routstrd 0.3.11 → 0.4.1

package/src/daemon/wallet/receive-dedup.ts

@@ -0,0 +1,384 @@
+import { createHash } from "crypto";
+import type { ReceiveOperation } from "@cashu/coco-core";
+import type { Database } from "bun:sqlite";
+
+const TOKEN_TABLE = "routstrd_receive_tokens";
+const MAINTENANCE_TABLE = "routstrd_wallet_maintenance";
+const RECONCILE_BACKUP_KEY = "receive_reconcile_v1_backup";
+
+export type StoredReceiveTokenState = "processing" | "succeeded" | "failed";
+
+export interface StoredReceiveTokenRow {
+  tokenHash: string;
+  state: StoredReceiveTokenState;
+  operationId: string | null;
+  error: string | null;
+}
+
+export interface ReceiveTokenReservation {
+  acquired: boolean;
+  tokenHash: string;
+  existing?: StoredReceiveTokenRow;
+}
+
+export interface ReceiveReconcileResult {
+  executing: number;
+  uniqueGroups: number;
+  rolledBack: number;
+  retained: number;
+  unresolved: number;
+  recoveryOperationIds: string[];
+  backupPath?: string;
+}
+
+interface SerializedBlindedMessageLike {
+  amount: number;
+  id: string;
+  B_: string;
+}
+
+interface SerializedOutput {
+  blindedMessage: SerializedBlindedMessageLike;
+  secret: string;
+}
+
+interface SerializedOutputDataLike {
+  keep: SerializedOutput[];
+  send: SerializedOutput[];
+}
+
+type ExecutingReceive = Extract<ReceiveOperation, { state: "executing" }>;
+
+export interface ReceiveReconcileSource {
+  listExecuting(): Promise<ReceiveOperation[]>;
+  checkProofStates(operation: ExecutingReceive): Promise<Array<{ state: string }>>;
+  restoreOutputs(
+    mintUrl: string,
+    outputs: SerializedBlindedMessageLike[],
+  ): Promise<Array<{ B_: string }>>;
+  hasSavedOutputs(operation: ExecutingReceive): Promise<boolean>;
+  rollBack(operation: ExecutingReceive, reason: string): Promise<void>;
+}
+
+export function hashReceiveToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function initReceiveDedupSchema(database: Database): void {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS ${TOKEN_TABLE} (
+      tokenHash TEXT PRIMARY KEY,
+      state TEXT NOT NULL CHECK (state IN ('processing', 'succeeded', 'failed')),
+      operationId TEXT,
+      error TEXT,
+      createdAt INTEGER NOT NULL,
+      updatedAt INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS ${MAINTENANCE_TABLE} (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updatedAt INTEGER NOT NULL
+    );
+  `);
+}
+
+export function listProcessingReceiveTokens(database: Database): StoredReceiveTokenRow[] {
+  return database
+    .query(
+      `SELECT tokenHash, state, operationId, error
+       FROM ${TOKEN_TABLE} WHERE state = 'processing'`,
+    )
+    .all() as StoredReceiveTokenRow[];
+}
+
+export function deleteReceiveTokenReservation(database: Database, tokenHash: string): void {
+  database.query(`DELETE FROM ${TOKEN_TABLE} WHERE tokenHash = ?`).run(tokenHash);
+}
+
+export function clearInterruptedReceiveReservations(database: Database): number {
+  const result = database
+    .query(
+      `DELETE FROM ${TOKEN_TABLE}
+       WHERE state = 'processing' AND operationId IS NULL`,
+    )
+    .run();
+  return result.changes;
+}
+
+export function reserveReceiveToken(database: Database, token: string): ReceiveTokenReservation {
+  const tokenHash = hashReceiveToken(token);
+  const now = Math.floor(Date.now() / 1000);
+  const result = database
+    .query(
+      `INSERT OR IGNORE INTO ${TOKEN_TABLE}
+       (tokenHash, state, operationId, error, createdAt, updatedAt)
+       VALUES (?, 'processing', NULL, NULL, ?, ?)`,
+    )
+    .run(tokenHash, now, now);
+
+  if (result.changes > 0) return { acquired: true, tokenHash };
+
+  const existing = database
+    .query(
+      `SELECT tokenHash, state, operationId, error
+       FROM ${TOKEN_TABLE} WHERE tokenHash = ?`,
+    )
+    .get(tokenHash) as StoredReceiveTokenRow | null;
+  return { acquired: false, tokenHash, ...(existing ? { existing } : {}) };
+}
+
+export function releaseReceiveToken(database: Database, tokenHash: string): void {
+  database
+    .query(`DELETE FROM ${TOKEN_TABLE} WHERE tokenHash = ? AND operationId IS NULL`)
+    .run(tokenHash);
+}
+
+export function updateReceiveToken(
+  database: Database,
