blockyard 0.1.0 → 0.1.1

package/server/collect/monitor.js

@@ -15,12 +15,12 @@
 //    empty in this deployment -- so `health.quality` records every such gap
 //    rather than silently preferring one.
 import { EventEmitter } from 'node:events';
-import { RpcClient, RpcError } from '../rpc/client.js';
+import { RpcClient, RpcError, displayUrl, shortPath } from '../rpc/client.js';
 import { LogTail } from './logtail.js';
 import { CounterRate } from '../store/ring.js';
 import { computeSync, stripFacts } from './sync.js';
 import { SHAPES, RULE_TO_SHAPE } from './logparse.js';
-import { decodeCoinbase, minerRow, ledgerApply, ledgerRows, aliasFor, matchPool } from './mining.js';
+import { decodeCoinbaseSafe, minerRow, ledgerApply, ledgerRows, aliasFor, matchPool } from './mining.js';
 import { NetworkStats } from './network.js';
 import { summarizeTemplate, packagesFromTemplate, blockEconomy, templateCells } from './nextblock.js';
 import { templateFromMempool, LOCAL_TEMPLATE_NOTE } from './gbt.js';
@@ -39,6 +39,15 @@ export const BLOCKSTATS_FIELDS = ['totalfee', 'txs', 'total_size', 'total_weight
   'swtotal_size', 'swtxs', 'subsidy', 'utxo_increase', 'ins', 'outs', 'avgfee', 'medianfee', 'maxfee',
   'feerate_percentiles', 'height', 'blockhash', 'time', 'mediantime'];
 
+
+// WHAT THE NODE SAYS IS DATA OF A KNOWN SHAPE, OR NOTHING (audit 2026-09-16, L2). These fields went
+// from the RPC reply to the page unchecked, and the page wrote some of them as markup: a node that
+// answered `chain: "main<img src=x onerror=…>"` put an element on the Chain page. The page now
+// escapes them too; the server also refuses to pass on a value that is not the type it names.
+export const chainName = (v) => (typeof v === 'string' && /^[a-z0-9_-]{1,24}$/i.test(v) ? v : null);
+export const boolOrNull = (v) => (typeof v === 'boolean' ? v : null);
+export const countOrNull = (v) => (Number.isFinite(v) && v >= 0 ? v : null);
+
 export class NodeMonitor extends EventEmitter {
   constructor(nodeCfg, { rpc, poll, store, log, history, logCfg, miningCfg }) {
     super();
@@ -888,7 +897,11 @@ export class NodeMonitor extends EventEmitter {
     const rtRes = await this.rpc.batch([{ method: 'getrawtransaction', params: [cbTxid, 2] }], { priority: 3 });
     if (!rtRes?.[0]?.ok) throw new Error(rtRes?.[0]?.error?.message ?? 'getrawtransaction unanswered');
     const vin0 = rtRes[0].result?.vin?.[0] ?? {};
-    const decoded = decodeCoinbase(vin0.coinbase ?? vin0.coinbaseHex ?? '');
+    // 2026-09-16 (audit L4): everything above that throws is the node not answering, and
+    // pumpMining puts the height back and backs off. What follows is the block's own bytes,
+    // and a coinbase we cannot read will read the same way next time -- so it never throws:
+    // the block is recorded as unparseable (an unknown pool) and the queue moves on.
+    const decoded = decodeCoinbaseSafe(vin0.coinbase ?? vin0.coinbaseHex ?? '');
     const stats = this.state.blocks.get(height) ?? {};
     const row = minerRow({
       height, hash,
@@ -1821,8 +1834,8 @@ export class NodeMonitor extends EventEmitter {
       label: s.label,
       color: s.color,
       online: this.rpc.telemetry().online,
-      chain: s.chain,
-      ibd: s.chainInfo?.initialblockdownload ?? null,
+      chain: chainName(s.chain),
+      ibd: boolOrNull(s.chainInfo?.initialblockdownload),
       tip: {
         height: s.chainInfo?.blocks ?? null,
         headers: s.chainInfo?.headers ?? null,
@@ -1841,12 +1854,12 @@ export class NodeMonitor extends EventEmitter {
       sync: computeSync({
         blocks: s.chainInfo?.blocks ?? null,
         headers: s.chainInfo?.headers ?? null,
-        ibd: s.chainInfo?.initialblockdownload ?? null,
+        ibd: boolOrNull(s.chainInfo?.initialblockdownload),
         verificationProgress: s.chainInfo?.verificationprogress ?? null,
         tipTime: s.chainInfo?.time ?? null,
         bestHash: s.chainInfo?.bestblockhash ?? null,
         sizeOnDisk: s.chainInfo?.size_on_disk ?? null,
-        chain: s.chain,
+        chain: chainName(s.chain),
         warnings: s.chainInfo?.warnings ?? [],
         blockRatePerSec: this.blockRateFast.rate(),
         blockRateFastSpanMs: this.blockRateFast.span,
@@ -1875,7 +1888,7 @@ export class NodeMonitor extends EventEmitter {
       hashrateNote: hashrateSuppressed ?? (hashrateRaw == null ? 'difficulty or a block-gap sample is missing' : null),
       avgBlockGapSec: avgGap,
       sizeOnDisk: s.chainInfo?.size_on_disk ?? null,
-      pruned: s.chainInfo?.pruned ?? null,
+      pruned: boolOrNull(s.chainInfo?.pruned),
       chainwork: s.chainInfo?.chainwork ?? null,
       uptimeSec: s.uptimeSec ?? null,
       network: s.networkInfo ? {
@@ -1901,7 +1914,7 @@ export class NodeMonitor extends EventEmitter {
         minFee: mi.mempoolminfee ?? null,
         minRelayFee: mi.minrelaytxfee ?? null,
         incrementalRelayFee: mi.incrementalrelayfee ?? null,
-        unbroadcast: mi.unbroadcastcount ?? null,
+        unbroadcast: countOrNull(mi.unbroadcastcount),
         maxDataCarrier: mi.maxdatacarriersize ?? null,
         permitBareMultisig: mi.permitbaremultisig ?? null,
         ingestRate: s.logState.relayRate ?? s.logState.acceptRate ?? null,
@@ -2038,7 +2051,7 @@ export class NodeMonitor extends EventEmitter {
       indexes: s.indexes,
       tips: s.tips,
       deployments: s.deployments,
-      rpcInfo: s.rpcInfo,
+      rpcInfo: s.rpcInfo ? { ...s.rpcInfo, logpath: shortPath(s.rpcInfo.logpath) } : null,   // no directories to viewers (audit 2026-09-16, L11)
       log: {
         ...(this.tail ? this.tail.status() : { exists: false, file: null }),
         // 'disabled' is a configuration decision; 'missing' would be a fault. The
@@ -2128,7 +2141,7 @@ export class NodeMonitor extends EventEmitter {
     // the bar without drawing which node it belongs to.
     out.sync.node = s.id;
     out.sync.nodeLabel = s.label;
-    out.sync.endpoint = this.cfg.rpcUrl;
+    out.sync.endpoint = displayUrl(this.cfg.rpcUrl);   // no userinfo to viewers (audit 2026-09-16, L3)
     // One dense row for every state; `strip` is the ordered facts to draw in it.
     out.sync.strip = stripFacts(out.sync);
     return out;

