blockyard 0.0.9 → 0.1.1

package/server/http/sse.js

@@ -10,6 +10,20 @@
 // are coalesced per client -- at most one snapshot in flight, latest wins -- and
 // the event feed is batched. A client that cannot keep up sees a coarser stream,
 // never an unbounded queue that takes the process down.
+//
+// THAT LAST SENTENCE WAS NOT TRUE UNTIL 2026-09-16 (audit H1). Coalescing only helps if nothing is
+// written while the socket is full, and flush() wrote every pending frame regardless: `write()`
+// noted `backpressured` and nothing ever read it. The reaper removed a client only if it had been
+// sent zero bytes, which no client ever has. So a reader that stopped reading kept every snapshot
+// queued in Node's socket buffer: 400 stalled connections took a test instance from 73 MB to 1.5 GB
+// in three minutes. Now a backpressured client is sent nothing (its pending snapshot keeps being
+// replaced, latest wins) until the socket drains; one whose buffer passes a ceiling, or that stays
+// blocked past a deadline, is dropped; and one address holds a bounded number of streams.
+export const SSE_LIMITS = Object.freeze({
+  maxBufferedBytes: 4 * 1024 * 1024,   // well above one snapshot; a client this far behind is not reading
+  maxBlockedMs: 60_000,                // blocked for a minute: an EventSource reconnects on its own
+  maxPerKey: 16,                       // streams per address (open mode) or per account
+});
 class Client {
   constructor(res, user, id) {
     this.res = res;
@@ -25,13 +39,17 @@ class Client {
     this.alive = true;
     this.lastWriteAt = Date.now();
     this.nodeId = null;
+    this.key = null;
+    this.backpressured = false;
+    this.blockedSince = 0;
   }
 
   get dead() { return !this.alive || this.res.writableEnded || this.res.destroyed; }
 }
 
 export class StreamHub {
-  constructor({ log = () => {} } = {}) {
+  constructor({ log = () => {}, limits = {} } = {}) {
+    this.limits = { ...SSE_LIMITS, ...limits };
     this.clients = new Set();
     this.log = log;
     this.seq = 0;
@@ -39,10 +57,18 @@ export class StreamHub {
     this.timer = null;
   }
 
-  add(req, res, { user = null, nodeId = null } = {}) {
+  /** How many open streams share this key (an address in open mode, an account otherwise). */
+  countFor(key) {
+    let n = 0;
+    for (const c of this.clients) if (c.key === key && !c.dead) n += 1;
+    return n;
+  }
+
+  add(req, res, { user = null, nodeId = null, key = null } = {}) {
     const id = ++this.seq;
     const client = new Client(res, user, id);
     client.nodeId = nodeId;
+    client.key = key;
     res.writeHead(200, {
       'Content-Type': 'text/event-stream; charset=utf-8',
       'Cache-Control': 'no-cache, no-store, must-revalidate',
@@ -55,6 +81,11 @@ export class StreamHub {
     req.on('close', close);
     req.on('aborted', close);
     res.on('error', close);
+    res.on('drain', () => {
+      client.backpressured = false;
+      client.blockedSince = 0;
+      this.flush();
+    });
     if (!this.timer) this.startHeartbeat();
     return client;
   }
@@ -70,24 +101,35 @@ export class StreamHub {
     const tick = () => {
       for (const c of [...this.clients]) {
         if (c.dead) { this.remove(c); continue; }
+        if (this.stalled(c)) continue;
         // A comment frame keeps intermediaries from reaping an idle stream and
-        // lets us notice a dead socket on our own terms.
-        if (this.write(c, ': ping\n\n')) {
-          if (Date.now() - c.lastWriteAt > 120_000 && c.bytes === 0) this.remove(c);
-        }
+        // lets us notice a dead socket on our own terms. Never onto a full socket.
+        if (!c.backpressured) this.write(c, ': ping\n\n');
       }
     };
     this.timer = setInterval(tick, this.heartbeatMs);
     this.timer.unref?.();
   }
 
