS, actionAllowed, NODE_REFUSES } from '../rpc/allowlist.js';
-import { RpcClient } from '../rpc/client.js';
+import { RpcClient, displayUrl, shortPath } from '../rpc/client.js';
 import { SERIES } from '../store/history.js';
 import { randomPassword } from '../auth/users.js';
 import { formatEta, formatBytes } from '../util/fmt.js';
@@ -12,8 +12,36 @@ import { xSearch, xTx, xBlock, xAddress } from './explorer.js';
 
 // Dollar figures for the explorer: a spot price if one is at hand within 1.5 s -- never a slower
 // page for want of one (server/collect/markets.js spot()).
+// THE MARKET SWITCH (operator, 2026-09-15: "disable markets by default so we can claim true zero
+// telemetry out of the box" ... "an app wide 'Enable Market Polling' checkbox"). Two layers:
+//   - BLOCKYARD_MARKETS=0 (markets.enabled=false) removes the feed from the server altogether;
+//     nothing in the browser can turn it on. For machines that must never reach out.
+//   - otherwise the feed exists but polls only while the Display setting
+//     markets.polling is on -- and that ships OFF, so a fresh install makes no outbound
+//     connection but to the node until someone ticks the box.
+// The setting lives in the server's settings file (config/blockyard.json, the same one every
+// screen shares); it is read here per request, cached on the file's mtime and size, so a tick in
+// the panel takes effect on the next call without a restart -- and the next call also PARKS the
+// feed, so unticking stops the exchange traffic at once rather than ten minutes later.
+const MARKETS_OFF = 'market data is off on this server (BLOCKYARD_MARKETS=0 or markets.enabled=false); the switch in Display settings cannot turn it on';
+const POLLING_OFF = 'market polling is off -- the default, so that out of the box this monitor makes no outbound connection but to your node. Turn it on under Display settings → Markets & Price → Enable market polling';
+const pollingCache = new WeakMap();
+export async function marketsPollingOn(app) {
+  const file = app.settingsFile;
+  if (!file) return false;
+  let st;
+  try { st = await fsp.stat(file); } catch { return false; }
+  const hit = pollingCache.get(app);
+  if (hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size) return hit.value;
+  let value = false;
+  try { value = JSON.parse(await fsp.readFile(file, 'utf8'))?.markets?.polling === true; } catch { value = false; }
+  pollingCache.set(app, { mtimeMs: st.mtimeMs, size: st.size, value });
+  return value;
+}
+const pollingOff = (app) => { app.markets?.stop?.(); return { ok: true, enabled: false, polling: false, note: POLLING_OFF }; };
+
 async function withUsd(app, r) {
-  if (!r?.ok || !app.markets) return r;
+  if (!r?.ok || !app.markets || !(await marketsPollingOn(app))) return r;
   const p = await Promise.race([app.markets.spot().catch(() => null), new Promise((res) => { setTimeout(res, 1500, null).unref?.(); })]);
   return { ...r, usd: p?.usd ?? null };
 }
@@ -70,6 +98,33 @@ function configWriteAllowed(app, ctx) {
   if (app.cfg.auth.enabled) needRole(ctx, 'admin');
 }
 