+  tokenHash: string,
+  update: { state: StoredReceiveTokenState; operationId?: string; error?: string },
+): void {
+  database
+    .query(
+      `UPDATE ${TOKEN_TABLE}
+       SET state = ?, operationId = COALESCE(?, operationId), error = ?, updatedAt = ?
+       WHERE tokenHash = ?`,
+    )
+    .run(
+      update.state,
+      update.operationId ?? null,
+      update.error ?? null,
+      Math.floor(Date.now() / 1000),
+      tokenHash,
+    );
+}
+
+export function receiveInputFingerprint(operation: ReceiveOperation): string {
+  // Legacy cleanup is intentionally stricter than new-request token hashing:
+  // only operations with the exact same proof material are grouped. A shared
+  // secret alone is not enough evidence to discard an operation.
+  const proofs = operation.inputProofs
+    .map((proof) => ({
+      amount: proof.amount,
+      id: proof.id,
+      secret: proof.secret,
+      C: proof.C,
+      witness: proof.witness ?? null,
+    }))
+    .sort((left, right) =>
+      JSON.stringify(left).localeCompare(JSON.stringify(right)),
+    );
+  return createHash("sha256")
+    .update(JSON.stringify([operation.mintUrl, operation.unit, proofs]))
+    .digest("hex");
+}
+
+export function groupExecutingReceives(
+  operations: ReceiveOperation[],
+): ExecutingReceive[][] {
+  const groups = new Map<string, ExecutingReceive[]>();
+  for (const operation of operations) {
+    if (operation.state !== "executing") continue;
+    const key = receiveInputFingerprint(operation);
+    const group = groups.get(key) ?? [];
+    group.push(operation);
+    groups.set(key, group);
+  }
+  return [...groups.values()].map((group) =>
+    group.sort((left, right) => left.createdAt - right.createdAt || left.id.localeCompare(right.id)),
+  );
+}
+
+function outputData(operation: ExecutingReceive): SerializedOutputDataLike | null {
+  const value = operation.outputData as unknown;
+  if (!value || typeof value !== "object") return null;
+  const candidate = value as Partial<SerializedOutputDataLike>;
+  if (!Array.isArray(candidate.keep) || !Array.isArray(candidate.send)) return null;
+  return { keep: candidate.keep, send: candidate.send };
+}
+
+function outputBlindedMessages(operation: ExecutingReceive): SerializedBlindedMessageLike[] {
+  const data = outputData(operation);
+  if (!data) return [];
+  return [...data.keep, ...data.send]
+    .map((entry) => entry?.blindedMessage)
+    .filter((message): message is SerializedBlindedMessageLike =>
+      Boolean(
+        message &&
+          typeof message.B_ === "string" &&
+          message.B_ &&
+          typeof message.id === "string" &&
+          Number.isFinite(message.amount),
+      ),
+    );
+}
+
+async function rollBackOthers(
+  source: ReceiveReconcileSource,
+  group: ExecutingReceive[],
+  retainedIds: Set<string>,
+  reason: string,
+): Promise<number> {
+  let count = 0;
+  for (const operation of group) {
+    if (retainedIds.has(operation.id)) continue;
+    await source.rollBack(operation, reason);
+    count++;
+  }
+  return count;
+}
+
+/**
+ * Reduce legacy executing receives before coco-core's per-operation recovery.
+ *
+ * No state is changed unless the evidence is conclusive:
+ * - saved local outputs identify the successful operation;
+ * - all inputs are unspent, so one deterministic retry is sufficient; or
+ * - all inputs are spent and restore identifies an output owner (or confirms
+ *   that none of the stored deterministic outputs exist).
+ *
+ * Unreachable mints, malformed output data, partial restore ownership, and
+ * mixed proof states are left untouched for normal recovery/manual review.
+ */
+export async function reconcileExecutingReceives(
+  source: ReceiveReconcileSource,
+): Promise<ReceiveReconcileResult> {
+  const executing = (await source.listExecuting()).filter(
+    (operation): operation is ExecutingReceive => operation.state === "executing",
+  );
+  const groups = groupExecutingReceives(executing);
+  const result: ReceiveReconcileResult = {
+    executing: executing.length,
+    uniqueGroups: groups.length,
+    rolledBack: 0,
+    retained: 0,
+    unresolved: 0,
+    recoveryOperationIds: [],
+  };
+
+  for (const group of groups) {
