routstrd 0.4.0 → 0.4.2

package/src/daemon/fatal-error.ts

@@ -0,0 +1,48 @@
+import { logger } from "../utils/logger";
+
+/**
+ * Report an unrecoverable error, then exit.
+ *
+ * The daemon runs detached under a supervisor (pm2 via `routstrd service
+ * install`, or the spawning CLI). An uncaught exception means the call stack
+ * unwound unexpectedly mid-operation and process state can no longer be
+ * trusted. Swallowing it once left a daemon alive with nothing listening
+ * while it held both wallet PID locks, so every later start failed on the
+ * lock and liveness-only supervisors never restarted it. Exiting lets the
+ * supervisor bring up a healthy process instead.
+ *
+ * The file logger writes synchronously, so the record survives the exit.
+ * The error is mirrored to stderr because the daemon's stdout/stderr are
+ * redirected to debug.log, which is what the CLI surfaces when the daemon
+ * exits early and what pm2 captures. process.exit() runs the synchronous
+ * PID-lock exit hooks registered by claimPidFile, releasing the wallet
+ * locks on the way out.
+ *
+ * `exit` is injectable for tests.
+ */
+export function exitOnUncaughtException(
+  error: unknown,
+  exit: (code: number) => void = (code) => process.exit(code),
+): void {
+  logger.error("UNCAUGHT EXCEPTION:", error);
+  // Full error object (not just .message): this path means a bug, so the
+  // stack is the most useful thing to have in debug.log.
+  console.error("UNCAUGHT EXCEPTION:", error);
+  exit(1);
+}
+
+/**
+ * Install the process-level error handlers. Called once at daemon module
+ * load, before main() runs.
+ *
+ * Only uncaught exceptions are fatal. An unhandled rejection means a
+ * promise's failure went unobserved; the stack was not unwound and the
+ * process is still in a consistent state, so it is logged and the daemon
+ * keeps serving.
+ */
+export function installGlobalErrorHandlers(): void {
+  process.on("uncaughtException", (error) => exitOnUncaughtException(error));
+  process.on("unhandledRejection", (reason) => {
+    logger.error("UNHANDLED REJECTION:", reason);
+  });
+}

package/src/daemon/models.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from "bun:test";
+import type { SdkStore } from "@routstr/sdk";
+import { createModelService } from "./models";
+
+/**
+ * `ensureProvidersBootstrapped` must mirror the review-disabled provider set
+ * (kind 38425) into the SdkStore. The SDK applies review disables to the
+ * discovery adapter during bootstrap, but `providers list` and per-model
+ * provider views read the store — if the store is not kept in sync, a fresh
+ * install reports "0 disabled" while routing silently excludes them.
+ */
+describe("createModelService.ensureProvidersBootstrapped", () => {
+  function makeStore(initialBaseUrls: string[] = []) {
+    const disabledCalls: string[][] = [];
+    const state: Record<string, unknown> = {
+      baseUrlsList: initialBaseUrls,
+      setBaseUrlsList: (urls: string[]) => {
+        state.baseUrlsList = urls;
+      },
+      disabledProviders: [],
+      setDisabledProviders: (urls: string[]) => {
+        state.disabledProviders = urls;
+        disabledCalls.push(urls);
+      },
+      manuallyDisabledProviders: [],
+      manuallyEnabledProviders: [],
+    };
+
+    return {
+      store: { getState: () => state } as unknown as SdkStore,
+      state,
+      disabledCalls,
+    };
+  }
+
+  function makeModelManager(
+    providers: string[],
+    reviewedDisabled: string[] | null,
+  ) {
+    return {
+      bootstrapProviders: async () => providers,
+      syncReviewedProvidersFromNostr: async () => reviewedDisabled,
+    } as never;
+  }
+
+  it("mirrors review-disabled providers into the store after bootstrap", async () => {
+    const { store, state, disabledCalls } = makeStore();
+    const modelManager = makeModelManager(
+      ["https://ok.example/", "https://bad.example/"],
+      ["https://bad.example/"],
+    );
+    const service = createModelService(
+      modelManager as never,
+      {} as never,
+      store,
+    );
+
+    await service.ensureProvidersBootstrapped();
+
+    expect(disabledCalls).toEqual([["https://bad.example/"]]);
+    expect(state.disabledProviders).toEqual(["https://bad.example/"]);
+  });
+
+  it("leaves the store unchanged when review sync reports no change (null)", async () => {
+    const { store, state, disabledCalls } = makeStore(["https://ok.example/"]);
+    const modelManager = makeModelManager(
+      ["https://ok.example/", "https://new.example/"],
+      null,
+    );
+    const service = createModelService(
+      modelManager as never,
+      {} as never,
+      store,
+    );
+
+    await service.ensureProvidersBootstrapped();
+
+    expect(disabledCalls).toEqual([]);
+    expect(state.disabledProviders).toEqual([]);
+  });
+});

package/src/daemon/models.ts

@@ -89,7 +89,11 @@ export function createModelService(
 
         // Sync discovered providers into the store so `providers list` reflects
         // the same set that the model manager knows about.
-        const { baseUrlsList, setBaseUrlsList } = store.getState();
+        const {
+          baseUrlsList,
+          setBaseUrlsList,
+          setDisabledProviders,
+        } = store.getState();
         const existing = new Set(baseUrlsList);
         const merged = [
           ...baseUrlsList,
@@ -102,6 +106,18 @@ export function createModelService(
           );
         }
 