+// THE NODE CONNECTION IN OPEN MODE: FROM THIS MACHINE ONLY (audit 2026-09-16, M1 and M2).
+//
+// The open-mode cross-site check refuses a browser on another origin, because a browser cannot
+// suppress Origin or forge Sec-Fetch-Site. A script sends neither header, and can forge both. So with
+// accounts off, a script anywhere on the LAN could (1) save an rpcUrl of its choosing, after which the
+// next restart sends the datadir's cookie to it -- reproduced end to end -- and (2) use the probe to
+// make this server POST to internal URLs and read back what they answered. There is no identity to
+// check in open mode, so the check is WHERE the caller is: the socket's own peer address must be
+// loopback. X-Forwarded-For is never consulted, and behind a trusted proxy every request would look
+// local, so the form is refused there. `auth.openNodeConfigFromNetwork` restores the old reach.
+// Full server paths go to an admin; everyone else, which in open mode is anyone who can reach the
+// port, gets the last two parts (audit 2026-09-16, L11).
+const pathFor = (ctx, p) => (ctx.user?.role === 'admin' ? p : shortPath(p));
+
+export function isLoopbackAddress(addr) {
+  const a = String(addr ?? '').replace(/^::ffff:/i, '');
+  return a === '::1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(a);
+}
+function nodeConfigAllowed(app, ctx) {
+  if (app.cfg.auth.enabled) return needRole(ctx, 'admin');
+  if (app.cfg.auth.openNodeConfigFromNetwork === true) return undefined;
+  if (!app.cfg.server?.trustProxy && isLoopbackAddress(ctx.req.socket?.remoteAddress)) return undefined;
+  throw new HttpError(403, app.cfg.server?.trustProxy
+    ? 'with accounts off and server.trustProxy on, the node connection cannot be changed over HTTP: every proxied request looks local. Edit config/local.json, or turn accounts on'
+    : 'with accounts off, the node connection can only be changed from this machine (open the monitor at 127.0.0.1), or turn accounts on, or set auth.openNodeConfigFromNetwork', { code: 'local_only' });
+}
+
 // What a form may set, and nothing else. Credentials come from the datadir's .cookie
 // (config.js resolveCookie), so rpcUser / rpcPassword / cookieFile are NOT accepted here: taking a
 // password over an endpoint that is open by default is not a thing to add quietly.
@@ -425,17 +480,33 @@ export const routes = [
   // Exchange prices (server/collect/markets.js). Asking is what keeps the feed polling.
   {
     method: 'GET', path: '/api/markets', auth: 'any',
-    handler: (ctx, app) => {
-      if (!app.markets) return { ok: true, enabled: false, note: 'market data is off on this monitor (BLOCKYARD_MARKETS=0 or markets.enabled=false)' };
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return pollingOff(app);
       app.markets.touch();
       return app.markets.view();
     },
   },
+  // THE SPOT PRICE, for dollar figures on pages that are not Markets (the Mining tab's reward
+  // stats, 2026-09-15: "Add dollar figures"): the feed's median while it is polling, else the
+  // explorer's cached spot read (two exchanges, at most once a minute) -- and null, saying why,
+  // while market polling is off. Does NOT touch the feed: asking the price here never starts
+  // the week-long polling that Markets does.
+  {
+    method: 'GET', path: '/api/price', auth: 'any',
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, usd: null, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return { ok: true, usd: null, polling: false, note: POLLING_OFF };
+      const p = await Promise.race([app.markets.spot().catch(() => null), new Promise((res) => { setTimeout(res, 1500, null).unref?.(); })]);
+      return { ok: true, usd: p?.usd ?? null, at: p?.at ?? null, source: p?.source ?? null };
+    },
+  },
   // The depth chart: the books as cumulative depth, and the snapshot `ago` seconds earlier.
   {
     method: 'GET', path: '/api/markets/depth', auth: 'any',
-    handler: (ctx, app) => {
-      if (!app.markets) return { ok: true, enabled: false, note: 'market data is off on this monitor (BLOCKYARD_MARKETS=0 or markets.enabled=false)' };
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return pollingOff(app);
       app.markets.touch();
       return app.markets.depthView(Number(ctx.query.ago) || 600);
     },
@@ -494,7 +565,7 @@ export const routes = [
         let sync = null;
         try { sync = m.snapshot({ seriesRanges: {} }).sync; } catch { /* not yet populated */ }
         return {
-          id: m.id, label: m.label, color: m.color, rpcUrl: m.node?.rpcUrl ?? m.rpc.url,
+          id: m.id, label: m.label, color: m.color, rpcUrl: displayUrl(m.node?.rpcUrl ?? m.rpc.url),
           chain: m.state.chain, online: m.rpc.telemetry().online,
           optional: !!m.cfg.optional,
           syncState: sync?.state ?? null, pct: sync?.pct ?? null,
@@ -562,8 +633,11 @@ export const routes = [