+  /** Drop a client that is too far behind, or blocked too long; true if it was dropped. */
+  stalled(client) {
+    const buffered = client.res.writableLength ?? 0;
+    const blockedFor = client.backpressured && client.blockedSince ? Date.now() - client.blockedSince : 0;
+    if (buffered <= this.limits.maxBufferedBytes && blockedFor <= this.limits.maxBlockedMs) return false;
+    this.log({ level: 'warn', msg: `sse #${client.id} dropped: not reading (${Math.round(buffered / 1024)} KB buffered, blocked ${Math.round(blockedFor / 1000)}s)` });
+    this.remove(client);
+    try { client.res.destroy(); } catch { /* already gone */ }
+    return true;
+  }
+
   write(client, frame) {
     if (client.dead) return false;
     try {
       const ok = client.res.write(frame);
       client.bytes += frame.length;
       client.lastWriteAt = Date.now();
-      if (!ok) client.backpressured = true;
+      if (!ok && !client.backpressured) { client.backpressured = true; client.blockedSince = Date.now(); }
+      if (!ok) this.stalled(client);
       return ok;
     } catch (err) {
       this.log({ level: 'debug', msg: `sse write failed: ${err.message}` });
@@ -142,6 +184,9 @@ export class StreamHub {
       this.flushing = false;
       for (const c of [...this.clients]) {
         if (c.dead) { this.remove(c); continue; }
+        // A full socket gets nothing more: what is pending stays pending (and is replaced by
+        // newer state) until 'drain' flushes again.
+        if (c.backpressured) { this.stalled(c); continue; }
         if (c.pendingSnapshot !== null) {
           const snap = c.pendingSnapshot;
           c.pendingSnapshot = null;
@@ -166,6 +211,7 @@ export class StreamHub {
       perClient: [...this.clients].map((c) => ({
         id: c.id, user: c.user?.username ?? null, seconds: Math.round((Date.now() - c.connectedAt) / 1000),
         kb: Math.round(c.bytes / 1024), dropped: { ...c.dropped }, node: c.nodeId,
+        backpressured: c.backpressured, bufferedKb: Math.round((c.res.writableLength ?? 0) / 1024),
       })),
     };
   }

package/server/main.js

@@ -12,6 +12,9 @@ import { createAppServer } from './http/server.js';
 import { computeBuildId } from './http/static.js';
 import { NodeMonitor } from './collect/monitor.js';
 import { localAddresses, bindProblemMessage, planBinds } from './netinfo.js';
+import { ensureSelfSigned } from './tls/selfsigned.js';
+import { inspectTls } from './config.js';
+import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 
 // ONE PLACE, NOT TWO. This was a literal here AND a "version" field in package.json, and on
@@ -23,8 +26,9 @@ const VERSION = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf
 
 export async function boot({ configFile, log: logOverride = null } = {}) {
   const cfg = loadConfig({ configFile });
-  await fsp.mkdir(cfg.store.dir, { recursive: true });
-  await fsp.mkdir(cfg.auth.dataDir, { recursive: true });
+  // owner-only where this creates them (audit 2026-09-16, L10); an existing directory keeps its mode
+  await fsp.mkdir(cfg.store.dir, { recursive: true, mode: 0o700 });
+  await fsp.mkdir(cfg.auth.dataDir, { recursive: true, mode: 0o700 });
 