+    try {
+      const savedOwners = new Set<string>();
+      for (const operation of group) {
+        if (await source.hasSavedOutputs(operation)) savedOwners.add(operation.id);
+      }
+      if (savedOwners.size > 0) {
+        result.rolledBack += await rollBackOthers(
+          source,
+          group,
+          savedOwners,
+          "Duplicate receive: outputs already persisted by another operation",
+        );
+        result.retained += savedOwners.size;
+        result.recoveryOperationIds.push(...savedOwners);
+        continue;
+      }
+
+      const states = await source.checkProofStates(group[0]!);
+      const completeStates = states.length === group[0]!.inputProofs.length;
+      const allUnspent = completeStates && states.every((state) => state.state === "UNSPENT");
+      const allSpent = completeStates && states.every((state) => state.state === "SPENT");
+
+      if (allUnspent) {
+        const canonical = group.find((operation) => outputBlindedMessages(operation).length > 0);
+        if (!canonical) {
+          result.unresolved += group.length;
+          continue;
+        }
+        result.rolledBack += await rollBackOthers(
+          source,
+          group,
+          new Set([canonical.id]),
+          "Duplicate receive: identical inputs retained by canonical operation",
+        );
+        result.retained++;
+        result.recoveryOperationIds.push(canonical.id);
+        continue;
+      }
+
+      if (!allSpent) {
+        result.unresolved += group.length;
+        continue;
+      }
+
+      const outputOwners = new Map<
+        string,
+        { message: SerializedBlindedMessageLike; owners: Set<string> }
+      >();
+      let malformed = false;
+      for (const operation of group) {
+        const outputs = outputBlindedMessages(operation);
+        if (outputs.length === 0) {
+          malformed = true;
+          continue;
+        }
+        for (const output of outputs) {
+          const entry = outputOwners.get(output.B_) ?? {
+            message: output,
+            owners: new Set<string>(),
+          };
+          entry.owners.add(operation.id);
+          outputOwners.set(output.B_, entry);
+        }
+      }
+      if (malformed || outputOwners.size === 0) {
+        result.unresolved += group.length;
+        continue;
+      }
+
+      const restored = await source.restoreOutputs(
+        group[0]!.mintUrl,
+        [...outputOwners.values()].map((entry) => entry.message),
+      );
+      const restoredOwners = new Set<string>();
+      for (const output of restored) {
+        for (const owner of outputOwners.get(output.B_)?.owners ?? []) {
+          restoredOwners.add(owner);
+        }
+      }
+
+      if (restoredOwners.size === 0) {
+        for (const operation of group) {
+          await source.rollBack(
+            operation,
+            "Recovered: input proofs spent without recoverable outputs",
+          );
+          result.rolledBack++;
+        }
+        continue;
+      }
+
+      result.rolledBack += await rollBackOthers(
+        source,
+        group,
+        restoredOwners,
+        "Duplicate receive: recoverable outputs belong to another operation",
+      );
+      result.retained += restoredOwners.size;
+      result.recoveryOperationIds.push(...restoredOwners);
+    } catch {
+      // A network, parsing, or persistence failure is not evidence that an
+      // operation is safe to abandon. Leave the complete group untouched.
+      result.unresolved += group.length;
+    }
+  }
+
+  return result;
+}
+
+export function getReceiveReconcileBackup(database: Database): string | null {
+  const row = database
+    .query(`SELECT value FROM ${MAINTENANCE_TABLE} WHERE key = ?`)
+    .get(RECONCILE_BACKUP_KEY) as { value: string } | null;
+  return row?.value ?? null;
+}
+
+export function setReceiveReconcileBackup(database: Database, path: string): void {
+  database
+    .query(
+      `INSERT INTO ${MAINTENANCE_TABLE} (key, value, updatedAt)
+       VALUES (?, ?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value, updatedAt = excluded.updatedAt`,
+    )
+    .run(RECONCILE_BACKUP_KEY, path, Math.floor(Date.now() / 1000));
+}