       const params = Array.isArray(ctx.body?.params) ? ctx.body.params : [];
       const cls = classifyMethod(method);
       if (!cls.allowed) {
-        await app.audit({ type: 'rpc-denied', username: ctx.user.username, node: m.id, method, reason: cls.reason, ip: ctx.ip });
-        throw new HttpError(403, `${method || '(empty)'} is not callable from the web UI: ${cls.reason}`, { code: 'rpc_denied' });
+        // No RPC name is longer than a few dozen characters; the caller's string is clamped before
+        // it is written or echoed (audit 2026-09-16, M6).
+        const shown = method.length > 64 ? `${method.slice(0, 64)}… (${method.length} chars)` : method;
+        await app.audit({ type: 'rpc-denied', username: ctx.user.username, node: m.id, method: shown, reason: cls.reason, ip: ctx.ip });
+        throw new HttpError(403, `${shown || '(empty)'} is not callable from the web UI: ${cls.reason}`, { code: 'rpc_denied' });
       }
       const t0 = Date.now();
       try {
@@ -728,7 +802,7 @@ export const routes = [
   {
     method: 'POST', path: '/api/config/node/test', auth: 'any', csrf: true, body: true,
     handler: async (ctx, app) => {
-      configWriteAllowed(app, ctx);
+      nodeConfigAllowed(app, ctx);
       const node = candidateNode(app, ctx.body);
       const started = Date.now();
       // A THROWAWAY CLIENT WITH ITS OWN LANE. The live node's client holds a serialized queue
@@ -781,9 +855,22 @@ export const routes = [
         // `authenticated` is reported on EVERY path, success or failure: a caller cannot otherwise
         // tell "it refused us" from "we deliberately sent no credential", and those mean different
         // things to someone deciding whether the connection they typed is right.
+        //
+        // NOT WHAT A FOREIGN ENDPOINT SAID (audit 2026-09-16, M2). RpcClient's message carries up to
+        // 200 characters of the reply body, so echoing it made this route a way to read internal URLs
+        // through the server. For any endpoint but the configured one, the answer is the class of
+        // failure only.
+        const GENERIC = {
+          timeout: 'the endpoint did not answer in time',
+          transport: 'the endpoint could not be reached, or answered with an HTTP error',
+          parse: 'the endpoint answered, but not with JSON-RPC: this is not a Bitcoin Core RPC port',
+          rpc: 'the endpoint answered with an RPC error',
+          breaker: 'the endpoint could not be reached',
+        };
+        const message = sameEndpoint ? err.message : (GENERIC[err.kind] ?? 'the connection failed');
         return {
           ok: false, ms: Date.now() - started, authenticated: sameEndpoint,
-          error: { message: err.message, kind: err.kind ?? null, code: err.code ?? null },
+          error: { message, kind: err.kind ?? null, code: sameEndpoint ? (err.code ?? null) : null },
         };
       }
     },
@@ -791,7 +878,7 @@ export const routes = [
   {
     method: 'POST', path: '/api/config/node', auth: 'any', csrf: true, body: true,
     handler: async (ctx, app) => {
-      configWriteAllowed(app, ctx);
+      nodeConfigAllowed(app, ctx);
       if (!app.configFile) {
         throw new HttpError(409, 'this process was started without a config file (BLOCKYARD_CONFIG=none), so there is nowhere to save to', { code: 'no_config_file' });
       }
@@ -806,7 +893,21 @@ export const routes = [
       // JSON.stringify then omits it -- so carrying `{...cur}` across could DELETE a field from the
       // file rather than preserve it. Only real values take part in the merge.
       const changes = Object.fromEntries(Object.entries(node).filter(([, v]) => v !== undefined));
-      nodes[0] = { ...(nodes[0] ?? {}), ...changes };
+      // CREDENTIALS BELONG TO AN ENDPOINT (audit 2026-09-16, M1). The merge kept rpcUser, rpcPassword
+      // and cookieFile while the URL changed, so a saved address inherited another server's secret.
+      // When the host or port changes they are dropped; the cookie is then read from the datadir the
+      // form names, which is the credential this form was always meant to use.
+      const hostOf = (u) => { try { return new URL(u).host; } catch { return null; } };
+      const prior = nodes[0] ?? {};
+      const droppedCredentials = [];
+      if (prior.rpcUrl && hostOf(prior.rpcUrl) !== hostOf(changes.rpcUrl)) {
+        for (const k of ['rpcUser', 'rpcPassword', 'cookieFile']) if (k in prior) droppedCredentials.push(k);
+      }
+      nodes[0] = { ...prior, ...changes };
+      for (const k of droppedCredentials) delete nodes[0][k];
+      if (droppedCredentials.length && !nodes[0].datadir) {
+        throw new HttpError(400, 'a new endpoint needs a datadir, so its own .cookie can be read', { code: 'need_datadir' });
+      }
       delete nodes[0].__urlOverridden;
       const next = { ...fileCfg, nodes };
 
