routstrd 0.4.0 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "routstrd",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "module": "src/index.ts",
   "type": "module",
   "private": false,
@@ -26,7 +26,7 @@
     "@cashu/cashu-ts": "^4.3.0",
     "@cashu/coco-core": "^1.0.1",
     "@cashu/coco-sqlite-bun": "^1.0.1",
-    "@routstr/sdk": "^0.4.0",
+    "@routstr/sdk": "^0.4.1",
     "@scure/bip39": "^2.2.0",
     "applesauce-core": "^5.1.0",
     "applesauce-relay": "^5.1.0",

package/src/cli.ts

@@ -1,5 +1,6 @@
 import { program } from "commander";
 import { startDaemon } from "./start-daemon";
+import { ensureDirsSync, saveDaemonConfig } from "./daemon/config-store";
 import {
   handleDaemonCommand,
   callDaemon,
@@ -35,6 +36,13 @@ import {
 } from "./daemon/wallet/coco-client";
 import { migrateLegacyWallet } from "./daemon/wallet/migration";
 import {
+  diagnoseWallets,
+  renderWalletDoctor,
+  summarizeWalletDirectory,
+  WalletMigrationConflictError,
+} from "./daemon/wallet/diagnostics";
+import {
+  legacyCocodDir,
   legacyCocodPidPath,
   legacyCocodSocketPath,
   walletDir as defaultWalletDir,
@@ -210,19 +218,19 @@ async function requireLocalDaemon(): Promise<void> {
 async function initDaemon(): Promise<void> {
   console.log("Initializing routstrd...");
 
-  // Create config directory
+  // Create config directory (0700, correcting existing installs too)
   if (!existsSync(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
     console.log(`Created config directory: ${CONFIG_DIR}`);
   }
+  ensureDirsSync();
 
-  // Create initial config
+  // Create initial config (0600, atomic write)
   if (!existsSync(CONFIG_FILE)) {
     const config: RoutstrdConfig = {
       ...DEFAULT_CONFIG,
       cocodPath: null,
     };
-    await Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+    saveDaemonConfig(config);
     console.log(`Created config file: ${CONFIG_FILE}`);
   }
 
@@ -233,7 +241,7 @@ async function initDaemon(): Promise<void> {
     const nsec = nip19.nsecEncode(secretKey);
     const npub = npubFromSecretKey(secretKey);
     config.nsec = nsec;
-    await Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+    saveDaemonConfig(config);
     console.log("\nA new Nostr identity has been generated for authentication.");
     console.log(`Your npub: ${npub}`);
     console.log(`You can view it in the config file at: ${CONFIG_FILE}\n`);
@@ -242,27 +250,19 @@ async function initDaemon(): Promise<void> {
   console.log(`Database will be stored at: ${DB_PATH}`);
   await stopLegacyCocod();
 
-  let migrationLockOwner: number | undefined;
   const migration = await migrateLegacyWallet({
     assertLegacyStopped: () =>
       assertLegacyCocodNotRunning({
         socketPath: legacyCocodSocketPath(),
-        pidFilePath: legacyCocodPidPath(),
-        ignorePid: migrationLockOwner,
       }),
     acquireLegacyLock: () => {
       mkdirSync(dirname(legacyCocodPidPath()), {
         recursive: true,
         mode: 0o700,
       });
-      const release = claimLegacyCocodPidFile({
+      return claimLegacyCocodPidFile({
         pidFilePath: legacyCocodPidPath(),
       });
-      migrationLockOwner = process.pid;
-      return () => {
-        migrationLockOwner = undefined;
-        release();
-      };
     },
   });
   if (migration.status === "migrated") {
@@ -296,10 +296,7 @@ program
   .command("update")
   .description("Update routstrd to the latest version")
   .action(async () => {
-    const packages = [
-      { name: "routstrd", label: "routstrd" },
-      { name: "@routstr/cocod", label: "cocod" },
-    ];
+    const packages = [{ name: "routstrd", label: "routstrd" }];
 
     let updatedAny = false;
 