package/src/daemon/wallet/wallet-state.ts

@@ -0,0 +1,75 @@
+import { existsSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+
+/**
+ * Pure wallet-migration state detection, shared by the actual migration and by
+ * the doctor diagnostics so the two cannot disagree about startup behavior.
+ */
+
+export type WalletState = "absent" | "database-only" | "initialized";
+
+export function walletState(configPath: string, dbPath: string): WalletState {
+  const hasConfig = existsSync(configPath);
+  const hasDb = existsSync(dbPath);
+  if (hasConfig) return "initialized";
+  if (hasDb) return "database-only";
+  return "absent";
+}
+
+export function filesEqual(left: string, right: string): boolean {
+  if (!existsSync(left) || !existsSync(right)) return false;
+  if (statSync(left).size !== statSync(right).size) return false;
+  return readFileSync(left).equals(readFileSync(right));
+}
+
+export type WalletMigrationClass =
+  | { kind: "fresh" }
+  | { kind: "already-current" }
+  | { kind: "migrate" }
+  | { kind: "conflict" }
+  | { kind: "database-only"; targetState: WalletState; sourceState: WalletState }
+  | { kind: "orphaned-sidecars" };
+
+/**
+ * Classify the two wallet locations exactly the way `migrateLegacyWallet`
+ * decides what to do. This is the single source of truth for startup behavior;
+ * `migrateLegacyWallet` maps it onto actions/errors and the doctor maps it onto
+ * verdict text.
+ */
+export function classifyWalletMigration(
+  targetDir: string,
+  sourceDir: string,
+): WalletMigrationClass {
+  const targetConfig = join(targetDir, "config.json");
+  const targetDb = join(targetDir, "coco.db");
+  const sourceConfig = join(sourceDir, "config.json");
+  const sourceDb = join(sourceDir, "coco.db");
+  const sourceWal = `${sourceDb}-wal`;
+  const sourceShm = `${sourceDb}-shm`;
+
+  const targetState = walletState(targetConfig, targetDb);
+  const sourceState = walletState(sourceConfig, sourceDb);
+
+  // config.json is sufficient for a newly initialized wallet; coco.db is
+  // created on first open. A database without its mnemonic is never usable.
+  if (targetState === "initialized" && sourceState === "initialized") {
+    // A prior migration may have committed successfully but failed to remove
+    // its source files. Identical leftovers are safe; divergent wallets are not.
+    const configsMatch = filesEqual(targetConfig, sourceConfig);
+    const databasesMatch =
+      !existsSync(targetDb) && !existsSync(sourceDb)
+        ? true
+        : filesEqual(targetDb, sourceDb);
+    if (configsMatch && databasesMatch) return { kind: "already-current" };
+    return { kind: "conflict" };
+  }
+  if (targetState === "initialized") return { kind: "already-current" };
+  if (!existsSync(sourceDb) && (existsSync(sourceWal) || existsSync(sourceShm))) {
+    return { kind: "orphaned-sidecars" };
+  }
+  if (targetState === "database-only" || sourceState === "database-only") {
+    return { kind: "database-only", targetState, sourceState };
+  }
+  if (sourceState === "absent") return { kind: "fresh" };
+  return { kind: "migrate" };
+}