package/server/collect/network.js

@@ -16,7 +16,7 @@
 //                and the view says how far it has got
 //
 // The arithmetic is in pure functions above the class, which is what the tests hold.
-import { decodeCoinbase, matchPool, aliasFor, tagFingerprint } from './mining.js';
+import { decodeCoinbaseSafe, matchPool, aliasFor, tagFingerprint } from './mining.js';
 
 export const EPOCH = 2016;
 export const TARGET_SPACING = 600;
@@ -256,16 +256,26 @@ export class NetworkStats {
     const withCb = withHash.map((x, k) => ({ ...x, block: blocks[k]?.ok ? blocks[k].result : null })).filter((x) => x.block?.tx?.length);
     const cbs = await this.rpc.batch(withCb.map((x) => ({ method: 'getrawtransaction', params: [x.block.tx[0], 2, x.hash] })), { priority: 7, heavy: true });
     const map = this.poolMapOf(), aliases = this.aliasesOf();
+    // 2026-09-16 (audit L4): one block's coinbase used to be able to throw out of this loop,
+    // and pumpPools then put the whole chunk of eight back at the front and retried it every
+    // 15 s -- forever, since the bytes never change. Only the RPC calls above are worth a
+    // retry. A block whose coinbase cannot be read is a permanent fact about that block: it
+    // is recorded as an unknown pool (`unparseable`) and the week keeps filling.
     withCb.forEach((x, k) => {
       const tx = cbs[k]?.ok ? cbs[k].result : null;
-      const hex = tx?.vin?.[0]?.coinbase ?? '';
-      const decoded = decodeCoinbase(hex);
-      const tagText = decoded?.tagText ?? '';
-      const matched = matchPool(map, { tagText, rawHex: hex });
-      const rawKey = decoded?.tag ? decoded.tag : tagFingerprint(tagText);   // the ledger's own key rule (minerRow)
-      const key = matched ? matched.key : rawKey;
-      const name = matched ? matched.name : (aliasFor(aliases, rawKey) ?? rawKey);   // the ledger shows an unlabelled pool by its key
-      this.pools.set(x.h, { height: x.h, time: x.block.time, poolKey: key, name, labelled: !!matched, tagText });
+      const hex = typeof tx?.vin?.[0]?.coinbase === 'string' ? tx.vin[0].coinbase : '';
+      try {
+        const decoded = decodeCoinbaseSafe(hex);
+        const tagText = decoded?.tagText ?? '';
+        const matched = matchPool(map, { tagText, rawHex: hex });
+        const rawKey = decoded?.tag ? decoded.tag : tagFingerprint(tagText);   // the ledger's own key rule (minerRow)
+        const key = matched ? matched.key : rawKey;
+        const name = matched ? matched.name : (aliasFor(aliases, rawKey) ?? rawKey);   // the ledger shows an unlabelled pool by its key
+        this.pools.set(x.h, { height: x.h, time: x.block.time, poolKey: key, name, labelled: !!matched, tagText, ...(decoded?.decodeError ? { unparseable: true } : {}) });
+      } catch {
+        const key = tagFingerprint('');
+        this.pools.set(x.h, { height: x.h, time: x.block.time, poolKey: key, name: key, labelled: false, tagText: '', unparseable: true });
+      }
     });
     this.at = this.now();
   }