@@ -349,7 +346,7 @@ program
   .description("Refund pending tokens and API keys to a specified mint")
   .option(
     "-m, --mint-url <mintUrl>",
-    "Mint URL to refund to (defaults to first mint in wallet)",
+    "Mint URL to refund to (defaults to active wallet mint)",
   )
   .option("-y, --yes", "Skip confirmation prompt", false)
   .option("--xcashu", "Refund xcashu tokens only (uses refundXcashuTokens)", false)
@@ -363,18 +360,19 @@ program
         console.log(balanceResult.error);
         process.exit(1);
       }
-      const balances = (
-        balanceResult.output as
-          | {
-              balances?: Record<string, number>;
-            }
-          | undefined
-      )?.balances;
-      if (!balances || Object.keys(balances).length === 0) {
+      const output = balanceResult.output as
+        | {
+            balances?: Record<string, number>;
+            activeMint?: string;
+          }
+        | undefined;
+      mintUrl =
+        output?.activeMint ??
+        (output?.balances ? Object.keys(output.balances)[0] : undefined);
+      if (!mintUrl) {
         console.log("No mint URLs found in wallet balance");
         process.exit(1);
       }
-      mintUrl = Object.keys(balances)[0];
       console.log(`Using mint URL: ${mintUrl}`);
     }
 
@@ -520,7 +518,7 @@ program
       ...updates,
     };
 
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
 
     console.log(`Remote daemon URL set to: ${url}`);
     if (options.authUrl) {
@@ -555,7 +553,7 @@ program
     const { daemonUrl: _daemonUrl, authUrl: _authUrl, ...rest } = config;
     const updatedConfig: RoutstrdConfig = rest;
 
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
 
     console.log("Switched back to local daemon mode.");
     if (previousDaemonUrl) {
@@ -578,7 +576,17 @@ program
   )
   .action(async () => {
     await requireLocalDaemon();
-    await initDaemon();
+    try {
+      await initDaemon();
+    } catch (error) {
+      // An expected, user-actionable refusal — print the structured message
+      // without Bun's unhandled-rejection source snippet and stack trace.
+      if (error instanceof WalletMigrationConflictError) {
+        console.error(error.message);
+        process.exit(1);
+      }
+      throw error;
+    }
   });
 
 // Start - start the background daemon
@@ -592,11 +600,18 @@ program
     await requireLocalDaemon();
     const config = await loadConfig();
     await stopLegacyCocod();
-    await startDaemon({
-      port: options.port || String(config.port || 8008),
-      host: options.host || config.host || undefined,
-      provider: options.provider,
-    });
+    try {
+      await startDaemon({
+        port: options.port || String(config.port || 8008),
+        host: options.host || config.host || undefined,
+        provider: options.provider,
+      });
+    } catch (error) {
+      // startDaemon embeds the failed daemon's own output in the message
+      // (including the wallet-conflict report), so print it without a stack.
+      console.error(error instanceof Error ? error.message : error);
+      process.exit(1);
+    }
   });
 
 // Status - check daemon status
@@ -641,7 +656,7 @@ program
   )
   .option(
     "--mint-url <url>",
-    "Mint URL to refund the deleted API key balance to (defaults to first mint in wallet)",
+    "Mint URL to refund the deleted API key balance to (defaults to active wallet mint)",
   )
   .action(async (options: { apiKeys: boolean; deleteApiKeys?: string; mintUrl?: string }) => {
     await ensureDaemonRunning();
@@ -1102,6 +1117,94 @@ providersCmd
     }
   });
 