@@ -826,7 +927,7 @@ export const routes = [
         .filter((k) => process.env[k] !== undefined && process.env[k] !== '');
       await app.audit({ type: 'config-node', username: ctx.user.username, ip: ctx.ip, rpcUrl: node.rpcUrl, file: app.configFile });
       return {
-        ok: true, file: app.configFile, restartRequired: true, envOverrides,
+        ok: true, file: app.configFile, restartRequired: true, envOverrides, droppedCredentials,
         note: envOverrides.length
           ? `saved, but this process takes its node from ${envOverrides.join(', ')}, which the environment sets and which beats the file — change the unit or drop-in, or the restart will keep the old endpoint`
           : 'saved; restart the monitor for it to take effect',
@@ -852,12 +953,12 @@ export const routes = [
     handler: async (ctx, app) => {
       try {
         const raw = await fsp.readFile(app.settingsFile, 'utf8');
-        return { settings: JSON.parse(raw), file: app.settingsFile, stored: true };
+        return { settings: JSON.parse(raw), file: pathFor(ctx, app.settingsFile), stored: true };
       } catch (err) {
         // Nothing saved yet is the normal first-run answer, not a fault: the client then keeps its
         // own defaults and offers to push them up. A CORRUPT file is different and says so.
-        if (err.code === 'ENOENT') return { settings: null, file: app.settingsFile, stored: false };
-        return { settings: null, file: app.settingsFile, stored: false, error: `unreadable: ${err.message}` };
+        if (err.code === 'ENOENT') return { settings: null, file: pathFor(ctx, app.settingsFile), stored: false };
+        return { settings: null, file: pathFor(ctx, app.settingsFile), stored: false, error: `unreadable: ${err.message.replaceAll(app.settingsFile, pathFor(ctx, app.settingsFile))}` };
       }
     },
   },
@@ -883,7 +984,7 @@ export const routes = [
       await fh.close();
       await fsp.rename(tmp, app.settingsFile);
 