package/src/integrations/claudecode.ts

@@ -27,7 +27,8 @@ export async function installClaudeCodeIntegration(
       settings = JSON.parse(content);
     }
   } catch (error) {
-    console.error(`Error reading ${configPath}, creating new one.`);
+    console.error(`Failed to read or parse ${configPath}; leaving it unchanged:`, error);
+    return;
   }
 
   if (!settings.env) {

package/src/integrations/hermes.ts

@@ -17,6 +17,13 @@ interface HermesCustomProvider {
   [key: string]: unknown;
 }
 
+/** Hermes references a custom provider as `custom:<slug>`, where the slug is
+ *  the provider name lowercased with runs of whitespace collapsed to hyphens
+ *  (e.g. `Routstr (routstr.ft.hn)` -> `custom:routstr-(routstr.ft.hn)`). */
+function hermesProviderRef(name: string): string {
+  return `custom:${name.toLowerCase().replace(/\s+/g, "-")}`;
+}
+
 export function mergeHermesConfig(
   content: string,
   routstr: HermesRoutstrConfig,
@@ -29,8 +36,9 @@ export function mergeHermesConfig(
   const urlDisplay = routstr.baseUrl
     .replace(/\/v1$/, "")
     .replace(/^https?:\/\//, "");
+  const providerName = `Routstr (${urlDisplay})`;
   const provider = {
-    name: `Routstr (${urlDisplay})`,
+    name: providerName,
     base_url: routstr.baseUrl,
     api_key: routstr.apiKey,
     model: routstr.defaultModel,
@@ -46,17 +54,48 @@ export function mergeHermesConfig(
     });
   }
 
+  // Replace an existing Routstr custom provider in place so that re-running
+  // `clients add --hermes` after changing the daemon URL updates base_url /
+  // api_key / model instead of silently keeping the stale entry. We only touch
+  // the first matching entry; any other providers are left as-is.
   const existingConfig = document.toJS() as {
     custom_providers?: HermesCustomProvider[];
   };
   const existingProviders = existingConfig.custom_providers;
-  const providers = Array.isArray(existingProviders) ? existingProviders : [];
-  if (providers.some((item) => item.name?.startsWith("Routstr ("))) {
-    return content;
+  const providers = Array.isArray(existingProviders)
+    ? existingProviders.slice()
+    : [];
+  const routstrIndex = providers.findIndex(
+    (item) => typeof item?.name === "string" && item.name.startsWith("Routstr ("),
+  );
+  let previousName: string | undefined;
+  if (routstrIndex >= 0) {
+    previousName = providers[routstrIndex]!.name;
+    providers[routstrIndex] = { ...providers[routstrIndex], ...provider };
+  } else {
+    providers.push(provider);
   }
-  providers.push(provider);
   document.set("custom_providers", providers);
 