+        // Mirror the review-disabled set (kind 38425) into the store. The SDK
+        // applies review disables to the discovery adapter during bootstrap,
+        // but `providers list` and the per-model provider views read the store,
+        // so without this a fresh install reports "0 disabled" while routing
+        // silently excludes the review-disabled providers.
+        const reviewedDisabled = await modelManager.syncReviewedProvidersFromNostr(
+          providers,
+        );
+        if (reviewedDisabled !== null) {
+          setDisabledProviders(reviewedDisabled);
+        }
+
         logger.log("Provider bootstrap complete.");
       })().catch((error) => {
         providerBootstrapPromise = null;
@@ -117,7 +133,7 @@ export function createModelService(
   ): Promise<ExposedModel[]> => {
     const routstr21ModelIds = Array.from(
       new Set(await modelManager.fetchRoutstr21Models(forceRefresh)),
-    ).slice(0, 21);
+    );
 
     let discoveredModels: ExposedModel[];
     if (!forceRefresh) {

package/src/daemon/wallet/auto-refill.ts

@@ -66,8 +66,6 @@ export function startAutoRefillLoop(
       return;
     }
 
-    checkInProgress = true;
-
     // If we've been failing too much, back off rather than retrying at full speed.
     // This prevents tight loops on transient errors.
     const backoffInterval = Math.min(
@@ -78,6 +76,8 @@ export function startAutoRefillLoop(
       return;
     }
 
+    checkInProgress = true;
+
     try {
       const balances = await cocod.getBalances();
       const totalBalance = Object.values(balances).reduce<number>(
@@ -94,11 +94,9 @@ export function startAutoRefillLoop(
         `[auto-refill] Balance ${totalBalance} sats < threshold ${config.threshold}. Refilling ${config.amount} sats...`,
       );
 
-      // Get active mint
-      const mints = await cocod.listMints();
-      const mintUrl = mints[0];
+      const mintUrl = await cocod.getDefaultMint();
       if (!mintUrl) {
-        logger.error("[auto-refill] No active mint configured");
+        logger.error("[auto-refill] No default mint configured");
         return;
       }
 

package/src/daemon/wallet/cleanup.test.ts

@@ -0,0 +1,168 @@
+import { describe, expect, it } from "bun:test";
+import { selectCleanupOperations } from "./cleanup";
+
+const NOW_MS = 1_800_000_000_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function mint(overrides: Record<string, unknown>) {
+  return {
+    id: "mint-1",
+    state: "pending",
+    expiry: NOW_MS / 1000 - 1000, // expired
+    updatedAt: NOW_MS - 2 * DAY_MS,
+    lastObservedRemoteState: undefined,
+    ...overrides,
+  };
+}
+
+function send(overrides: Record<string, unknown>) {
+  return {
+    id: "send-1",
+    state: "pending",
+    updatedAt: NOW_MS - 2 * DAY_MS,
+    ...overrides,
+  };
+}
+
+function melt(overrides: Record<string, unknown>) {
+  return {
+    id: "melt-1",
+    state: "prepared",
+    updatedAt: NOW_MS - 2 * DAY_MS,
+    ...overrides,
+  };
+}
+
+describe("selectCleanupOperations", () => {
+  it("selects expired pending mint quotes that are old enough", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a" })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail.map((op) => op.id)).toEqual(["a"]);
+  });
+
+  it("ignores mint quotes that have not expired", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a", expiry: NOW_MS / 1000 + 1000 })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail).toEqual([]);
+  });
+
+  it("ignores expired mint quotes already observed as PAID", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a", lastObservedRemoteState: "PAID" })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail).toEqual([]);
+  });
+
+  it("ignores expired mint quotes already observed as ISSUED", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a", lastObservedRemoteState: "ISSUED" })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail).toEqual([]);
+  });
+
+  it("ignores mint quotes without an expiry", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a", expiry: 0 })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail).toEqual([]);
+  });
+
+  it("selects expired mint quotes even when the watcher recently touched them", () => {
+    const result = selectCleanupOperations({
+      mints: [mint({ id: "a", updatedAt: NOW_MS - 60_000 })],
+      sends: [],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.mintsToFail.map((op) => op.id)).toEqual(["a"]);
+  });
+
+  it("selects stale pending sends for reclaim", () => {
+    const result = selectCleanupOperations({
+      mints: [],
+      sends: [send({ id: "s" })],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.sendsToReclaim.map((op) => op.id)).toEqual(["s"]);
+  });
+
+  it("ignores recent pending sends", () => {
+    const result = selectCleanupOperations({
+      mints: [],
+      sends: [send({ id: "s", updatedAt: NOW_MS - 60_000 })],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.sendsToReclaim).toEqual([]);
+  });
+
+  it("ignores non-pending sends even when old", () => {
+    const result = selectCleanupOperations({
+      mints: [],
+      sends: [send({ id: "s", state: "executing" })],
+      melts: [],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.sendsToReclaim).toEqual([]);
+  });
+
+  it("selects stale prepared melts for cancellation", () => {
+    const result = selectCleanupOperations({
+      mints: [],
+      sends: [],
+      melts: [melt({ id: "m" })],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.meltsToCancel.map((op) => op.id)).toEqual(["m"]);
+  });
+
+  it("ignores non-prepared melts", () => {
+    const result = selectCleanupOperations({
+      mints: [],
+      sends: [],
+      melts: [melt({ id: "m", state: "pending" })],
+      nowMs: NOW_MS,
+      minAgeMs: DAY_MS,
+    });
+
+    expect(result.meltsToCancel).toEqual([]);
+  });
+});