package/server/config.js

@@ -234,6 +234,12 @@ const DEFAULTS = {
     lockoutMs: 600000,
     cookieName: 'blockyard_sid',
     secureCookie: false, // forced true at boot when TLS is on
+    // OPEN MODE'S NODE CONNECTION IS SET FROM THIS MACHINE ONLY (audit 2026-09-16, M1/M2). With
+    // accounts off, the node-connection save and test are answered only for a loopback caller: the
+    // open-mode cross-site check stops a browser, never a script, and a script on the LAN could point
+    // the saved connection -- and with it the datadir cookie, after the next restart -- at itself, or
+    // make this server fetch its internal URLs. `true` restores the old reach, knowingly.
+    openNodeConfigFromNetwork: false,
   },
   actions: {
     // Anything that can change node or machine state is off unless explicitly
@@ -402,6 +408,7 @@ export function loadConfig({ configFile = defaultConfigFile(), ifaces = null, no
     'BLOCKYARD_DATA': ['store.dir', String],
     'BLOCKYARD_AUTH': ['auth.enabled', Boolean],
     'BLOCKYARD_ALLOW_WRITES_WITHOUT_AUTH': ['actions.allowWritesWithoutAuth', Boolean],
+    'BLOCKYARD_OPEN_NODE_CONFIG_FROM_NETWORK': ['auth.openNodeConfigFromNetwork', Boolean],
     // Run on RPC alone: 0 turns the log tail off for every node. Measured why is
     // in server/collect/monitor.js and MEASUREMENTS 3/4 -- bandwidth and per-peer
     // bytes work on builds that publish them and do not on the deployed one.

package/server/http/api.js

@@ -4,7 +4,7 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { classifyMethod, allowlistSummary, ACTIONS, actionAllowed, NODE_REFUSES } from '../rpc/allowlist.js';
-import { RpcClient } from '../rpc/client.js';
+import { RpcClient, displayUrl, shortPath } from '../rpc/client.js';
 import { SERIES } from '../store/history.js';
 import { randomPassword } from '../auth/users.js';
 import { formatEta, formatBytes } from '../util/fmt.js';
@@ -98,6 +98,33 @@ function configWriteAllowed(app, ctx) {
   if (app.cfg.auth.enabled) needRole(ctx, 'admin');
 }
 