+providersCmd
+  .command("reviews")
+  .description(
+    "Show all known providers with their stored review events and event IDs",
+  )
+  .action(async () => {
+    await ensureDaemonRunning();
+
+    const result = await callDaemon("/providers/reviews");
+    if (result.error) {
+      console.log(result.error);
+      process.exit(1);
+    }
+
+    const output = result.output as
+      | {
+          providers: Array<{
+            index: number;
+            baseUrl: string;
+            disabled: boolean;
+            nodePubkeys: string[];
+            reviewCount: number;
+            reviews: Array<{
+              eventId: string;
+              createdAt: number;
+              authorPubkey: string | null;
+              nodePubkey: string | null;
+              label: string;
+              isLgtm: boolean;
+              tags: string[][];
+            }>;
+          }>;
+          unmatchedReviews: Array<{
+            eventId: string;
+            createdAt: number;
+            authorPubkey: string | null;
+            nodePubkey: string | null;
+            label: string;
+            isLgtm: boolean;
+            tags: string[][];
+          }>;
+          totalCount: number;
+          reviewEventCount: number;
+        }
+      | undefined;
+
+    if (!output) {
+      console.log("No provider review data available.");
+      return;
+    }
+
+    console.log(
+      `Providers (${output.totalCount} total, ${output.reviewEventCount} stored review events):\n`,
+    );
+
+    for (const provider of output.providers) {
+      const status = provider.disabled ? "DISABLED" : "enabled ";
+      console.log(
+        `  [${provider.index}] ${status}  ${provider.baseUrl}  (${provider.reviewCount} review${provider.reviewCount === 1 ? "" : "s"})`,
+      );
+
+      if (provider.nodePubkeys.length > 0) {
+        console.log(`      node pubkeys: ${provider.nodePubkeys.join(", ")}`);
+      }
+
+      for (const review of provider.reviews) {
+        const label = review.label || "review";
+        const created = new Date(review.createdAt * 1000).toISOString();
+        console.log(`      - ${label}  eventId: ${review.eventId}`);
+        console.log(`          node:   ${review.nodePubkey ?? "(none)"}`);
+        console.log(`          author: ${review.authorPubkey ?? "(none)"}`);
+        console.log(`          at:     ${created}`);
+      }
+    }
+
+    if (output.unmatchedReviews.length > 0) {
+      console.log(
+        `\n  Unmatched review events (${output.unmatchedReviews.length} — node pubkey not in any known provider):`,
+      );
+      for (const review of output.unmatchedReviews) {
+        const created = new Date(review.createdAt * 1000).toISOString();
+        console.log(`      - eventId: ${review.eventId}`);
+        console.log(`          node:   ${review.nodePubkey ?? "(none)"}`);
+        console.log(`          at:     ${created}`);
+      }
+    }
+  });
+
 // Clients - list and manage clients
 const clientsCmd = program
   .command("clients")
@@ -1531,6 +1634,16 @@ walletCmd
     await handleDaemonCommand("/wallet/status");
   });
 
+walletCmd
+  .command("doctor")
+  .description("Diagnose conflicting wallets (current routstrd wallet vs legacy cocod)")
+  .action(async () => {
+    const target = summarizeWalletDirectory(defaultWalletDir(), "canonical");
+    const source = summarizeWalletDirectory(legacyCocodDir(), "legacy");
+    console.log(renderWalletDoctor(target, source));
+    if (diagnoseWallets(target, source).conflict) process.exit(1);
+  });
+
 walletCmd
   .command("unlock <passphrase>")
   .description("Unlock the wallet")
@@ -1548,6 +1661,113 @@ walletCmd
     await handleDaemonCommand("/wallet/balance");
   });
 