package/src/daemon/wallet/cleanup.ts

@@ -0,0 +1,104 @@
+/**
+ * Pure selection helpers for the wallet cleanup command.
+ *
+ * These helpers decide *which* stuck operations are safe to clear. The actual
+ * state transitions are applied by the in-process coco wallet client so that
+ * coco-core's operation services emit their normal events and release proof
+ * reservations. Keeping the selection logic here makes it easy to unit test
+ * without a wallet database or network access.
+ */
+
+export interface MintCleanupCandidate {
+  id: string;
+  state: string;
+  /** Quote expiry in epoch seconds. `0` means unknown/not applicable. */
+  expiry: number;
+  /** Last update time in epoch milliseconds. */
+  updatedAt: number;
+  /**
+   * Last quote state observed from the mint (e.g. "PAID", "ISSUED").
+   * Unknown/undefined means no terminal observation has been recorded.
+   */
+  lastObservedRemoteState?: string;
+}
+
+export interface NonMintCleanupCandidate {
+  id: string;
+  state: string;
+  /** Last update time in epoch milliseconds. */
+  updatedAt: number;
+}
+
+export interface CleanupSelectionOptions<
+  TMint extends MintCleanupCandidate,
+  TSend extends NonMintCleanupCandidate,
+  TMelt extends NonMintCleanupCandidate,
+> {
+  mints: TMint[];
+  sends: TSend[];
+  melts: TMelt[];
+  nowMs: number;
+  minAgeMs: number;
+}
+
+export interface CleanupSelection<
+  TMint extends MintCleanupCandidate,
+  TSend extends NonMintCleanupCandidate,
+  TMelt extends NonMintCleanupCandidate,
+> {
+  mintsToFail: TMint[];
+  sendsToReclaim: TSend[];
+  meltsToCancel: TMelt[];
+}
+
+/**
+ * Select stuck operations that are old enough to be considered for clearing.
+ *
+ * - Pending mint quotes are candidates once their bolt11 quote has expired
+ *   (an expired Lightning invoice can never be paid again) and the mint has
+ *   not already reported it as PAID/ISSUED. A paid-but-unfinalized quote
+ *   still has claimable proofs, so it must go through normal recovery instead
+ *   of being failed locally.
+ *
+ *   Note that expiry alone does not prove a quote was never paid: the payment
+ *   can have happened before expiry while the daemon was down, leaving no
+ *   local observation. Callers that fail quotes automatically at startup must
+ *   therefore confirm UNPAID with the mint first (see
+ *   settleExpiredMintQuotes in coco-client.ts); only the explicit,
+ *   user-invoked cleanup command may fail candidates purely locally.
+ * - Pending sends are reclaimed (rolled back) only when they are older than
+ *   `minAgeMs`, so we never roll back a token that a receiver might still
+ *   legitimately claim.
+ * - Prepared melts are cancelled under the same age guard.
+ */
+export function selectCleanupOperations<
+  TMint extends MintCleanupCandidate,
+  TSend extends NonMintCleanupCandidate,
+  TMelt extends NonMintCleanupCandidate,
+>(
+  options: CleanupSelectionOptions<TMint, TSend, TMelt>,
+): CleanupSelection<TMint, TSend, TMelt> {
+  const { mints, sends, melts, nowMs, minAgeMs } = options;
+
+  // Expired quotes can never be paid again, but may have been paid before
+  // expiry without a local observation: this is a candidate set, and whether
+  // failing is safe without a mint round-trip depends on the caller (above).
+  const mintsToFail = mints.filter(
+    (op) =>
+      op.state === "pending" &&
+      op.expiry > 0 &&
+      op.expiry * 1000 <= nowMs &&
+      op.lastObservedRemoteState !== "PAID" &&
+      op.lastObservedRemoteState !== "ISSUED",
+  );
+
+  const sendsToReclaim = sends.filter(
+    (op) => op.state === "pending" && nowMs - op.updatedAt >= minAgeMs,
+  );
+
+  const meltsToCancel = melts.filter(
+    (op) => op.state === "prepared" && nowMs - op.updatedAt >= minAgeMs,
+  );
+
+  return { mintsToFail, sendsToReclaim, meltsToCancel };
+}