+// THE NODE CONNECTION IN OPEN MODE: FROM THIS MACHINE ONLY (audit 2026-09-16, M1 and M2).
+//
+// The open-mode cross-site check refuses a browser on another origin, because a browser cannot
+// suppress Origin or forge Sec-Fetch-Site. A script sends neither header, and can forge both. So with
+// accounts off, a script anywhere on the LAN could (1) save an rpcUrl of its choosing, after which the
+// next restart sends the datadir's cookie to it -- reproduced end to end -- and (2) use the probe to
+// make this server POST to internal URLs and read back what they answered. There is no identity to
+// check in open mode, so the check is WHERE the caller is: the socket's own peer address must be
+// loopback. X-Forwarded-For is never consulted, and behind a trusted proxy every request would look
+// local, so the form is refused there. `auth.openNodeConfigFromNetwork` restores the old reach.
+// Full server paths go to an admin; everyone else, which in open mode is anyone who can reach the
+// port, gets the last two parts (audit 2026-09-16, L11).
+const pathFor = (ctx, p) => (ctx.user?.role === 'admin' ? p : shortPath(p));
+
+export function isLoopbackAddress(addr) {
+  const a = String(addr ?? '').replace(/^::ffff:/i, '');
+  return a === '::1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(a);
+}
+function nodeConfigAllowed(app, ctx) {
+  if (app.cfg.auth.enabled) return needRole(ctx, 'admin');
+  if (app.cfg.auth.openNodeConfigFromNetwork === true) return undefined;
+  if (!app.cfg.server?.trustProxy && isLoopbackAddress(ctx.req.socket?.remoteAddress)) return undefined;
+  throw new HttpError(403, app.cfg.server?.trustProxy
+    ? 'with accounts off and server.trustProxy on, the node connection cannot be changed over HTTP: every proxied request looks local. Edit config/local.json, or turn accounts on'
+    : 'with accounts off, the node connection can only be changed from this machine (open the monitor at 127.0.0.1), or turn accounts on, or set auth.openNodeConfigFromNetwork', { code: 'local_only' });
+}
+
 // What a form may set, and nothing else. Credentials come from the datadir's .cookie
 // (config.js resolveCookie), so rpcUser / rpcPassword / cookieFile are NOT accepted here: taking a
 // password over an endpoint that is open by default is not a thing to add quietly.
@@ -538,7 +565,7 @@ export const routes = [
         let sync = null;
         try { sync = m.snapshot({ seriesRanges: {} }).sync; } catch { /* not yet populated */ }
         return {
-          id: m.id, label: m.label, color: m.color, rpcUrl: m.node?.rpcUrl ?? m.rpc.url,
+          id: m.id, label: m.label, color: m.color, rpcUrl: displayUrl(m.node?.rpcUrl ?? m.rpc.url),
           chain: m.state.chain, online: m.rpc.telemetry().online,
           optional: !!m.cfg.optional,
           syncState: sync?.state ?? null, pct: sync?.pct ?? null,
@@ -606,8 +633,11 @@ export const routes = [
       const params = Array.isArray(ctx.body?.params) ? ctx.body.params : [];
       const cls = classifyMethod(method);
       if (!cls.allowed) {
-        await app.audit({ type: 'rpc-denied', username: ctx.user.username, node: m.id, method, reason: cls.reason, ip: ctx.ip });
-        throw new HttpError(403, `${method || '(empty)'} is not callable from the web UI: ${cls.reason}`, { code: 'rpc_denied' });
+        // No RPC name is longer than a few dozen characters; the caller's string is clamped before
+        // it is written or echoed (audit 2026-09-16, M6).
+        const shown = method.length > 64 ? `${method.slice(0, 64)}… (${method.length} chars)` : method;
+        await app.audit({ type: 'rpc-denied', username: ctx.user.username, node: m.id, method: shown, reason: cls.reason, ip: ctx.ip });
+        throw new HttpError(403, `${shown || '(empty)'} is not callable from the web UI: ${cls.reason}`, { code: 'rpc_denied' });
       }
       const t0 = Date.now();
       try {
@@ -772,7 +802,7 @@ export const routes = [
   {
     method: 'POST', path: '/api/config/node/test', auth: 'any', csrf: true, body: true,
     handler: async (ctx, app) => {
-      configWriteAllowed(app, ctx);
+      nodeConfigAllowed(app, ctx);
       const node = candidateNode(app, ctx.body);
       const started = Date.now();
       // A THROWAWAY CLIENT WITH ITS OWN LANE. The live node's client holds a serialized queue
@@ -825,9 +855,22 @@ export const routes = [
         // `authenticated` is reported on EVERY path, success or failure: a caller cannot otherwise
         // tell "it refused us" from "we deliberately sent no credential", and those mean different
         // things to someone deciding whether the connection they typed is right.
+        //
+        // NOT WHAT A FOREIGN ENDPOINT SAID (audit 2026-09-16, M2). RpcClient's message carries up to
+        // 200 characters of the reply body, so echoing it made this route a way to read internal URLs
+        // through the server. For any endpoint but the configured one, the answer is the class of
+        // failure only.
+        const GENERIC = {
+          timeout: 'the endpoint did not answer in time',
+          transport: 'the endpoint could not be reached, or answered with an HTTP error',
+          parse: 'the endpoint answered, but not with JSON-RPC: this is not a Bitcoin Core RPC port',
+          rpc: 'the endpoint answered with an RPC error',
+          breaker: 'the endpoint could not be reached',
+        };
+        const message = sameEndpoint ? err.message : (GENERIC[err.kind] ?? 'the connection failed');
         return {
           ok: false, ms: Date.now() - started, authenticated: sameEndpoint,
-          error: { message: err.message, kind: err.kind ?? null, code: err.code ?? null },
+          error: { message, kind: err.kind ?? null, code: sameEndpoint ? (err.code ?? null) : null },
         };
       }
     },
@@ -835,7 +878,7 @@ export const routes = [
   {
     method: 'POST', path: '/api/config/node', auth: 'any', csrf: true, body: true,
     handler: async (ctx, app) => {
-      configWriteAllowed(app, ctx);
+      nodeConfigAllowed(app, ctx);
       if (!app.configFile) {
         throw new HttpError(409, 'this process was started without a config file (BLOCKYARD_CONFIG=none), so there is nowhere to save to', { code: 'no_config_file' });
       }
@@ -850,7 +893,21 @@ export const routes = [
       // JSON.stringify then omits it -- so carrying `{...cur}` across could DELETE a field from the
       // file rather than preserve it. Only real values take part in the merge.
       const changes = Object.fromEntries(Object.entries(node).filter(([, v]) => v !== undefined));
-      nodes[0] = { ...(nodes[0] ?? {}), ...changes };
+      // CREDENTIALS BELONG TO AN ENDPOINT (audit 2026-09-16, M1). The merge kept rpcUser, rpcPassword
+      // and cookieFile while the URL changed, so a saved address inherited another server's secret.
+      // When the host or port changes they are dropped; the cookie is then read from the datadir the
+      // form names, which is the credential this form was always meant to use.
+      const hostOf = (u) => { try { return new URL(u).host; } catch { return null; } };
+      const prior = nodes[0] ?? {};
+      const droppedCredentials = [];
+      if (prior.rpcUrl && hostOf(prior.rpcUrl) !== hostOf(changes.rpcUrl)) {
+        for (const k of ['rpcUser', 'rpcPassword', 'cookieFile']) if (k in prior) droppedCredentials.push(k);
+      }
+      nodes[0] = { ...prior, ...changes };
+      for (const k of droppedCredentials) delete nodes[0][k];
+      if (droppedCredentials.length && !nodes[0].datadir) {
+        throw new HttpError(400, 'a new endpoint needs a datadir, so its own .cookie can be read', { code: 'need_datadir' });
+      }
       delete nodes[0].__urlOverridden;
       const next = { ...fileCfg, nodes };
 