   const app = {
     version: VERSION,
@@ -49,6 +53,8 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     ),
     startedAt: Date.now(),
     publicDir: path.join(ROOT, 'public'),
+    // the DOS Diversions' game files, a directory a game, where the operator put them (http/games.js)
+    gamesDir: path.join(ROOT, 'games'),
     monitors: new Map(),
     stateSeq: 0,
     rssStart: process.memoryUsage().rss,
@@ -66,6 +72,18 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   // Decided here, before any listener exists, and the cookie follows it: a Secure
   // cookie on an HTTP listener is a cookie the browser will not send, which reads
   // as "login keeps failing" -- so the two settings must not be independently set.
+  // HTTPS BY DEFAULT (2026-09-15): no certificate named means the monitor's own, made here on
+  // first start under <data>/tls and kept, naming every address it can be reached on -- the
+  // bound hosts, this machine's addresses, its hostname, localhost -- and remade when it nears
+  // expiry or stops naming a bound host. BLOCKYARD_TLS=0 is plain HTTP.
+  if (cfg.__tlsAuto) {
+    const bound = (cfg.server.hosts ?? [cfg.server.host]).filter((h) => h && h !== '0.0.0.0' && h !== '::');
+    const sans = ['localhost', os.hostname(), '127.0.0.1', '::1', ...bound, ...localAddresses().map((a) => a.address)];
+    const made = ensureSelfSigned(path.join(cfg.store.dir, 'tls'), { sans, mustName: bound });
+    cfg.server.tls.cert = made.certFile; cfg.server.tls.key = made.keyFile;
+    if (made.made) app.log({ level: 'warn', msg: `made this monitor's own self-signed certificate (${made.why}) at ${made.certFile}, valid to ${new Date(made.notAfter).toISOString().slice(0, 10)}, for ${made.sans.join(', ')} -- browsers warn once per address; name your own with BLOCKYARD_TLS_CERT/KEY, or BLOCKYARD_TLS=0 behind a proxy that terminates TLS` });
+    inspectTls(cfg, cfg.server.tls);   // fingerprint, expiry note, self-signed flag for the log line below
+  }
   app.tls = Boolean(cfg.server.tls?.cert && cfg.server.tls?.key);
   if (app.tls) {
     app.tlsOptions = {
@@ -77,7 +95,8 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
       app.log({ level: 'info', msg: 'TLS is on, so the session cookie is now Secure (a Secure cookie over plain HTTP is never sent, which looks like a login that will not stick)' });
     }
     app.log({ level: 'warn', msg: `TLS on (fingerprint ${String(cfg.server.tls.fingerprint).slice(0, 17)}…${cfg.server.tls.selfSigned ? ', self-signed: expect a browser warning the first time per address' : ''})${cfg.__tlsExpiring ? `; WARNING ${cfg.__tlsExpiring}` : ''}` });
-  } else if (cfg.auth.enabled) {
+  } else if (cfg.auth.enabled && !(cfg.server.hosts ?? [cfg.server.host]).every((h) => LOOPBACK.has(h))) {
+    // (not said for a loopback-only bind -- the default now -- where nothing crosses the LAN)
     app.log({ level: 'warn', msg: 'serving HTTP, not HTTPS: the session cookie and every RPC reply cross the LAN in the clear. Either put a TLS terminator in front (then BLOCKYARD_SECURE_COOKIE=1), name server.tls.cert/key, or bind 127.0.0.1 and use an SSH tunnel -- see README, "TLS, or the lack of it".' });
   }
   app.scheme = app.tls ? 'https' : 'http';
@@ -128,7 +147,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     const where = (cfg.server.hosts ?? [cfg.server.host]).join(', ') || '(wildcard)';
     app.log({
       level: 'warn',
-      msg: `NO SIGN-IN (auth.enabled=false, the default): anyone who can reach ${where}:${cfg.server.port} reads this monitor — charts, the event feed, peer and mempool detail, and the read-only RPC console — as role "viewer". Not open to them: user administration, the audit trail, password changes, and node writes (set BLOCKYARD_AUTH=1 for accounts, roles, sessions and CSRF).`,
+      msg: `NO SIGN-IN (auth.enabled=false -- accounts were switched off; they are on out of the box): anyone who can reach ${where}:${cfg.server.port} reads this monitor — charts, the event feed, peer and mempool detail, and the read-only RPC console — as role "viewer". Not open to them: user administration, the audit trail, password changes, and node writes (BLOCKYARD_AUTH=1, or drop the override, for accounts, roles, sessions and CSRF).`,
     });
   }
 