+walletCmd
+  .command("cleanup")
+  .description("Clear stuck pending/in-flight wallet operations")
+  .option("--mint-url <url>", "Only clean up operations for this mint URL")
+  .option(
+    "--min-age <hours>",
+    "Minimum age for reclaiming sends/cancelling melts, in hours (default: 168, one week; expired mint quotes are always failed)",
+    "168",
+  )
+  .option("--dry-run", "Report what would be cleaned without applying changes", false)
+  .option("-y, --yes", "Skip confirmation prompt", false)
+  .action(
+    async (options: {
+      mintUrl?: string;
+      minAge: string;
+      dryRun: boolean;
+      yes: boolean;
+    }) => {
+      const minAgeHours = Number.parseFloat(options.minAge);
+      if (!Number.isFinite(minAgeHours) || minAgeHours < 0) {
+        console.error(`Invalid --min-age value: ${options.minAge}`);
+        process.exit(1);
+      }
+
+      if (!options.dryRun && !options.yes) {
+        const rl = require("readline").createInterface({
+          input: process.stdin,
+          output: process.stdout,
+        });
+        const answer = await new Promise<string>((resolve) => {
+          rl.question(
+            "This will fail expired mint quotes, reclaim old pending sends, and cancel prepared melts. Continue? [y/N] ",
+            (value: string) => {
+              rl.close();
+              resolve(value.trim().toLowerCase());
+            },
+          );
+        });
+        if (answer !== "y" && answer !== "yes") {
+          console.log("Aborted.");
+          return;
+        }
+      }
+
+      try {
+        await ensureDaemonRunning();
+
+        const result = await callDaemon("/wallet/cleanup", {
+          method: "POST",
+          body: {
+            mintUrl: options.mintUrl,
+            minAgeMs: Math.round(minAgeHours * 60 * 60 * 1000),
+            dryRun: options.dryRun === true,
+          },
+        });
+
+        if (result.error) {
+          console.log(result.error);
+          process.exit(1);
+        }
+
+        const output = result.output as
+          | {
+              dryRun?: boolean;
+              failedMintQuotes?: number;
+              reclaimedSends?: number;
+              cancelledMelts?: number;
+              skipped?: number;
+              errors?: Array<{ operationId: string; error: string }>;
+            }
+          | undefined;
+
+        if (output) {
+          const prefix = output.dryRun ? "Would clean up:" : "Cleaned up:";
+          console.log(prefix);
+          console.log(
+            `  Expired mint quotes failed: ${output.failedMintQuotes ?? 0}`,
+          );
+          console.log(`  Pending sends reclaimed: ${output.reclaimedSends ?? 0}`);
+          console.log(
+            `  Prepared melts cancelled: ${output.cancelledMelts ?? 0}`,
+          );
+          console.log(
+            `  Skipped (still recent or already terminal): ${output.skipped ?? 0}`,
+          );
+          if (output.errors && output.errors.length > 0) {
+            console.log("\nErrors:");
+            for (const e of output.errors) {
+              console.log(`  - ${e.operationId}: ${e.error}`);
+            }
+          }
+        }
+      } catch (error) {
+        const message = (error as Error).message;
+        if (
+          message?.includes("fetch failed") ||
+          message?.includes("Connection refused")
+        ) {
+          console.error("Daemon is not running");
+          process.exit(1);
+        }
+        console.error(message);
+        process.exit(1);
+      }
+    },
+  );
+
 const walletReceiveCmd = walletCmd
   .command("receive")
   .description("Wallet receive operations");
@@ -2008,7 +2228,7 @@ program
       ...config,
       mode: selectedMode,
     };
-    await Bun.write(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2));
+    saveDaemonConfig(updatedConfig);
     console.log(`Mode set to '${selectedMode}'. Restarting daemon...`);
 
     // Restart daemon

package/src/daemon/config-store.ts

@@ -1,5 +1,13 @@
 import { mkdir } from "fs/promises";
-import { existsSync, readFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "fs";
 import {
   CONFIG_DIR,
   CONFIG_FILE,
@@ -10,18 +18,61 @@ import { logger } from "../utils/logger";
 
 export const REQUESTS_DIR = `${CONFIG_DIR}/requests`;
 
+// The daemon config holds spend-capable credentials (the operator `nsec` and
+// the NWC connection string), so the directory and file permissions must match
+// the wallet seed handling (0700/0600), not the umask default (0755/0644).
+
+function chmodIgnoreErrors(path: string, mode: number): void {
+  try {
+    chmodSync(path, mode);
+  } catch {
+    // Best effort on filesystems that do not support POSIX modes.
+  }
+}
+
+/** Create the config directories (0700), correcting existing installs too. */
+export function ensureDirsSync(): void {
+  try {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(CONFIG_DIR, 0o700);
+
+  try {
+    mkdirSync(REQUESTS_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(REQUESTS_DIR, 0o700);
+}
+
 export async function ensureDirs(): Promise<void> {
   try {
-    await mkdir(CONFIG_DIR, { recursive: true });
-    await mkdir(REQUESTS_DIR, { recursive: true });
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  } catch {
+    // Directory may already exist
+  }
+  chmodSync(CONFIG_DIR, 0o700);
+
+  try {
+    await mkdir(REQUESTS_DIR, { recursive: true, mode: 0o700 });
   } catch {
     // Directory may already exist
   }
+  chmodSync(REQUESTS_DIR, 0o700);
+}
+
+function repairConfigPermissions(): void {
+  if (existsSync(CONFIG_FILE)) {
+    chmodIgnoreErrors(CONFIG_FILE, 0o600);
+  }
 }
 
 export async function loadDaemonConfig(): Promise<RoutstrdConfig> {
   try {
     if (existsSync(CONFIG_FILE)) {
+      repairConfigPermissions();
       const content = await Bun.file(CONFIG_FILE).text();
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
     }
@@ -34,6 +85,7 @@ export async function loadDaemonConfig(): Promise<RoutstrdConfig> {
 export function loadDaemonConfigSync(): RoutstrdConfig {
   try {
     if (existsSync(CONFIG_FILE)) {
+      repairConfigPermissions();
       const content = readFileSync(CONFIG_FILE, "utf-8");
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
     }
@@ -43,6 +95,29 @@ export function loadDaemonConfigSync(): RoutstrdConfig {
   return DEFAULT_CONFIG;
 }
 