-      return { ok: true, file: app.settingsFile, bytes: text.length };
+      return { ok: true, file: pathFor(ctx, app.settingsFile), bytes: text.length };
     },
   },
 ];

package/server/http/games.js

@@ -0,0 +1,77 @@
+// THE GAME FILES (operator, 2026-09-15: "I've added doom_dos to the project directory. Get DOOM
+// working as a diversion inside blockyard with zero dependancies"; later "move doom_dos out of the
+// root and move into games", and "get Quake working as a diversion").
+//
+// The DOS Diversions run shareware DOOM and Quake in a PC emulated in the browser (public/js/x86.js,
+// dospc.js, soundcard.js), and the emulator needs the games' own files. They live in games/, one
+// directory a game, where the operator put them -- not in public/, which is the app and is stamped
+// with a build id computed over every file in it (18 MB of PAK in that digest, re-hashed every two
+// seconds of page loads, would be a cost paid by every page for two diversions).
+//
+// Served under /games/<game>/<path>, and only that: a game this file names, and a DOS path of at
+// most one directory and an 8.3 name of a kind the games read (an executable, a WAD, a PAK, a
+// config, Wolfenstein 3D's .WL1 data). No dots but the one in each name, so there is no path to
+// traverse; the lookup is
+// case-insensitive because DOS names are, and the files on disk are upper-case while a browser asks
+// for whatever it was told.
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { securityHeaders } from './static.js';
+
+/** Each game's directory under the games root. */
+export const GAME_DIRS = Object.freeze({ wolf3d: 'wolf3d_dos', doom: 'doom_dos', quake: 'quake_dos' });
+
+export const GAME_PATH = /^\/games\/([a-z0-9]+)\/((?:[A-Za-z0-9_-]{1,8}\/)?[A-Za-z0-9_-]{1,8}\.(?:wad|exe|cfg|pak|wl1))$/i;
+
+/** The file under `dir` at the DOS path `rel` ("ID1/PAK0.PAK"), matching each part ignoring case, or null. */
+export async function findGameFile(dir, rel) {
+  let at = dir;
+  const parts = rel.split('/');
+  for (let i = 0; i < parts.length; i++) {
+    let names;
+    try { names = await fsp.readdir(at, { withFileTypes: true }); } catch { return null; }
+    const want = parts[i].toUpperCase(), last = i === parts.length - 1;
+    const hit = names.find((e) => (last ? e.isFile() : e.isDirectory()) && e.name.toUpperCase() === want);
+    if (!hit) return null;
+    at = path.join(at, hit.name);
+  }
+  return at;
+}
+
+/**
+ * Answer a /games/ request. Returns { status } when it answered, or null when the path is not one
+ * of ours (the caller's 404 applies).
+ */
+export async function serveGame(req, res, urlPath, root, { tls = false, hstsMs = 0 } = {}) {
+  const m = GAME_PATH.exec(urlPath);
+  if (!m || !Object.hasOwn(GAME_DIRS, m[1])) return null;
+  const dirName = GAME_DIRS[m[1]];
+  const file = await findGameFile(path.join(root, dirName), m[2]);
+  const headers = securityHeaders({ tls, hstsMs });
+  if (!file) {
+    res.writeHead(404, { ...headers, 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' });
+    res.end(req.method === 'HEAD' ? undefined : `${m[2].toUpperCase()} is not in games/${dirName}/`);
+    return { status: 404 };
+  }
+  const st = await fsp.stat(file);
+  const etag = `W/"${st.size.toString(16)}-${Math.floor(st.mtimeMs).toString(16)}"`;
+  if (req.headers['if-none-match'] === etag) {
+    res.writeHead(304, { ...headers, ETag: etag, 'Cache-Control': 'no-cache' });
+    res.end();
+    return { status: 304 };
+  }
+  res.writeHead(200, {
+    ...headers,
+    'Content-Type': 'application/octet-stream',
+    'Content-Length': st.size,
+    'Cache-Control': 'no-cache',
+    ETag: etag,
+    'Last-Modified': new Date(st.mtimeMs).toUTCString(),
+  });
+  if (req.method === 'HEAD') { res.end(); return { status: 200 }; }
+  const { createReadStream } = await import('node:fs');
+  const stream = createReadStream(file);
+  stream.on('error', () => res.destroy());
+  stream.pipe(res);
+  return { status: 200 };
+}

package/server/http/server.js

@@ -7,6 +7,7 @@ import http from 'node:http';
 import https from 'node:https';
 import { URL } from 'node:url';
 import { StaticFiles, SECURITY_HEADERS, securityHeaders } from './static.js';
+import { serveGame } from './games.js';
 import { routes, HttpError } from './api.js';
 import { parseCookies, serializeCookie, csrfOk } from '../auth/sessions.js';
 import { ipDecision } from '../netinfo.js';
@@ -16,6 +17,7 @@ import { ipDecision } from '../netinfo.js';
 export { ipAllowed, parseIp, parseCidr } from '../netinfo.js';
 
 const MAX_BODY = 1024 * 1024; // 1 MB: a raw transaction is nowhere near this
+export const REQUEST_TIMEOUT_MS = 30_000; // the whole request, body included, must arrive within this
 