@@ -251,7 +270,12 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   // which are not secrets, and an audit trail full of [redacted] where the useful fields were is
   // its own kind of failure.
   const SECRETISH = /pass(word|phrase)?|secret|cookie|token|priv(ate)?_?key|seed|mnemonic|authorization|credential/i;
+  // AND CLAMP BY LENGTH (audit 2026-09-16, M6). A caller-chosen string went into the trail whole:
+  // a 900 KB RPC method name, sixty times over, rotated every retained file and took the sign-ins and
+  // user changes with it. No field the trail needs is anywhere near this long.
+  const AUDIT_STRING_MAX = 1024;
   const redact = (v, depth = 0) => {
+    if (typeof v === 'string' && v.length > AUDIT_STRING_MAX) return `${v.slice(0, AUDIT_STRING_MAX)}…[${v.length - AUDIT_STRING_MAX} more chars]`;
     if (v == null || depth > 6) return v;
     if (Array.isArray(v)) return v.map((x) => redact(x, depth + 1));
     if (typeof v !== 'object') return v;
@@ -342,7 +366,10 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   }
   const served = plan.bindable.map((h) => `${app.scheme}://${h}:${cfg.server.port}`);
   app.log({ level: 'info', msg: `BlockYard ${VERSION} listening on ${served.join(' and ')}` });
-  if (!plan.bindable.includes('0.0.0.0') && !plan.bindable.includes('::')) {
+  const loopbackOnly = plan.bindable.every((h) => LOOPBACK.has(h));
+  if (loopbackOnly) {
+    app.log({ level: 'info', msg: 'bound to this machine only (the default): reach it from elsewhere over an SSH tunnel, or bind a LAN address with BLOCKYARD_BIND / server.hosts -- docs/INSTALL.md §7' });
+  } else if (!plan.bindable.includes('0.0.0.0') && !plan.bindable.includes('::')) {
     const v4 = localAddresses().filter((a) => a.family === 'IPv4' && !plan.bindable.includes(a.address) && !a.internal);
     const v6 = localAddresses().filter((a) => a.family === 'IPv6' && !plan.bindable.includes(a.address) && !a.internal).length;
     // warn, not info: when loopback is not among the bound addresses, "connection
@@ -352,7 +379,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     app.log({
       level: 'warn',
       msg: `bound to specific interfaces -- NOT reachable on ${v4.map((a) => `${a.address} (${a.name})`).join(', ') || 'other IPv4 addresses'}`
-        + `${v6 ? ` (plus ${v6} IPv6 address(es))` : ''}, and not on 127.0.0.1 either: use one of the addresses above from this machine too.`,
+        + `${v6 ? ` (plus ${v6} IPv6 address(es))` : ''}${plan.bindable.some((h) => LOOPBACK.has(h)) ? '.' : ', and not on 127.0.0.1 either: use one of the addresses above from this machine too.'}`,
     });
     if (plan.missing.length) {
       app.log({ level: 'warn', msg: `skipped at boot: ${plan.missing.join(', ')} -- clients that would have used those addresses will get "connection refused", which is not a crash` });
@@ -443,27 +470,44 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
       // when its RPC slows past the monitor's own threshold (rpc.slowLatencyMs, 5 s) the next file waits
       // until it recovers (2026-09-14, the first Mac install: 18 s answers and 90 s timeouts while the
       // build ran flat out -- which turned out to be gettxoutsetinfo, not the build, but the pacing stays)
+      let phase = null, phaseAt = Date.now(), lastFlag = 0, lastProgressAt = Date.now();
+      const flagLine = () => {
+        const pct = status.total ? Math.round((100 * status.done) / status.total) : 0;
+        const quiet = Date.now() - lastProgressAt;
+        return `the address index is being built: ${status.phase ?? 'starting'} ${Number(status.done ?? 0).toLocaleString()} of ${Number(status.total ?? 0).toLocaleString()} (${pct}%)${status.rows ? `, ${status.rows.toLocaleString()} rows so far` : ''}${status.eta ? `, about ${status.eta} left` : ''}${status.paused ? ' -- paused while the node\'s RPC is slow' : quiet > 120_000 ? ` -- no progress for ${Math.round(quiet / 60000)} min` : ''}`;
+      };
       const pace = rpcPacer(m.rpc, { slowMs: cfg.rpc?.slowLatencyMs ?? 5000, onChange: (held, t) => {
         status.paused = held;
+        lastFlag = Date.now(); m.flagQuality?.('address-index-building', flagLine(), 'info');   // on the flag the moment it changes
         app.log({ level: 'info', msg: held ? `address index build: paused while the node's RPC is ${t.breakerOpen ? 'refused' : t.lastError ? 'failing' : `answering in ${((t.avgLatencyMs ?? 0) / 1000).toFixed(1)} s`}` : 'address index build: resumed' });
       } });
       const say = (text, severity = 'info') => { m.addEvent?.({ kind: 'index', severity, tag: 'index', ts: Date.now(), text }); app.log({ level: severity === 'warn' ? 'warn' : 'info', msg: text }); };
       say(`address index: building ${dir} from ${m.id}'s block files with ${workers} workers -- the Overview shows the progress`);
-      let phase = null, phaseAt = Date.now(), lastFlag = 0;
+      // THE FLAG IS REWRITTEN ON A CLOCK, NOT ONLY ON PROGRESS (2026-09-15: "scan 5,720 of 5,721,
+      // about 1 s left (88m ago)" -- a build that had stopped moving showed its last good line,
+      // and a pause showed nothing at all until the next file finished). Every 30 s it says how
+      // long since anything happened, and a pause is on it the moment it begins.
+      const heartbeat = setInterval(() => { if (Date.now() - lastFlag > 25_000) { lastFlag = Date.now(); m.flagQuality?.('address-index-building', flagLine(), 'info'); } }, 30_000);
+      heartbeat.unref?.();
       buildIndex({
         rpc, blocksDir: path.join(m.cfg.datadir, 'blocks'), out: dir, workers, pace,
+        // AN INTERRUPTED BUILD RESUMES (build.js, THE BUILD JOURNAL): where it resumed, or why the
+        // unfinished work was thrown away, is an event like the start
+        log: (text) => say(text),
         onProgress: (p) => {
           if (p.phase !== phase) { phase = p.phase; phaseAt = Date.now(); }
           const elapsed = (Date.now() - phaseAt) / 1000;
-          const rate = elapsed > 0 && p.done > 0 ? p.done / elapsed : 0;
+          // a resumed build starts the phase part way (`from`): the rate is this run's, not the earlier one's
+          const rate = elapsed > 0 && p.done > (p.from ?? 0) ? (p.done - (p.from ?? 0)) / elapsed : 0;
           Object.assign(status, { phase: p.phase, done: p.done, total: p.total, rows: p.rows ?? status.rows, eta: rate > 0 && p.total > p.done ? HMS((p.total - p.done) / rate) : null });
+          lastProgressAt = Date.now();
           if (Date.now() - lastFlag > 5000) {
             lastFlag = Date.now();
-            const pct = p.total ? Math.round((100 * p.done) / p.total) : 0;
-            m.flagQuality?.('address-index-building', `the address index is being built: ${p.phase} ${p.done.toLocaleString()} of ${p.total.toLocaleString()} (${pct}%)${p.rows ? `, ${p.rows.toLocaleString()} rows so far` : ''}${status.eta ? `, about ${status.eta} left` : ''}${status.paused ? ' -- paused while the node\'s RPC is slow' : ''}`, 'info');
+            m.flagQuality?.('address-index-building', flagLine(), 'info');
           }
         },
       }).then((manifest) => {
+        clearInterval(heartbeat);
         registerIndexBuild(dir, null);
         m.indexBuild = null;
         m.clearQuality?.('address-index-building');
@@ -471,6 +515,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
         say(`address index built: ${Number(manifest.rows ?? 0).toLocaleString()} rows to block ${Number(manifest.tip?.height ?? 0).toLocaleString()} in ${mins} min -- address pages are live`);
         try { follow(dir, m); } catch (err) { say(`address index ${dir}: built, but the follower could not start: ${err.message}`, 'warn'); }
       }).catch((err) => {
+        clearInterval(heartbeat);
         status.error = err.message;
         registerIndexBuild(dir, null);
         m.indexBuild = null;
@@ -593,6 +638,8 @@ function installShutdown(app) {
   });
 }
 