+  // If we renamed the Routstr provider, keep `model.provider` pointing at it so
+  // Hermes doesn't end up referencing a provider that no longer exists. We only
+  // adjust configs whose default model already routes through a Routstr custom
+  // provider, leaving any other selection untouched.
+  if (
+    !isNewConfig &&
+    previousName &&
+    previousName !== providerName &&
+    document.hasIn(["model", "provider"])
+  ) {
+    const currentRef = document.getIn(["model", "provider"]);
+    if (
+      typeof currentRef === "string" &&
+      currentRef === hermesProviderRef(previousName)
+    ) {
+      document.setIn(["model", "provider"], hermesProviderRef(providerName));
+    }
+  }
+
   return document.toString();
 }
 
@@ -99,7 +138,8 @@ export async function installHermesIntegration(
       content = await readFile(configPath, "utf-8");
     }
   } catch (error) {
-    console.error(`Error reading ${configPath}, creating new one.`);
+    console.error(`Failed to read ${configPath}; leaving it unchanged:`, error);
+    return;
   }
 
   let newContent: string;

package/src/integrations/openclaw.ts

@@ -67,8 +67,9 @@ export async function installOpenClawIntegration(
       const content = await readFile(configPath, "utf-8");
       openclawConfig = JSON.parse(content) as OpenClawConfig;
     }
-  } catch {
-    openclawConfig = {};
+  } catch (error) {
+    console.error(`Failed to read or parse ${configPath}; leaving it unchanged:`, error);
+    return;
   }
 
   if (!openclawConfig.models) {

package/src/integrations/opencode.ts

@@ -40,8 +40,9 @@ export async function installOpencodeIntegration(
     } else {
       opencodeConfig = { provider: {} };
     }
-  } catch {
-    opencodeConfig = { provider: {} };
+  } catch (error) {
+    console.error(`Failed to read or parse ${configPath}; leaving it unchanged:`, error);
+    return;
   }
 
   if (!opencodeConfig.provider) {

package/src/integrations/pi.ts

@@ -40,8 +40,9 @@ export async function installPiIntegration(
       const content = await readFile(configPath, "utf-8");
       piConfig = JSON.parse(content) as PiConfig;
     }
-  } catch {
-    piConfig = {};
+  } catch (error) {
+    console.error(`Failed to read or parse ${configPath}; leaving it unchanged:`, error);
+    return;
   }
 
   if (!piConfig.providers) {

package/src/integrations/registry.ts

@@ -6,6 +6,8 @@ import { installOpenClawIntegration } from "./openclaw";
 import { installClaudeCodeIntegration } from "./claudecode";
 import { installHermesIntegration } from "./hermes";
 
+const HOME = process.env.HOME || process.env.USERPROFILE || "";
+
 export interface IntegrationConfig {
   clientId: string;
   name: string;
@@ -28,27 +30,27 @@ export const CLIENT_CONFIGS: Record<string, IntegrationConfig> = {
   opencode: {
     clientId: "opencode",
     name: "OpenCode",
-    configPath: join(process.env.HOME || "", ".config/opencode/opencode.json"),
+    configPath: join(HOME, ".config/opencode/opencode.json"),
   },
   "pi-agent": {
     clientId: "pi-agent",
     name: "Pi Agent",
-    configPath: join(process.env.HOME || "", ".pi/agent/models.json"),
+    configPath: join(HOME, ".pi/agent/models.json"),
   },
   openclaw: {
     clientId: "openclaw",
     name: "OpenClaw",
-    configPath: join(process.env.HOME || "", ".openclaw/openclaw.json"),
+    configPath: join(HOME, ".openclaw/openclaw.json"),
   },
   "claude-code": {
     clientId: "claude-code",
     name: "Claude Code",
-    configPath: join(process.env.HOME || "", ".claude/settings.json"),
+    configPath: join(HOME, ".claude/settings.json"),
   },
   hermes: {
     clientId: "hermes",
     name: "Hermes",
-    configPath: join(process.env.HOME || "", ".hermes/config.yaml"),
+    configPath: join(HOME, ".hermes/config.yaml"),
   },
 };