+/**
+ * Persist the daemon config atomically with owner-only permissions, mirroring
+ * the wallet config writer (saveConfig in wallet/coco-client.ts): write a
+ * 0600 temp file, then rename over the target. Synchronous so callers get
+ * error propagation instead of silently dropping credential updates.
+ */
 export function saveDaemonConfig(config: RoutstrdConfig): void {
-  Bun.write(CONFIG_FILE, JSON.stringify(config, null, 2));
+  ensureDirsSync();
+  const temporaryFile = `${CONFIG_FILE}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temporaryFile, JSON.stringify(config, null, 2), {
+      mode: 0o600,
+    });
+    renameSync(temporaryFile, CONFIG_FILE);
+  } catch (error) {
+    try {
+      unlinkSync(temporaryFile);
+    } catch {
+      // The temporary file may not have been created.
+    }
+    throw error;
+  }
+  // renameSync preserves the temp file's mode, but chmod anyway so an
+  // existing over-permissive file is corrected even on exotic filesystems.
+  chmodIgnoreErrors(CONFIG_FILE, 0o600);
 }

package/src/daemon/fatal-error.test.ts

@@ -0,0 +1,104 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { unlinkSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { exitOnUncaughtException } from "./fatal-error";
+
+const fatalErrorModule = JSON.stringify(join(import.meta.dir, "fatal-error.ts"));
+
+const fixturePaths: string[] = [];
+
+afterEach(() => {
+  while (fixturePaths.length > 0) {
+    try {
+      unlinkSync(fixturePaths.pop()!);
+    } catch {
+      // Best effort cleanup of temp fixtures.
+    }
+  }
+});
+
+/** Run a fixture script in a real subprocess so process.exit is for real. */
+async function runFixture(source: string): Promise<{
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}> {
+  const scriptPath = join(
+    tmpdir(),
+    `routstrd-fatal-error-fixture-${crypto.randomUUID()}.ts`,
+  );
+  fixturePaths.push(scriptPath);
+  await Bun.write(scriptPath, source);
+  const proc = Bun.spawn(["bun", scriptPath], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  const exitCode = await proc.exited;
+  return { exitCode, stdout, stderr };
+}
+
+describe("exitOnUncaughtException", () => {
+  test("reports the error and exits with code 1", () => {
+    let exitCode: number | undefined;
+    const stderrLines: string[] = [];
+    const originalConsoleError = console.error;
+    console.error = (...args: unknown[]) => {
+      stderrLines.push(args.map(String).join(" "));
+    };
+    try {
+      exitOnUncaughtException(new Error("boom"), (code) => {
+        exitCode = code;
+      });
+    } finally {
+      console.error = originalConsoleError;
+    }
+    expect(exitCode).toBe(1);
+    expect(stderrLines.join("\n")).toContain("boom");
+  });
+
+  test("handles non-Error thrown values", () => {
+    let exitCode: number | undefined;
+    const originalConsoleError = console.error;
+    console.error = () => {};
+    try {
+      exitOnUncaughtException("string failure", (code) => {
+        exitCode = code;
+      });
+    } finally {
+      console.error = originalConsoleError;
+    }
+    expect(exitCode).toBe(1);
+  });
+});
+
+describe("installGlobalErrorHandlers (subprocess)", () => {
+  test("an uncaught exception exits the process with code 1", async () => {
+    const { exitCode, stderr } = await runFixture(`
+      import { installGlobalErrorHandlers } from ${fatalErrorModule};
+      installGlobalErrorHandlers();
+      setTimeout(() => {
+        throw new Error("boom-uncaught");
+      }, 10);
+    `);
+    expect(exitCode).toBe(1);
+    expect(stderr).toContain("boom-uncaught");
+  });
+
+  test("an unhandled rejection is logged without exiting", async () => {
+    const { exitCode, stdout } = await runFixture(`
+      import { installGlobalErrorHandlers } from ${fatalErrorModule};
+      installGlobalErrorHandlers();
+      Promise.reject(new Error("boom-rejection"));
+      setTimeout(() => {
+        console.log("STILL-ALIVE");
+      }, 50);
+    `);
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain("STILL-ALIVE");
+  });
+});