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+
 export function banner(app) {
   const lines = [];
   const host = app.cfg.server.host;
@@ -608,7 +655,15 @@ export function banner(app) {
     // Same content as the boot warning, in the banner: the first thing on screen
     // after `npm start` should be the sentence about who can read the node.
     lines.push('    login    DISABLED — open to anyone who can reach the addresses above (role: viewer, read-only)');
-    lines.push('             user admin, the audit trail and node writes stay closed; BLOCKYARD_AUTH=1 turns accounts on');
+    lines.push('             user admin, the audit trail and node writes stay closed; BLOCKYARD_AUTH=1 turns accounts back on');
+  }
+  // LOOPBACK IS THE DEFAULT (2026-09-15): say how to reach it from anywhere else, because "it
+  // works on the box and nowhere else" is the first thing a new install runs into now
+  const hosts = app.cfg.server.hosts ?? [host];
+  if (hosts.every((h) => LOOPBACK.has(h))) {
+    const p = app.cfg.server.port;
+    lines.push(`    reach    this machine only. From elsewhere: ssh -L ${p}:127.0.0.1:${p} you@this-host, then ${app.scheme}://localhost:${p}`);
+    lines.push('             or bind a LAN address: BLOCKYARD_BIND=192.0.2.10 (or 0.0.0.0 for every interface) — docs/INSTALL.md §7');
   }
   lines.push(`    nodes    ${[...app.monitors.values()].map((m) => `${m.id} -> ${m.rpc.url}`).join(', ')}`);
   if (app.cfg.server.allowCidrs.length) lines.push(`    CIDRs    ${app.cfg.server.allowCidrs.join(', ')}`);

package/server/rpc/allowlist.js

@@ -48,8 +48,33 @@ const ALLOW_PREFIXES = ['get', 'list', 'estimate', 'verify', 'estimat', 'help',
 // transactions, which is a write in every way that matters.
 const DENY_PREFIXES = ['generate', 'invalidate', 'reconsider', 'import', 'send', 'set', 'unload', 'load', 'sign'];
 