 function compile(routesTable) {
   return routesTable.map((r) => {
@@ -56,10 +58,13 @@ export function createAppServer(app) {
     ? https.createServer({ ...app.tlsOptions }, listener)
     : http.createServer(listener);
   server.keepAliveTimeout = 5000;
-  server.headersTimeout = 10000;
-  // SSE connections are long-lived by design; do not let the defaults reap them.
-  server.requestTimeout = 0;
+  // A DEADLINE FOR RECEIVING THE WHOLE REQUEST, body included (audit 2026-09-16, M5). This was 0,
+  // "so SSE connections are not reaped" -- but requestTimeout bounds only how long the REQUEST takes
+  // to arrive, and a stream's GET has arrived the moment its headers do; the response may then run
+  // for days. Measured on Node 22: with a 1.5 s deadline a stream kept delivering for 5 s, while a
+  // POST trickling one body byte every 500 ms got 408 at 2 s. At 0, that POST was held forever.
   server.headersTimeout = 15000;
+  server.requestTimeout = REQUEST_TIMEOUT_MS;
 
   async function handle(req, res) {
     const ip = clientIp(req, app.cfg);
@@ -115,13 +120,20 @@ export function createAppServer(app) {
           },
         });
       }
-      const client = app.hub.add(req, res, { user: user.user, nodeId: wantNode });
+      // A BOUNDED NUMBER OF STREAMS PER ADDRESS OR ACCOUNT (audit 2026-09-16, H1). The rate limiter
+      // above only paces how fast streams open; it never capped how many stay open.
+      const streamKey = openAccess ? `ip:${ip}` : `user:${user.user.id}`;
+      if (app.hub.countFor(streamKey) >= app.hub.limits.maxPerKey) {
+        return sendJson(req, res, 429, { error: { message: `too many open streams (${app.hub.limits.maxPerKey}) for this ${openAccess ? 'address' : 'account'}`, kind: 'ratelimited' } });
+      }
+      const client = app.hub.add(req, res, { user: user.user, nodeId: wantNode, key: streamKey });
       app.log({ level: 'info', msg: `sse #${client.id} opened by ${user.user.username} (${ip})` });
       req.on('close', () => app.log({ level: 'info', msg: `sse #${client.id} closed (${Math.round((Date.now() - started) / 1000)}s)` }));
       return undefined;
     }
 
     const match = matchRoute(compiled, req.method, path);
+    if (match?.badPath) return sendJson(req, res, 400, { error: { message: 'malformed percent-encoding in the path', kind: 'bad_request' } });
     if (match?.methodMismatch) {
       res.setHeader('Allow', [...new Set(compiled.filter((r) => r.re.test(path)).map((r) => r.method))].join(', '));
       return sendJson(req, res, 405, { error: { message: `${req.method} is not allowed on ${path}`, kind: 'method' } });
@@ -136,6 +148,13 @@ export function createAppServer(app) {
         return res.end();
       }
       if (req.method !== 'GET' && req.method !== 'HEAD') return sendJson(req, res, 405, { error: { message: 'method not allowed', kind: 'method' } });
+      // The DOS Diversions' game files (http/games.js). Behind the session when accounts are on:
+      // twenty megabytes of somebody else's games are not a public asset of this monitor.
+      if (path.startsWith('/games/')) {
+        if (!openAccess && !resolveSession(req, app)) return sendJson(req, res, 401, { error: { message: 'authentication required', kind: 'auth' }, login: '/login' });
+        const done = await serveGame(req, res, path, app.gamesDir, { tls: app.tls, hstsMs });
+        if (done) { app.access({ req, res, path, status: done.status, ms: Date.now() - started, ip, user: null }); return undefined; }
+      }
       const out = await statics.serve(req, res, path);
       if (out?.error) return serveStaticError(req, res, statics, path, out.error, H());
       app.access({ req, res, path, status: out?.status ?? 200, ms: Date.now() - started, ip, user: null });
@@ -301,7 +320,13 @@ function matchRoute(compiled, method, path) {
     if (!m) continue;
     if (r.method !== method) { methodMismatch = true; continue; }
     const params = {};
-    r.names.forEach((n, i) => { params[n] = decodeURIComponent(m[i + 1]); });
+    // A malformed escape in a path parameter is the client's mistake, and answered as one: it used to
+    // throw here and come back as a 500 "internal error" (audit 2026-09-16, L13).
+    try {
+      r.names.forEach((n, i) => { params[n] = decodeURIComponent(m[i + 1]); });
+    } catch {
+      return { badPath: true };
+    }
     return { route: r, params };
   }
   return methodMismatch ? { methodMismatch: true } : null;