@@ -870,7 +927,7 @@ export const routes = [
         .filter((k) => process.env[k] !== undefined && process.env[k] !== '');
       await app.audit({ type: 'config-node', username: ctx.user.username, ip: ctx.ip, rpcUrl: node.rpcUrl, file: app.configFile });
       return {
-        ok: true, file: app.configFile, restartRequired: true, envOverrides,
+        ok: true, file: app.configFile, restartRequired: true, envOverrides, droppedCredentials,
         note: envOverrides.length
           ? `saved, but this process takes its node from ${envOverrides.join(', ')}, which the environment sets and which beats the file — change the unit or drop-in, or the restart will keep the old endpoint`
           : 'saved; restart the monitor for it to take effect',
@@ -896,12 +953,12 @@ export const routes = [
     handler: async (ctx, app) => {
       try {
         const raw = await fsp.readFile(app.settingsFile, 'utf8');
-        return { settings: JSON.parse(raw), file: app.settingsFile, stored: true };
+        return { settings: JSON.parse(raw), file: pathFor(ctx, app.settingsFile), stored: true };
       } catch (err) {
         // Nothing saved yet is the normal first-run answer, not a fault: the client then keeps its
         // own defaults and offers to push them up. A CORRUPT file is different and says so.
-        if (err.code === 'ENOENT') return { settings: null, file: app.settingsFile, stored: false };
-        return { settings: null, file: app.settingsFile, stored: false, error: `unreadable: ${err.message}` };
+        if (err.code === 'ENOENT') return { settings: null, file: pathFor(ctx, app.settingsFile), stored: false };
+        return { settings: null, file: pathFor(ctx, app.settingsFile), stored: false, error: `unreadable: ${err.message.replaceAll(app.settingsFile, pathFor(ctx, app.settingsFile))}` };
       }
     },
   },
@@ -927,7 +984,7 @@ export const routes = [
       await fh.close();
       await fsp.rename(tmp, app.settingsFile);
 
-      return { ok: true, file: app.settingsFile, bytes: text.length };
+      return { ok: true, file: pathFor(ctx, app.settingsFile), bytes: text.length };
     },
   },
 ];

package/server/http/server.js

@@ -17,6 +17,7 @@ import { ipDecision } from '../netinfo.js';
 export { ipAllowed, parseIp, parseCidr } from '../netinfo.js';
 
 const MAX_BODY = 1024 * 1024; // 1 MB: a raw transaction is nowhere near this
+export const REQUEST_TIMEOUT_MS = 30_000; // the whole request, body included, must arrive within this
 
 function compile(routesTable) {
   return routesTable.map((r) => {
@@ -57,10 +58,13 @@ export function createAppServer(app) {
     ? https.createServer({ ...app.tlsOptions }, listener)
     : http.createServer(listener);
   server.keepAliveTimeout = 5000;
-  server.headersTimeout = 10000;
-  // SSE connections are long-lived by design; do not let the defaults reap them.
-  server.requestTimeout = 0;
+  // A DEADLINE FOR RECEIVING THE WHOLE REQUEST, body included (audit 2026-09-16, M5). This was 0,
+  // "so SSE connections are not reaped" -- but requestTimeout bounds only how long the REQUEST takes
+  // to arrive, and a stream's GET has arrived the moment its headers do; the response may then run
+  // for days. Measured on Node 22: with a 1.5 s deadline a stream kept delivering for 5 s, while a
+  // POST trickling one body byte every 500 ms got 408 at 2 s. At 0, that POST was held forever.
   server.headersTimeout = 15000;
+  server.requestTimeout = REQUEST_TIMEOUT_MS;
 