+// EVERY WALLET RPC, READ-SHAPED OR NOT (audit 2026-09-16, M4). The `get` and `list` prefixes let
+// `listdescriptors true` and `gethdkeys {"private":true}` through, and both return private keys
+// from an unlocked wallet -- to anyone the console serves, which in open mode is anyone who can
+// reach the port. The monitor has no use for a wallet, so the whole category is refused by name.
+// The list is Bitcoin Core's own "== Wallet ==" section of `help` (Core 29/30, taken 2026-09-16),
+// plus the legacy-wallet methods older nodes still answer.
+export const WALLET_METHODS = new Set([
+  'abandontransaction', 'abortrescan', 'addhdkey', 'backupwallet', 'bumpfee', 'createwallet',
+  'createwalletdescriptor', 'encryptwallet', 'exportwatchonlywallet', 'getaddressesbylabel',
+  'getaddressinfo', 'getbalance', 'getbalances', 'gethdkeys', 'getnewaddress', 'getrawchangeaddress',
+  'getreceivedbyaddress', 'getreceivedbylabel', 'gettransaction', 'getwalletinfo', 'importdescriptors',
+  'importprunedfunds', 'keypoolrefill', 'listaddressgroupings', 'listdescriptors', 'listlabels',
+  'listlockunspent', 'listreceivedbyaddress', 'listreceivedbylabel', 'listsinceblock', 'listtransactions',
+  'listunspent', 'listwalletdir', 'listwallets', 'loadwallet', 'lockunspent', 'migratewallet',
+  'psbtbumpfee', 'removeprunedfunds', 'rescanblockchain', 'restorewallet', 'send', 'sendall', 'sendmany',
+  'sendtoaddress', 'setlabel', 'setwalletflag', 'signmessage', 'signrawtransactionwithwallet',
+  'simulaterawtransaction', 'unloadwallet', 'walletcreatefundedpsbt', 'walletdisplayaddress', 'walletlock',
+  'walletpassphrase', 'walletpassphrasechange', 'walletprocesspsbt',
+  // legacy (pre-descriptor) wallets
+  'dumpprivkey', 'dumpwallet', 'importprivkey', 'importaddress', 'importpubkey', 'importmulti',
+  'importwallet', 'sethdseed', 'upgradewallet', 'getunconfirmedbalance', 'listaccounts', 'getaccount',
+  'getaccountaddress', 'getaddressesbyaccount', 'getreceivedbyaccount', 'listreceivedbyaccount',
+]);
+
 export function classifyMethod(method) {
   if (typeof method !== 'string' || !method) return { allowed: false, kind: 'unknown', reason: 'method name must be a string' };
+  if (WALLET_METHODS.has(method)) return { allowed: false, kind: 'wallet', reason: 'wallet RPCs are not exposed: some of them return private keys, and the monitor has no use for a wallet' };
   if (DENY_EXACT.has(method)) return { allowed: false, kind: 'write-or-heavy', reason: 'this method mutates state or monopolises the node\'s single-threaded RPC server' };
   for (const p of DENY_PREFIXES) if (method.startsWith(p) && !ALLOW_PREFIXES.includes(method)) return { allowed: false, kind: 'write', reason: `method starts with "${p}" and is treated as a mutation` };
   if (method === 'help' || method === 'uptime' || method === 'stop') {
@@ -73,6 +98,7 @@ export const NODE_REFUSES = new Set([
 export function allowlistSummary() {
   return {
     denyExactCount: DENY_EXACT.size,
+    walletDenied: WALLET_METHODS.size,
     allowPrefixes: [...new Set(ALLOW_PREFIXES)].sort(),
     denyPrefixes: [...new Set(DENY_PREFIXES)].sort(),
     defaultDecision: 'deny',

package/server/rpc/client.js

@@ -34,6 +34,34 @@ import http from 'node:http';
 import https from 'node:https';
 import { resolveCookie } from '../config.js';
 
+
+/**
+ * A file path as it may be shown to a viewer (audit 2026-09-16, L11): its last two parts, which say
+ * which cookie or log it is (`main/.cookie`, `bitcoin/debug.log`) without the directories above --
+ * a home directory in them names the account the node runs as, and in open mode anyone who can
+ * reach the port reads these responses.
+ */
+export function shortPath(p) {
+  if (typeof p !== 'string' || !p) return p ?? null;
+  const parts = p.split(/[\\/]+/).filter(Boolean);
+  return parts.length <= 2 ? parts.join('/') : `…/${parts.slice(-2).join('/')}`;
+}
+
+/**
+ * The RPC URL as it may be shown to a viewer (audit 2026-09-16, L3): never with a username or
+ * password in it. `http://user:pass@host:8332` is a valid rpcUrl, and the endpoint is shown on the
+ * Node page and in the node picker's tooltip to everyone who can read the monitor.
+ */
+export function displayUrl(u) {
+  if (typeof u !== 'string' || !u) return u ?? null;
+  try {
+    const url = new URL(u);
+    if (!url.username && !url.password) return u;
+    url.username = ''; url.password = '';
+    return url.toString();
+  } catch { return u.replace(/\/\/[^@/]*@/, '//'); }
+}
+
 export class RpcError extends Error {
   constructor(message, { code = null, httpStatus = null, kind = 'rpc' } = {}) {
     super(message);
@@ -399,8 +427,8 @@ export class RpcClient {
   telemetry() {
     return {
       nodeId: this.id,
-      url: this.node.rpcUrl,
-      cookieSource: this._cookieSource,
+      url: displayUrl(this.node.rpcUrl),
+      cookieSource: shortPath(this._cookieSource),
       online: !!this.lastGoodAt && !this.lane.breakerOpen && (!this.lastError || (this.lastGoodAt > this.lastError.at)),
       lastGoodAt: this.lastGoodAt,
       lastError: this.lastError,

package/server/store/audit.js

@@ -14,7 +14,7 @@
 import fsp from 'node:fs/promises';
 import fs from 'node:fs';
 import path from 'node:path';
-import { appendJsonl } from './history.js';
+import { appendJsonl, fchmodOwnerOnly } from './history.js';
 
 export class AuditLog {
   constructor(file, { maxBytes = 8 * 1024 * 1024, keep = 5, log = () => {} } = {}) {
@@ -129,6 +129,11 @@ export class AuditLog {
 
   /** Adopt an existing file's size so the first append after a restart is correct. */
   async adopt() {
+    // THE MODE IS TIGHTENED ON FILES THAT ALREADY EXIST (audit 2026-09-16, L10): appendJsonl passes
+    // 0o600, which applies only when it creates the file, so a trail written before 2026-09-14 kept
+    // whatever the umask gave it. Opened without following a symlink where the platform allows, and
+    // fchmod'ed through the descriptor.
+    for (const f of this.chain()) await fchmodOwnerOnly(f);
     try {
       this.bytes = (await fsp.stat(this.file)).size;
       return { adopted: this.bytes };

package/server/store/history.js

@@ -7,6 +7,7 @@
 // whole"), and it is the only sane answer when the process can be SIGKILLed
 // mid-flush by a system OOM killer this box has actually triggered before.
 import fsp from 'node:fs/promises';
+import fs from 'node:fs';
 import path from 'node:path';
 import { Ring } from './ring.js';
 
@@ -141,7 +142,7 @@ export class History {
     if (this.saving) return { skipped: true };
     this.saving = true;
     try {
-      await fsp.mkdir(this.dir, { recursive: true });
+      await fsp.mkdir(this.dir, { recursive: true, mode: 0o700 });
       const payload = {
         version: 1,
         savedAt: Date.now(),
@@ -151,7 +152,10 @@ export class History {
         eventsSeq: this.eventsSeq,
       };
       const tmp = `${this.file}.tmp`;
-      const fh = await fsp.open(tmp, 'w', 0o600);   // node-derived detail: owner-only, like users and sessions
+      // node-derived detail: owner-only, like users and sessions. The temporary name is unlinked and
+      // created with O_EXCL, so a symlink planted there is never followed (audit 2026-09-16, L10)
+      await fsp.unlink(tmp).catch((err) => { if (err.code !== 'ENOENT') throw err; });
+      const fh = await fsp.open(tmp, 'wx', 0o600);
       await fh.writeFile(JSON.stringify(payload));
       await fh.sync();
       await fh.close();
@@ -170,6 +174,7 @@ export class History {
   }
 
   async load() {
+    await fchmodOwnerOnly(this.file);   // a snapshot written before the mode was passed (audit 2026-09-16, L10)
     let raw;
     try {
       raw = await fsp.readFile(this.file, 'utf8');
@@ -215,6 +220,17 @@ export class History {
 