   async function handle(req, res) {
     const ip = clientIp(req, app.cfg);
@@ -116,13 +120,20 @@ export function createAppServer(app) {
           },
         });
       }
-      const client = app.hub.add(req, res, { user: user.user, nodeId: wantNode });
+      // A BOUNDED NUMBER OF STREAMS PER ADDRESS OR ACCOUNT (audit 2026-09-16, H1). The rate limiter
+      // above only paces how fast streams open; it never capped how many stay open.
+      const streamKey = openAccess ? `ip:${ip}` : `user:${user.user.id}`;
+      if (app.hub.countFor(streamKey) >= app.hub.limits.maxPerKey) {
+        return sendJson(req, res, 429, { error: { message: `too many open streams (${app.hub.limits.maxPerKey}) for this ${openAccess ? 'address' : 'account'}`, kind: 'ratelimited' } });
+      }
+      const client = app.hub.add(req, res, { user: user.user, nodeId: wantNode, key: streamKey });
       app.log({ level: 'info', msg: `sse #${client.id} opened by ${user.user.username} (${ip})` });
       req.on('close', () => app.log({ level: 'info', msg: `sse #${client.id} closed (${Math.round((Date.now() - started) / 1000)}s)` }));
       return undefined;
     }
 
     const match = matchRoute(compiled, req.method, path);
+    if (match?.badPath) return sendJson(req, res, 400, { error: { message: 'malformed percent-encoding in the path', kind: 'bad_request' } });
     if (match?.methodMismatch) {
       res.setHeader('Allow', [...new Set(compiled.filter((r) => r.re.test(path)).map((r) => r.method))].join(', '));
       return sendJson(req, res, 405, { error: { message: `${req.method} is not allowed on ${path}`, kind: 'method' } });
@@ -309,7 +320,13 @@ function matchRoute(compiled, method, path) {
     if (!m) continue;
     if (r.method !== method) { methodMismatch = true; continue; }
     const params = {};
-    r.names.forEach((n, i) => { params[n] = decodeURIComponent(m[i + 1]); });
+    // A malformed escape in a path parameter is the client's mistake, and answered as one: it used to
+    // throw here and come back as a 500 "internal error" (audit 2026-09-16, L13).
+    try {
+      r.names.forEach((n, i) => { params[n] = decodeURIComponent(m[i + 1]); });
+    } catch {
+      return { badPath: true };
+    }
     return { route: r, params };
   }
   return methodMismatch ? { methodMismatch: true } : null;

package/server/http/sse.js

@@ -10,6 +10,20 @@
 // are coalesced per client -- at most one snapshot in flight, latest wins -- and
 // the event feed is batched. A client that cannot keep up sees a coarser stream,
 // never an unbounded queue that takes the process down.
+//
+// THAT LAST SENTENCE WAS NOT TRUE UNTIL 2026-09-16 (audit H1). Coalescing only helps if nothing is
+// written while the socket is full, and flush() wrote every pending frame regardless: `write()`
+// noted `backpressured` and nothing ever read it. The reaper removed a client only if it had been
+// sent zero bytes, which no client ever has. So a reader that stopped reading kept every snapshot
+// queued in Node's socket buffer: 400 stalled connections took a test instance from 73 MB to 1.5 GB
+// in three minutes. Now a backpressured client is sent nothing (its pending snapshot keeps being
+// replaced, latest wins) until the socket drains; one whose buffer passes a ceiling, or that stays
+// blocked past a deadline, is dropped; and one address holds a bounded number of streams.
+export const SSE_LIMITS = Object.freeze({
+  maxBufferedBytes: 4 * 1024 * 1024,   // well above one snapshot; a client this far behind is not reading
+  maxBlockedMs: 60_000,                // blocked for a minute: an EventSource reconnects on its own
+  maxPerKey: 16,                       // streams per address (open mode) or per account
+});
 class Client {
   constructor(res, user, id) {
     this.res = res;
@@ -25,13 +39,17 @@ class Client {
     this.alive = true;
     this.lastWriteAt = Date.now();
     this.nodeId = null;
+    this.key = null;
+    this.backpressured = false;
+    this.blockedSince = 0;
   }
 
   get dead() { return !this.alive || this.res.writableEnded || this.res.destroyed; }
 }
 
 export class StreamHub {
-  constructor({ log = () => {} } = {}) {
+  constructor({ log = () => {}, limits = {} } = {}) {
+    this.limits = { ...SSE_LIMITS, ...limits };
     this.clients = new Set();
     this.log = log;
     this.seq = 0;
@@ -39,10 +57,18 @@ export class StreamHub {
     this.timer = null;
   }
 
-  add(req, res, { user = null, nodeId = null } = {}) {
+  /** How many open streams share this key (an address in open mode, an account otherwise). */
+  countFor(key) {
+    let n = 0;
+    for (const c of this.clients) if (c.key === key && !c.dead) n += 1;
+    return n;
+  }
+
+  add(req, res, { user = null, nodeId = null, key = null } = {}) {
     const id = ++this.seq;
     const client = new Client(res, user, id);
     client.nodeId = nodeId;
+    client.key = key;
     res.writeHead(200, {
       'Content-Type': 'text/event-stream; charset=utf-8',
       'Cache-Control': 'no-cache, no-store, must-revalidate',
@@ -55,6 +81,11 @@ export class StreamHub {
     req.on('close', close);
     req.on('aborted', close);
     res.on('error', close);
+    res.on('drain', () => {
+      client.backpressured = false;
+      client.blockedSince = 0;
+      this.flush();
+    });
     if (!this.timer) this.startHeartbeat();
     return client;
   }
@@ -70,24 +101,35 @@ export class StreamHub {
     const tick = () => {
       for (const c of [...this.clients]) {
         if (c.dead) { this.remove(c); continue; }
+        if (this.stalled(c)) continue;
         // A comment frame keeps intermediaries from reaping an idle stream and
-        // lets us notice a dead socket on our own terms.
-        if (this.write(c, ': ping\n\n')) {
-          if (Date.now() - c.lastWriteAt > 120_000 && c.bytes === 0) this.remove(c);
-        }
+        // lets us notice a dead socket on our own terms. Never onto a full socket.
+        if (!c.backpressured) this.write(c, ': ping\n\n');
       }
     };
     this.timer = setInterval(tick, this.heartbeatMs);
     this.timer.unref?.();
   }
 
+  /** Drop a client that is too far behind, or blocked too long; true if it was dropped. */
+  stalled(client) {
+    const buffered = client.res.writableLength ?? 0;
+    const blockedFor = client.backpressured && client.blockedSince ? Date.now() - client.blockedSince : 0;
+    if (buffered <= this.limits.maxBufferedBytes && blockedFor <= this.limits.maxBlockedMs) return false;
+    this.log({ level: 'warn', msg: `sse #${client.id} dropped: not reading (${Math.round(buffered / 1024)} KB buffered, blocked ${Math.round(blockedFor / 1000)}s)` });
+    this.remove(client);
+    try { client.res.destroy(); } catch { /* already gone */ }
+    return true;
+  }
+
   write(client, frame) {
     if (client.dead) return false;
     try {
       const ok = client.res.write(frame);
       client.bytes += frame.length;
       client.lastWriteAt = Date.now();
-      if (!ok) client.backpressured = true;
+      if (!ok && !client.backpressured) { client.backpressured = true; client.blockedSince = Date.now(); }
+      if (!ok) this.stalled(client);
       return ok;
     } catch (err) {
       this.log({ level: 'debug', msg: `sse write failed: ${err.message}` });
@@ -142,6 +184,9 @@ export class StreamHub {
       this.flushing = false;
       for (const c of [...this.clients]) {
         if (c.dead) { this.remove(c); continue; }
+        // A full socket gets nothing more: what is pending stays pending (and is replaced by
+        // newer state) until 'drain' flushes again.
+        if (c.backpressured) { this.stalled(c); continue; }
         if (c.pendingSnapshot !== null) {
           const snap = c.pendingSnapshot;
           c.pendingSnapshot = null;
@@ -166,6 +211,7 @@ export class StreamHub {
       perClient: [...this.clients].map((c) => ({
         id: c.id, user: c.user?.username ?? null, seconds: Math.round((Date.now() - c.connectedAt) / 1000),
         kb: Math.round(c.bytes / 1024), dropped: { ...c.dropped }, node: c.nodeId,
+        backpressured: c.backpressured, bufferedKb: Math.round((c.res.writableLength ?? 0) / 1024),
       })),
     };
   }

package/server/main.js

@@ -26,8 +26,9 @@ const VERSION = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf
 
 export async function boot({ configFile, log: logOverride = null } = {}) {
   const cfg = loadConfig({ configFile });
-  await fsp.mkdir(cfg.store.dir, { recursive: true });
-  await fsp.mkdir(cfg.auth.dataDir, { recursive: true });
+  // owner-only where this creates them (audit 2026-09-16, L10); an existing directory keeps its mode
+  await fsp.mkdir(cfg.store.dir, { recursive: true, mode: 0o700 });
+  await fsp.mkdir(cfg.auth.dataDir, { recursive: true, mode: 0o700 });
 
   const app = {
     version: VERSION,
@@ -269,7 +270,12 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   // which are not secrets, and an audit trail full of [redacted] where the useful fields were is
   // its own kind of failure.
   const SECRETISH = /pass(word|phrase)?|secret|cookie|token|priv(ate)?_?key|seed|mnemonic|authorization|credential/i;
+  // AND CLAMP BY LENGTH (audit 2026-09-16, M6). A caller-chosen string went into the trail whole:
+  // a 900 KB RPC method name, sixty times over, rotated every retained file and took the sign-ins and
+  // user changes with it. No field the trail needs is anywhere near this long.
+  const AUDIT_STRING_MAX = 1024;
   const redact = (v, depth = 0) => {
+    if (typeof v === 'string' && v.length > AUDIT_STRING_MAX) return `${v.slice(0, AUDIT_STRING_MAX)}…[${v.length - AUDIT_STRING_MAX} more chars]`;
     if (v == null || depth > 6) return v;
     if (Array.isArray(v)) return v.map((x) => redact(x, depth + 1));
     if (typeof v !== 'object') return v;
@@ -485,10 +491,14 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
       heartbeat.unref?.();
       buildIndex({
         rpc, blocksDir: path.join(m.cfg.datadir, 'blocks'), out: dir, workers, pace,
+        // AN INTERRUPTED BUILD RESUMES (build.js, THE BUILD JOURNAL): where it resumed, or why the
+        // unfinished work was thrown away, is an event like the start
+        log: (text) => say(text),
         onProgress: (p) => {
           if (p.phase !== phase) { phase = p.phase; phaseAt = Date.now(); }
           const elapsed = (Date.now() - phaseAt) / 1000;
-          const rate = elapsed > 0 && p.done > 0 ? p.done / elapsed : 0;
+          // a resumed build starts the phase part way (`from`): the rate is this run's, not the earlier one's
+          const rate = elapsed > 0 && p.done > (p.from ?? 0) ? (p.done - (p.from ?? 0)) / elapsed : 0;
           Object.assign(status, { phase: p.phase, done: p.done, total: p.total, rows: p.rows ?? status.rows, eta: rate > 0 && p.total > p.done ? HMS((p.total - p.done) / rate) : null });
           lastProgressAt = Date.now();
           if (Date.now() - lastFlag > 5000) {