 // Atomic append-only text sink, used by the audit log.
 export async function appendJsonl(file, row) {
-  await fsp.mkdir(path.dirname(file), { recursive: true });
+  await fsp.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
   await fsp.appendFile(file, JSON.stringify(row) + '\n', { encoding: 'utf8', mode: 0o600 });   // who did what: owner-only (audit 2026-09-14, L4)
 }
+
+// An existing file made owner-only through its own descriptor (audit 2026-09-16, L10). O_NOFOLLOW
+// where the platform has it, so a symlink's target is never re-moded; a missing file, or a platform
+// that keeps no modes (Windows), is not an error.
+export async function fchmodOwnerOnly(file) {
+  let fh;
+  try {
+    fh = await fsp.open(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    await fh.chmod(0o600);
+  } catch { /* absent, a symlink, or modes not kept here */ } finally { await fh?.close().catch(() => {}); }
+}

package/server/store/ledger.js

@@ -54,7 +54,7 @@ async function sqliteEngine() {
 
 export async function openLedger({ file, engine = 'auto', keepHeights = 52_594, log = () => {} } = {}) {
   if (!file) throw new Error('openLedger needs a file path');
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });   // owner-only (audit 2026-09-16, L10)
   let chosen = engine;
   if (engine === 'auto') {
     chosen = (process.env.BLOCKYARD_LEDGER_ENGINE ?? 'sqlite').trim().toLowerCase();
@@ -90,6 +90,9 @@ class SqliteLedger {
       height INTEGER PRIMARY KEY, pool_key TEXT, pool_label TEXT, seen_at INTEGER, row TEXT
     )`);
     this.db.exec('CREATE INDEX IF NOT EXISTS attribution_seen ON attribution(seen_at DESC)');
+    // SQLite creates its files by the umask: tightened to owner-only, and an older file with them
+    // (audit 2026-09-16, L10)
+    for (const f of [file, `${file}-wal`, `${file}-shm`]) ownerOnly(f);
     this.insert = this.db.prepare('INSERT OR REPLACE INTO attribution VALUES (?,?,?,?,?)');
   }
 
@@ -164,7 +167,8 @@ class JsonlLedger {
         if (Number.isInteger(row?.height)) this.byHeight.set(row.height, row);
       } catch { /* the incomplete final write; ignored, then overwritten */ }
     }
-    this.fd = fs.openSync(file, 'a');
+    this.fd = fs.openSync(file, 'a', 0o600);
+    try { fs.fchmodSync(this.fd, 0o600); } catch { /* not every filesystem keeps modes */ }   // one created before (audit 2026-09-16, L10)
   }
 
   put(row) { return this.putMany([row]); }
@@ -188,13 +192,15 @@ class JsonlLedger {
   #compact() {
     const rows = [...this.byHeight.values()].sort((a, b) => a.height - b.height);
     const tmp = `${this.file}.tmp`;
-    const fd = fs.openSync(tmp, 'w');
+    // never a planted symlink followed: unlinked, then created afresh and owner-only (audit 2026-09-16, L10)
+    try { fs.unlinkSync(tmp); } catch (err) { if (err.code !== 'ENOENT') throw err; }
+    const fd = fs.openSync(tmp, 'wx', 0o600);
     for (const r of rows) fs.writeSync(fd, JSON.stringify(r) + '\n');
     fs.fsyncSync(fd);
     fs.closeSync(fd);
     fs.closeSync(this.fd);
     fs.renameSync(tmp, this.file);
-    this.fd = fs.openSync(this.file, 'a');
+    this.fd = fs.openSync(this.file, 'a', 0o600);
     this.dirty = 0;
   }
 
@@ -288,3 +294,8 @@ export function aggregate(rows = []) {
     }))
     .sort((a, b) => b.blocks - a.blocks || b.lastHeight - a.lastHeight);
 }
+
+// chmod 0o600 when the file exists; a missing file or a filesystem without modes is not an error
+function ownerOnly(file) {
+  try { fs.chmodSync(file, 0o600); } catch { /* absent, or modes not kept here */ }
+}