package/server/rpc/allowlist.js

@@ -48,8 +48,33 @@ const ALLOW_PREFIXES = ['get', 'list', 'estimate', 'verify', 'estimat', 'help',
 // transactions, which is a write in every way that matters.
 const DENY_PREFIXES = ['generate', 'invalidate', 'reconsider', 'import', 'send', 'set', 'unload', 'load', 'sign'];
 
+// EVERY WALLET RPC, READ-SHAPED OR NOT (audit 2026-09-16, M4). The `get` and `list` prefixes let
+// `listdescriptors true` and `gethdkeys {"private":true}` through, and both return private keys
+// from an unlocked wallet -- to anyone the console serves, which in open mode is anyone who can
+// reach the port. The monitor has no use for a wallet, so the whole category is refused by name.
+// The list is Bitcoin Core's own "== Wallet ==" section of `help` (Core 29/30, taken 2026-09-16),
+// plus the legacy-wallet methods older nodes still answer.
+export const WALLET_METHODS = new Set([
+  'abandontransaction', 'abortrescan', 'addhdkey', 'backupwallet', 'bumpfee', 'createwallet',
+  'createwalletdescriptor', 'encryptwallet', 'exportwatchonlywallet', 'getaddressesbylabel',
+  'getaddressinfo', 'getbalance', 'getbalances', 'gethdkeys', 'getnewaddress', 'getrawchangeaddress',
+  'getreceivedbyaddress', 'getreceivedbylabel', 'gettransaction', 'getwalletinfo', 'importdescriptors',
+  'importprunedfunds', 'keypoolrefill', 'listaddressgroupings', 'listdescriptors', 'listlabels',
+  'listlockunspent', 'listreceivedbyaddress', 'listreceivedbylabel', 'listsinceblock', 'listtransactions',
+  'listunspent', 'listwalletdir', 'listwallets', 'loadwallet', 'lockunspent', 'migratewallet',
+  'psbtbumpfee', 'removeprunedfunds', 'rescanblockchain', 'restorewallet', 'send', 'sendall', 'sendmany',
+  'sendtoaddress', 'setlabel', 'setwalletflag', 'signmessage', 'signrawtransactionwithwallet',
+  'simulaterawtransaction', 'unloadwallet', 'walletcreatefundedpsbt', 'walletdisplayaddress', 'walletlock',
+  'walletpassphrase', 'walletpassphrasechange', 'walletprocesspsbt',
+  // legacy (pre-descriptor) wallets
+  'dumpprivkey', 'dumpwallet', 'importprivkey', 'importaddress', 'importpubkey', 'importmulti',
+  'importwallet', 'sethdseed', 'upgradewallet', 'getunconfirmedbalance', 'listaccounts', 'getaccount',
+  'getaccountaddress', 'getaddressesbyaccount', 'getreceivedbyaccount', 'listreceivedbyaccount',
+]);
+
 export function classifyMethod(method) {
   if (typeof method !== 'string' || !method) return { allowed: false, kind: 'unknown', reason: 'method name must be a string' };
+  if (WALLET_METHODS.has(method)) return { allowed: false, kind: 'wallet', reason: 'wallet RPCs are not exposed: some of them return private keys, and the monitor has no use for a wallet' };
   if (DENY_EXACT.has(method)) return { allowed: false, kind: 'write-or-heavy', reason: 'this method mutates state or monopolises the node\'s single-threaded RPC server' };
   for (const p of DENY_PREFIXES) if (method.startsWith(p) && !ALLOW_PREFIXES.includes(method)) return { allowed: false, kind: 'write', reason: `method starts with "${p}" and is treated as a mutation` };
   if (method === 'help' || method === 'uptime' || method === 'stop') {
@@ -73,6 +98,7 @@ export const NODE_REFUSES = new Set([
 export function allowlistSummary() {
   return {
     denyExactCount: DENY_EXACT.size,
+    walletDenied: WALLET_METHODS.size,
     allowPrefixes: [...new Set(ALLOW_PREFIXES)].sort(),
     denyPrefixes: [...new Set(DENY_PREFIXES)].sort(),
     defaultDecision: 'deny',